strapi-plugin-oidc 1.6.2 → 1.6.3

package/README.md

@@ -119,14 +119,13 @@ Role names are the **display names** shown in **Settings → Roles** (e.g. `"Edi
 ### Role assignment precedence
 
 1. **User's OIDC groups match `OIDC_GROUP_ROLE_MAP`** → use the mapped Strapi roles
-2. **No group match or no mapping configured** → use the default OIDC roles
+2. **No group match or no mapping configured** → use the default OIDC roles (new users only — see below)
 
 ### Role updates on subsequent logins
 
-- **New users** — OIDC roles are always assigned on first login.
-- **Existing users with manually unchanged roles** — If a user's current roles still match the roles assigned by OIDC on their previous login (i.e., an administrator has not manually changed their roles), their roles are updated to reflect the current group mapping. This ensures that when the group-to-role mapping changes, returning users pick up the new roles automatically.
-- **Existing users with manually changed roles** — If an administrator has manually assigned the user different roles since their last OIDC login, the user's roles are left unchanged. OIDC will not overwrite a manual role assignment.
-- **Mapping removed or user's groups don't map** — If the `OIDC_GROUP_ROLE_MAP` is removed, a user's groups no longer match any mapping, or there are no default OIDC roles configured, the user keeps their last known roles.
+- **New users** — Roles are always assigned on first login: group-mapped roles if a match is found, otherwise the configured default OIDC roles.
+- **Existing users with a group mapping match** — Roles are updated to reflect the current mapping. If a user's groups change between logins, their Strapi roles are updated accordingly.
+- **Existing users with no group mapping match** — Roles are left unchanged, regardless of what the default OIDC roles are set to. Manually-assigned roles are never overwritten by a default fallback.
 
 ## Whitelist API
 

package/dist/server/index.js

@@ -476,9 +476,9 @@ function resolveRolesFromGroups(userInfo, config2, availableRoles) {
 }
 async function resolveRoles(userInfo, config2, roleService2, availableRoles) {
   const groupRoles = resolveRolesFromGroups(userInfo, config2, availableRoles);
-  if (groupRoles.length > 0) return groupRoles;
+  if (groupRoles.length > 0) return { roles: groupRoles, fromGroupMapping: true };
   const oidcRoles = await roleService2.oidcRoles();
-  return oidcRoles?.roles || [];
+  return { roles: oidcRoles?.roles || [], fromGroupMapping: false };
 }
 async function registerNewUser(oauthService2, email, userResponseData, config2, ctx, roles2) {
   const defaultLocale = oauthService2.localeFindByHeader(
@@ -526,7 +526,12 @@ async function handleUserAuthentication(userService, oauthService2, roleService2
   }
   await whitelistService2.checkWhitelistForEmail(email);
   const allRoles = await strapi.db.query("admin::role").findMany();
-  const roles2 = await resolveRoles(userResponseData, config2, roleService2, allRoles);
+  const { roles: roles2, fromGroupMapping } = await resolveRoles(
+    userResponseData,
+    config2,
+    roleService2,
+    allRoles
+  );
   const resolvedRoleNames = allRoles.filter((r) => roles2.includes(String(r.id))).map((r) => r.name);
   let userCreated = false;
   let rolesUpdated = false;
@@ -535,16 +540,11 @@ async function handleUserAuthentication(userService, oauthService2, roleService2
     user = await registerNewUser(oauthService2, email, userResponseData, config2, ctx, roles2);
     userCreated = true;
     rolesUpdated = true;
-  } else if (roles2.length > 0) {
-    const defaultRoleIds = new Set(user.roles.map((r) => String(r.id)));
+  } else if (fromGroupMapping && roles2.length > 0) {
     const currentRoleIds = new Set(user.roles.map((r) => String(r.id)));
-    const newRoleIds = new Set(roles2);
-    if (rolesChanged(currentRoleIds, newRoleIds)) {
-      const isOnDefaultRoles = currentRoleIds.size === defaultRoleIds.size && [...currentRoleIds].every((id) => defaultRoleIds.has(id));
-      if (isOnDefaultRoles) {
-        await updateUserRoles(user, currentRoleIds, roles2);
-        rolesUpdated = true;
-      }
+    if (rolesChanged(currentRoleIds, new Set(roles2))) {
+      await updateUserRoles(user, currentRoleIds, roles2);
+      rolesUpdated = true;
     }
   }
   const jwtToken = await oauthService2.generateToken(user, ctx);

package/dist/server/index.mjs

@@ -470,9 +470,9 @@ function resolveRolesFromGroups(userInfo, config2, availableRoles) {
 }
 async function resolveRoles(userInfo, config2, roleService2, availableRoles) {
   const groupRoles = resolveRolesFromGroups(userInfo, config2, availableRoles);
-  if (groupRoles.length > 0) return groupRoles;
+  if (groupRoles.length > 0) return { roles: groupRoles, fromGroupMapping: true };
   const oidcRoles = await roleService2.oidcRoles();
-  return oidcRoles?.roles || [];
+  return { roles: oidcRoles?.roles || [], fromGroupMapping: false };
 }
 async function registerNewUser(oauthService2, email, userResponseData, config2, ctx, roles2) {
   const defaultLocale = oauthService2.localeFindByHeader(
@@ -520,7 +520,12 @@ async function handleUserAuthentication(userService, oauthService2, roleService2
   }
   await whitelistService2.checkWhitelistForEmail(email);
   const allRoles = await strapi.db.query("admin::role").findMany();
-  const roles2 = await resolveRoles(userResponseData, config2, roleService2, allRoles);
+  const { roles: roles2, fromGroupMapping } = await resolveRoles(
+    userResponseData,
+    config2,
+    roleService2,
+    allRoles
+  );
   const resolvedRoleNames = allRoles.filter((r) => roles2.includes(String(r.id))).map((r) => r.name);
   let userCreated = false;
   let rolesUpdated = false;
@@ -529,16 +534,11 @@ async function handleUserAuthentication(userService, oauthService2, roleService2
     user = await registerNewUser(oauthService2, email, userResponseData, config2, ctx, roles2);
     userCreated = true;
     rolesUpdated = true;
-  } else if (roles2.length > 0) {
-    const defaultRoleIds = new Set(user.roles.map((r) => String(r.id)));
+  } else if (fromGroupMapping && roles2.length > 0) {
     const currentRoleIds = new Set(user.roles.map((r) => String(r.id)));
-    const newRoleIds = new Set(roles2);
-    if (rolesChanged(currentRoleIds, newRoleIds)) {
-      const isOnDefaultRoles = currentRoleIds.size === defaultRoleIds.size && [...currentRoleIds].every((id) => defaultRoleIds.has(id));
-      if (isOnDefaultRoles) {
-        await updateUserRoles(user, currentRoleIds, roles2);
-        rolesUpdated = true;
-      }
+    if (rolesChanged(currentRoleIds, new Set(roles2))) {
+      await updateUserRoles(user, currentRoleIds, roles2);
+      rolesUpdated = true;
     }
   }
   const jwtToken = await oauthService2.generateToken(user, ctx);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "strapi-plugin-oidc",
-  "version": "1.6.2",
+  "version": "1.6.3",
   "description": "A Strapi plugin that provides OpenID Connect (OIDC) authentication functionality for the Strapi Admin Panel.",
   "strapi": {
     "displayName": "OIDC Plugin",