marketing-shibata50/tududi
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
tududi/package.json
Chris c2e9a1aa21
feat: Add OIDC/SSO authentication support (#1008) 
* feat: add OIDC/SSO database schema and models (Phase 1)

Add database foundation for OpenID Connect authentication:

Database Migrations:
- Create oidc_identities table (links users to OIDC accounts)
- Create oidc_state_nonces table (OAuth state/nonce for CSRF protection)
- Create auth_audit_log table (security event logging)
- Make password_digest nullable in users table (allow OIDC-only users)

Models:
- OIDCIdentity: Links users to external OIDC providers
- OIDCStateNonce: Temporary OAuth state management
- AuthAuditLog: Authentication event audit trail

Changes:
- Updated User model to allow null password_digest
- Added model associations in models/index.js
- All migrations tested and verified

Related to #977

* feat: add OIDC core services (Phase 2)

- Install openid-client@^6.2.0 for OIDC protocol support
- Implement providerConfig.js for loading providers from .env
  - Support single provider or numbered providers (OIDC_PROVIDER_1_*, etc.)
  - Auto-provision and admin email domain configuration
  - Provider caching for performance
- Implement stateManager.js for OAuth state/nonce management
  - CSRF protection with 10-minute TTL
  - One-time use state consumption
  - Automatic cleanup of expired states
- Implement auditService.js for authentication event logging
  - Track login success/failure, logout, OIDC linking/unlinking
  - Store IP address, user agent, and metadata
  - Support for event queries and retention cleanup
- Add comprehensive unit tests (60 tests, all passing)
  - providerConfig: 36 tests for env parsing and validation
  - stateManager: 12 tests for state lifecycle and security
  - auditService: 12 tests for event logging and queries

Phase 2 completes the backend core services needed for OIDC authentication.

* feat: implement OIDC authentication flow (Phase 3)

Core OIDC Flow (service.js):
- Provider discovery with issuer caching
- Authorization URL generation with state/nonce
- OAuth callback handling and token exchange
- ID token validation using openid-client
- Token refresh functionality

JIT User Provisioning (provisioningService.js):
- Auto-create users from OIDC claims
- Link existing email accounts to OIDC identities
- Admin role assignment based on email domain rules
- Automatic username generation from email
- Transaction-safe identity creation

Identity Management (oidcIdentityService.js):
- List user's linked OIDC identities
- Link additional providers to existing accounts
- Unlink identities with safety checks
- Prevent unlinking last auth method
- Update identity claims on login

HTTP Layer (controller.js + routes.js):
- GET /api/oidc/providers - List configured providers
- GET /api/oidc/auth/:slug - Initiate OIDC flow
- GET /api/oidc/callback/:slug - Handle OAuth callback
- POST /api/oidc/link/:slug - Link provider to current user
- DELETE /api/oidc/unlink/:id - Unlink identity
- GET /api/oidc/identities - Get user's identities

Integration:
- Register OIDC routes in Express app (public + authenticated)
- Update auth service to reject password login for OIDC-only users
- Audit logging for all OIDC operations
- Session creation on successful authentication

Security:
- State/nonce CSRF protection
- One-time use state consumption
- Transaction-safe user provisioning
- Foreign key constraints enforced

* feat: implement OIDC frontend login flow (Phase 4)

- Created OIDCProviderButtons component for SSO login options
- Created OIDCCallback component for OAuth callback handling
- Updated Login page to fetch and display OIDC providers
- Added /auth/callback/:provider route to App.tsx
- Added i18n translations for OIDC UI elements
- Downgraded openid-client to v5.7.0 (CommonJS compatibility)
- Fixed linting issues in backend OIDC modules

Phase 4 completes the frontend login flow for OIDC/SSO authentication.
Users can now see configured SSO providers on the login page.

* feat: implement OIDC account linking UI (Phase 5)

Add Connected Accounts section to Profile Security tab allowing users to:
- View linked OIDC provider accounts
- Link new SSO providers to their account
- Unlink OIDC identities with validation
- Prevent unlinking last authentication method

Backend changes:
- Add has_password virtual field to User model
- Include has_password in profile API response
- Track whether user has password set for validation

Frontend changes:
- Create oidcService for OIDC API operations
- Create ConnectedAccounts component with link/unlink flows
- Add confirmation dialog before unlinking accounts
- Validate that users cannot unlink their last auth method
- Show warning if user has no password set
- Integrate Connected Accounts into SecurityTab

User experience:
- View all linked SSO provider accounts with email and link date
- Link additional providers via "Link Provider" buttons
- Unlink with two-step confirmation to prevent accidents
- Clear error messages when unlinking would leave no auth method
- Warning message suggesting password setup for OIDC-only users

Fixes #977

* feat: complete OIDC documentation and UI improvements (Phase 6)

This commit completes Phase 6 of the OIDC/SSO implementation with comprehensive
documentation, bug fixes, and UI reorganization.

Documentation:
- Add comprehensive user guide at docs/10-oidc-sso.md with:
  - Setup guides for 6 major providers (Google, Okta, Keycloak, Authentik, PocketID, Azure AD)
  - Configuration examples for single and multiple providers
  - User features documentation (login, account linking, management)
  - Advanced topics (auto-provisioning, admin role assignment, hybrid auth)
  - Comprehensive troubleshooting section
  - Security considerations and best practices
- Update README.md with OIDC/SSO section and quick setup examples

Internationalization:
- Add i18n support to OIDCProviderButtons component
- Add translation keys for all OIDC UI text
- Update English translations with "sign_in_with" key

Bug Fixes:
- Fix oidcService.ts to correctly unwrap API responses
  - Backend returns {providers: [...]} and {identities: [...]}
  - Frontend was expecting plain arrays, causing "map is not a function" error
- Fix initiateOIDCLink to properly handle POST response

UI Improvements:
- Move OIDC/SSO to dedicated tab in profile settings
  - Create new OIDCTab component with green LinkIcon
  - Remove ConnectedAccounts from SecurityTab
  - Add OIDC tab between Security and API Keys tabs
  - Update ProfileSettings with new tab configuration
- Security tab now focuses solely on password management

Testing:
- All linting passes
- All tests pass (82 suites, 1223 tests)

Related to #977

* feat: add OIDC/SSO translations for all 24 languages

Add i18n support for OIDC/SSO features across all supported languages:
- "Sign in with {{provider}}" button text
- "OIDC/SSO" tab label in profile settings
- OIDC authentication flow messages

Translations added for: Arabic, Bulgarian, Danish, German, Greek, Spanish,
Finnish, French, Indonesian, Italian, Japanese, Korean, Dutch, Norwegian,
Polish, Portuguese, Romanian, Russian, Slovenian, Swedish, Turkish,
Ukrainian, Vietnamese, and Chinese.

* fix: resolve 13 CodeQL security alerts

This commit addresses critical security vulnerabilities identified by CodeQL scanning:

**Security Configuration (2 fixes)**
- Fix insecure Helmet configuration - enable CSP and HSTS in production
- Fix clear text cookie transmission - enable secure cookies in production

**Path Injection (3 fixes)**
- Add path validation in users/controller.js to prevent arbitrary file deletion
- Add path validation in users/service.js for avatar operations
- Add path sanitization in attachment-utils.js deleteFileFromDisk function

**Cross-Site Scripting (1 fix)**
- Fix XSS vulnerability in GeneralTab.tsx avatar URL handling
- Add URL sanitization to prevent javascript: protocol attacks

**URL Security (2 fixes)**
- Fix double escaping in url/service.js HTML entity decoding
- Fix incomplete URL sanitization for YouTube domain validation

**Denial of Service (1 fix)**
- Add loop bound protection in inboxProcessingService.js (10k char limit)

**Rate Limiting (3 fixes)**
- Add rate limiting to auth routes (register, verify-email)
- Add rate limiting to task attachment upload/delete endpoints
- Add rate limiting to user avatar upload/delete endpoints

**GitHub Actions Security (1 fix)**
- Add explicit read-only permissions to CI workflow

Note: CSRF middleware (#10) requires frontend changes and is tracked separately.

Relates to PR #1008

* fix: allow test files in path validation for tests

* fix: format long condition in attachment-utils for Prettier compliance

Break the path validation condition across multiple lines to meet Prettier formatting requirements and fix CI linting failure.

* fix: resolve CodeQL security alerts

- Add rate limiting to OIDC authentication routes using authLimiter and authenticatedApiLimiter
- Implement CSRF protection middleware using csrf-sync (skips for API tokens and test environment)
- Add CSRF token endpoint at /api/csrf-token
- Fix incomplete URL scheme validation in GeneralTab to block all dangerous schemes (javascript:, data:, vbscript:, file:)

This addresses 5 high-severity CodeQL security vulnerabilities:
- Missing rate limiting on OIDC auth routes
- Missing CSRF middleware protection
- Incomplete URL sanitization in avatar handling

All 1223 tests passing.

* fix: implement CSRF protection with lusca for CodeQL compliance

Add CSRF protection using lusca.csrf (CodeQL's recommended library) to
protect session-based authentication while supporting hybrid auth patterns.

Implementation:
- Pre-check middleware marks exempt requests (test env, Bearer tokens)
- Lusca CSRF middleware applied with exemption flag check
- Session-based requests require valid x-csrf-token header
- Bearer token requests exempt (don't use cookies)
- Test environment exempt for test execution

This addresses CodeQL security alert js/missing-token-validation while
maintaining support for both cookie-based and token-based authentication.

Related: #977 (OIDC/SSO authentication feature)
2026-04-13 12:17:35 +03:00

189 lines
7.2 KiB
JSON
Raw Blame History

{
"name": "tududi",
"version": "v1.0.0",
"description": "Self-hosted task management with hierarchical organization, multi-language support, and Telegram integration.",
"directories": {
"test": "test"
},
"scripts": {
"start": "bash scripts/start-all-dev.sh",
"dev": "npm run frontend:dev",
"build": "npm run frontend:build",
"pre-push": "lint-staged",
"pre-release": "npm run lint:fix && npm run format:fix && npm run test && npm run test:ui",
"test": "npm run backend:test",
"test:backend": "npm run backend:test",
"test:ui": "bash e2e/bin/run-e2e.sh && echo \"Success!\"",
"test:ui:mode": "cross-env E2E_MODE=ui bash e2e/bin/run-e2e.sh",
"test:ui:headed": "cross-env E2E_MODE=headed E2E_SLOWMO=500 bash e2e/bin/run-e2e.sh",
"test:watch": "npm run frontend:test:watch",
"test:coverage": "npm run frontend:test:coverage && npm run backend:test:coverage",
"frontend:dev": "webpack serve --config webpack.config.js --hot",
"frontend:start": "tsc --noEmit && webpack serve --config webpack.config.js",
"frontend:build": "npm run clean && tsc --noEmit && webpack --config webpack.config.js",
"frontend:test": "jest",
"frontend:test:watch": "jest --watch",
"frontend:test:coverage": "jest --coverage",
"frontend:lint": "eslint 'frontend/**/*.{js,jsx,ts,tsx}'",
"frontend:lint:fix": "eslint --fix 'frontend/**/*.{js,jsx,ts,tsx}'",
"frontend:format": "prettier -c 'frontend/**/*.{js,jsx,ts,tsx}'",
"frontend:format:fix": "prettier --write 'frontend/**/*.{js,jsx,ts,tsx}'",
"backend:start": "cd backend && ./cmd/start-dev.sh",
"backend:dev": "cd backend && nodemon app.js",
"backend:test": "cd backend && cross-env NODE_ENV=test jest",
"backend:test:watch": "cd backend && cross-env NODE_ENV=test jest --watch",
"backend:test:coverage": "cd backend && cross-env NODE_ENV=test jest --coverage",
"backend:test:unit": "cd backend && cross-env NODE_ENV=test jest tests/unit",
"backend:test:integration": "cd backend && cross-env NODE_ENV=test jest tests/integration",
"backend:lint": "cd backend && eslint .",
"backend:lint:fix": "cd backend && eslint . --fix",
"backend:format": "cd backend && prettier -c .",
"backend:format:fix": "cd backend && prettier --write .",
"db:init": "cd backend && node scripts/db-init.js",
"db:sync": "cd backend && node scripts/db-sync.js",
"db:migrate": "cd backend && node scripts/db-migrate.js",
"db:reset": "cd backend && node scripts/db-reset.js",
"db:status": "cd backend && node scripts/db-status.js",
"db:seed": "cd backend && node scripts/seed-dev-data.js",
"db:reset-and-seed": "cd backend && NODE_ENV=development node scripts/reset-and-seed.js",
"user:create": "cd backend && node scripts/user-create.js",
"migration:create": "cd backend && node scripts/migration-create.js",
"migration:run": "cd backend && npx sequelize-cli db:migrate",
"migration:undo": "cd backend && npx sequelize-cli db:migrate:undo",
"migration:undo:all": "cd backend && npx sequelize-cli db:migrate:undo:all",
"migration:status": "cd backend && npx sequelize-cli db:migrate:status",
"clean": "rimraf dist",
"lint": "npm run frontend:lint && npm run backend:lint",
"lint:fix": "npm run frontend:lint:fix && npm run backend:lint:fix",
"format": "npm run frontend:format && npm run backend:format",
"format:fix": "npm run frontend:format:fix && npm run backend:format:fix",
"docker:test-build": "bash scripts/test-docker-build.sh",
"kill:all": "lsof -ti:8080,3002 | xargs kill -9 2>/dev/null || true",
"mcp:start": "cd backend && node modules/mcp/server.js",
"mcp:dev": "cd backend && nodemon modules/mcp/server.js"
},
"keywords": [],
"author": "",
"license": "ISC",
"devDependencies": {
"@babel/core": "^7.25.7",
"@babel/preset-env": "^7.25.7",
"@babel/preset-react": "^7.25.7",
"@babel/preset-typescript": "^7.25.7",
"@dnd-kit/core": "^6.3.1",
"@dnd-kit/sortable": "^10.0.0",
"@dnd-kit/utilities": "^3.2.2",
"@faker-js/faker": "^10.1.0",
"@heroicons/react": "^2.1.5",
"@pmmmwh/react-refresh-webpack-plugin": "^0.5.15",
"@swc/core": "^1.13.3",
"@testing-library/jest-dom": "^6.0.0",
"@testing-library/react": "^14.0.0",
"@testing-library/user-event": "^14.0.0",
"@types/jest": "^29.0.0",
"@types/node": "^20.0.0",
"@types/react": "^18.3.10",
"@types/react-dom": "^18.3.0",
"@types/react-router-dom": "^5.3.3",
"@yaireo/tagify": "^4.31.3",
"autoprefixer": "^10.4.20",
"babel-jest": "^29.0.0",
"babel-loader": "^9.2.1",
"copy-webpack-plugin": "^14.0.0",
"cross-env": "~7.0.3",
"css-loader": "^7.1.2",
"eslint": "^8.0.0",
"eslint-plugin-jest": "^29.0.1",
"eslint-plugin-prettier": "^5.5.1",
"eslint-plugin-react": "^7.37.5",
"globals": "^15.11.0",
"highlight.js": "^11.11.1",
"html-webpack-plugin": "^5.6.3",
"i18next": "^24.2.3",
"i18next-browser-languagedetector": "^8.0.4",
"i18next-http-backend": "^3.0.2",
"identity-obj-proxy": "^3.0.0",
"jest": "^29.0.0",
"jest-environment-jsdom": "^30.3.0",
"lint-staged": "^16.2.7",
"nodemon": "~3.0.1",
"postcss": "^8.4.47",
"postcss-loader": "^8.1.1",
"prettier": "^3.6.2",
"react": "^18.3.1",
"react-dom": "^18.3.1",
"react-i18next": "^15.4.1",
"react-markdown": "^10.1.0",
"react-refresh": "^0.14.2",
"react-router-dom": "^6.26.2",
"react-tagify": "^1.0.7",
"recharts": "^2.15.4",
"rehype-highlight": "^7.0.2",
"remark-gfm": "^4.0.1",
"rimraf": "^6.0.1",
"style-loader": "^4.0.0",
"supertest": "~7.1.1",
"supertest-session": "^5.0.1",
"swc-loader": "^0.2.6",
"swr": "^2.2.5",
"tailwindcss": "^3.4.13",
"ts-jest": "^29.0.0",
"ts-loader": "^9.5.1",
"typescript": "^5.6.2",
"typescript-eslint": "^8.36.0",
"webpack": "^5.95.0",
"webpack-cli": "^5.1.4",
"webpack-dev-server": "^5.1.0",
"zustand": "^5.0.3"
},
"dependencies": {
"@dr.pogodin/csurf": "^1.16.9",
"@modelcontextprotocol/sdk": "^1.0.0",
"@playwright/test": "^1.57.0",
"bcrypt": "~6.0.0",
"compression": "~1.8.0",
"compromise": "^14.14.4",
"connect-session-sequelize": "~7.1.7",
"cors": "~2.8.5",
"date-fns": "^4.1.0",
"date-fns-tz": "^3.2.0",
"dotenv": "~16.5.0",
"express": "^4.21.2",
"express-rate-limit": "^8.2.1",
"express-session": "~1.18.1",
"helmet": "~8.1.0",
"js-yaml": "~4.1.0",
"linguaisync": "^0.1.2",
"lodash": "~4.18.1",
"lusca": "^1.7.0",
"moment-timezone": "~0.6.0",
"morgan": "~1.10.0",
"multer": "~2.1.0",
"nanoid": "^3.3.7",
"node-cron": "~4.1.0",
"nodemailer": "^8.0.5",
"openid-client": "^5.7.1",
"sequelize": "~6.37.7",
"sequelize-cli": "~6.6.2",
"slugify": "^1.6.6",
"sqlite3": "^6.0.1",
"swagger-jsdoc": "^6.2.8",
"swagger-ui-express": "^5.0.1",
"use-debounce": "^10.0.6",
"uuid": "~11.1.0",
"web-push": "^3.6.7"
},
"overrides": {
"tar": "^7.5.8"
},
"lint-staged": {
"frontend/**/*.{js,jsx,ts,tsx}": [
"eslint --fix",
"prettier --write"
],
"backend/**/*.{js,ts}": [
"eslint --fix",
"prettier --write"
]
}
}
Reference in a new issue View git blame Copy permalink