strapi-plugin-oidc 1.0.4 → 1.0.6

package/dist/server/index.mjs

@@ -118,10 +118,22 @@ const contentTypes = {
 };
 function configValidation() {
   const config2 = strapi.config.get("plugin::strapi-plugin-oidc");
-  if (config2["OIDC_CLIENT_ID"] && config2["OIDC_CLIENT_SECRET"] && config2["OIDC_REDIRECT_URI"] && config2["OIDC_SCOPES"] && config2["OIDC_TOKEN_ENDPOINT"] && config2["OIDC_USER_INFO_ENDPOINT"] && config2["OIDC_GRANT_TYPE"] && config2["OIDC_FAMILY_NAME_FIELD"] && config2["OIDC_GIVEN_NAME_FIELD"] && config2["OIDC_AUTHORIZATION_ENDPOINT"]) {
+  const requiredKeys = [
+    "OIDC_CLIENT_ID",
+    "OIDC_CLIENT_SECRET",
+    "OIDC_REDIRECT_URI",
+    "OIDC_SCOPES",
+    "OIDC_TOKEN_ENDPOINT",
+    "OIDC_USER_INFO_ENDPOINT",
+    "OIDC_GRANT_TYPE",
+    "OIDC_FAMILY_NAME_FIELD",
+    "OIDC_GIVEN_NAME_FIELD",
+    "OIDC_AUTHORIZATION_ENDPOINT"
+  ];
+  if (requiredKeys.every((key) => config2[key])) {
     return config2;
   }
-  throw new Error("OIDC_AUTHORIZATION_ENDPOINT,OIDC_TOKEN_ENDPOINT, OIDC_USER_INFO_ENDPOINT,OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, OIDC_REDIRECT_URI, and OIDC_SCOPES are required");
+  throw new Error(`The following configuration keys are required: ${requiredKeys.join(", ")}`);
 }
 async function oidcSignIn(ctx) {
   let { state } = ctx.query;
@@ -144,6 +156,66 @@ async function oidcSignIn(ctx) {
   ctx.set("Location", authorizationUrl);
   return ctx.send({}, 302);
 }
+async function exchangeTokenAndFetchUserInfo(httpClient, config2, params) {
+  const response = await httpClient.post(config2.OIDC_TOKEN_ENDPOINT, params, {
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    }
+  });
+  let userInfoEndpointHeaders = {};
+  let userInfoEndpointParameters = `?access_token=${response.data.access_token}`;
+  if (config2.OIDC_USER_INFO_ENDPOINT_WITH_AUTH_HEADER) {
+    userInfoEndpointHeaders = {
+      headers: { Authorization: `Bearer ${response.data.access_token}` }
+    };
+    userInfoEndpointParameters = "";
+  }
+  const userInfoEndpoint = `${config2.OIDC_USER_INFO_ENDPOINT}${userInfoEndpointParameters}`;
+  const userResponse = await httpClient.get(userInfoEndpoint, userInfoEndpointHeaders);
+  return userResponse.data;
+}
+async function registerNewUser(userService, oauthService2, roleService2, email, userResponseData, whitelistUser, config2, ctx) {
+  let roles2 = [];
+  if (whitelistUser?.roles?.length > 0) {
+    roles2 = whitelistUser.roles;
+  } else {
+    const oidcRoles = await roleService2.oidcRoles();
+    roles2 = oidcRoles?.roles || [];
+  }
+  const defaultLocale = oauthService2.localeFindByHeader(ctx.request.headers);
+  const activateUser = await oauthService2.createUser(
+    email,
+    userResponseData[config2.OIDC_FAMILY_NAME_FIELD],
+    userResponseData[config2.OIDC_GIVEN_NAME_FIELD],
+    defaultLocale,
+    roles2
+  );
+  await oauthService2.triggerWebHook(activateUser);
+  return activateUser;
+}
+async function handleUserAuthentication(userService, oauthService2, roleService2, whitelistService2, userResponseData, config2, ctx) {
+  const email = String(userResponseData.email).toLowerCase();
+  const whitelistUser = await whitelistService2.checkWhitelistForEmail(email);
+  const dbUser = await userService.findOneByEmail(email);
+  let activateUser;
+  if (dbUser) {
+    activateUser = dbUser;
+  } else {
+    activateUser = await registerNewUser(
+      userService,
+      oauthService2,
+      roleService2,
+      email,
+      userResponseData,
+      whitelistUser,
+      config2,
+      ctx
+    );
+  }
+  const jwtToken = await oauthService2.generateToken(activateUser, ctx);
+  oauthService2.triggerSignInSuccess(activateUser);
+  return { activateUser, jwtToken };
+}
 async function oidcSignInCallback(ctx) {
   const config2 = configValidation();
   const httpClient = axios.create();
@@ -152,77 +224,41 @@ async function oidcSignInCallback(ctx) {
   const roleService2 = strapi.plugin("strapi-plugin-oidc").service("role");
   const whitelistService2 = strapi.plugin("strapi-plugin-oidc").service("whitelist");
   if (!ctx.query.code) {
-    return ctx.send(oauthService2.renderSignUpError(`code Not Found`));
+    return ctx.send(oauthService2.renderSignUpError("code Not Found"));
   }
   if (!ctx.query.state || ctx.query.state !== ctx.session.oidcState) {
-    return ctx.send(oauthService2.renderSignUpError(`Invalid state`));
+    return ctx.send(oauthService2.renderSignUpError("Invalid state"));
   }
   const params = new URLSearchParams();
   params.append("code", ctx.query.code);
-  params.append("client_id", config2["OIDC_CLIENT_ID"]);
-  params.append("client_secret", config2["OIDC_CLIENT_SECRET"]);
-  params.append("redirect_uri", config2["OIDC_REDIRECT_URI"]);
-  params.append("grant_type", config2["OIDC_GRANT_TYPE"]);
+  params.append("client_id", config2.OIDC_CLIENT_ID);
+  params.append("client_secret", config2.OIDC_CLIENT_SECRET);
+  params.append("redirect_uri", config2.OIDC_REDIRECT_URI);
+  params.append("grant_type", config2.OIDC_GRANT_TYPE);
   params.append("code_verifier", ctx.session.codeVerifier);
   try {
-    const response = await httpClient.post(config2["OIDC_TOKEN_ENDPOINT"], params, {
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded"
-      }
-    });
-    let userInfoEndpointHeaders = {};
-    let userInfoEndpointParameters = `?access_token=${response.data.access_token}`;
-    if (config2["OIDC_USER_INFO_ENDPOINT_WITH_AUTH_HEADER"]) {
-      userInfoEndpointHeaders = {
-        headers: { Authorization: `Bearer ${response.data.access_token}` }
-      };
-      userInfoEndpointParameters = "";
-    }
-    const userInfoEndpoint = `${config2["OIDC_USER_INFO_ENDPOINT"]}${userInfoEndpointParameters}`;
-    const userResponse = await httpClient.get(
-      userInfoEndpoint,
-      userInfoEndpointHeaders
+    const userResponseData = await exchangeTokenAndFetchUserInfo(httpClient, config2, params);
+    const { activateUser, jwtToken } = await handleUserAuthentication(
+      userService,
+      oauthService2,
+      roleService2,
+      whitelistService2,
+      userResponseData,
+      config2,
+      ctx
     );
-    const email = userResponse.data.email;
-    const whitelistUser = await whitelistService2.checkWhitelistForEmail(email);
-    const dbUser = await userService.findOneByEmail(email);
-    let activateUser;
-    let jwtToken;
-    if (dbUser) {
-      activateUser = dbUser;
-      jwtToken = await oauthService2.generateToken(dbUser, ctx);
-    } else {
-      let roles2 = [];
-      if (whitelistUser && whitelistUser.roles && whitelistUser.roles.length > 0) {
-        roles2 = whitelistUser.roles;
-      } else {
-        const oidcRoles = await roleService2.oidcRoles();
-        roles2 = oidcRoles && oidcRoles["roles"] ? oidcRoles["roles"] : [];
-      }
-      const defaultLocale = oauthService2.localeFindByHeader(ctx.request.headers);
-      activateUser = await oauthService2.createUser(
-        email,
-        userResponse.data[config2["OIDC_FAMILY_NAME_FIELD"]],
-        userResponse.data[config2["OIDC_GIVEN_NAME_FIELD"]],
-        defaultLocale,
-        roles2
-      );
-      jwtToken = await oauthService2.generateToken(activateUser, ctx);
-      await oauthService2.triggerWebHook(activateUser);
-    }
-    oauthService2.triggerSignInSuccess(activateUser);
     const nonce = randomUUID();
     const html = oauthService2.renderSignUpSuccess(jwtToken, activateUser, nonce);
     ctx.set("Content-Security-Policy", `script-src 'nonce-${nonce}'`);
     ctx.send(html);
   } catch (e) {
-    console.error(e);
+    console.error("ERROR CAUGHT IN OIDC SIGNIN:", e);
     ctx.send(oauthService2.renderSignUpError(e.message));
   }
 }
 async function logout(ctx) {
   const config2 = strapi.config.get("plugin::strapi-plugin-oidc");
-  const logoutUrl = config2["OIDC_LOGOUT_URL"];
+  const logoutUrl = config2.OIDC_LOGOUT_URL;
   if (logoutUrl) {
     ctx.redirect(logoutUrl);
   } else {
@@ -240,10 +276,9 @@ async function find(ctx) {
   const roles2 = await roleService2.find();
   const oidcConstants = roleService2.getOidcRoles();
   for (const oidc2 of oidcConstants) {
-    for (const role2 of roles2) {
-      if (role2["oauth_type"] === oidc2["oauth_type"]) {
-        oidc2["role"] = role2["roles"];
-      }
+    const matchedRole = roles2.find((r) => r.oauth_type === oidc2.oauth_type);
+    if (matchedRole) {
+      oidc2.role = matchedRole.roles;
     }
   }
   ctx.send(oidcConstants);
@@ -255,7 +290,7 @@ async function update(ctx) {
     await roleService2.update(roles2);
     ctx.send({}, 204);
   } catch (e) {
-    console.log(e);
+    console.error(e);
     ctx.send({}, 400);
   }
 }
@@ -274,8 +309,14 @@ async function info(ctx) {
   };
 }
 async function updateSettings(ctx) {
-  const { useWhitelist, enforceOIDC } = ctx.request.body;
+  let { useWhitelist, enforceOIDC } = ctx.request.body;
   const whitelistService2 = strapi.plugin("strapi-plugin-oidc").service("whitelist");
+  if (useWhitelist && enforceOIDC) {
+    const users = await whitelistService2.getUsers();
+    if (users.length === 0) {
+      enforceOIDC = false;
+    }
+  }
   await whitelistService2.setSettings({ useWhitelist, enforceOIDC });
   ctx.body = { useWhitelist, enforceOIDC };
 }
@@ -289,12 +330,11 @@ async function publicSettings(ctx) {
 async function register(ctx) {
   const { email, roles: roles2 } = ctx.request.body;
   if (!email) {
-    ctx.body = {
-      message: "Please enter a valid email address"
-    };
+    ctx.body = { message: "Please enter a valid email address" };
     return;
   }
-  const emailList = Array.isArray(email) ? email : email.split(",").map((e) => e.trim()).filter((e) => e);
+  const rawEmails = Array.isArray(email) ? email : email.split(",");
+  const emailList = rawEmails.map((e) => String(e).trim().toLowerCase()).filter(Boolean);
   const existingUsers = await strapi.query("admin::user").findMany({
     where: { email: { $in: emailList } },
     populate: ["roles"]
@@ -304,8 +344,8 @@ async function register(ctx) {
   for (const singleEmail of emailList) {
     const existingUser = existingUsers.find((u) => u.email === singleEmail);
     let finalRoles = roles2;
-    if (existingUser && existingUser.roles) {
-      finalRoles = existingUser.roles.map((r) => r.id.toString());
+    if (existingUser?.roles) {
+      finalRoles = existingUser.roles.map((r) => String(r.id));
       matchedExistingUsersCount++;
     }
     const alreadyWhitelisted = await strapi.query("plugin::strapi-plugin-oidc.whitelists").findOne({
@@ -324,7 +364,8 @@ async function removeEmail(ctx) {
   ctx.body = {};
 }
 async function syncUsers(ctx) {
-  const { users } = ctx.request.body;
+  let { users } = ctx.request.body;
+  users = users.map((u) => ({ ...u, email: String(u.email).toLowerCase() }));
   const whitelistService2 = strapi.plugin("strapi-plugin-oidc").service("whitelist");
   const currentUsers = await whitelistService2.getUsers();
   let matchedExistingUsersCount = 0;
@@ -342,8 +383,8 @@ async function syncUsers(ctx) {
     const existingStrapiUser = existingStrapiUsers.find((u) => u.email === user.email);
     let finalRoles = user.roles;
     const currUser = currentUsers.find((u) => u.email === user.email);
-    if (!currUser && existingStrapiUser && existingStrapiUser.roles) {
-      finalRoles = existingStrapiUser.roles.map((r) => r.id.toString());
+    if (!currUser && existingStrapiUser?.roles) {
+      finalRoles = existingStrapiUser.roles.map((r) => String(r.id));
       matchedExistingUsersCount++;
     }
     if (currUser) {
@@ -370,6 +411,23 @@ const controllers = {
   role,
   whitelist
 };
+const rateLimitMap = /* @__PURE__ */ new Map();
+const RATE_LIMIT_WINDOW = 6e4;
+const MAX_REQUESTS = 20;
+const rateLimitMiddleware = async (ctx, next) => {
+  const ip = ctx.request.ip;
+  const now = Date.now();
+  const windowStart = now - RATE_LIMIT_WINDOW;
+  const requestStamps = (rateLimitMap.get(ip) || []).filter((timestamp) => timestamp > windowStart);
+  if (requestStamps.length >= MAX_REQUESTS) {
+    ctx.status = 429;
+    ctx.body = "Too Many Requests";
+    return;
+  }
+  requestStamps.push(now);
+  rateLimitMap.set(ip, requestStamps);
+  await next();
+};
 const routes = [
   {
     method: "GET",
@@ -389,7 +447,10 @@ const routes = [
     config: {
       policies: [
         "admin::isAuthenticatedAdmin",
-        { name: "admin::hasPermissions", config: { actions: ["plugin::strapi-plugin-oidc.update"] } }
+        {
+          name: "admin::hasPermissions",
+          config: { actions: ["plugin::strapi-plugin-oidc.update"] }
+        }
       ]
     }
   },
@@ -398,7 +459,8 @@ const routes = [
     path: "/oidc",
     handler: "oidc.oidcSignIn",
     config: {
-      auth: false
+      auth: false,
+      middlewares: [rateLimitMiddleware]
     }
   },
   {
@@ -406,7 +468,8 @@ const routes = [
     path: "/oidc/callback",
     handler: "oidc.oidcSignInCallback",
     config: {
-      auth: false
+      auth: false,
+      middlewares: [rateLimitMiddleware]
     }
   },
   {
@@ -435,7 +498,10 @@ const routes = [
     config: {
       policies: [
         "admin::isAuthenticatedAdmin",
-        { name: "admin::hasPermissions", config: { actions: ["plugin::strapi-plugin-oidc.update"] } }
+        {
+          name: "admin::hasPermissions",
+          config: { actions: ["plugin::strapi-plugin-oidc.update"] }
+        }
       ]
     }
   },
@@ -454,7 +520,10 @@ const routes = [
     config: {
       policies: [
         "admin::isAuthenticatedAdmin",
-        { name: "admin::hasPermissions", config: { actions: ["plugin::strapi-plugin-oidc.update"] } }
+        {
+          name: "admin::hasPermissions",
+          config: { actions: ["plugin::strapi-plugin-oidc.update"] }
+        }
       ]
     }
   },
@@ -465,7 +534,10 @@ const routes = [
     config: {
       policies: [
         "admin::isAuthenticatedAdmin",
-        { name: "admin::hasPermissions", config: { actions: ["plugin::strapi-plugin-oidc.update"] } }
+        {
+          name: "admin::hasPermissions",
+          config: { actions: ["plugin::strapi-plugin-oidc.update"] }
+        }
       ]
     }
   },
@@ -476,12 +548,132 @@ const routes = [
     config: {
       policies: [
         "admin::isAuthenticatedAdmin",
-        { name: "admin::hasPermissions", config: { actions: ["plugin::strapi-plugin-oidc.update"] } }
+        {
+          name: "admin::hasPermissions",
+          config: { actions: ["plugin::strapi-plugin-oidc.update"] }
+        }
       ]
     }
   }
 ];
 const policies = {};
+function renderHtmlTemplate(title, content) {
+  return `
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${title}</title>
+  <style>
+    :root {
+      --bg-color: #f6f6f9;
+      --card-bg: #ffffff;
+      --text-color: #32324d;
+      --text-muted: #666687;
+      --btn-bg: #4945ff;
+      --btn-hover: #271fe0;
+      --btn-text: #ffffff;
+      --icon-bg: #fcecea;
+      --icon-color: #d02b20;
+      --success-bg: #eafbe7;
+      --success-color: #328048;
+      --shadow: 0 1px 4px rgba(33, 33, 52, 0.1);
+    }
+    @media (prefers-color-scheme: dark) {
+      :root {
+        --bg-color: #181826;
+        --card-bg: #212134;
+        --text-color: #ffffff;
+        --text-muted: #a5a5ba;
+        --btn-bg: #4945ff;
+        --btn-hover: #7b79ff;
+        --btn-text: #ffffff;
+        --icon-bg: #4a2123;
+        --icon-color: #f23628;
+        --success-bg: #1c3523;
+        --success-color: #55ca76;
+        --shadow: 0 1px 4px rgba(0, 0, 0, 0.5);
+      }
+    }
+    body {
+      margin: 0;
+      padding: 0;
+      display: flex;
+      justify-content: center;
+      align-items: center;
+      height: 100vh;
+      background-color: var(--bg-color);
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+      color: var(--text-color);
+    }
+    .card {
+      background: var(--card-bg);
+      padding: 32px 40px;
+      border-radius: 8px;
+      box-shadow: var(--shadow);
+      max-width: 400px;
+      width: 100%;
+      text-align: center;
+      box-sizing: border-box;
+    }
+    .icon {
+      width: 48px;
+      height: 48px;
+      background-color: var(--icon-bg);
+      color: var(--icon-color);
+      border-radius: 50%;
+      display: inline-flex;
+      justify-content: center;
+      align-items: center;
+      margin-bottom: 24px;
+    }
+    .icon.success {
+      background-color: var(--success-bg);
+      color: var(--success-color);
+    }
+    .icon svg {
+      width: 24px;
+      height: 24px;
+      stroke: currentColor;
+      stroke-width: 2;
+      stroke-linecap: round;
+      stroke-linejoin: round;
+      fill: none;
+    }
+    h1 {
+      margin: 0 0 12px 0;
+      font-size: 20px;
+      font-weight: 600;
+      color: var(--text-color);
+    }
+    p {
+      margin: 0 0 32px 0;
+      font-size: 14px;
+      line-height: 1.5;
+      color: var(--text-muted);
+    }
+    .btn {
+      display: inline-block;
+      background-color: var(--btn-bg);
+      color: var(--btn-text);
+      padding: 10px 16px;
+      border-radius: 4px;
+      text-decoration: none;
+      font-size: 14px;
+      font-weight: 500;
+      transition: background-color 0.2s;
+    }
+    .btn:hover {
+      background-color: var(--btn-hover);
+    }
+  </style>
+</head>
+<body>
+  ${content}
+</body>
+</html>`;
+}
 function oauthService({ strapi: strapi2 }) {
   return {
     async createUser(email, lastname, firstname, locale, roles2 = []) {
@@ -493,8 +685,8 @@ function oauthService({ strapi: strapi2 }) {
         }
       }
       const createdUser = await userService.create({
-        firstname: firstname ? firstname : "unset",
-        lastname: lastname ? lastname : "",
+        firstname: firstname || "unset",
+        lastname: lastname || "",
         email: email.toLocaleLowerCase(),
         roles: roles2,
         preferedLanguage: locale
@@ -502,8 +694,8 @@ function oauthService({ strapi: strapi2 }) {
       return await userService.register({
         registrationToken: createdUser.registrationToken,
         userInfo: {
-          firstname: firstname ? firstname : "unset",
-          lastname: lastname ? lastname : "user",
+          firstname: firstname || "unset",
+          lastname: lastname || "user",
           password: generator.generate({
             length: 43,
             // 256 bits (https://en.wikipedia.org/wiki/Password_strength#Random_passwords)
@@ -527,11 +719,7 @@ function oauthService({ strapi: strapi2 }) {
       return `${origin}+${alias}${domain}`;
     },
     localeFindByHeader(headers) {
-      if (headers["accept-language"] && headers["accept-language"].includes("ja")) {
-        return "ja";
-      } else {
-        return "en";
-      }
+      return headers["accept-language"]?.includes("ja") ? "ja" : "en";
     },
     async triggerWebHook(user) {
       let ENTRY_CREATE;
@@ -554,7 +742,7 @@ function oauthService({ strapi: strapi2 }) {
       });
     },
     triggerSignInSuccess(user) {
-      delete user["password"];
+      delete user.password;
       const eventHub = strapi2.serviceMap.get("eventHub");
       eventHub.emit("admin.auth.success", {
         user,
@@ -566,40 +754,48 @@ function oauthService({ strapi: strapi2 }) {
       const config2 = strapi2.config.get("plugin::strapi-plugin-oidc");
       const REMEMBER_ME = config2["REMEMBER_ME"];
       const isRememberMe = !!REMEMBER_ME;
-      return `
-<!doctype html>
-<html>
-<head>
-<noscript>
-<h3>JavaScript must be enabled for authentication</h3>
-</noscript>
-<script nonce="${nonce}">
- window.addEventListener('load', function() {
-  if(${isRememberMe}){
-    localStorage.setItem('jwtToken', '"${jwtToken}"');
-  }else{
-    document.cookie = 'jwtToken=${encodeURIComponent(jwtToken)}; Path=/';
-  }
-  localStorage.setItem('isLoggedIn', 'true');
-  location.href = '${strapi2.config.admin.url}'
- })
-<\/script>
-</head>
-<body>
-</body>
-</html>`;
+      const content = `
+    <noscript>
+      <div class="card">
+        <div class="icon success">
+          <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-check">
+            <path d="M20 6 9 17l-5-5"/>
+          </svg>
+        </div>
+        <h1>JavaScript Required</h1>
+        <p>JavaScript must be enabled for authentication to complete.</p>
+      </div>
+    </noscript>
+    <script nonce="${nonce}">
+     window.addEventListener('load', function() {
+      if(${isRememberMe}){
+        localStorage.setItem('jwtToken', '"${jwtToken}"');
+      }else{
+        document.cookie = 'jwtToken=${encodeURIComponent(jwtToken)}; Path=/';
+      }
+      localStorage.setItem('isLoggedIn', 'true');
+      location.href = '${strapi2.config.admin.url}'
+     })
+    <\/script>`;
+      return renderHtmlTemplate("Authenticating...", content);
     },
     // Sign In Error
     renderSignUpError(message) {
-      return `
-<!doctype html>
-<html>
-<head></head>
-<body>
-<h3>Authentication failed</h3>
-<p>${message}</p>
-</body>
-</html>`;
+      const safeMessage = String(message).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#039;");
+      const content = `
+  <div class="card">
+    <div class="icon">
+      <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-triangle-alert">
+        <path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"/>
+        <path d="M12 9v4"/>
+        <path d="M12 17h.01"/>
+      </svg>
+    </div>
+    <h1>Authentication Failed</h1>
+    <p>${safeMessage}</p>
+    <a href="${strapi2.config.admin.url}" class="btn">Return to Login</a>
+  </div>`;
+      return renderHtmlTemplate("Authentication Failed", content);
     },
     async generateToken(user, ctx) {
       const sessionManager = strapi2.sessionManager;
@@ -654,35 +850,35 @@ function roleService({ strapi: strapi2 }) {
     getOidcRoles() {
       return [
         {
-          "oauth_type": this.OIDC_TYPE,
+          oauth_type: this.OIDC_TYPE,
           name: "OIDC"
         }
       ];
     },
     async oidcRoles() {
-      return await strapi2.query("plugin::strapi-plugin-oidc.roles").findOne({
+      return strapi2.query("plugin::strapi-plugin-oidc.roles").findOne({
         where: {
-          "oauth_type": this.OIDC_TYPE
+          oauth_type: this.OIDC_TYPE
         }
       });
     },
     async find() {
-      return await strapi2.query("plugin::strapi-plugin-oidc.roles").findMany();
+      return strapi2.query("plugin::strapi-plugin-oidc.roles").findMany();
     },
     async update(roles2) {
       const query = strapi2.query("plugin::strapi-plugin-oidc.roles");
       await Promise.all(
         roles2.map(async (role2) => {
-          const oidcRole = await query.findOne({ where: { "oauth_type": role2["oauth_type"] } });
+          const oidcRole = await query.findOne({ where: { oauth_type: role2.oauth_type } });
           if (oidcRole) {
             await query.update({
-              where: { "oauth_type": role2["oauth_type"] },
+              where: { oauth_type: role2.oauth_type },
               data: { roles: role2.role }
             });
           } else {
             await query.create({
               data: {
-                "oauth_type": role2["oauth_type"],
+                oauth_type: role2.oauth_type,
                 roles: role2.role
               }
             });
@@ -693,53 +889,48 @@ function roleService({ strapi: strapi2 }) {
   };
 }
 function whitelistService({ strapi: strapi2 }) {
+  const getPluginStore = () => strapi2.store({
+    environment: "",
+    type: "plugin",
+    name: "strapi-plugin-oidc"
+  });
+  const getWhitelistQuery = () => strapi2.query("plugin::strapi-plugin-oidc.whitelists");
   return {
     async getSettings() {
-      const pluginStore = strapi2.store({ type: "plugin", name: "strapi-plugin-oidc" });
-      let settings = await pluginStore.get({ key: "settings" });
+      let settings = await getPluginStore().get({ key: "settings" });
       if (!settings) {
         settings = { useWhitelist: true, enforceOIDC: false };
-        await pluginStore.set({ key: "settings", value: settings });
+        await getPluginStore().set({ key: "settings", value: settings });
       }
       return settings;
     },
     async setSettings(settings) {
-      const pluginStore = strapi2.store({ type: "plugin", name: "strapi-plugin-oidc" });
-      await pluginStore.set({ key: "settings", value: settings });
+      await getPluginStore().set({ key: "settings", value: settings });
     },
     async getUsers() {
-      const query = strapi2.query("plugin::strapi-plugin-oidc.whitelists");
-      return await query.findMany();
+      return getWhitelistQuery().findMany();
     },
     async registerUser(email, roles2) {
-      const query = strapi2.query("plugin::strapi-plugin-oidc.whitelists");
-      await query.create({
-        data: {
-          email,
-          roles: roles2
-        }
+      await getWhitelistQuery().create({
+        data: { email, roles: roles2 }
       });
     },
     async removeUser(id) {
-      const query = strapi2.query("plugin::strapi-plugin-oidc.whitelists");
-      await query.delete({
-        where: {
-          id
-        }
+      await getWhitelistQuery().delete({
+        where: { id }
       });
     },
     async checkWhitelistForEmail(email) {
       const settings = await this.getSettings();
+      console.log("checkWhitelistForEmail settings:", settings);
       if (!settings.useWhitelist) {
         return null;
       }
-      const query = strapi2.query("plugin::strapi-plugin-oidc.whitelists");
-      const result = await query.findOne({
-        where: {
-          email
-        }
+      const result = await getWhitelistQuery().findOne({
+        where: { email }
       });
-      if (result === null) {
+      console.log("checkWhitelistForEmail result:", result);
+      if (!result) {
         throw new Error("Not present in whitelist");
       }
       return result;