strapi-plugin-oidc 1.0.5 → 1.0.7

package/dist/server/index.js

@@ -201,7 +201,7 @@ async function registerNewUser(userService, oauthService2, roleService2, email,
   return activateUser;
 }
 async function handleUserAuthentication(userService, oauthService2, roleService2, whitelistService2, userResponseData, config2, ctx) {
-  const email = userResponseData.email;
+  const email = String(userResponseData.email).toLowerCase();
   const whitelistUser = await whitelistService2.checkWhitelistForEmail(email);
   const dbUser = await userService.findOneByEmail(email);
   let activateUser;
@@ -316,8 +316,14 @@ async function info(ctx) {
   };
 }
 async function updateSettings(ctx) {
-  const { useWhitelist, enforceOIDC } = ctx.request.body;
+  let { useWhitelist, enforceOIDC } = ctx.request.body;
   const whitelistService2 = strapi.plugin("strapi-plugin-oidc").service("whitelist");
+  if (useWhitelist && enforceOIDC) {
+    const users = await whitelistService2.getUsers();
+    if (users.length === 0) {
+      enforceOIDC = false;
+    }
+  }
   await whitelistService2.setSettings({ useWhitelist, enforceOIDC });
   ctx.body = { useWhitelist, enforceOIDC };
 }
@@ -334,7 +340,8 @@ async function register(ctx) {
     ctx.body = { message: "Please enter a valid email address" };
     return;
   }
-  const emailList = Array.isArray(email) ? email : email.split(",").map((e) => e.trim()).filter(Boolean);
+  const rawEmails = Array.isArray(email) ? email : email.split(",");
+  const emailList = rawEmails.map((e) => String(e).trim().toLowerCase()).filter(Boolean);
   const existingUsers = await strapi.query("admin::user").findMany({
     where: { email: { $in: emailList } },
     populate: ["roles"]
@@ -364,7 +371,8 @@ async function removeEmail(ctx) {
   ctx.body = {};
 }
 async function syncUsers(ctx) {
-  const { users } = ctx.request.body;
+  let { users } = ctx.request.body;
+  users = users.map((u) => ({ ...u, email: String(u.email).toLowerCase() }));
   const whitelistService2 = strapi.plugin("strapi-plugin-oidc").service("whitelist");
   const currentUsers = await whitelistService2.getUsers();
   let matchedExistingUsersCount = 0;
@@ -410,6 +418,23 @@ const controllers = {
   role,
   whitelist
 };
+const rateLimitMap = /* @__PURE__ */ new Map();
+const RATE_LIMIT_WINDOW = 6e4;
+const MAX_REQUESTS = 20;
+const rateLimitMiddleware = async (ctx, next) => {
+  const ip = ctx.request.ip;
+  const now = Date.now();
+  const windowStart = now - RATE_LIMIT_WINDOW;
+  const requestStamps = (rateLimitMap.get(ip) || []).filter((timestamp) => timestamp > windowStart);
+  if (requestStamps.length >= MAX_REQUESTS) {
+    ctx.status = 429;
+    ctx.body = "Too Many Requests";
+    return;
+  }
+  requestStamps.push(now);
+  rateLimitMap.set(ip, requestStamps);
+  await next();
+};
 const routes = [
   {
     method: "GET",
@@ -429,7 +454,10 @@ const routes = [
     config: {
       policies: [
         "admin::isAuthenticatedAdmin",
-        { name: "admin::hasPermissions", config: { actions: ["plugin::strapi-plugin-oidc.update"] } }
+        {
+          name: "admin::hasPermissions",
+          config: { actions: ["plugin::strapi-plugin-oidc.update"] }
+        }
       ]
     }
   },
@@ -438,7 +466,8 @@ const routes = [
     path: "/oidc",
     handler: "oidc.oidcSignIn",
     config: {
-      auth: false
+      auth: false,
+      middlewares: [rateLimitMiddleware]
     }
   },
   {
@@ -446,7 +475,8 @@ const routes = [
     path: "/oidc/callback",
     handler: "oidc.oidcSignInCallback",
     config: {
-      auth: false
+      auth: false,
+      middlewares: [rateLimitMiddleware]
     }
   },
   {
@@ -475,7 +505,10 @@ const routes = [
     config: {
       policies: [
         "admin::isAuthenticatedAdmin",
-        { name: "admin::hasPermissions", config: { actions: ["plugin::strapi-plugin-oidc.update"] } }
+        {
+          name: "admin::hasPermissions",
+          config: { actions: ["plugin::strapi-plugin-oidc.update"] }
+        }
       ]
     }
   },
@@ -494,7 +527,10 @@ const routes = [
     config: {
       policies: [
         "admin::isAuthenticatedAdmin",
-        { name: "admin::hasPermissions", config: { actions: ["plugin::strapi-plugin-oidc.update"] } }
+        {
+          name: "admin::hasPermissions",
+          config: { actions: ["plugin::strapi-plugin-oidc.update"] }
+        }
       ]
     }
   },
@@ -505,7 +541,10 @@ const routes = [
     config: {
       policies: [
         "admin::isAuthenticatedAdmin",
-        { name: "admin::hasPermissions", config: { actions: ["plugin::strapi-plugin-oidc.update"] } }
+        {
+          name: "admin::hasPermissions",
+          config: { actions: ["plugin::strapi-plugin-oidc.update"] }
+        }
       ]
     }
   },
@@ -516,12 +555,132 @@ const routes = [
     config: {
       policies: [
         "admin::isAuthenticatedAdmin",
-        { name: "admin::hasPermissions", config: { actions: ["plugin::strapi-plugin-oidc.update"] } }
+        {
+          name: "admin::hasPermissions",
+          config: { actions: ["plugin::strapi-plugin-oidc.update"] }
+        }
       ]
     }
   }
 ];
 const policies = {};
+function renderHtmlTemplate(title, content) {
+  return `
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${title}</title>
+  <style>
+    :root {
+      --bg-color: #f6f6f9;
+      --card-bg: #ffffff;
+      --text-color: #32324d;
+      --text-muted: #666687;
+      --btn-bg: #4945ff;
+      --btn-hover: #271fe0;
+      --btn-text: #ffffff;
+      --icon-bg: #fcecea;
+      --icon-color: #d02b20;
+      --success-bg: #eafbe7;
+      --success-color: #328048;
+      --shadow: 0 1px 4px rgba(33, 33, 52, 0.1);
+    }
+    @media (prefers-color-scheme: dark) {
+      :root {
+        --bg-color: #181826;
+        --card-bg: #212134;
+        --text-color: #ffffff;
+        --text-muted: #a5a5ba;
+        --btn-bg: #4945ff;
+        --btn-hover: #7b79ff;
+        --btn-text: #ffffff;
+        --icon-bg: #4a2123;
+        --icon-color: #f23628;
+        --success-bg: #1c3523;
+        --success-color: #55ca76;
+        --shadow: 0 1px 4px rgba(0, 0, 0, 0.5);
+      }
+    }
+    body {
+      margin: 0;
+      padding: 0;
+      display: flex;
+      justify-content: center;
+      align-items: center;
+      height: 100vh;
+      background-color: var(--bg-color);
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+      color: var(--text-color);
+    }
+    .card {
+      background: var(--card-bg);
+      padding: 32px 40px;
+      border-radius: 8px;
+      box-shadow: var(--shadow);
+      max-width: 400px;
+      width: 100%;
+      text-align: center;
+      box-sizing: border-box;
+    }
+    .icon {
+      width: 48px;
+      height: 48px;
+      background-color: var(--icon-bg);
+      color: var(--icon-color);
+      border-radius: 50%;
+      display: inline-flex;
+      justify-content: center;
+      align-items: center;
+      margin-bottom: 24px;
+    }
+    .icon.success {
+      background-color: var(--success-bg);
+      color: var(--success-color);
+    }
+    .icon svg {
+      width: 24px;
+      height: 24px;
+      stroke: currentColor;
+      stroke-width: 2;
+      stroke-linecap: round;
+      stroke-linejoin: round;
+      fill: none;
+    }
+    h1 {
+      margin: 0 0 12px 0;
+      font-size: 20px;
+      font-weight: 600;
+      color: var(--text-color);
+    }
+    p {
+      margin: 0 0 32px 0;
+      font-size: 14px;
+      line-height: 1.5;
+      color: var(--text-muted);
+    }
+    .btn {
+      display: inline-block;
+      background-color: var(--btn-bg);
+      color: var(--btn-text);
+      padding: 10px 16px;
+      border-radius: 4px;
+      text-decoration: none;
+      font-size: 14px;
+      font-weight: 500;
+      transition: background-color 0.2s;
+    }
+    .btn:hover {
+      background-color: var(--btn-hover);
+    }
+  </style>
+</head>
+<body>
+  ${content}
+</body>
+</html>`;
+}
 function oauthService({ strapi: strapi2 }) {
   return {
     async createUser(email, lastname, firstname, locale, roles2 = []) {
@@ -602,40 +761,48 @@ function oauthService({ strapi: strapi2 }) {
       const config2 = strapi2.config.get("plugin::strapi-plugin-oidc");
       const REMEMBER_ME = config2["REMEMBER_ME"];
       const isRememberMe = !!REMEMBER_ME;
-      return `
-<!doctype html>
-<html>
-<head>
-<noscript>
-<h3>JavaScript must be enabled for authentication</h3>
-</noscript>
-<script nonce="${nonce}">
- window.addEventListener('load', function() {
-  if(${isRememberMe}){
-    localStorage.setItem('jwtToken', '"${jwtToken}"');
-  }else{
-    document.cookie = 'jwtToken=${encodeURIComponent(jwtToken)}; Path=/';
-  }
-  localStorage.setItem('isLoggedIn', 'true');
-  location.href = '${strapi2.config.admin.url}'
- })
-<\/script>
-</head>
-<body>
-</body>
-</html>`;
+      const content = `
+    <noscript>
+      <div class="card">
+        <div class="icon success">
+          <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-check">
+            <path d="M20 6 9 17l-5-5"/>
+          </svg>
+        </div>
+        <h1>JavaScript Required</h1>
+        <p>JavaScript must be enabled for authentication to complete.</p>
+      </div>
+    </noscript>
+    <script nonce="${nonce}">
+     window.addEventListener('load', function() {
+      if(${isRememberMe}){
+        localStorage.setItem('jwtToken', '"${jwtToken}"');
+      }else{
+        document.cookie = 'jwtToken=${encodeURIComponent(jwtToken)}; Path=/';
+      }
+      localStorage.setItem('isLoggedIn', 'true');
+      location.href = '${strapi2.config.admin.url}'
+     })
+    <\/script>`;
+      return renderHtmlTemplate("Authenticating...", content);
     },
     // Sign In Error
     renderSignUpError(message) {
-      return `
-<!doctype html>
-<html>
-<head></head>
-<body>
-<h3>Authentication failed</h3>
-<p>${message}</p>
-</body>
-</html>`;
+      const safeMessage = String(message).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#039;");
+      const content = `
+  <div class="card">
+    <div class="icon">
+      <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-triangle-alert">
+        <path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"/>
+        <path d="M12 9v4"/>
+        <path d="M12 17h.01"/>
+      </svg>
+    </div>
+    <h1>Authentication Failed</h1>
+    <p>${safeMessage}</p>
+    <a href="${strapi2.config.admin.url}" class="btn">Return to Login</a>
+  </div>`;
+      return renderHtmlTemplate("Authentication Failed", content);
     },
     async generateToken(user, ctx) {
       const sessionManager = strapi2.sessionManager;
@@ -729,39 +896,35 @@ function roleService({ strapi: strapi2 }) {
   };
 }
 function whitelistService({ strapi: strapi2 }) {
+  const getPluginStore = () => strapi2.store({
+    environment: "",
+    type: "plugin",
+    name: "strapi-plugin-oidc"
+  });
+  const getWhitelistQuery = () => strapi2.query("plugin::strapi-plugin-oidc.whitelists");
   return {
     async getSettings() {
-      const pluginStore = strapi2.store({ type: "plugin", name: "strapi-plugin-oidc" });
-      let settings = await pluginStore.get({ key: "settings" });
+      let settings = await getPluginStore().get({ key: "settings" });
       if (!settings) {
         settings = { useWhitelist: true, enforceOIDC: false };
-        await pluginStore.set({ key: "settings", value: settings });
+        await getPluginStore().set({ key: "settings", value: settings });
       }
       return settings;
     },
     async setSettings(settings) {
-      const pluginStore = strapi2.store({ type: "plugin", name: "strapi-plugin-oidc" });
-      await pluginStore.set({ key: "settings", value: settings });
+      await getPluginStore().set({ key: "settings", value: settings });
     },
     async getUsers() {
-      const query = strapi2.query("plugin::strapi-plugin-oidc.whitelists");
-      return query.findMany();
+      return getWhitelistQuery().findMany();
     },
     async registerUser(email, roles2) {
-      const query = strapi2.query("plugin::strapi-plugin-oidc.whitelists");
-      await query.create({
-        data: {
-          email,
-          roles: roles2
-        }
+      await getWhitelistQuery().create({
+        data: { email, roles: roles2 }
       });
     },
     async removeUser(id) {
-      const query = strapi2.query("plugin::strapi-plugin-oidc.whitelists");
-      await query.delete({
-        where: {
-          id
-        }
+      await getWhitelistQuery().delete({
+        where: { id }
       });
     },
     async checkWhitelistForEmail(email) {
@@ -770,11 +933,8 @@ function whitelistService({ strapi: strapi2 }) {
       if (!settings.useWhitelist) {
         return null;
       }
-      const query = strapi2.query("plugin::strapi-plugin-oidc.whitelists");
-      const result = await query.findOne({
-        where: {
-          email
-        }
+      const result = await getWhitelistQuery().findOne({
+        where: { email }
       });
       console.log("checkWhitelistForEmail result:", result);
       if (!result) {