strapi-plugin-oidc 1.8.0 → 1.8.1

package/dist/admin/{index-8YTLPV3h.mjs → index-BqWd-Iiq.mjs}

@@ -2,10 +2,10 @@ import { jsxs, Fragment, jsx } from "react/jsx-runtime";
 import { useBlocker, Routes, Route } from "react-router-dom";
 import { useNotification, useFetchClient, Page, Layouts } from "@strapi/strapi/admin";
 import { useState, useRef, useId, useEffect, useCallback, useReducer, useMemo, memo } from "react";
-import { Typography, Flex, Box, MultiSelect, MultiSelectOption, Button, Dialog, Table, Pagination, PreviousLink, NextLink, PageLink, Field, Divider, Thead, Tr, Th, Tbody, Td, IconButton, Tooltip, Alert } from "@strapi/design-system";
+import { Typography, Flex, Box, MultiSelect, MultiSelectOption, Button, Dialog, Table, Pagination, PreviousLink, NextLink, PageLink, Field, Divider, Thead, Tr, Th, Tbody, Td, IconButton, Loader, Tooltip, Alert } from "@strapi/design-system";
 import { Cross, WarningCircle, Plus, Download, Upload, Trash, Calendar, Mail, Information } from "@strapi/icons";
 import { useIntl } from "react-intl";
-import { g as getTrad } from "./index-B-K4X_N9.mjs";
+import { g as getTrad } from "./index-Bb9-aYb4.mjs";
 import styled from "styled-components";
 import { Filter, ClipboardList, Server } from "lucide-react";
 function Role({ oidcRoles, roles, onChangeRole }) {
@@ -1014,7 +1014,7 @@ function Whitelist({
           /* @__PURE__ */ jsx(Th, { children: formatMessage(getTrad("whitelist.table.created")) }),
           /* @__PURE__ */ jsx(Th, { style: { paddingRight: 0 }, children: " " })
         ] }) }),
-        /* @__PURE__ */ jsx(Tbody, { children: users.length === 0 ? /* @__PURE__ */ jsx(Tr, { children: /* @__PURE__ */ jsx(Td, { colSpan: 4, children: /* @__PURE__ */ jsx(Flex, { justifyContent: "center", padding: 4, children: /* @__PURE__ */ jsx(Typography, { textColor: "neutral600", children: formatMessage(getTrad("whitelist.table.empty")) }) }) }) }) : paginatedUsers.map((user, index) => /* @__PURE__ */ jsxs(Tr, { children: [
+        /* @__PURE__ */ jsx(Tbody, { children: users.length === 0 ? /* @__PURE__ */ jsx(Tr, { children: /* @__PURE__ */ jsx(Td, { colSpan: 4, children: /* @__PURE__ */ jsx(Flex, { justifyContent: "center", alignItems: "center", style: { minHeight: "80px" }, children: /* @__PURE__ */ jsx(Typography, { textColor: "neutral600", children: formatMessage(getTrad("whitelist.table.empty")) }) }) }) }) : paginatedUsers.map((user, index) => /* @__PURE__ */ jsxs(Tr, { children: [
           /* @__PURE__ */ jsx(Td, { children: index + 1 + (page - 1) * PAGE_SIZE$1 }),
           /* @__PURE__ */ jsx(Td, { children: user.email }),
           /* @__PURE__ */ jsx(Td, { children: /* @__PURE__ */ jsx(LocalizedDate, { date: user.createdAt, options: { second: "2-digit" } }) }),
@@ -3618,6 +3618,7 @@ const AUDIT_ACTIONS = [
   "user_created"
 ];
 const PAGE_SIZE = 10;
+const MIN_SPINNER_MS = 400;
 const DETAILS_TEXT_STYLE = {
   display: "block",
   overflow: "hidden",
@@ -3667,28 +3668,35 @@ function AuditLog({ title } = {}) {
     pageCount: 1
   });
   const [page, setPage] = useState(1);
-  const [loading, setLoading] = useState(false);
+  const [loading, setLoading] = useState(true);
   const [filters, setFilters] = useState({});
+  const fetchGenRef = useRef(0);
   const debouncedFilters = useDebounced(filters);
   const fetchLogs = useCallback(
     async (p, f) => {
+      const gen = ++fetchGenRef.current;
       setLoading(true);
+      const startTime = Date.now();
+      let newRecords = [];
+      let newPagination = { page: p, pageSize: PAGE_SIZE, total: 0, pageCount: 1 };
       try {
-        const queryString = buildQueryString({
-          filters: f,
-          page: p,
-          pageSize: PAGE_SIZE
-        });
+        const queryString = buildQueryString({ filters: f, page: p, pageSize: PAGE_SIZE });
         const response = await get2(`/strapi-plugin-oidc/audit-logs?${queryString}`);
-        setRecords(response.data.results ?? []);
-        setPagination(
-          response.data.pagination ?? { page: p, pageSize: PAGE_SIZE, total: 0, pageCount: 1 }
-        );
+        newRecords = response.data.results ?? [];
+        newPagination = response.data.pagination ?? {
+          page: p,
+          pageSize: PAGE_SIZE,
+          total: 0,
+          pageCount: 1
+        };
       } catch {
-        setRecords([]);
-      } finally {
-        setLoading(false);
       }
+      const remaining = MIN_SPINNER_MS - (Date.now() - startTime);
+      if (remaining > 0) await new Promise((r) => setTimeout(r, remaining));
+      if (gen !== fetchGenRef.current) return;
+      setRecords(newRecords);
+      setPagination(newPagination);
+      setLoading(false);
     },
     [get2]
   );
@@ -3865,37 +3873,54 @@ function AuditLog({ title } = {}) {
         ]
       }
     ),
-    /* @__PURE__ */ jsxs(CustomTable, { colCount: 5, rowCount: records.length, children: [
-      /* @__PURE__ */ jsx(Thead, { children: /* @__PURE__ */ jsxs(Tr, { children: [
-        /* @__PURE__ */ jsx(Th, { children: formatMessage(getTrad("auditlog.table.timestamp")) }),
-        /* @__PURE__ */ jsx(Th, { children: formatMessage(getTrad("auditlog.table.action")) }),
-        /* @__PURE__ */ jsx(Th, { children: formatMessage(getTrad("auditlog.table.email")) }),
-        /* @__PURE__ */ jsx(Th, { children: formatMessage(getTrad("auditlog.table.ip")) }),
-        /* @__PURE__ */ jsx(Th, { children: formatMessage(getTrad("auditlog.table.details")) })
-      ] }) }),
-      /* @__PURE__ */ jsxs(Tbody, { children: [
-        loading && /* @__PURE__ */ jsx(Tr, { children: /* @__PURE__ */ jsx(Td, { colSpan: 5, children: /* @__PURE__ */ jsx(Flex, { justifyContent: "center", padding: 4, children: /* @__PURE__ */ jsx(Typography, { textColor: "neutral600", children: formatMessage(getTrad("auditlog.loading")) }) }) }) }),
-        !loading && records.length === 0 && /* @__PURE__ */ jsx(Tr, { children: /* @__PURE__ */ jsx(Td, { colSpan: 5, children: /* @__PURE__ */ jsx(Flex, { justifyContent: "center", padding: 4, children: /* @__PURE__ */ jsx(Typography, { textColor: "neutral600", children: hasActiveFilters ? formatMessage(getTrad("auditlog.filters.empty")) : formatMessage(getTrad("auditlog.table.empty")) }) }) }) }),
-        !loading && records.map((record) => /* @__PURE__ */ jsxs(Tr, { children: [
-          /* @__PURE__ */ jsx(Td, { children: /* @__PURE__ */ jsx(Typography, { variant: "omega", children: /* @__PURE__ */ jsx(LocalizedDate, { date: record.createdAt, options: { second: "2-digit" } }) }) }),
-          /* @__PURE__ */ jsx(Td, { children: /* @__PURE__ */ jsxs(Flex, { gap: 2, alignItems: "center", children: [
-            /* @__PURE__ */ jsx(Typography, { variant: "omega", children: record.action }),
-            /* @__PURE__ */ jsx(Tooltip, { label: formatMessage(getTrad(`auditlog.action.${record.action}`)), children: /* @__PURE__ */ jsx(
-              Information,
-              {
-                "aria-hidden": true,
-                style: { cursor: "help" },
-                width: "1.4rem",
-                height: "1.4rem",
-                fill: "primary600"
-              }
-            ) })
-          ] }) }),
-          /* @__PURE__ */ jsx(Td, { children: /* @__PURE__ */ jsx(Typography, { variant: "omega", children: record.email ?? "—" }) }),
-          /* @__PURE__ */ jsx(Td, { children: /* @__PURE__ */ jsx(Typography, { variant: "omega", children: record.ip ?? "—" }) }),
-          /* @__PURE__ */ jsx(Td, { style: { maxWidth: "200px" }, children: record.details ? /* @__PURE__ */ jsx(Tooltip, { label: record.details, side: "top", children: /* @__PURE__ */ jsx(Typography, { variant: "omega", textColor: "neutral600", style: DETAILS_TEXT_STYLE, children: record.details }) }) : /* @__PURE__ */ jsx(Typography, { variant: "omega", textColor: "neutral600", children: "—" }) })
-        ] }, record.id))
-      ] })
+    /* @__PURE__ */ jsxs("div", { style: { position: "relative", width: "100%" }, children: [
+      /* @__PURE__ */ jsxs(CustomTable, { colCount: 5, rowCount: records.length, children: [
+        /* @__PURE__ */ jsx(Thead, { children: /* @__PURE__ */ jsxs(Tr, { children: [
+          /* @__PURE__ */ jsx(Th, { children: formatMessage(getTrad("auditlog.table.timestamp")) }),
+          /* @__PURE__ */ jsx(Th, { children: formatMessage(getTrad("auditlog.table.action")) }),
+          /* @__PURE__ */ jsx(Th, { children: formatMessage(getTrad("auditlog.table.email")) }),
+          /* @__PURE__ */ jsx(Th, { children: formatMessage(getTrad("auditlog.table.ip")) }),
+          /* @__PURE__ */ jsx(Th, { children: formatMessage(getTrad("auditlog.table.details")) })
+        ] }) }),
+        /* @__PURE__ */ jsxs(Tbody, { children: [
+          records.length === 0 && /* @__PURE__ */ jsx(Tr, { children: /* @__PURE__ */ jsx(Td, { colSpan: 5, children: /* @__PURE__ */ jsx(Flex, { justifyContent: "center", alignItems: "center", style: { minHeight: "80px" }, children: loading ? /* @__PURE__ */ jsx(Loader, { small: true }) : /* @__PURE__ */ jsx(Typography, { textColor: "neutral600", children: hasActiveFilters ? formatMessage(getTrad("auditlog.filters.empty")) : formatMessage(getTrad("auditlog.table.empty")) }) }) }) }),
+          records.map((record) => /* @__PURE__ */ jsxs(
+            Tr,
+            {
+              style: { opacity: loading ? 0.4 : 1, transition: "opacity 0.15s" },
+              children: [
+                /* @__PURE__ */ jsx(Td, { children: /* @__PURE__ */ jsx(Typography, { variant: "omega", children: /* @__PURE__ */ jsx(LocalizedDate, { date: record.createdAt, options: { second: "2-digit" } }) }) }),
+                /* @__PURE__ */ jsx(Td, { children: /* @__PURE__ */ jsxs(Flex, { gap: 2, alignItems: "center", children: [
+                  /* @__PURE__ */ jsx(Typography, { variant: "omega", children: record.action }),
+                  /* @__PURE__ */ jsx(Tooltip, { label: formatMessage(getTrad(`auditlog.action.${record.action}`)), children: /* @__PURE__ */ jsx(
+                    Information,
+                    {
+                      "aria-hidden": true,
+                      style: { cursor: "help" },
+                      width: "1.4rem",
+                      height: "1.4rem",
+                      fill: "primary600"
+                    }
+                  ) })
+                ] }) }),
+                /* @__PURE__ */ jsx(Td, { children: /* @__PURE__ */ jsx(Typography, { variant: "omega", children: record.email ?? "—" }) }),
+                /* @__PURE__ */ jsx(Td, { children: /* @__PURE__ */ jsx(Typography, { variant: "omega", children: record.ip ?? "—" }) }),
+                /* @__PURE__ */ jsx(Td, { style: { maxWidth: "200px" }, children: record.details ? /* @__PURE__ */ jsx(Tooltip, { label: record.details, side: "top", children: /* @__PURE__ */ jsx(Typography, { variant: "omega", textColor: "neutral600", style: DETAILS_TEXT_STYLE, children: record.details }) }) : /* @__PURE__ */ jsx(Typography, { variant: "omega", textColor: "neutral600", children: "—" }) })
+              ]
+            },
+            record.id
+          ))
+        ] })
+      ] }),
+      loading && records.length > 0 && /* @__PURE__ */ jsx(
+        Flex,
+        {
+          justifyContent: "center",
+          alignItems: "center",
+          style: { position: "absolute", inset: 0, pointerEvents: "none" },
+          children: /* @__PURE__ */ jsx(Loader, { small: true })
+        }
+      )
     ] }),
     /* @__PURE__ */ jsx(
       TablePagination,

package/dist/admin/{index-BSgVStns.js → index-Dk6TYtio.js}

@@ -1,5 +1,10 @@
 "use strict";
-const react = require("react");
+const React = require("react");
+const client = require("react-dom/client");
+const jsxRuntime = require("react/jsx-runtime");
+const designSystem = require("@strapi/design-system");
+const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
+const React__default = /* @__PURE__ */ _interopDefault(React);
 const __variableDynamicImportRuntimeHelper = (glob, path, segs) => {
   const v = glob[path];
   if (v) {
@@ -24,15 +29,51 @@ const pluginPkg = {
 };
 const pluginId = pluginPkg.name.replace(/^@strapi\/plugin-/i, "");
 function Initializer({ setPlugin }) {
-  const ref = react.useRef();
+  const ref = React.useRef();
   ref.current = setPlugin;
-  react.useEffect(() => {
+  React.useEffect(() => {
     if (ref.current) {
       ref.current(pluginId);
     }
   }, []);
   return null;
 }
+const LOGOUT_EVENT = "strapi-oidc:logout";
+function Overlay({ bg }) {
+  const [active, setActive] = React.useState(false);
+  React.useEffect(() => {
+    const handler = () => setActive(true);
+    window.addEventListener(LOGOUT_EVENT, handler);
+    return () => window.removeEventListener(LOGOUT_EVENT, handler);
+  }, []);
+  if (!active) return null;
+  return /* @__PURE__ */ jsxRuntime.jsx(
+    "div",
+    {
+      style: {
+        position: "fixed",
+        inset: 0,
+        zIndex: 1e4,
+        display: "flex",
+        alignItems: "center",
+        justifyContent: "center",
+        background: bg,
+        backdropFilter: "blur(2px)"
+      },
+      children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Loader, {})
+    }
+  );
+}
+function resolveTheme() {
+  const stored = window.localStorage.getItem("STRAPI_THEME") ?? "system";
+  const isDark = stored === "dark" || stored === "system" && (window.matchMedia?.("(prefers-color-scheme: dark)").matches ?? false);
+  return isDark ? designSystem.darkTheme : designSystem.lightTheme;
+}
+function LogoutOverlay() {
+  const theme = resolveTheme();
+  const bg = theme === designSystem.darkTheme ? "rgba(24, 24, 38, 0.85)" : "rgba(255, 255, 255, 0.85)";
+  return /* @__PURE__ */ jsxRuntime.jsx(designSystem.DesignSystemProvider, { theme, children: /* @__PURE__ */ jsxRuntime.jsx(Overlay, { bg }) });
+}
 const en = {
   "global.plugins.strapi-plugin-oidc": "OIDC Plugin",
   "page.title": "Configure OIDC default role(s) and access controls.",
@@ -95,7 +136,6 @@ const en = {
   "auditlog.table.ip": "IP",
   "auditlog.table.details": "Details",
   "auditlog.table.empty": "No audit log entries",
-  "auditlog.loading": "Loading…",
   "auditlog.clear": "Clear Logs",
   "auditlog.clear.title": "Clear All Logs",
   "auditlog.clear.description": "This will permanently delete all {count, plural, one {# audit log entry} other {# audit log entries}}. This action cannot be undone.",
@@ -168,7 +208,7 @@ const index = {
           defaultMessage: "Configuration"
         },
         Component: async () => {
-          return await Promise.resolve().then(() => require("./index-CgG_mHzZ.js"));
+          return await Promise.resolve().then(() => require("./index-Bmg4eTYb.js"));
         },
         permissions: [{ action: "plugin::strapi-plugin-oidc.read", subject: null }]
       }
@@ -180,6 +220,9 @@ const index = {
     });
   },
   bootstrap() {
+    const overlayContainer = document.createElement("div");
+    document.body.appendChild(overlayContainer);
+    client.createRoot(overlayContainer).render(React__default.default.createElement(LogoutOverlay));
     const defaultButtonText = t("login.sso");
     const isAuthRoute = (path) => /\/auth\/(login|register|forgot-password|reset-password)/.test(path);
     let ssoButtonInjected = false;
@@ -239,6 +282,7 @@ const index = {
         if (!isAuthRoute(window.location.pathname)) return;
         injectSSOButton(buttonText);
         if (enforced) removeEnforcedElements();
+        if (ssoButtonInjected && !enforced) loginObserver?.disconnect();
       };
       tick();
       loginObserver = new MutationObserver(tick);
@@ -259,27 +303,27 @@ const index = {
       }
     };
     applySettings();
+    if (window.__strapiOidcFetchPatched) return;
+    window.__strapiOidcFetchPatched = true;
     const originalFetch = window.fetch;
     window.fetch = async (...args) => {
       const url = typeof args[0] === "string" ? args[0] : args[0].url;
       const isLogout = url?.endsWith("/admin/logout") && args[1]?.method?.toUpperCase() === "POST";
-      const response = await originalFetch(...args);
-      if (isLogout && response.ok) {
+      if (isLogout) {
+        window.dispatchEvent(new CustomEvent(LOGOUT_EVENT));
         window.localStorage.removeItem("jwtToken");
         window.localStorage.removeItem("isLoggedIn");
         window.sessionStorage.removeItem("jwtToken");
         window.sessionStorage.removeItem("isLoggedIn");
         document.cookie = "jwtToken=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/";
         document.cookie = "jwtToken=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/admin";
-        const form = document.createElement("form");
-        form.method = "POST";
-        form.action = "/strapi-plugin-oidc/logout";
-        document.body.appendChild(form);
-        form.submit();
+        originalFetch(...args).catch(() => {
+        });
+        window.location.href = "/strapi-plugin-oidc/logout";
         return new Promise(() => {
         });
       }
-      return response;
+      return originalFetch(...args);
     };
   },
   async registerTrads({ locales }) {

package/dist/admin/index.js

@@ -1,4 +1,6 @@
 "use strict";
 Object.defineProperties(exports, { __esModule: { value: true }, [Symbol.toStringTag]: { value: "Module" } });
-const index = require("./index-BSgVStns.js");
+const index = require("./index-Dk6TYtio.js");
+require("react");
+require("react-dom/client");
 exports.default = index.index;

package/dist/admin/index.mjs

@@ -1,4 +1,6 @@
-import { i } from "./index-B-K4X_N9.mjs";
+import { i } from "./index-Bb9-aYb4.mjs";
+import "react";
+import "react-dom/client";
 export {
   i as default
 };

package/dist/server/index.js

@@ -44,8 +44,44 @@ const getRoleService = () => strapi.plugin(PLUGIN_NAME).service("role");
 const getWhitelistService = () => strapi.plugin(PLUGIN_NAME).service("whitelist");
 const getAuditLogService = () => strapi.plugin(PLUGIN_NAME).service("auditLog");
 const getAdminUserService = () => strapi.service("admin::user");
+const DISCOVERY_TIMEOUT_MS = 5e3;
+const FIELD_MAP = [
+  ["issuer", "OIDC_ISSUER"],
+  ["authorization_endpoint", "OIDC_AUTHORIZATION_ENDPOINT"],
+  ["token_endpoint", "OIDC_TOKEN_ENDPOINT"],
+  ["userinfo_endpoint", "OIDC_USERINFO_ENDPOINT"],
+  ["end_session_endpoint", "OIDC_END_SESSION_ENDPOINT"],
+  ["jwks_uri", "OIDC_JWKS_URI"]
+];
+async function applyDiscovery(strapi2) {
+  const config2 = strapi2.config.get("plugin::strapi-plugin-oidc");
+  const discoveryUrl = config2.OIDC_DISCOVERY_URL;
+  if (!discoveryUrl) return;
+  let doc;
+  try {
+    const res = await fetch(discoveryUrl, { signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS) });
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    doc = await res.json();
+  } catch (e) {
+    strapi2.log.error(
+      `[strapi-plugin-oidc] Failed to fetch OIDC discovery document from ${discoveryUrl}: ${e instanceof Error ? e.message : String(e)}`
+    );
+    return;
+  }
+  const updates = {};
+  for (const [docField, configKey] of FIELD_MAP) {
+    if (doc[docField]) {
+      updates[configKey] = doc[docField];
+    }
+  }
+  if (Object.keys(updates).length > 0) {
+    strapi2.config.set("plugin::strapi-plugin-oidc", { ...config2, ...updates });
+    strapi2.log.info(`[strapi-plugin-oidc] Discovery applied: ${Object.keys(updates).join(", ")}`);
+  }
+}
 const AUTH_ROUTES = ["login", "register", "register-admin", "forgot-password", "reset-password"];
 async function bootstrap({ strapi: strapi2 }) {
+  await applyDiscovery(strapi2);
   const adminUrl = strapi2.config.get("admin.url", "/admin");
   const tokenRefreshPath = `${adminUrl}/token/refresh`;
   const enforceOidcMiddleware = async (ctx, next) => {
@@ -157,17 +193,13 @@ function destroy() {
 const config = {
   default: {
     REMEMBER_ME: false,
+    OIDC_DISCOVERY_URL: "",
     OIDC_REDIRECT_URI: "http://localhost:1337/strapi-plugin-oidc/oidc/callback",
     OIDC_CLIENT_ID: "",
     OIDC_CLIENT_SECRET: "",
     OIDC_SCOPE: "openid profile email",
-    OIDC_AUTHORIZATION_ENDPOINT: "",
-    OIDC_TOKEN_ENDPOINT: "",
-    OIDC_USERINFO_ENDPOINT: "",
-    OIDC_GRANT_TYPE: "authorization_code",
     OIDC_FAMILY_NAME_FIELD: "family_name",
     OIDC_GIVEN_NAME_FIELD: "given_name",
-    OIDC_END_SESSION_ENDPOINT: "",
     OIDC_SSO_BUTTON_TEXT: "Login via SSO",
     OIDC_ENFORCE: null,
     // null = use DB setting; true/false = override DB (useful for lockout recovery)
@@ -176,9 +208,14 @@ const config = {
     OIDC_GROUP_ROLE_MAP: "{}",
     OIDC_REQUIRE_EMAIL_VERIFIED: true,
     OIDC_TRUSTED_IP_HEADER: "",
+    OIDC_FORCE_SECURE_COOKIES: false,
+    // Populated at bootstrap from OIDC_DISCOVERY_URL — not user-configurable directly
+    OIDC_AUTHORIZATION_ENDPOINT: "",
+    OIDC_TOKEN_ENDPOINT: "",
+    OIDC_USERINFO_ENDPOINT: "",
+    OIDC_END_SESSION_ENDPOINT: "",
     OIDC_JWKS_URI: "",
-    OIDC_ISSUER: "",
-    OIDC_FORCE_SECURE_COOKIES: false
+    OIDC_ISSUER: ""
   },
   validator() {
   }
@@ -234,8 +271,7 @@ function shouldMarkSecure(strapi2, ctx) {
   if (config2.OIDC_FORCE_SECURE_COOKIES === true) return true;
   if (ctx.request.secure) return true;
   const proxyTrusted = ctx.app?.proxy === true;
-  if (proxyTrusted && typeof ctx.get === "function" && ctx.get("x-forwarded-proto") === "https")
-    return true;
+  if (proxyTrusted && ctx.get("x-forwarded-proto") === "https") return true;
   return false;
 }
 function getExpiredCookieOptions(strapi2, ctx) {
@@ -369,7 +405,6 @@ const en = {
   "auditlog.table.ip": "IP",
   "auditlog.table.details": "Details",
   "auditlog.table.empty": "No audit log entries",
-  "auditlog.loading": "Loading…",
   "auditlog.clear": "Clear Logs",
   "auditlog.clear.title": "Clear All Logs",
   "auditlog.clear.description": "This will permanently delete all {count, plural, one {# audit log entry} other {# audit log entries}}. This action cannot be undone.",
@@ -424,7 +459,6 @@ const locales = Object.fromEntries(
     return [code ?? "", mod.default];
   })
 );
-Object.keys(locales).filter(Boolean);
 const DEFAULT_LOCALE = "en";
 function parseAcceptLanguage(header) {
   return header.split(",").map((part) => {
@@ -527,13 +561,13 @@ const OIDC_ERROR_DISPATCH = {
     key: "sign_in_unknown"
   }
 };
-const TRUSTED_HEADER_WHITELIST = /* @__PURE__ */ new Set(["cf-connecting-ip"]);
+const TRUSTED_IP_HEADER = "cf-connecting-ip";
 function getTrustedHeaderName() {
   const config2 = strapi.config.get("plugin::strapi-plugin-oidc") ?? {};
   const raw = config2.OIDC_TRUSTED_IP_HEADER;
   if (typeof raw !== "string" || !raw) return void 0;
   const normalized = raw.trim().toLowerCase();
-  return TRUSTED_HEADER_WHITELIST.has(normalized) ? normalized : void 0;
+  return normalized === TRUSTED_IP_HEADER ? normalized : void 0;
 }
 function getClientIp(ctx) {
   const proxyTrusted = ctx.app?.proxy === true;
@@ -550,19 +584,23 @@ function getClientIp(ctx) {
   }
   return ctx.ip;
 }
+function toMessage(e) {
+  return e instanceof Error ? e.message : String(e);
+}
 const REQUIRED_CONFIG_KEYS = [
+  "OIDC_DISCOVERY_URL",
   "OIDC_CLIENT_ID",
   "OIDC_CLIENT_SECRET",
   "OIDC_REDIRECT_URI",
   "OIDC_SCOPE",
-  "OIDC_TOKEN_ENDPOINT",
-  "OIDC_USERINFO_ENDPOINT",
-  "OIDC_GRANT_TYPE",
   "OIDC_FAMILY_NAME_FIELD",
   "OIDC_GIVEN_NAME_FIELD",
+  // Populated at bootstrap from OIDC_DISCOVERY_URL — checked here as a runtime safety net
+  "OIDC_TOKEN_ENDPOINT",
+  "OIDC_USERINFO_ENDPOINT",
   "OIDC_AUTHORIZATION_ENDPOINT"
 ];
-const LOGOUT_USERINFO_TIMEOUT_MS = 3e3;
+const LOGOUT_USERINFO_TIMEOUT_MS = 1500;
 const jwksCache = /* @__PURE__ */ new Map();
 let jwksDisabledWarned = false;
 function getJwks(uri) {
@@ -594,7 +632,7 @@ async function verifyIdToken(idToken, config2) {
     return payload;
   } catch (e) {
     if (e instanceof jose.errors.JWTClaimValidationFailed || e instanceof jose.errors.JWSSignatureVerificationFailed || e instanceof jose.errors.JWTExpired || e instanceof jose.errors.JWTInvalid || e instanceof jose.errors.JWSInvalid) {
-      const msg = e instanceof Error ? e.message : String(e);
+      const msg = toMessage(e);
       throw new OidcError("id_token_invalid", msg, e);
     }
     throw e;
@@ -785,7 +823,7 @@ async function ensureUser(userService, oauthService2, email, userResponseData, c
       );
       return { user, userCreated: true, rolesUpdated: true };
     } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
+      const msg = toMessage(e);
       throw new OidcError("user_creation_failed", msg, e);
     }
   }
@@ -835,7 +873,7 @@ async function handleUserAuthentication(userService, oauthService2, roleService2
 function classifyOidcError(e, userInfo) {
   const kind = e instanceof OidcError ? e.kind : "unknown";
   const dispatch = OIDC_ERROR_DISPATCH[kind];
-  const msg = e instanceof Error ? e.message : String(e);
+  const msg = toMessage(e);
   let params;
   if (kind === "id_token_parse_failed" || kind === "id_token_invalid" || kind === "unknown") {
     params = { error: msg };
@@ -884,7 +922,7 @@ async function logSuccessfulAuth(auditLog2, ctx, user, userCreated, rolesUpdated
 }
 async function handleCallbackError(e, userInfo, auditLog2, oauthService2, ctx) {
   const errorInfo = classifyOidcError(e, userInfo);
-  const message = e instanceof Error ? e.message : String(e);
+  const message = toMessage(e);
   await auditLog2.log({
     action: errorInfo.action,
     email: userInfo?.email,
@@ -925,7 +963,7 @@ async function oidcSignInCallback(ctx) {
     client_id: config2.OIDC_CLIENT_ID,
     client_secret: config2.OIDC_CLIENT_SECRET,
     redirect_uri: config2.OIDC_REDIRECT_URI,
-    grant_type: config2.OIDC_GRANT_TYPE,
+    grant_type: "authorization_code",
     code_verifier: codeVerifier ?? ""
   });
   let userInfo;
@@ -969,13 +1007,13 @@ async function oidcSignInCallback(ctx) {
     await handleCallbackError(e, userInfo, auditLog2, oauthService2, ctx);
   }
 }
-async function isProviderSessionActive(userinfoEndpoint, accessToken) {
+async function isProviderSessionExpired(userinfoEndpoint, accessToken) {
   try {
     const response = await fetch(userinfoEndpoint, {
       headers: { Authorization: `Bearer ${accessToken}` },
       signal: AbortSignal.timeout(LOGOUT_USERINFO_TIMEOUT_MS)
     });
-    return response.ok;
+    return !response.ok;
   } catch {
     return false;
   }
@@ -995,14 +1033,14 @@ async function logout(ctx) {
   }
   const logAudit = (action) => userEmail ? auditLog2.log({ action, email: userEmail, ip: getClientIp(ctx) }) : Promise.resolve();
   if (logoutUrl && accessToken) {
-    const active = await isProviderSessionActive(config2.OIDC_USERINFO_ENDPOINT, accessToken);
-    if (active) {
-      logAudit("logout").catch(() => {
-      });
-      return ctx.redirect(logoutUrl);
+    const expired = await isProviderSessionExpired(config2.OIDC_USERINFO_ENDPOINT, accessToken);
+    if (expired) {
+      await logAudit("session_expired");
+      return ctx.redirect(loginUrl);
     }
-    await logAudit("session_expired");
-    return ctx.redirect(loginUrl);
+    logAudit("logout").catch(() => {
+    });
+    return ctx.redirect(logoutUrl);
   }
   await logAudit("logout");
   ctx.redirect(logoutUrl || loginUrl);
@@ -1160,13 +1198,9 @@ async function importUsers(ctx) {
   const whitelistService2 = getWhitelistService();
   const existing = await whitelistService2.getUsers();
   const existingEmails = new Set(existing.map((u) => u.email));
-  let importedCount = 0;
-  for (const email of deduped) {
-    if (existingEmails.has(email)) continue;
-    await whitelistService2.registerUser(email);
-    importedCount++;
-  }
-  ctx.body = { importedCount };
+  const toImport = deduped.filter((email) => !existingEmails.has(email));
+  await Promise.all(toImport.map((email) => whitelistService2.registerUser(email)));
+  ctx.body = { importedCount: toImport.length };
 }
 async function syncUsers(ctx) {
   const { users: rawUsers } = ctx.request.body;
@@ -1175,16 +1209,10 @@ async function syncUsers(ctx) {
   const currentUsers = await whitelistService2.getUsers();
   const syncEmailSet = new Set(emails);
   const currentUsersByEmail = new Map(currentUsers.map((u) => [u.email, u]));
-  for (const currUser of currentUsers) {
-    if (!syncEmailSet.has(currUser.email)) {
-      await whitelistService2.removeUser(currUser.email);
-    }
-  }
-  for (const email of emails) {
-    if (!currentUsersByEmail.has(email)) {
-      await whitelistService2.registerUser(email);
-    }
-  }
+  await Promise.all([
+    ...currentUsers.filter((u) => !syncEmailSet.has(u.email)).map((u) => whitelistService2.removeUser(u.email)),
+    ...emails.filter((email) => !currentUsersByEmail.has(email)).map((email) => whitelistService2.registerUser(email))
+  ]);
   ctx.body = {};
 }
 const whitelist = {
@@ -1488,6 +1516,12 @@ const routes = {
         handler: "oidc.oidcSignInCallback",
         config: { auth: false, middlewares: [rateLimitMiddleware] }
       },
+      {
+        method: "GET",
+        path: "/logout",
+        handler: "oidc.logout",
+        config: { auth: false }
+      },
       {
         method: "POST",
         path: "/logout",
@@ -1796,9 +1830,10 @@ function oauthService({ strapi: strapi2 }) {
       }
       const modelDef = strapi2.getModel("admin::user");
       const sanitizedEntity = await strapiUtils__default.default.sanitize.sanitizers.defaultSanitizeOutput(
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        { schema: modelDef, getModel: (uid2) => strapi2.getModel(uid2) },
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        {
+          schema: modelDef,
+          getModel: (uid2) => strapi2.getModel(uid2)
+        },
         user
       );
       eventHub?.emit(ENTRY_CREATE ?? "entry.create", {