* feat: add OIDC/SSO database schema and models (Phase 1) Add database foundation for OpenID Connect authentication: Database Migrations: - Create oidc_identities table (links users to OIDC accounts) - Create oidc_state_nonces table (OAuth state/nonce for CSRF protection) - Create auth_audit_log table (security event logging) - Make password_digest nullable in users table (allow OIDC-only users) Models: - OIDCIdentity: Links users to external OIDC providers - OIDCStateNonce: Temporary OAuth state management - AuthAuditLog: Authentication event audit trail Changes: - Updated User model to allow null password_digest - Added model associations in models/index.js - All migrations tested and verified Related to #977 * feat: add OIDC core services (Phase 2) - Install openid-client@^6.2.0 for OIDC protocol support - Implement providerConfig.js for loading providers from .env - Support single provider or numbered providers (OIDC_PROVIDER_1_*, etc.) - Auto-provision and admin email domain configuration - Provider caching for performance - Implement stateManager.js for OAuth state/nonce management - CSRF protection with 10-minute TTL - One-time use state consumption - Automatic cleanup of expired states - Implement auditService.js for authentication event logging - Track login success/failure, logout, OIDC linking/unlinking - Store IP address, user agent, and metadata - Support for event queries and retention cleanup - Add comprehensive unit tests (60 tests, all passing) - providerConfig: 36 tests for env parsing and validation - stateManager: 12 tests for state lifecycle and security - auditService: 12 tests for event logging and queries Phase 2 completes the backend core services needed for OIDC authentication. * feat: implement OIDC authentication flow (Phase 3) Core OIDC Flow (service.js): - Provider discovery with issuer caching - Authorization URL generation with state/nonce - OAuth callback handling and token exchange - ID token validation using openid-client - Token refresh functionality JIT User Provisioning (provisioningService.js): - Auto-create users from OIDC claims - Link existing email accounts to OIDC identities - Admin role assignment based on email domain rules - Automatic username generation from email - Transaction-safe identity creation Identity Management (oidcIdentityService.js): - List user's linked OIDC identities - Link additional providers to existing accounts - Unlink identities with safety checks - Prevent unlinking last auth method - Update identity claims on login HTTP Layer (controller.js + routes.js): - GET /api/oidc/providers - List configured providers - GET /api/oidc/auth/:slug - Initiate OIDC flow - GET /api/oidc/callback/:slug - Handle OAuth callback - POST /api/oidc/link/:slug - Link provider to current user - DELETE /api/oidc/unlink/:id - Unlink identity - GET /api/oidc/identities - Get user's identities Integration: - Register OIDC routes in Express app (public + authenticated) - Update auth service to reject password login for OIDC-only users - Audit logging for all OIDC operations - Session creation on successful authentication Security: - State/nonce CSRF protection - One-time use state consumption - Transaction-safe user provisioning - Foreign key constraints enforced * feat: implement OIDC frontend login flow (Phase 4) - Created OIDCProviderButtons component for SSO login options - Created OIDCCallback component for OAuth callback handling - Updated Login page to fetch and display OIDC providers - Added /auth/callback/:provider route to App.tsx - Added i18n translations for OIDC UI elements - Downgraded openid-client to v5.7.0 (CommonJS compatibility) - Fixed linting issues in backend OIDC modules Phase 4 completes the frontend login flow for OIDC/SSO authentication. Users can now see configured SSO providers on the login page. * feat: implement OIDC account linking UI (Phase 5) Add Connected Accounts section to Profile Security tab allowing users to: - View linked OIDC provider accounts - Link new SSO providers to their account - Unlink OIDC identities with validation - Prevent unlinking last authentication method Backend changes: - Add has_password virtual field to User model - Include has_password in profile API response - Track whether user has password set for validation Frontend changes: - Create oidcService for OIDC API operations - Create ConnectedAccounts component with link/unlink flows - Add confirmation dialog before unlinking accounts - Validate that users cannot unlink their last auth method - Show warning if user has no password set - Integrate Connected Accounts into SecurityTab User experience: - View all linked SSO provider accounts with email and link date - Link additional providers via "Link Provider" buttons - Unlink with two-step confirmation to prevent accidents - Clear error messages when unlinking would leave no auth method - Warning message suggesting password setup for OIDC-only users Fixes #977 * feat: complete OIDC documentation and UI improvements (Phase 6) This commit completes Phase 6 of the OIDC/SSO implementation with comprehensive documentation, bug fixes, and UI reorganization. Documentation: - Add comprehensive user guide at docs/10-oidc-sso.md with: - Setup guides for 6 major providers (Google, Okta, Keycloak, Authentik, PocketID, Azure AD) - Configuration examples for single and multiple providers - User features documentation (login, account linking, management) - Advanced topics (auto-provisioning, admin role assignment, hybrid auth) - Comprehensive troubleshooting section - Security considerations and best practices - Update README.md with OIDC/SSO section and quick setup examples Internationalization: - Add i18n support to OIDCProviderButtons component - Add translation keys for all OIDC UI text - Update English translations with "sign_in_with" key Bug Fixes: - Fix oidcService.ts to correctly unwrap API responses - Backend returns {providers: [...]} and {identities: [...]} - Frontend was expecting plain arrays, causing "map is not a function" error - Fix initiateOIDCLink to properly handle POST response UI Improvements: - Move OIDC/SSO to dedicated tab in profile settings - Create new OIDCTab component with green LinkIcon - Remove ConnectedAccounts from SecurityTab - Add OIDC tab between Security and API Keys tabs - Update ProfileSettings with new tab configuration - Security tab now focuses solely on password management Testing: - All linting passes - All tests pass (82 suites, 1223 tests) Related to #977 * feat: add OIDC/SSO translations for all 24 languages Add i18n support for OIDC/SSO features across all supported languages: - "Sign in with {{provider}}" button text - "OIDC/SSO" tab label in profile settings - OIDC authentication flow messages Translations added for: Arabic, Bulgarian, Danish, German, Greek, Spanish, Finnish, French, Indonesian, Italian, Japanese, Korean, Dutch, Norwegian, Polish, Portuguese, Romanian, Russian, Slovenian, Swedish, Turkish, Ukrainian, Vietnamese, and Chinese. * fix: resolve 13 CodeQL security alerts This commit addresses critical security vulnerabilities identified by CodeQL scanning: **Security Configuration (2 fixes)** - Fix insecure Helmet configuration - enable CSP and HSTS in production - Fix clear text cookie transmission - enable secure cookies in production **Path Injection (3 fixes)** - Add path validation in users/controller.js to prevent arbitrary file deletion - Add path validation in users/service.js for avatar operations - Add path sanitization in attachment-utils.js deleteFileFromDisk function **Cross-Site Scripting (1 fix)** - Fix XSS vulnerability in GeneralTab.tsx avatar URL handling - Add URL sanitization to prevent javascript: protocol attacks **URL Security (2 fixes)** - Fix double escaping in url/service.js HTML entity decoding - Fix incomplete URL sanitization for YouTube domain validation **Denial of Service (1 fix)** - Add loop bound protection in inboxProcessingService.js (10k char limit) **Rate Limiting (3 fixes)** - Add rate limiting to auth routes (register, verify-email) - Add rate limiting to task attachment upload/delete endpoints - Add rate limiting to user avatar upload/delete endpoints **GitHub Actions Security (1 fix)** - Add explicit read-only permissions to CI workflow Note: CSRF middleware (#10) requires frontend changes and is tracked separately. Relates to PR #1008 * fix: allow test files in path validation for tests * fix: format long condition in attachment-utils for Prettier compliance Break the path validation condition across multiple lines to meet Prettier formatting requirements and fix CI linting failure. * fix: resolve CodeQL security alerts - Add rate limiting to OIDC authentication routes using authLimiter and authenticatedApiLimiter - Implement CSRF protection middleware using csrf-sync (skips for API tokens and test environment) - Add CSRF token endpoint at /api/csrf-token - Fix incomplete URL scheme validation in GeneralTab to block all dangerous schemes (javascript:, data:, vbscript:, file:) This addresses 5 high-severity CodeQL security vulnerabilities: - Missing rate limiting on OIDC auth routes - Missing CSRF middleware protection - Incomplete URL sanitization in avatar handling All 1223 tests passing. * fix: implement CSRF protection with lusca for CodeQL compliance Add CSRF protection using lusca.csrf (CodeQL's recommended library) to protect session-based authentication while supporting hybrid auth patterns. Implementation: - Pre-check middleware marks exempt requests (test env, Bearer tokens) - Lusca CSRF middleware applied with exemption flag check - Session-based requests require valid x-csrf-token header - Bearer token requests exempt (don't use cookies) - Test environment exempt for test execution This addresses CodeQL security alert js/missing-token-validation while maintaining support for both cookie-based and token-based authentication. Related: #977 (OIDC/SSO authentication feature)
324 lines
13 KiB
TypeScript
324 lines
13 KiB
TypeScript
import React, { useEffect, useState, Suspense, lazy } from 'react';
|
|
import { Routes, Route, Navigate, Outlet } from 'react-router-dom';
|
|
import { useTranslation } from 'react-i18next';
|
|
import Login from './components/Login';
|
|
import Register from './components/Register';
|
|
import OIDCCallback from './components/Auth/OIDCCallback';
|
|
import NotFound from './components/Shared/NotFound';
|
|
import ProjectDetails from './components/Project/ProjectDetails';
|
|
import Projects from './components/Projects';
|
|
import AreaDetails from './components/Area/AreaDetails';
|
|
import Areas from './components/Areas';
|
|
import TagDetails from './components/Tag/TagDetails';
|
|
import Tags from './components/Tags';
|
|
import Views from './components/Views';
|
|
import ViewDetail from './components/ViewDetail';
|
|
import Notes from './components/Notes';
|
|
import NoteDetails from './components/Note/NoteDetails';
|
|
import Calendar from './components/Calendar';
|
|
import ProfileSettings from './components/Profile/ProfileSettings';
|
|
import About from './components/About';
|
|
import BackupRestore from './components/Backup/BackupRestore';
|
|
import Layout from './Layout';
|
|
import { User } from './entities/User';
|
|
import TasksToday from './components/Task/TasksToday';
|
|
import TaskDetails from './components/Task/TaskDetails';
|
|
import LoadingScreen from './components/Shared/LoadingScreen';
|
|
import InboxItems from './components/Inbox/InboxItems';
|
|
import Habits from './components/Habits/Habits';
|
|
import HabitDetails from './components/Habits/HabitDetails';
|
|
import { setCurrentUser as setUserInStorage } from './utils/userUtils';
|
|
import { getApiPath, getLocalesPath } from './config/paths';
|
|
// Lazy load Tasks component to prevent issues with tags loading
|
|
const Tasks = lazy(() => import('./components/Tasks'));
|
|
|
|
const App: React.FC = () => {
|
|
const { i18n } = useTranslation();
|
|
const [currentUser, setCurrentUser] = useState<User | null>(null);
|
|
const [loading, setLoading] = useState(true);
|
|
|
|
if (!i18n.isInitialized) {
|
|
return <LoadingScreen />;
|
|
}
|
|
|
|
const fetchCurrentUser = async () => {
|
|
try {
|
|
const response = await fetch(getApiPath('current_user'), {
|
|
credentials: 'include',
|
|
headers: {
|
|
Accept: 'application/json',
|
|
},
|
|
});
|
|
|
|
if (!response.ok) {
|
|
if (response.status === 401) {
|
|
setCurrentUser(null);
|
|
return;
|
|
}
|
|
throw new Error(`Failed to fetch user: ${response.status}`);
|
|
}
|
|
|
|
const data = await response.json();
|
|
if (data.user) {
|
|
setCurrentUser(data.user);
|
|
setUserInStorage(data.user);
|
|
} else {
|
|
setCurrentUser(null);
|
|
setUserInStorage(null);
|
|
}
|
|
} catch {
|
|
setCurrentUser(null);
|
|
} finally {
|
|
setLoading(false);
|
|
}
|
|
};
|
|
|
|
useEffect(() => {
|
|
// Fetch user on mount
|
|
fetchCurrentUser();
|
|
}, []);
|
|
|
|
// Listen for login events to update user state
|
|
useEffect(() => {
|
|
const handleUserLoggedIn = (event: CustomEvent) => {
|
|
const user = event.detail;
|
|
setCurrentUser(user);
|
|
setUserInStorage(user);
|
|
};
|
|
|
|
window.addEventListener(
|
|
'userLoggedIn',
|
|
handleUserLoggedIn as EventListener
|
|
);
|
|
return () =>
|
|
window.removeEventListener(
|
|
'userLoggedIn',
|
|
handleUserLoggedIn as EventListener
|
|
);
|
|
}, []);
|
|
|
|
useEffect(() => {
|
|
if (i18n.isInitialized) {
|
|
fetch(getLocalesPath(`${i18n.language}/translation.json`))
|
|
.then((response) => {
|
|
return response.json();
|
|
})
|
|
.then((data) => {
|
|
i18n.addResourceBundle(
|
|
i18n.language,
|
|
'translation',
|
|
data,
|
|
true,
|
|
true
|
|
);
|
|
})
|
|
.catch((error) => {
|
|
console.error(
|
|
'Error manually fetching translation file:',
|
|
error
|
|
);
|
|
});
|
|
}
|
|
}, [i18n.isInitialized]);
|
|
|
|
const [isDarkMode, setIsDarkMode] = useState<boolean>(() => {
|
|
const storedPreference = localStorage.getItem('isDarkMode');
|
|
return storedPreference !== null
|
|
? storedPreference === 'true'
|
|
: window.matchMedia('(prefers-color-scheme: dark)').matches;
|
|
});
|
|
|
|
const toggleDarkMode = () => {
|
|
const newValue = !isDarkMode;
|
|
setIsDarkMode(newValue);
|
|
localStorage.setItem('isDarkMode', JSON.stringify(newValue));
|
|
};
|
|
|
|
useEffect(() => {
|
|
const updateTheme = () => {
|
|
document.documentElement.classList.toggle('dark', isDarkMode);
|
|
};
|
|
updateTheme();
|
|
|
|
const mediaQuery = window.matchMedia('(prefers-color-scheme: dark)');
|
|
const mediaListener = (e: MediaQueryListEvent) => {
|
|
if (!localStorage.getItem('isDarkMode')) {
|
|
setIsDarkMode(e.matches);
|
|
}
|
|
};
|
|
mediaQuery.addEventListener('change', mediaListener);
|
|
return () => mediaQuery.removeEventListener('change', mediaListener);
|
|
}, [isDarkMode]);
|
|
|
|
const LoadingComponent = () => (
|
|
<div className="flex items-center justify-center h-screen bg-gray-100 dark:bg-gray-900">
|
|
<div className="text-xl font-semibold text-gray-700 dark:text-gray-200">
|
|
{i18n.t(
|
|
'common.loading',
|
|
'Loading application... Please wait.'
|
|
)}
|
|
</div>
|
|
</div>
|
|
);
|
|
|
|
if (loading) {
|
|
return <LoadingComponent />;
|
|
}
|
|
|
|
return (
|
|
<Suspense fallback={<LoadingComponent />}>
|
|
<Routes>
|
|
{currentUser ? (
|
|
<>
|
|
<Route
|
|
element={
|
|
<Layout
|
|
currentUser={currentUser}
|
|
setCurrentUser={setCurrentUser}
|
|
isDarkMode={isDarkMode}
|
|
toggleDarkMode={toggleDarkMode}
|
|
>
|
|
<Outlet />
|
|
</Layout>
|
|
}
|
|
>
|
|
<Route
|
|
index
|
|
element={<Navigate to="/today" replace />}
|
|
/>
|
|
<Route path="/today" element={<TasksToday />} />
|
|
<Route
|
|
path="/task/:uid"
|
|
element={<TaskDetails />}
|
|
/>
|
|
<Route
|
|
path="/upcoming"
|
|
element={
|
|
<Suspense
|
|
fallback={
|
|
<div className="p-4">
|
|
{i18n.t(
|
|
'common.loading',
|
|
'Loading...'
|
|
)}
|
|
</div>
|
|
}
|
|
>
|
|
<Tasks />
|
|
</Suspense>
|
|
}
|
|
/>
|
|
<Route
|
|
path="/tasks"
|
|
element={
|
|
<Suspense
|
|
fallback={
|
|
<div className="p-4">
|
|
{i18n.t(
|
|
'common.loading',
|
|
'Loading...'
|
|
)}
|
|
</div>
|
|
}
|
|
>
|
|
<Tasks />
|
|
</Suspense>
|
|
}
|
|
/>
|
|
<Route path="/inbox" element={<InboxItems />} />
|
|
<Route path="/habits" element={<Habits />} />
|
|
<Route
|
|
path="/habit/:uid"
|
|
element={<HabitDetails />}
|
|
/>
|
|
<Route path="/projects" element={<Projects />} />
|
|
<Route
|
|
path="/project/:uidSlug"
|
|
element={<ProjectDetails />}
|
|
/>
|
|
<Route path="/areas" element={<Areas />} />
|
|
<Route path="/area/:id" element={<AreaDetails />} />
|
|
<Route path="/tags" element={<Tags />} />
|
|
<Route
|
|
path="/tag/:uidSlug"
|
|
element={<TagDetails />}
|
|
/>
|
|
<Route path="/views" element={<Views />} />
|
|
<Route
|
|
path="/views/:uid"
|
|
element={<ViewDetail />}
|
|
/>
|
|
<Route path="/notes" element={<Notes />} />
|
|
<Route path="/notes/:uid" element={<Notes />} />
|
|
<Route
|
|
path="/note/:uidSlug"
|
|
element={<NoteDetails />}
|
|
/>
|
|
<Route path="/calendar" element={<Calendar />} />
|
|
<Route
|
|
path="/profile"
|
|
element={
|
|
<ProfileSettings
|
|
currentUser={currentUser}
|
|
isDarkMode={isDarkMode}
|
|
toggleDarkMode={toggleDarkMode}
|
|
/>
|
|
}
|
|
/>
|
|
<Route
|
|
path="/about"
|
|
element={<About isDarkMode={isDarkMode} />}
|
|
/>
|
|
<Route path="/backup" element={<BackupRestore />} />
|
|
<Route
|
|
path="/admin/users"
|
|
element={
|
|
currentUser?.is_admin === true ? (
|
|
<React.Suspense
|
|
fallback={
|
|
<div className="p-4">
|
|
Loading...
|
|
</div>
|
|
}
|
|
>
|
|
{React.createElement(
|
|
React.lazy(
|
|
() =>
|
|
import(
|
|
'./components/Admin/AdminUsersPage'
|
|
)
|
|
)
|
|
)}
|
|
</React.Suspense>
|
|
) : (
|
|
<Navigate to="/today" replace />
|
|
)
|
|
}
|
|
/>
|
|
<Route path="*" element={<NotFound />} />
|
|
</Route>
|
|
</>
|
|
) : (
|
|
<>
|
|
<Route path="/login" element={<Login />} />
|
|
<Route path="/register" element={<Register />} />
|
|
<Route
|
|
path="/auth/callback/:provider"
|
|
element={<OIDCCallback />}
|
|
/>
|
|
<Route
|
|
path="/"
|
|
element={<Navigate to="/login" replace />}
|
|
/>
|
|
<Route
|
|
path="*"
|
|
element={<Navigate to="/login" replace />}
|
|
/>
|
|
</>
|
|
)}
|
|
</Routes>
|
|
</Suspense>
|
|
);
|
|
};
|
|
|
|
export default App;
|