strapi-plugin-oidc 1.7.0 → 1.7.2

package/dist/admin/{index-DB7zjuHj.js → index-B0piQv3P.js}

@@ -166,7 +166,7 @@ const index = {
           defaultMessage: "Configuration"
         },
         Component: async () => {
-          return await Promise.resolve().then(() => require("./index-C2KZ4QxC.js"));
+          return await Promise.resolve().then(() => require("./index-hjzLEp0H.js"));
         },
         permissions: [{ action: "plugin::strapi-plugin-oidc.read", subject: null }]
       }

package/dist/admin/{index-UvfJxIgI.mjs → index-BJqQjQee.mjs}

@@ -5,7 +5,7 @@ import { useState, useRef, useId, useEffect, useCallback, useReducer, useMemo, m
 import { Typography, Flex, Box, MultiSelect, MultiSelectOption, Dialog, Button, Table, Pagination, PreviousLink, NextLink, PageLink, Field, Divider, Thead, Tr, Th, Tbody, Td, IconButton, Tooltip, Alert } from "@strapi/design-system";
 import { Cross, WarningCircle, Plus, Download, Upload, Trash, Calendar, Mail, Information } from "@strapi/icons";
 import { useIntl } from "react-intl";
-import { g as getTrad } from "./index-D_ZKgByO.mjs";
+import { g as getTrad } from "./index-BkJB6R7y.mjs";
 import styled from "styled-components";
 import { Filter, ClipboardList, Server } from "lucide-react";
 function Role({ oidcRoles, roles, onChangeRole }) {
@@ -80,7 +80,7 @@ const TagInputWrapper = styled(Box)`
     box-shadow: 0 0 0 2px ${({ theme }) => theme.colors.primary100};
   }
 `;
-const TagStyledInput = styled.input`
+const TagStyledInput = styled.input.attrs({ autocomplete: "off" })`
   border: none;
   background: transparent;
   outline: none;

package/dist/admin/{index-D_ZKgByO.mjs → index-BkJB6R7y.mjs}

@@ -165,7 +165,7 @@ const index = {
           defaultMessage: "Configuration"
         },
         Component: async () => {
-          return await import("./index-UvfJxIgI.mjs");
+          return await import("./index-BJqQjQee.mjs");
         },
         permissions: [{ action: "plugin::strapi-plugin-oidc.read", subject: null }]
       }

package/dist/admin/{index-C2KZ4QxC.js → index-hjzLEp0H.js}

@@ -7,7 +7,7 @@ const react = require("react");
 const designSystem = require("@strapi/design-system");
 const icons = require("@strapi/icons");
 const reactIntl = require("react-intl");
-const index = require("./index-DB7zjuHj.js");
+const index = require("./index-B0piQv3P.js");
 const styled = require("styled-components");
 const lucideReact = require("lucide-react");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
@@ -84,7 +84,7 @@ const TagInputWrapper = styled__default.default(designSystem.Box)`
     box-shadow: 0 0 0 2px ${({ theme }) => theme.colors.primary100};
   }
 `;
-const TagStyledInput = styled__default.default.input`
+const TagStyledInput = styled__default.default.input.attrs({ autocomplete: "off" })`
   border: none;
   background: transparent;
   outline: none;

package/dist/admin/index.js

@@ -1,4 +1,4 @@
 "use strict";
 Object.defineProperties(exports, { __esModule: { value: true }, [Symbol.toStringTag]: { value: "Module" } });
-const index = require("./index-DB7zjuHj.js");
+const index = require("./index-B0piQv3P.js");
 exports.default = index.index;

package/dist/admin/index.mjs

@@ -1,4 +1,4 @@
-import { i } from "./index-D_ZKgByO.mjs";
+import { i } from "./index-BkJB6R7y.mjs";
 export {
   i as default
 };

package/dist/server/index.js

@@ -483,6 +483,21 @@ const OIDC_ERROR_DISPATCH = {
     key: "sign_in_unknown"
   }
 };
+function getClientIp(ctx) {
+  const cfConnectingIp = ctx.get("CF-Connecting-IP");
+  if (cfConnectingIp) {
+    return cfConnectingIp.split(",")[0].trim();
+  }
+  const forwardedFor = ctx.get("X-Forwarded-For");
+  if (forwardedFor) {
+    return forwardedFor.split(",")[0].trim();
+  }
+  const realIp = ctx.get("X-Real-IP");
+  if (realIp) {
+    return realIp.trim();
+  }
+  return ctx.ip;
+}
 const REQUIRED_CONFIG_KEYS = [
   "OIDC_CLIENT_ID",
   "OIDC_CLIENT_SECRET",
@@ -752,7 +767,7 @@ async function logSuccessfulAuth(auditLog2, ctx, user, userCreated, rolesUpdated
     auditLog2.log({
       action: "login_success",
       email: user.email,
-      ip: ctx.ip,
+      ip: getClientIp(ctx),
       detailsKey: rolesUpdated ? "roles_updated" : void 0,
       detailsParams: rolesUpdated ? { roles: roles2 } : void 0
     })
@@ -762,7 +777,7 @@ async function logSuccessfulAuth(auditLog2, ctx, user, userCreated, rolesUpdated
       auditLog2.log({
         action: "user_created",
         email: user.email,
-        ip: ctx.ip,
+        ip: getClientIp(ctx),
         detailsKey: "user_created",
         detailsParams: { roles: roles2 }
       })
@@ -776,7 +791,7 @@ async function handleCallbackError(e, userInfo, auditLog2, oauthService2, ctx) {
   await auditLog2.log({
     action: errorInfo.action,
     email: userInfo?.email,
-    ip: ctx.ip,
+    ip: getClientIp(ctx),
     detailsKey: errorInfo.action,
     detailsParams: errorInfo.action === "login_failure" ? { message } : void 0
   });
@@ -796,14 +811,14 @@ async function oidcSignInCallback(ctx) {
   const auditLog2 = getAuditLogService();
   const locale = negotiateLocale(ctx.request.headers["accept-language"]);
   if (!ctx.query.code) {
-    await auditLog2.log({ action: "missing_code", ip: ctx.ip });
+    await auditLog2.log({ action: "missing_code", ip: getClientIp(ctx) });
     return ctx.send(
       oauthService2.renderSignUpError(userFacingMessages(locale).missing_code, locale)
     );
   }
   const { oidcState, codeVerifier, oidcNonce } = readAndClearPkceCookies(ctx);
   if (!ctx.query.state || ctx.query.state !== oidcState) {
-    await auditLog2.log({ action: "state_mismatch", ip: ctx.ip });
+    await auditLog2.log({ action: "state_mismatch", ip: getClientIp(ctx) });
     return ctx.send(
       oauthService2.renderSignUpError(userFacingMessages(locale).invalid_state, locale)
     );
@@ -882,7 +897,7 @@ async function logout(ctx) {
   if (!isOidcSession) {
     return ctx.redirect(loginUrl);
   }
-  const logAudit = (action) => userEmail ? auditLog2.log({ action, email: userEmail, ip: ctx.ip }) : Promise.resolve();
+  const logAudit = (action) => userEmail ? auditLog2.log({ action, email: userEmail, ip: getClientIp(ctx) }) : Promise.resolve();
   if (logoutUrl && accessToken) {
     const active = await isProviderSessionActive(config2.OIDC_USERINFO_ENDPOINT, accessToken);
     if (active) {
@@ -1277,7 +1292,7 @@ const rateLimitMap = /* @__PURE__ */ new Map();
 const RATE_LIMIT_WINDOW = 6e4;
 const MAX_REQUESTS = 1e3;
 function getRateLimitKey(ctx) {
-  const ip = ctx.request.ip;
+  const ip = getClientIp(ctx);
   const ua = ctx.request.header["user-agent"] ?? "";
   const uaHash = node_crypto.createHash("sha256").update(ua).digest("hex").slice(0, 16);
   return `${ip}:${uaHash}`;

package/dist/server/index.mjs

@@ -477,6 +477,21 @@ const OIDC_ERROR_DISPATCH = {
     key: "sign_in_unknown"
   }
 };
+function getClientIp(ctx) {
+  const cfConnectingIp = ctx.get("CF-Connecting-IP");
+  if (cfConnectingIp) {
+    return cfConnectingIp.split(",")[0].trim();
+  }
+  const forwardedFor = ctx.get("X-Forwarded-For");
+  if (forwardedFor) {
+    return forwardedFor.split(",")[0].trim();
+  }
+  const realIp = ctx.get("X-Real-IP");
+  if (realIp) {
+    return realIp.trim();
+  }
+  return ctx.ip;
+}
 const REQUIRED_CONFIG_KEYS = [
   "OIDC_CLIENT_ID",
   "OIDC_CLIENT_SECRET",
@@ -746,7 +761,7 @@ async function logSuccessfulAuth(auditLog2, ctx, user, userCreated, rolesUpdated
     auditLog2.log({
       action: "login_success",
       email: user.email,
-      ip: ctx.ip,
+      ip: getClientIp(ctx),
       detailsKey: rolesUpdated ? "roles_updated" : void 0,
       detailsParams: rolesUpdated ? { roles: roles2 } : void 0
     })
@@ -756,7 +771,7 @@ async function logSuccessfulAuth(auditLog2, ctx, user, userCreated, rolesUpdated
       auditLog2.log({
         action: "user_created",
         email: user.email,
-        ip: ctx.ip,
+        ip: getClientIp(ctx),
         detailsKey: "user_created",
         detailsParams: { roles: roles2 }
       })
@@ -770,7 +785,7 @@ async function handleCallbackError(e, userInfo, auditLog2, oauthService2, ctx) {
   await auditLog2.log({
     action: errorInfo.action,
     email: userInfo?.email,
-    ip: ctx.ip,
+    ip: getClientIp(ctx),
     detailsKey: errorInfo.action,
     detailsParams: errorInfo.action === "login_failure" ? { message } : void 0
   });
@@ -790,14 +805,14 @@ async function oidcSignInCallback(ctx) {
   const auditLog2 = getAuditLogService();
   const locale = negotiateLocale(ctx.request.headers["accept-language"]);
   if (!ctx.query.code) {
-    await auditLog2.log({ action: "missing_code", ip: ctx.ip });
+    await auditLog2.log({ action: "missing_code", ip: getClientIp(ctx) });
     return ctx.send(
       oauthService2.renderSignUpError(userFacingMessages(locale).missing_code, locale)
     );
   }
   const { oidcState, codeVerifier, oidcNonce } = readAndClearPkceCookies(ctx);
   if (!ctx.query.state || ctx.query.state !== oidcState) {
-    await auditLog2.log({ action: "state_mismatch", ip: ctx.ip });
+    await auditLog2.log({ action: "state_mismatch", ip: getClientIp(ctx) });
     return ctx.send(
       oauthService2.renderSignUpError(userFacingMessages(locale).invalid_state, locale)
     );
@@ -876,7 +891,7 @@ async function logout(ctx) {
   if (!isOidcSession) {
     return ctx.redirect(loginUrl);
   }
-  const logAudit = (action) => userEmail ? auditLog2.log({ action, email: userEmail, ip: ctx.ip }) : Promise.resolve();
+  const logAudit = (action) => userEmail ? auditLog2.log({ action, email: userEmail, ip: getClientIp(ctx) }) : Promise.resolve();
   if (logoutUrl && accessToken) {
     const active = await isProviderSessionActive(config2.OIDC_USERINFO_ENDPOINT, accessToken);
     if (active) {
@@ -1271,7 +1286,7 @@ const rateLimitMap = /* @__PURE__ */ new Map();
 const RATE_LIMIT_WINDOW = 6e4;
 const MAX_REQUESTS = 1e3;
 function getRateLimitKey(ctx) {
-  const ip = ctx.request.ip;
+  const ip = getClientIp(ctx);
   const ua = ctx.request.header["user-agent"] ?? "";
   const uaHash = createHash("sha256").update(ua).digest("hex").slice(0, 16);
   return `${ip}:${uaHash}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "strapi-plugin-oidc",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "description": "A Strapi plugin that provides OpenID Connect (OIDC) authentication functionality for the Strapi Admin Panel.",
   "strapi": {
     "displayName": "OIDC Plugin",