strapi-plugin-oidc 1.6.4 → 1.6.6

package/dist/server/index.js

@@ -2,6 +2,7 @@
 Object.defineProperties(exports, { __esModule: { value: true }, [Symbol.toStringTag]: { value: "Module" } });
 const node_crypto = require("node:crypto");
 const pkceChallenge = require("pkce-challenge");
+const node_stream = require("node:stream");
 const strapiUtils = require("@strapi/utils");
 const generator = require("generate-password");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
@@ -36,6 +37,12 @@ function getRetentionDays() {
 function isAuditLogEnabled() {
   return getRetentionDays() !== 0;
 }
+const PLUGIN_NAME = "strapi-plugin-oidc";
+const getOauthService = () => strapi.plugin(PLUGIN_NAME).service("oauth");
+const getRoleService = () => strapi.plugin(PLUGIN_NAME).service("role");
+const getWhitelistService = () => strapi.plugin(PLUGIN_NAME).service("whitelist");
+const getAuditLogService = () => strapi.plugin(PLUGIN_NAME).service("auditLog");
+const getAdminUserService = () => strapi.service("admin::user");
 const AUTH_ROUTES = ["login", "register", "register-admin", "forgot-password", "reset-password"];
 async function bootstrap({ strapi: strapi2 }) {
   const adminUrl = strapi2.config.get("admin.url", "/admin");
@@ -47,7 +54,7 @@ async function bootstrap({ strapi: strapi2 }) {
     const isTokenRefresh = path === tokenRefreshPath;
     if (isAuthRoute && isPost || isTokenRefresh) {
       try {
-        const whitelistService2 = strapi2.plugin("strapi-plugin-oidc").service("whitelist");
+        const whitelistService2 = getWhitelistService();
         const settings = await whitelistService2.getSettings();
         const enforceOIDC = resolveEnforceOIDC(strapi2, settings?.enforceOIDC);
         if (enforceOIDC && isAuthRoute && isPost) {
@@ -95,7 +102,7 @@ async function bootstrap({ strapi: strapi2 }) {
   const enforceOIDCConfig = getEnforceOIDCConfig(strapi2);
   if (enforceOIDCConfig !== null) {
     try {
-      const whitelistService2 = strapi2.plugin("strapi-plugin-oidc").service("whitelist");
+      const whitelistService2 = getWhitelistService();
       const settings = await whitelistService2.getSettings();
       if (settings.enforceOIDC !== enforceOIDCConfig) {
         await whitelistService2.setSettings({ ...settings, enforceOIDC: enforceOIDCConfig });
@@ -125,7 +132,7 @@ async function bootstrap({ strapi: strapi2 }) {
       task: async () => {
         try {
           const retentionDays = getRetentionDays();
-          await strapi2.plugin("strapi-plugin-oidc").service("auditLog").cleanup(retentionDays);
+          await getAuditLogService().cleanup(retentionDays);
         } catch (err) {
           strapi2.log.warn("[strapi-plugin-oidc] Audit log cleanup failed:", err.message);
         }
@@ -219,9 +226,14 @@ function getExpiredCookieOptions(strapi2, ctx) {
 function clearAuthCookies(strapi2, ctx) {
   const options2 = getExpiredCookieOptions(strapi2, ctx);
   ctx.cookies.set("strapi_admin_refresh", "", options2);
-  ctx.cookies.set("oidc_authenticated", "", { ...options2, path: "/" });
-  ctx.cookies.set("oidc_access_token", "", { ...options2, path: "/" });
-  ctx.cookies.set("oidc_user_email", "", { ...options2, path: "/" });
+  const rootPathOptions = { ...options2, path: "/" };
+  for (const name of ["oidc_authenticated", "oidc_access_token", "oidc_user_email"]) {
+    ctx.cookies.set(name, "", rootPathOptions);
+  }
+}
+const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function isValidEmail(email) {
+  return EMAIL_REGEX.test(email);
 }
 const errorCodes = {
   TOKEN_EXCHANGE_FAILED: "TOKEN_EXCHANGE_FAILED",
@@ -293,8 +305,6 @@ const en = {
   "whitelist.toggle.enabled": "Enabled",
   "whitelist.toggle.disabled": "Disabled",
   "whitelist.email.placeholder": "Email address",
-  "whitelist.roles.placeholder": "Select specific role(s)",
-  "whitelist.table.roles": "Role(s)",
   "whitelist.table.empty": "No email addresses",
   "whitelist.delete.label": "Delete",
   "page.title.oidc": "OIDC",
@@ -318,7 +328,6 @@ const en = {
   "unsaved.description": "You have unsaved changes that will be lost if you leave. Do you want to continue?",
   "unsaved.confirm": "Leave",
   "unsaved.cancel": "Stay",
-  "whitelist.table.roles.default": "(Default)",
   "auditlog.title": "Audit Logs",
   "auditlog.export": "Download",
   "auditlog.table.timestamp": "Timestamp",
@@ -361,6 +370,53 @@ const userFacingMessages = {
     return en["user.signInError"];
   }
 };
+class OidcError extends Error {
+  kind;
+  cause;
+  constructor(kind, message, cause) {
+    super(message);
+    this.name = "OidcError";
+    this.kind = kind;
+    this.cause = cause;
+  }
+}
+const OIDC_ERROR_DISPATCH = {
+  nonce_mismatch: { action: "nonce_mismatch", code: errorCodes.NONCE_MISMATCH },
+  token_exchange_failed: {
+    action: "token_exchange_failed",
+    code: errorCodes.TOKEN_EXCHANGE_FAILED
+  },
+  id_token_parse_failed: {
+    action: "login_failure",
+    code: errorCodes.ID_TOKEN_PARSE_FAILED,
+    key: "id_token_parse_failed"
+  },
+  userinfo_fetch_failed: {
+    action: "login_failure",
+    code: errorCodes.USERINFO_FETCH_FAILED,
+    key: "userinfo_fetch_failed"
+  },
+  user_creation_failed: {
+    action: "login_failure",
+    code: errorCodes.USER_CREATION_FAILED,
+    key: "user_creation_failed"
+  },
+  whitelist_rejected: {
+    action: "whitelist_rejected",
+    code: errorCodes.WHITELIST_CHECK_FAILED,
+    key: "whitelist_rejected"
+  },
+  invalid_email: {
+    action: "login_failure",
+    code: errorCodes.TOKEN_EXCHANGE_FAILED,
+    key: "sign_in_unknown"
+  },
+  unknown: {
+    action: "login_failure",
+    code: errorCodes.TOKEN_EXCHANGE_FAILED,
+    key: "sign_in_unknown"
+  }
+};
 const REQUIRED_CONFIG_KEYS = [
   "OIDC_CLIENT_ID",
   "OIDC_CLIENT_SECRET",
@@ -373,6 +429,7 @@ const REQUIRED_CONFIG_KEYS = [
   "OIDC_GIVEN_NAME_FIELD",
   "OIDC_AUTHORIZATION_ENDPOINT"
 ];
+const LOGOUT_USERINFO_TIMEOUT_MS = 3e3;
 function configValidation() {
   const config2 = strapi.config.get("plugin::strapi-plugin-oidc");
   const missing = REQUIRED_CONFIG_KEYS.filter((key) => !config2[key]);
@@ -390,7 +447,6 @@ async function oidcSignIn(ctx) {
   const cookieOptions = {
     httpOnly: true,
     maxAge: 6e5,
-    // 10 minutes
     secure: isProduction && ctx.request.secure,
     sameSite: "lax"
   };
@@ -420,7 +476,7 @@ async function exchangeTokenAndFetchUserInfo(config2, params, expectedNonce) {
     }
   });
   if (!response.ok) {
-    throw new Error(errorMessages.TOKEN_EXCHANGE_FAILED);
+    throw new OidcError("token_exchange_failed", errorMessages.TOKEN_EXCHANGE_FAILED);
   }
   const tokenData = await response.json();
   if (tokenData.id_token) {
@@ -428,23 +484,23 @@ async function exchangeTokenAndFetchUserInfo(config2, params, expectedNonce) {
       const payloadB64 = tokenData.id_token.split(".")[1];
       const idTokenPayload = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8"));
       if (idTokenPayload.nonce !== expectedNonce) {
-        throw new Error(errorMessages.NONCE_MISMATCH);
+        throw new OidcError("nonce_mismatch", errorMessages.NONCE_MISMATCH);
       }
     } catch (e) {
-      if (e.message === "Nonce mismatch") throw e;
-      throw new Error(errorMessages.ID_TOKEN_PARSE_FAILED);
+      if (e instanceof OidcError && e.kind === "nonce_mismatch") throw e;
+      throw new OidcError("id_token_parse_failed", errorMessages.ID_TOKEN_PARSE_FAILED, e);
     }
   }
   const userResponse = await fetch(config2.OIDC_USERINFO_ENDPOINT, {
     headers: { Authorization: `Bearer ${tokenData.access_token}` }
   });
   if (!userResponse.ok) {
-    throw new Error(errorMessages.USERINFO_FETCH_FAILED);
+    throw new OidcError("userinfo_fetch_failed", errorMessages.USERINFO_FETCH_FAILED);
   }
   const userInfo = await userResponse.json();
   return { userInfo, accessToken: tokenData.access_token };
 }
-function resolveRolesFromGroups(userInfo, config2, availableRoles) {
+function collectGroupMapRoleNames(userInfo, config2) {
   const rawGroups = userInfo[config2.OIDC_GROUP_FIELD];
   if (!Array.isArray(rawGroups) || rawGroups.length === 0) return [];
   const groups = rawGroups.filter((g) => typeof g === "string");
@@ -455,22 +511,15 @@ function resolveRolesFromGroups(userInfo, config2, availableRoles) {
   } catch {
     return [];
   }
-  const roleIdSet = /* @__PURE__ */ new Set();
+  const roleNameSet = /* @__PURE__ */ new Set();
   for (const group of groups) {
     const roleNames = groupRoleMap[group];
     if (!roleNames) continue;
     for (const name of roleNames) {
-      const match = availableRoles.find((r) => r.name === name);
-      if (match) roleIdSet.add(String(match.id));
+      roleNameSet.add(name);
     }
   }
-  return [...roleIdSet];
-}
-async function resolveRoles(userInfo, config2, roleService2, availableRoles) {
-  const groupRoles = resolveRolesFromGroups(userInfo, config2, availableRoles);
-  if (groupRoles.length > 0) return { roles: groupRoles, fromGroupMapping: true };
-  const oidcRoles = await roleService2.oidcRoles();
-  return { roles: oidcRoles?.roles || [], fromGroupMapping: false };
+  return [...roleNameSet];
 }
 async function registerNewUser(oauthService2, email, userResponseData, config2, ctx, roles2) {
   const defaultLocale = oauthService2.localeFindByHeader(
@@ -488,10 +537,7 @@ async function registerNewUser(oauthService2, email, userResponseData, config2,
 }
 function rolesChanged(current, next) {
   if (current.size !== next.size) return true;
-  for (const id of next) {
-    if (!current.has(id)) return true;
-  }
-  return false;
+  return [...next].some((id) => !current.has(id));
 }
 async function updateUserRoles(user, currentRoleIds, newRoleIds) {
   try {
@@ -517,27 +563,51 @@ async function updateUserRoles(user, currentRoleIds, newRoleIds) {
 async function handleUserAuthentication(userService, oauthService2, roleService2, whitelistService2, userResponseData, config2, ctx) {
   const rawEmail = String(userResponseData.email ?? "");
   const email = rawEmail.toLowerCase();
-  if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
-    throw new Error(errorMessages.INVALID_EMAIL);
+  if (!email || !isValidEmail(email)) {
+    throw new OidcError("invalid_email", errorMessages.INVALID_EMAIL);
   }
   await whitelistService2.checkWhitelistForEmail(email);
-  const allRoles = await strapi.db.query("admin::role").findMany();
-  const { roles: roles2, fromGroupMapping } = await resolveRoles(
-    userResponseData,
-    config2,
-    roleService2,
-    allRoles
-  );
-  const resolvedRoleNames = allRoles.filter((r) => roles2.includes(String(r.id))).map((r) => r.name);
+  const candidateNames = collectGroupMapRoleNames(userResponseData, config2);
+  let roles2 = [];
+  let fromGroupMapping = false;
+  let resolvedRoleNames = [];
+  if (candidateNames.length > 0) {
+    const matchedRoles = await strapi.db.query("admin::role").findMany({
+      where: { name: { $in: candidateNames } },
+      select: ["id", "name"]
+    });
+    const nameToId = new Map(matchedRoles.map((r) => [r.name, String(r.id)]));
+    for (const name of candidateNames) {
+      const id = nameToId.get(name);
+      if (id) roles2.push(id);
+    }
+    resolvedRoleNames = matchedRoles.map((r) => r.name);
+    fromGroupMapping = true;
+  } else {
+    const oidcRolesResult = await roleService2.oidcRoles();
+    roles2 = oidcRolesResult?.roles || [];
+    if (roles2.length > 0) {
+      const oidcRoleRecords = await strapi.db.query("admin::role").findMany({
+        where: { id: { $in: roles2.map(Number) } },
+        select: ["id", "name"]
+      });
+      resolvedRoleNames = oidcRoleRecords.map((r) => r.name);
+    }
+  }
   let userCreated = false;
   let rolesUpdated = false;
   let user = await userService.findOneByEmail(email, ["roles"]);
   if (!user) {
-    user = await registerNewUser(oauthService2, email, userResponseData, config2, ctx, roles2);
+    try {
+      user = await registerNewUser(oauthService2, email, userResponseData, config2, ctx, roles2);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      throw new OidcError("user_creation_failed", msg, e);
+    }
     userCreated = true;
     rolesUpdated = true;
   } else if (fromGroupMapping && roles2.length > 0) {
-    const currentRoleIds = new Set(user.roles.map((r) => String(r.id)));
+    const currentRoleIds = new Set((user.roles ?? []).map((r) => String(r.id)));
     if (rolesChanged(currentRoleIds, new Set(roles2))) {
       await updateUserRoles(user, currentRoleIds, roles2);
       rolesUpdated = true;
@@ -547,55 +617,30 @@ async function handleUserAuthentication(userService, oauthService2, roleService2
   oauthService2.triggerSignInSuccess(user);
   return { activateUser: user, jwtToken, userCreated, rolesUpdated, resolvedRoleNames };
 }
-function classifyOidcError(msg, userInfo) {
-  if (msg.includes("whitelist")) {
-    return {
-      action: "whitelist_rejected",
-      code: errorCodes.WHITELIST_CHECK_FAILED,
-      key: "whitelist_rejected"
-    };
-  }
-  if (msg === "Nonce mismatch")
-    return { action: "nonce_mismatch", code: errorCodes.NONCE_MISMATCH };
-  if (msg === "Token exchange failed")
-    return { action: "token_exchange_failed", code: errorCodes.TOKEN_EXCHANGE_FAILED };
-  if (msg === "Failed to fetch user info") {
-    return {
-      action: "login_failure",
-      code: errorCodes.USERINFO_FETCH_FAILED,
-      key: "userinfo_fetch_failed"
-    };
-  }
-  if (msg === "Failed to parse ID token") {
-    return {
-      action: "login_failure",
-      code: errorCodes.ID_TOKEN_PARSE_FAILED,
-      key: "id_token_parse_failed",
-      params: { error: msg }
-    };
-  }
-  if (msg === "User creation failed" || msg.includes("createUser")) {
-    return {
-      action: "login_failure",
-      code: errorCodes.USER_CREATION_FAILED,
-      key: "user_creation_failed",
-      params: userInfo?.email ? { email: userInfo.email, error: msg } : void 0
-    };
+function classifyOidcError(e, userInfo) {
+  const kind = e instanceof OidcError ? e.kind : "unknown";
+  const dispatch = OIDC_ERROR_DISPATCH[kind];
+  const msg = e instanceof Error ? e.message : String(e);
+  let params;
+  if (kind === "id_token_parse_failed" || kind === "unknown") {
+    params = { error: msg };
+  } else if (kind === "user_creation_failed" && userInfo?.email) {
+    params = { email: userInfo.email, error: msg };
   }
   return {
-    action: "login_failure",
-    code: errorCodes.TOKEN_EXCHANGE_FAILED,
-    key: "sign_in_unknown",
-    params: { error: msg || "unknown" }
+    action: dispatch.action,
+    code: dispatch.code,
+    key: dispatch.key,
+    params
   };
 }
 async function oidcSignInCallback(ctx) {
   const config2 = configValidation();
-  const userService = strapi.service("admin::user");
-  const oauthService2 = strapi.plugin("strapi-plugin-oidc").service("oauth");
-  const roleService2 = strapi.plugin("strapi-plugin-oidc").service("role");
-  const whitelistService2 = strapi.plugin("strapi-plugin-oidc").service("whitelist");
-  const auditLog2 = strapi.plugin("strapi-plugin-oidc").service("auditLog");
+  const userService = getAdminUserService();
+  const oauthService2 = getOauthService();
+  const roleService2 = getRoleService();
+  const whitelistService2 = getWhitelistService();
+  const auditLog2 = getAuditLogService();
   if (!ctx.query.code) {
     await auditLog2.log({ action: "missing_code", ip: ctx.ip });
     return ctx.send(oauthService2.renderSignUpError(userFacingMessages.missing_code));
@@ -627,7 +672,6 @@ async function oidcSignInCallback(ctx) {
     ctx.cookies.set("oidc_access_token", accessToken, {
       httpOnly: true,
       maxAge: 3e5,
-      // 5 minutes — matches typical provider access token lifetime
       secure: isProduction && ctx.request.secure,
       sameSite: "lax"
     });
@@ -668,19 +712,18 @@ async function oidcSignInCallback(ctx) {
     ctx.set("Content-Security-Policy", `script-src 'nonce-${nonce}'`);
     ctx.send(html);
   } catch (e) {
-    const msg = e.message ?? "";
-    const errorInfo = classifyOidcError(msg, userInfo);
+    const errorInfo = classifyOidcError(e, userInfo);
     await auditLog2.log({
       action: errorInfo.action,
       email: userInfo?.email,
       ip: ctx.ip,
       detailsKey: errorInfo.action,
-      detailsParams: errorInfo.action === "login_failure" ? { message: msg } : void 0
+      detailsParams: errorInfo.action === "login_failure" ? { message: e instanceof Error ? e.message : String(e) } : void 0
     });
     strapi.log.error({
       code: errorInfo.code,
       phase: "oidc_callback",
-      message: msg || "Unknown sign-in error",
+      message: e instanceof Error ? e.message : "Unknown sign-in error",
       detail: errorInfo.key ? getErrorDetail(errorInfo.key, errorInfo.params) : void 0,
       email: userInfo?.email
     });
@@ -689,7 +732,7 @@ async function oidcSignInCallback(ctx) {
 }
 async function logout(ctx) {
   const config2 = strapi.config.get("plugin::strapi-plugin-oidc");
-  const auditLog2 = strapi.plugin("strapi-plugin-oidc").service("auditLog");
+  const auditLog2 = getAuditLogService();
   const logoutUrl = config2.OIDC_END_SESSION_ENDPOINT;
   const adminPanelUrl = strapi.config.get("admin.url", "/admin");
   const isOidcSession = !!ctx.cookies.get("oidc_authenticated");
@@ -699,7 +742,8 @@ async function logout(ctx) {
   if (logoutUrl && isOidcSession && accessToken) {
     try {
       const response = await fetch(config2.OIDC_USERINFO_ENDPOINT, {
-        headers: { Authorization: `Bearer ${accessToken}` }
+        headers: { Authorization: `Bearer ${accessToken}` },
+        signal: AbortSignal.timeout(LOGOUT_USERINFO_TIMEOUT_MS)
       });
       if (response.ok) {
         if (userEmail)
@@ -730,7 +774,7 @@ const oidc = {
   logout
 };
 async function find$1(ctx) {
-  const roleService2 = strapi.plugin("strapi-plugin-oidc").service("role");
+  const roleService2 = getRoleService();
   const roles2 = await roleService2.find();
   const oidcConstants = roleService2.getOidcRoles();
   for (const oidc2 of oidcConstants) {
@@ -744,7 +788,7 @@ async function find$1(ctx) {
 async function update(ctx) {
   try {
     const { roles: roles2 } = ctx.request.body;
-    const roleService2 = strapi.plugin("strapi-plugin-oidc").service("role");
+    const roleService2 = getRoleService();
     await roleService2.update(roles2);
     ctx.send({}, 204);
   } catch (e) {
@@ -765,8 +809,17 @@ function formatDatetimeForFilename(date) {
   const seconds = String(date.getSeconds()).padStart(2, "0");
   return `${year}${month}${day}_${hours}${minutes}${seconds}`;
 }
-function getWhitelistService() {
-  return strapi.plugin("strapi-plugin-oidc").service("whitelist");
+function setJsonAttachmentHeaders(ctx, basename) {
+  const datetime = formatDatetimeForFilename(/* @__PURE__ */ new Date());
+  ctx.set("Content-Type", "application/json");
+  ctx.set("Content-Disposition", `attachment; filename="${basename}-${datetime}.json"`);
+}
+function setNdjsonAttachmentHeaders(ctx, basename) {
+  const datetime = formatDatetimeForFilename(/* @__PURE__ */ new Date());
+  ctx.set("Content-Type", "application/x-ndjson; charset=utf-8");
+  ctx.set("Content-Disposition", `attachment; filename="${basename}-${datetime}.ndjson"`);
+  ctx.set("Cache-Control", "no-store");
+  ctx.set("X-Content-Type-Options", "nosniff");
 }
 async function info(ctx) {
   const whitelistService2 = getWhitelistService();
@@ -781,8 +834,9 @@ async function info(ctx) {
   };
 }
 async function updateSettings(ctx) {
-  const { useWhitelist } = ctx.request.body;
-  let { enforceOIDC } = ctx.request.body;
+  const body = ctx.request.body;
+  const { useWhitelist } = body;
+  let { enforceOIDC } = body;
   const whitelistService2 = getWhitelistService();
   if (useWhitelist && enforceOIDC) {
     const users = await whitelistService2.getUsers();
@@ -811,11 +865,9 @@ async function register(ctx) {
   const rawEmails = Array.isArray(email) ? email : email.split(",");
   const emailList = rawEmails.map((e) => String(e).trim().toLowerCase()).filter(Boolean);
   const whitelistService2 = getWhitelistService();
-  let matchedExistingUsersCount = 0;
+  const matchedExistingUsersCount = await whitelistService2.countAdminUsersByEmails(emailList);
   for (const singleEmail of emailList) {
-    const existingUser = await strapi.query("admin::user").findOne({ where: { email: singleEmail } });
-    if (existingUser) matchedExistingUsersCount++;
-    const alreadyWhitelisted = await strapi.query("plugin::strapi-plugin-oidc.whitelists").findOne({ where: { email: singleEmail } });
+    const alreadyWhitelisted = await whitelistService2.hasUser(singleEmail);
     if (!alreadyWhitelisted) {
       await whitelistService2.registerUser(singleEmail);
     }
@@ -829,13 +881,12 @@ async function removeEmail(ctx) {
   ctx.body = {};
 }
 async function deleteAll(ctx) {
-  await strapi.query("plugin::strapi-plugin-oidc.whitelists").deleteMany({});
+  const whitelistService2 = getWhitelistService();
+  await whitelistService2.deleteAllUsers();
   ctx.body = {};
 }
 async function exportWhitelist(ctx) {
-  const datetime = formatDatetimeForFilename(/* @__PURE__ */ new Date());
-  ctx.set("Content-Type", "application/json");
-  ctx.set("Content-Disposition", `attachment; filename="strapi-oidc-whitelist-${datetime}.json"`);
+  setJsonAttachmentHeaders(ctx, "strapi-oidc-whitelist");
   const whitelistService2 = getWhitelistService();
   const users = await whitelistService2.getUsers();
   ctx.body = users.map((u) => ({ email: u.email }));
@@ -847,7 +898,7 @@ async function importUsers(ctx) {
     ctx.body = { error: "Expected { users: [{email}] }" };
     return;
   }
-  const normalized = users.filter((u) => u?.email).map((u) => String(u.email).trim().toLowerCase()).filter((email) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email));
+  const normalized = users.filter((u) => u?.email).map((u) => String(u.email).trim().toLowerCase()).filter(isValidEmail);
   const deduped = [...new Set(normalized)];
   const whitelistService2 = getWhitelistService();
   const existing = await whitelistService2.getUsers();
@@ -862,7 +913,7 @@ async function importUsers(ctx) {
 }
 async function syncUsers(ctx) {
   const { users: rawUsers } = ctx.request.body;
-  const emails = rawUsers.map((u) => String(u.email).toLowerCase()).filter((e) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e));
+  const emails = rawUsers.map((u) => String(u.email).toLowerCase()).filter(isValidEmail);
   const whitelistService2 = getWhitelistService();
   const currentUsers = await whitelistService2.getUsers();
   const syncEmailSet = new Set(emails);
@@ -890,44 +941,49 @@ const whitelist = {
   importUsers,
   exportWhitelist
 };
-function getAuditLogService() {
-  return strapi.plugin("strapi-plugin-oidc").service("auditLog");
-}
-async function find(ctx) {
-  const page = Math.max(1, Number(ctx.query.page) || 1);
-  const pageSize = Math.min(100, Math.max(1, Number(ctx.query.pageSize) || 25));
-  ctx.body = await getAuditLogService().find({ page, pageSize });
-}
-async function exportLogs(ctx) {
-  const datetime = formatDatetimeForFilename(/* @__PURE__ */ new Date());
-  ctx.set("Content-Type", "application/json");
-  ctx.set("Content-Disposition", `attachment; filename="strapi-oidc-audit-log-${datetime}.json"`);
-  const service = getAuditLogService();
-  const PAGE_SIZE = 1e3;
-  const allRows = [];
+const EXPORT_PAGE_SIZE = 500;
+async function* ndjsonRowStream(service) {
   let page = 1;
   while (true) {
-    const { results } = await service.find({ page, pageSize: PAGE_SIZE });
+    const { results } = await service.find({ page, pageSize: EXPORT_PAGE_SIZE });
+    if (results.length === 0) return;
+    let chunk = "";
     for (const row of results) {
-      allRows.push({
-        id: row.id,
-        createdAt: row.createdAt,
+      chunk += JSON.stringify({
+        datetime: row.createdAt,
         action: row.action,
         email: row.email ?? null,
         ip: row.ip ?? null,
         details: row.details
-      });
+      }) + "\n";
     }
-    if (results.length < PAGE_SIZE) break;
+    yield Buffer.from(chunk, "utf8");
+    if (results.length < EXPORT_PAGE_SIZE) return;
     page++;
   }
-  ctx.body = allRows.map((row) => ({
-    datetime: row.createdAt,
-    action: row.action,
-    email: row.email,
-    ip: row.ip,
-    details: row.details
-  }));
+}
+function errorAwareNdjsonStream(service) {
+  const gen = ndjsonRowStream(service);
+  const readable = node_stream.Readable.from(gen);
+  readable.on("error", (err) => {
+    strapi$1.log.error({ phase: "audit_log_export", err }, "NDJSON export stream failed");
+  });
+  return readable;
+}
+let strapi$1;
+function find(ctx) {
+  strapi$1 = ctx.strapi;
+  const page = Math.max(1, Number(ctx.query.page) || 1);
+  const pageSize = Math.min(100, Math.max(1, Number(ctx.query.pageSize) || 25));
+  return getAuditLogService().find({ page, pageSize }).then((result) => {
+    ctx.body = result;
+  });
+}
+async function exportLogs(ctx) {
+  strapi$1 = ctx.strapi;
+  setNdjsonAttachmentHeaders(ctx, "strapi-oidc-audit-log");
+  const service = getAuditLogService();
+  ctx.body = errorAwareNdjsonStream(service);
 }
 async function clearAll(ctx) {
   await getAuditLogService().clearAll();
@@ -1162,7 +1218,7 @@ function renderHtmlTemplate(title, content) {
       --icon-color: #d02b20;
       --success-bg: #eafbe7;
       --success-color: #328048;
-      --shadow: 0 1px 4px rgba(33, 33, 52, 0.1);
+      --shadow: 0 1px 4 rgba(33, 33, 52, 0.1);
     }
     @media (prefers-color-scheme: dark) {
       :root {
@@ -1177,7 +1233,7 @@ function renderHtmlTemplate(title, content) {
         --icon-color: #f23628;
         --success-bg: #1c3523;
         --success-color: #55ca76;
-        --shadow: 0 1px 4px rgba(0, 0, 0, 0.5);
+        --shadow: 0 1px 4 rgba(0, 0, 0, 0.5);
       }
     }
     body {
@@ -1262,14 +1318,11 @@ function oauthService({ strapi: strapi2 }) {
   return {
     async createUser(email, lastname, firstname, locale, roles2 = []) {
       const userService = strapi2.service("admin::user");
-      if (/[A-Z]/.test(email)) {
-        const dbUser = await userService.findOneByEmail(email.toLocaleLowerCase());
-        if (dbUser) return dbUser;
-      }
+      const normalizedEmail = email.toLowerCase();
       const createdUser = await userService.create({
         firstname: firstname || "unset",
         lastname: lastname || "",
-        email: email.toLocaleLowerCase(),
+        email: normalizedEmail,
         roles: roles2,
         preferedLanguage: locale
       });
@@ -1300,35 +1353,35 @@ function oauthService({ strapi: strapi2 }) {
     },
     async triggerWebHook(user) {
       let ENTRY_CREATE;
-      const webhookStore = strapi2.serviceMap.get("webhookStore");
-      const eventHub = strapi2.serviceMap.get("eventHub");
+      const webhookStore = strapi2.serviceMap?.get("webhookStore");
+      const eventHub = strapi2.serviceMap?.get("eventHub");
       if (webhookStore) {
         ENTRY_CREATE = webhookStore.allowedEvents.get("ENTRY_CREATE");
       }
       const modelDef = strapi2.getModel("admin::user");
       const sanitizedEntity = await strapiUtils__default.default.sanitize.sanitizers.defaultSanitizeOutput(
-        {
-          schema: modelDef,
-          getModel: (uid2) => strapi2.getModel(uid2)
-        },
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        { schema: modelDef, getModel: (uid2) => strapi2.getModel(uid2) },
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
         user
       );
-      eventHub.emit(ENTRY_CREATE, {
+      eventHub?.emit(ENTRY_CREATE ?? "entry.create", {
         model: modelDef.modelName,
         entry: sanitizedEntity
       });
     },
     triggerSignInSuccess(user) {
-      delete user.password;
-      const eventHub = strapi2.serviceMap.get("eventHub");
-      eventHub.emit("admin.auth.success", {
-        user,
+      const userCopy = { ...user };
+      delete userCopy.password;
+      const eventHub = strapi2.serviceMap?.get("eventHub");
+      eventHub?.emit("admin.auth.success", {
+        user: userCopy,
         provider: "strapi-plugin-oidc"
       });
     },
     renderSignUpSuccess(jwtToken, user, nonce) {
       const config2 = strapi2.config.get("plugin::strapi-plugin-oidc");
-      const isRememberMe = !!config2["REMEMBER_ME"];
+      const isRememberMe = !!config2?.REMEMBER_ME;
       const content = `
     <noscript>
       <div class="card">
@@ -1379,12 +1432,15 @@ function oauthService({ strapi: strapi2 }) {
       const userId = String(user.id);
       const deviceId = node_crypto.randomUUID();
       const config2 = strapi2.config.get("plugin::strapi-plugin-oidc");
-      const rememberMe = !!config2["REMEMBER_ME"];
-      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(
-        "admin"
-      ).generateRefreshToken(userId, deviceId, {
-        type: rememberMe ? "refresh" : "session"
-      });
+      const rememberMe = !!config2?.REMEMBER_ME;
+      const smAdmin = sessionManager("admin");
+      const { token: refreshToken, absoluteExpiresAt } = await smAdmin.generateRefreshToken(
+        userId,
+        deviceId,
+        {
+          type: rememberMe ? "refresh" : "session"
+        }
+      );
       const isProduction = strapi2.config.get("environment") === "production";
       const domain = strapi2.config.get("admin.auth.cookie.domain") || strapi2.config.get("admin.auth.domain");
       const path = strapi2.config.get("admin.auth.cookie.path", "/admin");
@@ -1401,7 +1457,6 @@ function oauthService({ strapi: strapi2 }) {
         const idleLifespanSec = strapi2.config.get(
           "admin.auth.sessions.idleRefreshTokenLifespan",
           1209600
-          // 14 days — Strapi default
         );
         const idleMs = idleLifespanSec * 1e3;
         const absoluteMs = new Date(absoluteExpiresAt).getTime() - Date.now();
@@ -1411,7 +1466,7 @@ function oauthService({ strapi: strapi2 }) {
       }
       ctx.cookies.set("strapi_admin_refresh", refreshToken, cookieOptions);
       ctx.cookies.set("oidc_authenticated", "1", { ...cookieOptions, path: "/" });
-      const accessResult = await sessionManager("admin").generateAccessToken(refreshToken);
+      const accessResult = await smAdmin.generateAccessToken(refreshToken);
       if ("error" in accessResult) {
         throw new Error(accessResult.error);
       }
@@ -1502,8 +1557,23 @@ function whitelistService({ strapi: strapi2 }) {
       const result = await getWhitelistQuery().findOne({
         where: { email }
       });
-      if (!result) throw new Error(errorMessages.WHITELIST_NOT_PRESENT);
+      if (!result) throw new OidcError("whitelist_rejected", errorMessages.WHITELIST_NOT_PRESENT);
       return result;
+    },
+    async hasUser(email) {
+      const row = await getWhitelistQuery().findOne({ where: { email }, select: ["id"] });
+      return !!row;
+    },
+    async deleteAllUsers() {
+      await getWhitelistQuery().deleteMany({});
+    },
+    async countAdminUsersByEmails(emails) {
+      if (emails.length === 0) return 0;
+      const rows = await strapi2.query("admin::user").findMany({
+        where: { email: { $in: emails } },
+        select: ["id"]
+      });
+      return rows.length;
     }
   };
 }
@@ -1538,7 +1608,10 @@ function auditLogService({ strapi: strapi2 }) {
         });
       }
     },
-    async find({ page = 1, pageSize = 25 } = {}) {
+    async find({
+      page = 1,
+      pageSize = 25
+    } = {}) {
       const result = await strapi2.db.query("plugin::strapi-plugin-oidc.audit-log").findPage({
         sort: { createdAt: "desc" },
         page,