zudoku 0.82.3 → 0.82.4

package/src/lib/authentication/providers/entra.tsx

@@ -0,0 +1,97 @@
+import type * as oauth from "oauth4webapi";
+import type { EntraAuthenticationConfig } from "../../../config/config.js";
+import type {
+  AuthenticationPlugin,
+  AuthenticationProviderInitializer,
+} from "../authentication.js";
+import type { UserProfile } from "../state.js";
+import { OpenIDAuthenticationProvider } from "./openid.js";
+import { getEntraIssuer } from "./util.js";
+
+const ISSUER_TENANT_PLACEHOLDER = "{tenantid}";
+
+export class EntraAuthenticationProvider
+  extends OpenIDAuthenticationProvider
+  implements AuthenticationPlugin
+{
+  constructor(config: EntraAuthenticationConfig) {
+    super({ ...config, type: "openid", issuer: getEntraIssuer(config) });
+  }
+
+  // Multi-tenant authorities advertise a templated issuer that never matches
+  // the requested authority, so the strict discovery check would throw. Expect
+  // the template itself; resolveTokenIssuer resolves the concrete tenant per
+  // token. Recommended by oauth4webapi's maintainer:
+  // https://github.com/panva/oauth4webapi/issues/100
+  protected override async getExpectedDiscoveryIssuer(
+    issuerUrl: URL,
+    response: Response,
+  ): Promise<URL> {
+    try {
+      const metadata = (await response.clone().json()) as { issuer?: unknown };
+      return typeof metadata.issuer === "string" &&
+        metadata.issuer.includes(ISSUER_TENANT_PLACEHOLDER)
+        ? new URL(metadata.issuer)
+        : issuerUrl;
+    } catch {
+      // Malformed body: keep the strict path so processDiscoveryResponse
+      // surfaces the real error.
+      return issuerUrl;
+    }
+  }
+
+  // Without a usable ID token the template stays in place and fails the strict
+  // `iss` validation loudly.
+  protected override async resolveTokenIssuer(
+    as: oauth.AuthorizationServer,
+    response: Response,
+  ): Promise<oauth.AuthorizationServer> {
+    if (!as.issuer.includes(ISSUER_TENANT_PLACEHOLDER)) return as;
+    try {
+      const body = (await response.clone().json()) as { id_token?: unknown };
+      if (typeof body.id_token !== "string") return as;
+      const { decodeJwt } = await import("jose");
+      const { tid } = decodeJwt(body.id_token);
+      return typeof tid === "string" && tid.length > 0
+        ? {
+            ...as,
+            issuer: as.issuer.replace(ISSUER_TENANT_PLACEHOLDER, () => tid),
+          }
+        : as;
+    } catch {
+      return as;
+    }
+  }
+
+  // Entra's `email` claim is only present when the account has a mailbox, which
+  // isn't guaranteed — often absent for users from external tenants. Its
+  // UserInfo endpoint also omits `preferred_username`, so the base profile
+  // (built from UserInfo) can lack any usable identifier. Fill `email` from the
+  // ID token's username claims, and surface the immutable `oid`/`tid` for
+  // reliable identity and tenant checks. `email`/`preferred_username` are
+  // mutable — kept unverified and unsuitable for authorization.
+  // https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference
+  protected override buildUserProfile(
+    userInfo: oauth.UserInfoResponse,
+    claims: oauth.IDToken | undefined,
+  ): UserProfile {
+    const profile = super.buildUserProfile(userInfo, claims);
+    const claim = (name: string) =>
+      typeof claims?.[name] === "string" ? claims[name] : undefined;
+
+    const preferredUsername = claim("preferred_username");
+    return {
+      ...profile,
+      email: profile.email ?? preferredUsername ?? claim("upn"),
+      ...(preferredUsername && { preferred_username: preferredUsername }),
+      ...(claim("oid") && { oid: claim("oid") }),
+      ...(claim("tid") && { tid: claim("tid") }),
+    };
+  }
+}
+
+const entraAuth: AuthenticationProviderInitializer<
+  EntraAuthenticationConfig
+> = (options) => new EntraAuthenticationProvider(options);
+
+export default entraAuth;

package/src/lib/authentication/providers/openid.tsx

@@ -143,14 +143,32 @@ export class OpenIDAuthenticationProvider
         issuerUrl,
         this.oauthOptions,
       );
+
       this.authorizationServer = await oauth.processDiscoveryResponse(
-        issuerUrl,
+        await this.getExpectedDiscoveryIssuer(issuerUrl, response),
         response,
       );
     }
     return this.authorizationServer;
   }
 
+  // Override points for providers whose issuers deviate from the spec (see
+  // EntraAuthenticationProvider). Overrides must peek via `response.clone()`;
+  // the body is consumed downstream.
+  protected async getExpectedDiscoveryIssuer(
+    issuerUrl: URL,
+    _response: Response,
+  ): Promise<URL> {
+    return issuerUrl;
+  }
+
+  protected async resolveTokenIssuer(
+    as: oauth.AuthorizationServer,
+    _response: Response,
+  ): Promise<oauth.AuthorizationServer> {
+    return as;
+  }
+
   /**
    * Sets the tokens from various OAuth responses
    * @param response
@@ -239,12 +257,12 @@ export class OpenIDAuthenticationProvider
     });
   }
 
-  private buildUserProfile(
+  protected buildUserProfile(
     userInfo: oauth.UserInfoResponse,
-    fallbackEmailVerified: oauth.JsonValue | undefined,
+    claims: oauth.IDToken | undefined,
   ): UserProfile {
     const emailVerified =
-      userInfo.email_verified ?? fallbackEmailVerified ?? false;
+      userInfo.email_verified ?? claims?.email_verified ?? false;
     return {
       ...userInfo,
       sub: userInfo.sub,
@@ -303,12 +321,10 @@ export class OpenIDAuthenticationProvider
     const userInfo = await userInfoResponse.json();
 
     const { providerData } = useAuthState.getState();
-    const emailVerified =
-      providerData?.type === "openid"
-        ? providerData.claims?.email_verified
-        : undefined;
+    const claims =
+      providerData?.type === "openid" ? providerData.claims : undefined;
 
-    const profile = this.buildUserProfile(userInfo, emailVerified);
+    const profile = this.buildUserProfile(userInfo, claims);
 
     useAuthState.setState({
       isAuthenticated: true,
@@ -496,7 +512,7 @@ export class OpenIDAuthenticationProvider
       );
 
       const result = await oauth.processRefreshTokenResponse(
-        as,
+        await this.resolveTokenIssuer(as, response),
         this.client,
         response,
       );
@@ -590,7 +606,7 @@ export class OpenIDAuthenticationProvider
           this.oauthOptions,
         );
         const result = await oauth.processRefreshTokenResponse(
-          as,
+          await this.resolveTokenIssuer(as, response),
           this.client,
           response,
         );
@@ -657,7 +673,7 @@ export class OpenIDAuthenticationProvider
     );
 
     const oauthResult = await oauth.processAuthorizationCodeResponse(
-      authServer,
+      await this.resolveTokenIssuer(authServer, response),
       this.client,
       response,
     );
@@ -678,7 +694,7 @@ export class OpenIDAuthenticationProvider
     );
     const userInfo = await userInfoResponse.json();
 
-    const profile = this.buildUserProfile(userInfo, claims?.email_verified);
+    const profile = this.buildUserProfile(userInfo, claims);
 
     useAuthState.setState({
       isAuthenticated: true,

package/src/lib/authentication/providers/util.ts

@@ -12,6 +12,13 @@ export const redirectToSignUpUrl = (
   }
 };
 
+export const getEntraIssuer = (config: {
+  issuer?: string;
+  tenantId?: string;
+}) =>
+  config.issuer ??
+  `https://login.microsoftonline.com/${config.tenantId ?? "common"}/v2.0`;
+
 export const getClerkFrontendApi = (publishableKey: string) => {
   // Split by underscore and get the base64 encoded part (3rd segment)
   const parts = publishableKey.split("_");