strapi-plugin-oidc 1.3.1 → 1.4.0

package/dist/admin/{index-BqyGGX8X.js → index-QZkv75Xp.js}

@@ -7,7 +7,7 @@ const react = require("react");
 const designSystem = require("@strapi/design-system");
 const icons = require("@strapi/icons");
 const reactIntl = require("react-intl");
-const index = require("./index-Cse9ex24.js");
+const index = require("./index-CZDixCh4.js");
 const styled = require("styled-components");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
 const styled__default = /* @__PURE__ */ _interopDefault(styled);
@@ -56,13 +56,17 @@ function Whitelist({
   useWhitelist,
   loading,
   onSave,
-  onDelete
+  onDelete,
+  onDeleteAll,
+  onImport,
+  onExport
 }) {
   const [email, setEmail] = react.useState("");
   const [selectedRoles, setSelectedRoles] = react.useState([]);
   const [page, setPage] = react.useState(1);
   const { formatMessage } = reactIntl.useIntl();
   const { toggleNotification } = admin.useNotification();
+  const fileInputRef = react.useRef(null);
   const PAGE_SIZE = 10;
   const pageCount = Math.ceil(users.length / PAGE_SIZE) || 1;
   const paginatedUsers = users.slice((page - 1) * PAGE_SIZE, page * PAGE_SIZE);
@@ -83,9 +87,93 @@ function Whitelist({
     const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
     return emailRegex.test(email);
   }, [email]);
+  const handleImport = react.useCallback(
+    async (e) => {
+      const file = e.target.files?.[0];
+      if (!fileInputRef.current) return;
+      fileInputRef.current.value = "";
+      if (!file) return;
+      try {
+        const text = await file.text();
+        const parsed = JSON.parse(text);
+        if (!Array.isArray(parsed)) throw new Error();
+        const entries = parsed.filter((item) => item?.email).map((item) => ({
+          email: String(item.email),
+          roles: Array.isArray(item.roles) ? item.roles : []
+        }));
+        const count = await onImport(entries);
+        if (count === 0) {
+          toggleNotification({
+            type: "info",
+            message: formatMessage(index.getTrad("whitelist.import.none"))
+          });
+        } else {
+          toggleNotification({
+            type: "success",
+            message: formatMessage(index.getTrad("whitelist.import.success"), { count })
+          });
+        }
+      } catch {
+        toggleNotification({
+          type: "warning",
+          message: formatMessage(index.getTrad("whitelist.import.error"))
+        });
+      }
+    },
+    [onImport, formatMessage, toggleNotification]
+  );
   return /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Box, { children: [
     /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { tag: "p", variant: "omega", textColor: "neutral600", marginBottom: 4, children: formatMessage(index.getTrad("whitelist.description")) }),
     useWhitelist && /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+      /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { justifyContent: "space-between", alignItems: "center", marginBottom: 4, children: [
+        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", children: formatMessage(index.getTrad("whitelist.count"), { count: users.length }) }),
+        /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 2, children: [
+          /* @__PURE__ */ jsxRuntime.jsx(
+            designSystem.Button,
+            {
+              size: "S",
+              variant: "tertiary",
+              startIcon: /* @__PURE__ */ jsxRuntime.jsx(icons.Download, {}),
+              onClick: onExport,
+              disabled: users.length === 0,
+              children: formatMessage(index.getTrad("whitelist.export"))
+            }
+          ),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            designSystem.Button,
+            {
+              size: "S",
+              variant: "tertiary",
+              startIcon: /* @__PURE__ */ jsxRuntime.jsx(icons.Upload, {}),
+              onClick: () => fileInputRef.current?.click(),
+              children: formatMessage(index.getTrad("whitelist.import"))
+            }
+          ),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            "input",
+            {
+              ref: fileInputRef,
+              type: "file",
+              accept: ".json,application/json",
+              style: { display: "none" },
+              onChange: handleImport
+            }
+          ),
+          users.length > 0 && /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Dialog.Root, { children: [
+            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Dialog.Trigger, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Button, { size: "S", variant: "danger-light", startIcon: /* @__PURE__ */ jsxRuntime.jsx(icons.Trash, {}), children: formatMessage(index.getTrad("whitelist.delete.all.label")) }) }),
+            /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Dialog.Content, { children: [
+              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Dialog.Header, { children: formatMessage(index.getTrad("whitelist.delete.all.title")) }),
+              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Dialog.Body, { icon: /* @__PURE__ */ jsxRuntime.jsx(icons.WarningCircle, { fill: "danger600" }), children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { justifyContent: "center", children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { textColor: "neutral800", textAlign: "center", children: formatMessage(index.getTrad("whitelist.delete.all.description"), {
+                count: users.length
+              }) }) }) }),
+              /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Dialog.Footer, { children: [
+                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Dialog.Cancel, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Button, { fullWidth: true, variant: "tertiary", children: formatMessage(index.getTrad("page.cancel")) }) }),
+                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Dialog.Action, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Button, { fullWidth: true, variant: "danger", onClick: onDeleteAll, children: formatMessage(index.getTrad("whitelist.delete.all.label")) }) })
+              ] })
+            ] })
+          ] })
+        ] })
+      ] }),
       /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 4, marginTop: 5, marginBottom: 5, alignItems: "flex-start", children: [
         /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { style: { flex: 1 }, children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Root, { children: /* @__PURE__ */ jsxRuntime.jsx(
           designSystem.Field.Input,
@@ -137,17 +225,22 @@ function Whitelist({
             return r ? r.name : roleId;
           }).join(", ");
           let userRolesNames = getRoleNames(user.roles || []);
+          let isDefault = false;
           if (!userRolesNames) {
             const defaultRolesIds = oidcRoles.reduce((acc, oidc) => {
               if (oidc.role) acc.push(...oidc.role);
               return acc;
             }, []);
             userRolesNames = getRoleNames(defaultRolesIds);
+            isDefault = Boolean(userRolesNames);
           }
           return /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Tr, { children: [
             /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: index$1 + 1 + (page - 1) * PAGE_SIZE }),
             /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: user.email }),
-            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: userRolesNames || "-" }),
+            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: userRolesNames ? /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 2, alignItems: "center", children: [
+              /* @__PURE__ */ jsxRuntime.jsx("span", { children: userRolesNames }),
+              isDefault && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: "(Default)" })
+            ] }) : "-" }),
             /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: /* @__PURE__ */ jsxRuntime.jsx(LocalizedDate, { date: user.createdAt }) }),
             /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { style: { paddingRight: 0 }, children: /* @__PURE__ */ jsxRuntime.jsx(
               designSystem.Flex,
@@ -351,7 +444,7 @@ function CustomSwitch({ checked, onChange, label, disabled }) {
   ] });
 }
 function useOidcSettings() {
-  const { get, put } = admin.useFetchClient();
+  const { get, put, post } = admin.useFetchClient();
   const [loading, setLoading] = react.useState(false);
   const [showSuccess, setSuccess] = react.useState(false);
   const [showError, setError] = react.useState(false);
@@ -401,6 +494,31 @@ function useOidcSettings() {
       setEnforceOIDC(false);
     }
   };
+  const onDeleteAll = () => {
+    setUsers([]);
+    if (useWhitelist) setEnforceOIDC(false);
+  };
+  const onImport = async (entries) => {
+    const response = await post("/strapi-plugin-oidc/whitelist/import", { users: entries });
+    const refreshed = await get("/strapi-plugin-oidc/whitelist");
+    setUsers(refreshed.data.whitelistUsers);
+    setInitialUsers(JSON.parse(JSON.stringify(refreshed.data.whitelistUsers)));
+    return response.data.importedCount;
+  };
+  const onExport = () => {
+    const roleMap = new Map(roles.map((r) => [String(r.id), r.name]));
+    const data = users.map(({ email, roles: userRoles }) => ({
+      email,
+      roles: (userRoles || []).map((id) => roleMap.get(String(id)) ?? id)
+    }));
+    const blob = new Blob([JSON.stringify(data, null, 2)], { type: "application/json" });
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement("a");
+    a.href = url;
+    a.download = "whitelist.json";
+    a.click();
+    URL.revokeObjectURL(url);
+  };
   const onToggleWhitelist = (e) => {
     const checked = e.target.checked;
     setUseWhitelist(checked);
@@ -472,6 +590,9 @@ function useOidcSettings() {
       onChangeRole,
       onRegisterWhitelist,
       onDeleteWhitelist,
+      onDeleteAll,
+      onImport,
+      onExport,
       onToggleWhitelist,
       onToggleEnforce,
       onSaveAll
@@ -481,6 +602,7 @@ function useOidcSettings() {
 function HomePage$1() {
   const { formatMessage } = reactIntl.useIntl();
   const { state, actions } = useOidcSettings();
+  const blocker = reactRouterDom.useBlocker(state.isDirty);
   return /* @__PURE__ */ jsxRuntime.jsxs(admin.Page.Protect, { permissions: [{ action: "plugin::strapi-plugin-oidc.read", subject: null }], children: [
     /* @__PURE__ */ jsxRuntime.jsx(
       admin.Layouts.Header,
@@ -525,7 +647,10 @@ function HomePage$1() {
             oidcRoles: state.oidcRoles,
             useWhitelist: state.useWhitelist,
             onSave: actions.onRegisterWhitelist,
-            onDelete: actions.onDeleteWhitelist
+            onDelete: actions.onDeleteWhitelist,
+            onDeleteAll: actions.onDeleteAll,
+            onImport: actions.onImport,
+            onExport: actions.onExport
           }
         )
       ] }),
@@ -564,6 +689,14 @@ function HomePage$1() {
           children: formatMessage(index.getTrad("page.save"))
         }
       ) })
+    ] }) }),
+    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Dialog.Root, { open: blocker.state === "blocked", children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Dialog.Content, { children: [
+      /* @__PURE__ */ jsxRuntime.jsx(designSystem.Dialog.Header, { children: formatMessage(index.getTrad("unsaved.title")) }),
+      /* @__PURE__ */ jsxRuntime.jsx(designSystem.Dialog.Body, { children: formatMessage(index.getTrad("unsaved.description")) }),
+      /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Dialog.Footer, { children: [
+        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Dialog.Cancel, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Button, { variant: "tertiary", onClick: () => blocker.reset?.(), children: formatMessage(index.getTrad("unsaved.cancel")) }) }),
+        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Dialog.Action, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Button, { variant: "danger", onClick: () => blocker.proceed?.(), children: formatMessage(index.getTrad("unsaved.confirm")) }) })
+      ] })
     ] }) })
   ] });
 }

package/dist/admin/index.js

@@ -1,4 +1,4 @@
 "use strict";
 Object.defineProperties(exports, { __esModule: { value: true }, [Symbol.toStringTag]: { value: "Module" } });
-const index = require("./index-Cse9ex24.js");
+const index = require("./index-CZDixCh4.js");
 exports.default = index.index;

package/dist/admin/index.mjs

@@ -1,4 +1,4 @@
-import { i } from "./index-D1ypRUlq.mjs";
+import { i } from "./index-8hB6LKml.mjs";
 export {
   i as default
 };

package/dist/server/index.js

@@ -95,6 +95,21 @@ async function bootstrap({ strapi: strapi2 }) {
     }
   ];
   await strapi2.admin.services.permission.actionProvider.registerMany(actions);
+  const enforceOIDCConfig = getEnforceOIDCConfig(strapi2);
+  if (enforceOIDCConfig !== null) {
+    try {
+      const whitelistService2 = strapi2.plugin("strapi-plugin-oidc").service("whitelist");
+      const settings = await whitelistService2.getSettings();
+      if (settings.enforceOIDC !== enforceOIDCConfig) {
+        await whitelistService2.setSettings({ ...settings, enforceOIDC: enforceOIDCConfig });
+        strapi2.log.info(
+          `[strapi-plugin-oidc] OIDC_ENFORCE=${enforceOIDCConfig} written to database settings`
+        );
+      }
+    } catch (err) {
+      strapi2.log.error("[strapi-plugin-oidc] Failed to sync OIDC_ENFORCE to database:", err);
+    }
+  }
   try {
     const oidcRoleCount = await strapi2.query("plugin::strapi-plugin-oidc.roles").count({
       where: { oauth_type: "4" }
@@ -491,6 +506,48 @@ async function removeEmail(ctx) {
   await whitelistService2.removeUser(id);
   ctx.body = {};
 }
+async function deleteAll(ctx) {
+  await strapi.db.query("plugin::strapi-plugin-oidc.whitelists").deleteMany({});
+  ctx.body = {};
+}
+async function importUsers(ctx) {
+  const { users } = ctx.request.body;
+  if (!Array.isArray(users)) {
+    ctx.status = 400;
+    ctx.body = { error: "Expected { users: [{email, roles}] }" };
+    return;
+  }
+  const allRoles = await strapi.query("admin::role").findMany({});
+  const roleNameToId = new Map(allRoles.map((r) => [r.name, String(r.id)]));
+  const resolveRole = (nameOrId) => roleNameToId.get(nameOrId) ?? nameOrId;
+  const normalized = users.filter((u) => u?.email).map((u) => ({
+    email: String(u.email).trim().toLowerCase(),
+    roles: (Array.isArray(u.roles) ? u.roles : []).map(resolveRole)
+  }));
+  const seen = /* @__PURE__ */ new Set();
+  const deduped = normalized.filter((u) => {
+    if (seen.has(u.email)) return false;
+    seen.add(u.email);
+    return true;
+  });
+  const strapiUsers = await strapi.query("admin::user").findMany({
+    where: { email: { $in: deduped.map((u) => u.email) } },
+    populate: ["roles"]
+  });
+  const strapiUserMap = new Map(strapiUsers.map((u) => [u.email, u]));
+  const whitelistService2 = strapi.plugin("strapi-plugin-oidc").service("whitelist");
+  const existing = await whitelistService2.getUsers();
+  const existingEmails = new Set(existing.map((u) => u.email));
+  let importedCount = 0;
+  for (const user of deduped) {
+    if (existingEmails.has(user.email)) continue;
+    const strapiUser = strapiUserMap.get(user.email);
+    const finalRoles = strapiUser?.roles?.length ? strapiUser.roles.map((r) => String(r.id)) : user.roles;
+    await whitelistService2.registerUser(user.email, finalRoles);
+    importedCount++;
+  }
+  ctx.body = { importedCount };
+}
 async function syncUsers(ctx) {
   let { users } = ctx.request.body;
   users = users.map((u) => ({ ...u, email: String(u.email).toLowerCase() }));
@@ -532,7 +589,9 @@ const whitelist = {
   publicSettings,
   register,
   removeEmail,
-  syncUsers
+  deleteAll,
+  syncUsers,
+  importUsers
 };
 const controllers = {
   oidc,
@@ -556,134 +615,133 @@ const rateLimitMiddleware = async (ctx, next) => {
   rateLimitMap.set(ip, requestStamps);
   await next();
 };
-const routes = [
-  {
-    method: "GET",
-    path: "/oidc-roles",
-    handler: "role.find",
-    config: {
-      policies: [
-        "admin::isAuthenticatedAdmin",
-        { name: "admin::hasPermissions", config: { actions: ["plugin::strapi-plugin-oidc.read"] } }
-      ]
-    }
-  },
-  {
-    method: "PUT",
-    path: "/oidc-roles",
-    handler: "role.update",
-    config: {
-      policies: [
-        "admin::isAuthenticatedAdmin",
-        {
-          name: "admin::hasPermissions",
-          config: { actions: ["plugin::strapi-plugin-oidc.update"] }
-        }
-      ]
-    }
-  },
-  {
-    method: "GET",
-    path: "/oidc",
-    handler: "oidc.oidcSignIn",
-    config: {
-      auth: false,
-      middlewares: [rateLimitMiddleware]
-    }
-  },
-  {
-    method: "GET",
-    path: "/oidc/callback",
-    handler: "oidc.oidcSignInCallback",
-    config: {
-      auth: false,
-      middlewares: [rateLimitMiddleware]
-    }
-  },
-  {
-    method: "GET",
-    path: "/logout",
-    handler: "oidc.logout",
-    config: {
-      auth: false
-    }
-  },
-  {
-    method: "GET",
-    path: "/whitelist",
-    handler: "whitelist.info",
-    config: {
-      policies: [
-        "admin::isAuthenticatedAdmin",
-        { name: "admin::hasPermissions", config: { actions: ["plugin::strapi-plugin-oidc.read"] } }
-      ]
-    }
-  },
-  {
-    method: "PUT",
-    path: "/whitelist/settings",
-    handler: "whitelist.updateSettings",
-    config: {
-      policies: [
-        "admin::isAuthenticatedAdmin",
-        {
-          name: "admin::hasPermissions",
-          config: { actions: ["plugin::strapi-plugin-oidc.update"] }
-        }
-      ]
-    }
-  },
-  {
-    method: "GET",
-    path: "/settings/public",
-    handler: "whitelist.publicSettings",
-    config: {
-      auth: false
-    }
-  },
-  {
-    method: "PUT",
-    path: "/whitelist/sync",
-    handler: "whitelist.syncUsers",
-    config: {
-      policies: [
-        "admin::isAuthenticatedAdmin",
-        {
-          name: "admin::hasPermissions",
-          config: { actions: ["plugin::strapi-plugin-oidc.update"] }
-        }
-      ]
-    }
-  },
-  {
-    method: "POST",
-    path: "/whitelist",
-    handler: "whitelist.register",
-    config: {
-      policies: [
-        "admin::isAuthenticatedAdmin",
-        {
-          name: "admin::hasPermissions",
-          config: { actions: ["plugin::strapi-plugin-oidc.update"] }
-        }
-      ]
+const adminPolicies = (action) => ({
+  policies: [
+    "admin::isAuthenticatedAdmin",
+    {
+      name: "admin::hasPermissions",
+      config: { actions: [`plugin::strapi-plugin-oidc.${action}`] }
     }
+  ]
+});
+const routes = {
+  admin: {
+    type: "admin",
+    routes: [
+      {
+        method: "GET",
+        path: "/oidc-roles",
+        handler: "role.find",
+        config: adminPolicies("read")
+      },
+      {
+        method: "PUT",
+        path: "/oidc-roles",
+        handler: "role.update",
+        config: adminPolicies("update")
+      },
+      {
+        method: "GET",
+        path: "/oidc",
+        handler: "oidc.oidcSignIn",
+        config: { auth: false, middlewares: [rateLimitMiddleware] }
+      },
+      {
+        method: "GET",
+        path: "/oidc/callback",
+        handler: "oidc.oidcSignInCallback",
+        config: { auth: false, middlewares: [rateLimitMiddleware] }
+      },
+      {
+        method: "GET",
+        path: "/logout",
+        handler: "oidc.logout",
+        config: { auth: false }
+      },
+      {
+        method: "GET",
+        path: "/whitelist",
+        handler: "whitelist.info",
+        config: adminPolicies("read")
+      },
+      {
+        method: "PUT",
+        path: "/whitelist/settings",
+        handler: "whitelist.updateSettings",
+        config: adminPolicies("update")
+      },
+      {
+        method: "GET",
+        path: "/settings/public",
+        handler: "whitelist.publicSettings",
+        config: { auth: false }
+      },
+      {
+        method: "PUT",
+        path: "/whitelist/sync",
+        handler: "whitelist.syncUsers",
+        config: adminPolicies("update")
+      },
+      {
+        method: "POST",
+        path: "/whitelist/import",
+        handler: "whitelist.importUsers",
+        config: adminPolicies("update")
+      },
+      {
+        method: "POST",
+        path: "/whitelist",
+        handler: "whitelist.register",
+        config: adminPolicies("update")
+      },
+      {
+        method: "DELETE",
+        path: "/whitelist/:id",
+        handler: "whitelist.removeEmail",
+        config: adminPolicies("update")
+      },
+      {
+        method: "DELETE",
+        path: "/whitelist",
+        handler: "whitelist.deleteAll",
+        config: adminPolicies("update")
+      }
+    ]
   },
-  {
-    method: "DELETE",
-    path: "/whitelist/:id",
-    handler: "whitelist.removeEmail",
-    config: {
-      policies: [
-        "admin::isAuthenticatedAdmin",
-        {
-          name: "admin::hasPermissions",
-          config: { actions: ["plugin::strapi-plugin-oidc.update"] }
-        }
-      ]
-    }
+  // API-token-authenticated routes for programmatic whitelist management.
+  // Accessible at /strapi-plugin-oidc/... using a Strapi API token
+  // (full-access or custom) in the Authorization: Bearer <token> header.
+  "content-api": {
+    type: "content-api",
+    routes: [
+      {
+        method: "GET",
+        path: "/whitelist",
+        handler: "whitelist.info"
+      },
+      {
+        method: "POST",
+        path: "/whitelist",
+        handler: "whitelist.register"
+      },
+      {
+        method: "POST",
+        path: "/whitelist/import",
+        handler: "whitelist.importUsers"
+      },
+      {
+        method: "DELETE",
+        path: "/whitelist/:id",
+        handler: "whitelist.removeEmail"
+      },
+      {
+        method: "DELETE",
+        path: "/whitelist",
+        handler: "whitelist.deleteAll"
+      }
+    ]
   }
-];
+};
 const policies = {};
 function renderHtmlTemplate(title, content) {
   return `