zudoku 0.82.2 → 0.82.4

package/src/config/validators/ZudokuConfig.ts

@@ -486,6 +486,25 @@ const AuthenticationSchema = z.discriminatedUnion("type", [
     authorizationParams: z.record(z.string(), z.string()).optional(),
     forwardAuthorizationParams: z.array(z.string()).optional(),
   }),
+  z.object({
+    type: z.literal("entra"),
+    basePath: z.string().optional(),
+    clientId: z.string(),
+    // Tenant id or one of Entra's multi-tenant authorities
+    // (common/organizations/consumers). Defaults to "common".
+    tenantId: z.string().optional(),
+    // Full issuer override, e.g. for CIAM tenants on *.ciamlogin.com.
+    issuer: z.string().optional(),
+    audience: z.string().optional(),
+    scopes: z.array(z.string()).optional(),
+    redirectToAfterSignUp: z.string().optional(),
+    redirectToAfterSignIn: z.string().optional(),
+    redirectToAfterSignOut: z.string().optional(),
+    signUp: SignUpOpenIdSchema.optional(),
+    disableSignUp: z.boolean().optional(),
+    authorizationParams: z.record(z.string(), z.string()).optional(),
+    forwardAuthorizationParams: z.array(z.string()).optional(),
+  }),
   z.object({
     type: z.literal("azureb2c"),
     basePath: z.string().optional(),

package/src/lib/auth/issuer.ts

@@ -1,5 +1,8 @@
 import type { ZudokuConfig } from "../../config/validators/ZudokuConfig.js";
-import { getClerkFrontendApi } from "../authentication/providers/util.js";
+import {
+  getClerkFrontendApi,
+  getEntraIssuer,
+} from "../authentication/providers/util.js";
 
 export const getIssuer = async (config: ZudokuConfig) => {
   switch (config.authentication?.type) {
@@ -12,6 +15,9 @@ export const getIssuer = async (config: ZudokuConfig) => {
     case "openid": {
       return config.authentication.issuer;
     }
+    case "entra": {
+      return getEntraIssuer(config.authentication);
+    }
     case "supabase": {
       return config.authentication.supabaseUrl;
     }

package/src/lib/authentication/providers/entra.tsx

@@ -0,0 +1,97 @@
+import type * as oauth from "oauth4webapi";
+import type { EntraAuthenticationConfig } from "../../../config/config.js";
+import type {
+  AuthenticationPlugin,
+  AuthenticationProviderInitializer,
+} from "../authentication.js";
+import type { UserProfile } from "../state.js";
+import { OpenIDAuthenticationProvider } from "./openid.js";
+import { getEntraIssuer } from "./util.js";
+
+const ISSUER_TENANT_PLACEHOLDER = "{tenantid}";
+
+export class EntraAuthenticationProvider
+  extends OpenIDAuthenticationProvider
+  implements AuthenticationPlugin
+{
+  constructor(config: EntraAuthenticationConfig) {
+    super({ ...config, type: "openid", issuer: getEntraIssuer(config) });
+  }
+
+  // Multi-tenant authorities advertise a templated issuer that never matches
+  // the requested authority, so the strict discovery check would throw. Expect
+  // the template itself; resolveTokenIssuer resolves the concrete tenant per
+  // token. Recommended by oauth4webapi's maintainer:
+  // https://github.com/panva/oauth4webapi/issues/100
+  protected override async getExpectedDiscoveryIssuer(
+    issuerUrl: URL,
+    response: Response,
+  ): Promise<URL> {
+    try {
+      const metadata = (await response.clone().json()) as { issuer?: unknown };
+      return typeof metadata.issuer === "string" &&
+        metadata.issuer.includes(ISSUER_TENANT_PLACEHOLDER)
+        ? new URL(metadata.issuer)
+        : issuerUrl;
+    } catch {
+      // Malformed body: keep the strict path so processDiscoveryResponse
+      // surfaces the real error.
+      return issuerUrl;
+    }
+  }
+
+  // Without a usable ID token the template stays in place and fails the strict
+  // `iss` validation loudly.
+  protected override async resolveTokenIssuer(
+    as: oauth.AuthorizationServer,
+    response: Response,
+  ): Promise<oauth.AuthorizationServer> {
+    if (!as.issuer.includes(ISSUER_TENANT_PLACEHOLDER)) return as;
+    try {
+      const body = (await response.clone().json()) as { id_token?: unknown };
+      if (typeof body.id_token !== "string") return as;
+      const { decodeJwt } = await import("jose");
+      const { tid } = decodeJwt(body.id_token);
+      return typeof tid === "string" && tid.length > 0
+        ? {
+            ...as,
+            issuer: as.issuer.replace(ISSUER_TENANT_PLACEHOLDER, () => tid),
+          }
+        : as;
+    } catch {
+      return as;
+    }
+  }
+
+  // Entra's `email` claim is only present when the account has a mailbox, which
+  // isn't guaranteed — often absent for users from external tenants. Its
+  // UserInfo endpoint also omits `preferred_username`, so the base profile
+  // (built from UserInfo) can lack any usable identifier. Fill `email` from the
+  // ID token's username claims, and surface the immutable `oid`/`tid` for
+  // reliable identity and tenant checks. `email`/`preferred_username` are
+  // mutable — kept unverified and unsuitable for authorization.
+  // https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference
+  protected override buildUserProfile(
+    userInfo: oauth.UserInfoResponse,
+    claims: oauth.IDToken | undefined,
+  ): UserProfile {
+    const profile = super.buildUserProfile(userInfo, claims);
+    const claim = (name: string) =>
+      typeof claims?.[name] === "string" ? claims[name] : undefined;
+
+    const preferredUsername = claim("preferred_username");
+    return {
+      ...profile,
+      email: profile.email ?? preferredUsername ?? claim("upn"),
+      ...(preferredUsername && { preferred_username: preferredUsername }),
+      ...(claim("oid") && { oid: claim("oid") }),
+      ...(claim("tid") && { tid: claim("tid") }),
+    };
+  }
+}
+
+const entraAuth: AuthenticationProviderInitializer<
+  EntraAuthenticationConfig
+> = (options) => new EntraAuthenticationProvider(options);
+
+export default entraAuth;

package/src/lib/authentication/providers/openid.tsx

@@ -143,14 +143,32 @@ export class OpenIDAuthenticationProvider
         issuerUrl,
         this.oauthOptions,
       );
+
       this.authorizationServer = await oauth.processDiscoveryResponse(
-        issuerUrl,
+        await this.getExpectedDiscoveryIssuer(issuerUrl, response),
         response,
       );
     }
     return this.authorizationServer;
   }
 
+  // Override points for providers whose issuers deviate from the spec (see
+  // EntraAuthenticationProvider). Overrides must peek via `response.clone()`;
+  // the body is consumed downstream.
+  protected async getExpectedDiscoveryIssuer(
+    issuerUrl: URL,
+    _response: Response,
+  ): Promise<URL> {
+    return issuerUrl;
+  }
+
+  protected async resolveTokenIssuer(
+    as: oauth.AuthorizationServer,
+    _response: Response,
+  ): Promise<oauth.AuthorizationServer> {
+    return as;
+  }
+
   /**
    * Sets the tokens from various OAuth responses
    * @param response
@@ -239,12 +257,12 @@ export class OpenIDAuthenticationProvider
     });
   }
 
-  private buildUserProfile(
+  protected buildUserProfile(
     userInfo: oauth.UserInfoResponse,
-    fallbackEmailVerified: oauth.JsonValue | undefined,
+    claims: oauth.IDToken | undefined,
   ): UserProfile {
     const emailVerified =
-      userInfo.email_verified ?? fallbackEmailVerified ?? false;
+      userInfo.email_verified ?? claims?.email_verified ?? false;
     return {
       ...userInfo,
       sub: userInfo.sub,
@@ -303,12 +321,10 @@ export class OpenIDAuthenticationProvider
     const userInfo = await userInfoResponse.json();
 
     const { providerData } = useAuthState.getState();
-    const emailVerified =
-      providerData?.type === "openid"
-        ? providerData.claims?.email_verified
-        : undefined;
+    const claims =
+      providerData?.type === "openid" ? providerData.claims : undefined;
 
-    const profile = this.buildUserProfile(userInfo, emailVerified);
+    const profile = this.buildUserProfile(userInfo, claims);
 
     useAuthState.setState({
       isAuthenticated: true,
@@ -496,7 +512,7 @@ export class OpenIDAuthenticationProvider
       );
 
       const result = await oauth.processRefreshTokenResponse(
-        as,
+        await this.resolveTokenIssuer(as, response),
         this.client,
         response,
       );
@@ -590,7 +606,7 @@ export class OpenIDAuthenticationProvider
           this.oauthOptions,
         );
         const result = await oauth.processRefreshTokenResponse(
-          as,
+          await this.resolveTokenIssuer(as, response),
           this.client,
           response,
         );
@@ -657,7 +673,7 @@ export class OpenIDAuthenticationProvider
     );
 
     const oauthResult = await oauth.processAuthorizationCodeResponse(
-      authServer,
+      await this.resolveTokenIssuer(authServer, response),
       this.client,
       response,
     );
@@ -678,7 +694,7 @@ export class OpenIDAuthenticationProvider
     );
     const userInfo = await userInfoResponse.json();
 
-    const profile = this.buildUserProfile(userInfo, claims?.email_verified);
+    const profile = this.buildUserProfile(userInfo, claims);
 
     useAuthState.setState({
       isAuthenticated: true,

package/src/lib/authentication/providers/util.ts

@@ -12,6 +12,13 @@ export const redirectToSignUpUrl = (
   }
 };
 
+export const getEntraIssuer = (config: {
+  issuer?: string;
+  tenantId?: string;
+}) =>
+  config.issuer ??
+  `https://login.microsoftonline.com/${config.tenantId ?? "common"}/v2.0`;
+
 export const getClerkFrontendApi = (publishableKey: string) => {
   // Split by underscore and get the base64 encoded part (3rd segment)
   const parts = publishableKey.split("_");

package/src/lib/components/navigation/NavigationCategory.tsx

@@ -63,11 +63,12 @@ const NavigationCategoryInner = ({
         setOpen((prev) => !prev);
         setHasInteracted(true);
       }}
-      variant="ghost"
+      variant="none"
       size="icon"
       aria-label={open ? "Collapse section" : "Expand section"}
       aria-expanded={open}
-      className="size-6 hover:bg-[hsl(from_var(--accent)_h_s_calc(l+6*var(--dark)))]"
+      // -my-0.5 keeps the chevron from making folder rows taller than plain ones
+      className="size-6 -my-0.5"
     >
       <ChevronRightIcon
         size={16}

package/src/lib/components/navigation/StackRows.tsx

@@ -24,7 +24,7 @@ export const StackDrillRow = ({
     className={cn(navigationListItem(), "group justify-between", className)}
   >
     <span className="flex items-center gap-2 truncate">{children}</span>
-    <span className="grid size-6 shrink-0 place-items-center">
+    <span className="grid size-6 -my-0.5 shrink-0 place-items-center">
       <ChevronRightIcon size={16} />
     </span>
   </Link>