strapi-plugin-oidc 1.6.1 → 1.6.3

package/README.md

@@ -119,9 +119,13 @@ Role names are the **display names** shown in **Settings → Roles** (e.g. `"Edi
 ### Role assignment precedence
 
 1. **User's OIDC groups match `OIDC_GROUP_ROLE_MAP`** → use the mapped Strapi roles
-2. **No group match or no mapping configured** → use the default OIDC roles
+2. **No group match or no mapping configured** → use the default OIDC roles (new users only — see below)
 
-> **Note:** Existing users' roles are updated on every login to reflect current group membership.
+### Role updates on subsequent logins
+
+- **New users** — Roles are always assigned on first login: group-mapped roles if a match is found, otherwise the configured default OIDC roles.
+- **Existing users with a group mapping match** — Roles are updated to reflect the current mapping. If a user's groups change between logins, their Strapi roles are updated accordingly.
+- **Existing users with no group mapping match** — Roles are left unchanged, regardless of what the default OIDC roles are set to. Manually-assigned roles are never overwritten by a default fallback.
 
 ## Whitelist API
 

package/dist/server/index.js

@@ -476,9 +476,9 @@ function resolveRolesFromGroups(userInfo, config2, availableRoles) {
 }
 async function resolveRoles(userInfo, config2, roleService2, availableRoles) {
   const groupRoles = resolveRolesFromGroups(userInfo, config2, availableRoles);
-  if (groupRoles.length > 0) return groupRoles;
+  if (groupRoles.length > 0) return { roles: groupRoles, fromGroupMapping: true };
   const oidcRoles = await roleService2.oidcRoles();
-  return oidcRoles?.roles || [];
+  return { roles: oidcRoles?.roles || [], fromGroupMapping: false };
 }
 async function registerNewUser(oauthService2, email, userResponseData, config2, ctx, roles2) {
   const defaultLocale = oauthService2.localeFindByHeader(
@@ -494,6 +494,30 @@ async function registerNewUser(oauthService2, email, userResponseData, config2,
   await oauthService2.triggerWebHook(activateUser);
   return activateUser;
 }
+function rolesChanged(current, next) {
+  return current.size !== next.size || [...next].some((id) => !current.has(id));
+}
+async function updateUserRoles(user, currentRoleIds, newRoleIds) {
+  try {
+    strapi.log.info(
+      `[OIDC] Roles updated for user ${user.id}: [${[...currentRoleIds].join(",")}] -> [${newRoleIds.join(",")}]`
+    );
+    await strapi.db.query("admin::user").update({
+      where: { id: user.id },
+      data: { roles: newRoleIds }
+    });
+  } catch (updateErr) {
+    strapi.log.error({
+      code: errorCodes.ROLE_UPDATE_FAILED,
+      userId: user.id,
+      detail: getErrorDetail("role_update_failed", {
+        userId: user.id,
+        error: updateErr.message
+      })
+    });
+    throw updateErr;
+  }
+}
 async function handleUserAuthentication(userService, oauthService2, roleService2, whitelistService2, userResponseData, config2, ctx) {
   const rawEmail = String(userResponseData.email ?? "");
   const email = rawEmail.toLowerCase();
@@ -502,44 +526,30 @@ async function handleUserAuthentication(userService, oauthService2, roleService2
   }
   await whitelistService2.checkWhitelistForEmail(email);
   const allRoles = await strapi.db.query("admin::role").findMany();
-  const roles2 = await resolveRoles(userResponseData, config2, roleService2, allRoles);
+  const { roles: roles2, fromGroupMapping } = await resolveRoles(
+    userResponseData,
+    config2,
+    roleService2,
+    allRoles
+  );
   const resolvedRoleNames = allRoles.filter((r) => roles2.includes(String(r.id))).map((r) => r.name);
   let userCreated = false;
   let rolesUpdated = false;
-  let activateUser = await userService.findOneByEmail(email);
-  if (!activateUser) {
-    activateUser = await registerNewUser(oauthService2, email, userResponseData, config2, ctx, roles2);
+  let user = await userService.findOneByEmail(email, ["roles"]);
+  if (!user) {
+    user = await registerNewUser(oauthService2, email, userResponseData, config2, ctx, roles2);
     userCreated = true;
-  } else if (roles2.length > 0) {
-    const currentRoleIds = new Set((activateUser.roles ?? []).map((r) => String(r.id)));
-    const newRoleIds = new Set(roles2);
-    const rolesChanged = currentRoleIds.size !== newRoleIds.size || [...newRoleIds].some((id) => !currentRoleIds.has(id));
-    if (rolesChanged) {
-      try {
-        strapi.log.info(
-          `[OIDC] Roles updated for user ${activateUser.id}: [${[...currentRoleIds].join(",")}] -> [${roles2.join(",")}]`
-        );
-        await strapi.db.query("admin::user").update({
-          where: { id: activateUser.id },
-          data: { roles: roles2 }
-        });
-        rolesUpdated = true;
-      } catch (updateErr) {
-        strapi.log.error({
-          code: errorCodes.ROLE_UPDATE_FAILED,
-          userId: activateUser.id,
-          detail: getErrorDetail("role_update_failed", {
-            userId: activateUser.id,
-            error: updateErr.message
-          })
-        });
-        throw updateErr;
-      }
+    rolesUpdated = true;
+  } else if (fromGroupMapping && roles2.length > 0) {
+    const currentRoleIds = new Set(user.roles.map((r) => String(r.id)));
+    if (rolesChanged(currentRoleIds, new Set(roles2))) {
+      await updateUserRoles(user, currentRoleIds, roles2);
+      rolesUpdated = true;
     }
   }
-  const jwtToken = await oauthService2.generateToken(activateUser, ctx);
-  oauthService2.triggerSignInSuccess(activateUser);
-  return { activateUser, jwtToken, userCreated, rolesUpdated, resolvedRoleNames };
+  const jwtToken = await oauthService2.generateToken(user, ctx);
+  oauthService2.triggerSignInSuccess(user);
+  return { activateUser: user, jwtToken, userCreated, rolesUpdated, resolvedRoleNames };
 }
 function classifyOidcError(msg, userInfo) {
   const errorMap = [
@@ -1525,7 +1535,7 @@ function whitelistService({ strapi: strapi2 }) {
       });
     },
     async removeUser(email) {
-      await strapi2.db.query("plugin::strapi-plugin-oidc.whitelists").deleteMany({
+      await getWhitelistQuery().deleteMany({
         where: { email }
       });
     },

package/dist/server/index.mjs

@@ -470,9 +470,9 @@ function resolveRolesFromGroups(userInfo, config2, availableRoles) {
 }
 async function resolveRoles(userInfo, config2, roleService2, availableRoles) {
   const groupRoles = resolveRolesFromGroups(userInfo, config2, availableRoles);
-  if (groupRoles.length > 0) return groupRoles;
+  if (groupRoles.length > 0) return { roles: groupRoles, fromGroupMapping: true };
   const oidcRoles = await roleService2.oidcRoles();
-  return oidcRoles?.roles || [];
+  return { roles: oidcRoles?.roles || [], fromGroupMapping: false };
 }
 async function registerNewUser(oauthService2, email, userResponseData, config2, ctx, roles2) {
   const defaultLocale = oauthService2.localeFindByHeader(
@@ -488,6 +488,30 @@ async function registerNewUser(oauthService2, email, userResponseData, config2,
   await oauthService2.triggerWebHook(activateUser);
   return activateUser;
 }
+function rolesChanged(current, next) {
+  return current.size !== next.size || [...next].some((id) => !current.has(id));
+}
+async function updateUserRoles(user, currentRoleIds, newRoleIds) {
+  try {
+    strapi.log.info(
+      `[OIDC] Roles updated for user ${user.id}: [${[...currentRoleIds].join(",")}] -> [${newRoleIds.join(",")}]`
+    );
+    await strapi.db.query("admin::user").update({
+      where: { id: user.id },
+      data: { roles: newRoleIds }
+    });
+  } catch (updateErr) {
+    strapi.log.error({
+      code: errorCodes.ROLE_UPDATE_FAILED,
+      userId: user.id,
+      detail: getErrorDetail("role_update_failed", {
+        userId: user.id,
+        error: updateErr.message
+      })
+    });
+    throw updateErr;
+  }
+}
 async function handleUserAuthentication(userService, oauthService2, roleService2, whitelistService2, userResponseData, config2, ctx) {
   const rawEmail = String(userResponseData.email ?? "");
   const email = rawEmail.toLowerCase();
@@ -496,44 +520,30 @@ async function handleUserAuthentication(userService, oauthService2, roleService2
   }
   await whitelistService2.checkWhitelistForEmail(email);
   const allRoles = await strapi.db.query("admin::role").findMany();
-  const roles2 = await resolveRoles(userResponseData, config2, roleService2, allRoles);
+  const { roles: roles2, fromGroupMapping } = await resolveRoles(
+    userResponseData,
+    config2,
+    roleService2,
+    allRoles
+  );
   const resolvedRoleNames = allRoles.filter((r) => roles2.includes(String(r.id))).map((r) => r.name);
   let userCreated = false;
   let rolesUpdated = false;
-  let activateUser = await userService.findOneByEmail(email);
-  if (!activateUser) {
-    activateUser = await registerNewUser(oauthService2, email, userResponseData, config2, ctx, roles2);
+  let user = await userService.findOneByEmail(email, ["roles"]);
+  if (!user) {
+    user = await registerNewUser(oauthService2, email, userResponseData, config2, ctx, roles2);
     userCreated = true;
-  } else if (roles2.length > 0) {
-    const currentRoleIds = new Set((activateUser.roles ?? []).map((r) => String(r.id)));
-    const newRoleIds = new Set(roles2);
-    const rolesChanged = currentRoleIds.size !== newRoleIds.size || [...newRoleIds].some((id) => !currentRoleIds.has(id));
-    if (rolesChanged) {
-      try {
-        strapi.log.info(
-          `[OIDC] Roles updated for user ${activateUser.id}: [${[...currentRoleIds].join(",")}] -> [${roles2.join(",")}]`
-        );
-        await strapi.db.query("admin::user").update({
-          where: { id: activateUser.id },
-          data: { roles: roles2 }
-        });
-        rolesUpdated = true;
-      } catch (updateErr) {
-        strapi.log.error({
-          code: errorCodes.ROLE_UPDATE_FAILED,
-          userId: activateUser.id,
-          detail: getErrorDetail("role_update_failed", {
-            userId: activateUser.id,
-            error: updateErr.message
-          })
-        });
-        throw updateErr;
-      }
+    rolesUpdated = true;
+  } else if (fromGroupMapping && roles2.length > 0) {
+    const currentRoleIds = new Set(user.roles.map((r) => String(r.id)));
+    if (rolesChanged(currentRoleIds, new Set(roles2))) {
+      await updateUserRoles(user, currentRoleIds, roles2);
+      rolesUpdated = true;
     }
   }
-  const jwtToken = await oauthService2.generateToken(activateUser, ctx);
-  oauthService2.triggerSignInSuccess(activateUser);
-  return { activateUser, jwtToken, userCreated, rolesUpdated, resolvedRoleNames };
+  const jwtToken = await oauthService2.generateToken(user, ctx);
+  oauthService2.triggerSignInSuccess(user);
+  return { activateUser: user, jwtToken, userCreated, rolesUpdated, resolvedRoleNames };
 }
 function classifyOidcError(msg, userInfo) {
   const errorMap = [
@@ -1519,7 +1529,7 @@ function whitelistService({ strapi: strapi2 }) {
       });
     },
     async removeUser(email) {
-      await strapi2.db.query("plugin::strapi-plugin-oidc.whitelists").deleteMany({
+      await getWhitelistQuery().deleteMany({
         where: { email }
       });
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "strapi-plugin-oidc",
-  "version": "1.6.1",
+  "version": "1.6.3",
   "description": "A Strapi plugin that provides OpenID Connect (OIDC) authentication functionality for the Strapi Admin Panel.",
   "strapi": {
     "displayName": "OIDC Plugin",