chore: Update version

Closes #533

.github/workflows/build-and push release-package.yml

@@ -0,0 +1,57 @@
+name: Build and publish release package
+
+on:
+  release:
+    types: [created]
+
+
+jobs:
+  build-and-publish-release-package:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v3
+        with:
+          node-version: '18'
+          cache: 'npm'
+
+      - name: Workflow install pnpm
+        run: npm install pnpm -g
+
+      - name: Client install dependencies
+        run: pnpm install
+
+      - name: Server install dependencies
+        run: pnpm install
+
+      - name: Server include into dist
+        run: mv server/ dist/
+
+      - name: Client build production
+        run: |
+          npm run build
+        working-directory: ./client
+
+      - name: Client include into dist
+        run: |
+          mv build/index.html ../dist/views/index.ejs
+          mv build/* ../dist/public/
+        working-directory: ./client
+
+      - name: Dist include README.md SECURITY.md LICENSE start.sh
+        run: mv README.md SECURITY.md LICENSE start.sh dist/
+
+      - name: Dist Remove node modules
+        run: rm -R dist/node_modules
+
+      - name: Dist create .zip file
+        run: |
+          mv dist/ planka/
+          zip -r planka-prebuild-${{ github.event.release.tag_name }}.zip planka
+
+      - name: Dist upload assets
+        run: |
+          gh release upload ${{ github.event.release.tag_name }} planka-prebuild-${{ github.event.release.tag_name }}.zip
+        env:
+          GH_TOKEN: ${{ github.token }}

.github/workflows/build-and-push-docker-base-image.yml

@@ -13,26 +13,26 @@ env:
 
 jobs:
   build-and-push-docker-base-image:
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
+        uses: docker/setup-qemu-action@v2
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v2
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v4
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/arm/v7

.github/workflows/build-and-push-docker-image-dev.yml

@@ -0,0 +1,39 @@
+name: Build and push Docker DEV image
+
+on:
+  push:
+    paths-ignore:
+      - '.github/**'
+      - 'charts/**'
+      - 'docker-*.sh'
+      - '*.md'
+    branches: [master]
+
+jobs:
+  build-and-push-docker-image-dev:
+    runs-on: self-hosted
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          push: true
+          tags: |
+            ghcr.io/plankanban/planka:dev

.github/workflows/build-and-push-docker-image.yml

@@ -6,19 +6,19 @@ on:
 
 jobs:
   build-and-push-docker-image:
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
+        uses: docker/setup-qemu-action@v2
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v2
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -32,7 +32,7 @@ jobs:
           script: return context.payload.release.tag_name.replace('v', '')
 
       - name: Build and push
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v4
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/arm/v7

.github/workflows/helm-chart-release.yml

@@ -13,10 +13,10 @@ jobs:
     # see: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
     permissions:
       contents: write
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
@@ -38,5 +38,6 @@ jobs:
         uses: helm/chart-releaser-action@v1.5.0
         with:
           charts_dir: charts
+          mark_as_latest: false
         env:
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

Dockerfile

@@ -5,7 +5,8 @@ WORKDIR /app
 COPY server/package.json server/package-lock.json .
 
 RUN npm install npm@latest --global \
-  && npm clean-install --omit=dev
+  && npm install pnpm --global \
+  && pnpm install --prod
 
 FROM node:lts AS client
 
@@ -14,7 +15,8 @@ WORKDIR /app
 COPY client/package.json client/package-lock.json .
 
 RUN npm install npm@latest --global \
-  && npm clean-install --omit=dev
+  && npm install pnpm --global \
+  && pnpm install --prod
 
 COPY client .
 RUN DISABLE_ESLINT_PLUGIN=true npm run build

README.md

@@ -20,9 +20,9 @@
 
 ## How to deploy Planka
 
-There are 2 types of installation:
-- [Without Docker](https://docs.planka.cloud/docs/installl-planka/Debian%20&%20Ubuntu) ([for Windows](https://docs.planka.cloud/docs/installl-planka/Windows))
-- [Dockerized](https://docs.planka.cloud/docs/installl-planka/Docker%20Compose)
+There are many ways to install Planka
+
+[Check them out](https://docs.planka.cloud/docs/intro)
 
 For configuration, please see the [configuration section](https://docs.planka.cloud/docs/category/configuration).
 

charts/planka/Chart.yaml

@@ -15,16 +15,16 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.1
+version: 0.1.9
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "1.12.0"
+appVersion: "1.14.3"
 
 dependencies:
-- alias: postgresql
+  - alias: postgresql
     condition: postgresql.enabled
     name: postgresql
     repository: &bitnami-repo https://charts.bitnami.com/bitnami

charts/planka/README.md

@@ -21,7 +21,11 @@ git clone https://github.com/Chris-Greaves/planka-helm-chart.git
 cd planka-helm-chart
 helm dependency build
 export SECRETKEY=$(openssl rand -hex 64)
-helm install planka . --set secretkey=$SECRETKEY
+helm install planka . --set secretkey=$SECRETKEY  \
+--set admin_email="demo@demo.demo"  \
+--set admin_password="demo"  \
+--set admin_name="Demo Demo" \
+--set admin_username="demo"
 ```
 
 > **NOTE:** The command `openssl rand -hex 64` is needed to create a random hexadecimal key for planka. On Windows you can use Git Bash to run that command.
@@ -39,11 +43,19 @@ To access Planka externally you can use the following configuration
 ```bash
 # HTTP only
 helm install planka . --set secretkey=$SECRETKEY \
+--set admin_email="demo@demo.demo"  \
+--set admin_password="demo"  \
+--set admin_name="Demo Demo" \
+--set admin_username="demo"
 --set ingress.enabled=true \
 --set ingress.hosts[0].host=planka.example.dev \
 
 # HTTPS
 helm install planka . --set secretkey=$SECRETKEY \
+--set admin_email="demo@demo.demo"  \
+--set admin_password="demo"  \
+--set admin_name="Demo Demo" \
+--set admin_username="demo"
 --set ingress.enabled=true \
 --set ingress.hosts[0].host=planka.example.dev \
 --set ingress.tls[0].secretName=planka-tls \
@@ -54,6 +66,16 @@ or create a values.yaml file like:
 
 ```yaml
 secretkey: "<InsertSecretKey>"
+# The admin section needs to be present for new instances of Planka, after the first start you can remove the lines starting with admin_. If you want the admin user to be unchangeable admin_email: has to stay
+# After changing the config you have to run ```helm upgrade  planka . -f values.yaml```
+
+# Admin user
+admin_email: "demo@demo.demo" # Do not remove if you want to prevent this user from being edited/deleted
+admin_password: "demo"
+admin_name: "Demo Demo"
+admin_username: "demo"
+# Admin user
+
 ingress:
   enabled: true
   hosts:

charts/planka/templates/deployment.yaml

@@ -64,7 +64,9 @@ spec:
                   name: planka-postgresql-svcbind-custom-user
                   key: uri
             - name: BASE_URL
-              {{- if .Values.ingress.enabled }}
+              {{- if .Values.baseUrl }}
+              value: {{ .Values.baseUrl }}
+              {{- else if .Values.ingress.enabled }}
               value: {{ printf "https://%s" (first .Values.ingress.hosts).host }}
               {{- else }}
               value: http://localhost:3000
@@ -73,6 +75,18 @@ spec:
               value: {{ required "A secret key needs to be generated using 'openssl rand -hex 64' and assigned to secretkey." .Values.secretkey }}
             - name: TRUST_PROXY
               value: "0"
+            - name: DEFAULT_ADMIN_EMAIL
+              value: {{ .Values.admin_email }}
+            - name: DEFAULT_ADMIN_PASSWORD
+              value: {{ .Values.admin_password }}
+            - name: DEFAULT_ADMIN_NAME
+              value: {{ .Values.admin_name }}
+            - name: DEFAULT_ADMIN_USERNAME
+              value: {{ .Values.admin_username }}
+          {{ range $k, $v := .Values.env }}
+            - name: {{ $k | quote }}
+              value: {{ $v | quote }}
+          {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

charts/planka/values.yaml

@@ -17,6 +17,10 @@ fullnameOverride: ""
 # Generate a secret using openssl rand -base64 45
 secretkey: ""
 
+# Base url for Planka. Will override `ingress.hosts[0].host`
+# Defaults to `http://localhost:3000` if ingress is disabled.
+baseUrl: ""
+
 serviceAccount:
   # Specifies whether a service account should be created
   create: true
@@ -50,6 +54,7 @@ ingress:
     # kubernetes.io/ingress.class: nginx
     # kubernetes.io/tls-acme: "true"
   hosts:
+      # Used to set planka BASE_URL if no `baseurl` is provided.
     - host: planka.local
       paths:
         - path: /

client/.env

@@ -1 +1 @@
-REACT_APP_VERSION=1.12.0
+REACT_APP_VERSION=1.14.3

client/package-lock.json

@@ -18,6 +18,7 @@
         "js-cookie": "^3.0.1",
         "jwt-decode": "^3.1.2",
         "lodash": "^4.17.21",
+        "nanoid": "^5.0.2",
         "node-sass": "^8.0.0",
         "photoswipe": "^5.3.3",
         "prop-types": "^15.8.1",
@@ -16407,14 +16408,20 @@
       "integrity": "sha512-2ZTgtl0nJsO0KQCjEpxcIr5D+Yv90plTitZt9JBfQvVJDS5seMl3FOvsh3+9CoYWXf/1l5OaZzzF6nDm4cagaQ=="
     },
     "node_modules/nanoid": {
-      "version": "3.3.4",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.4.tgz",
-      "integrity": "sha512-MqBkQh/OHTS2egovRtLk45wEyNXwF+cokD+1YPf9u5VfJiRdAiRwB2froX5Co9Rh20xs4siNPm8naNotSD6RBw==",
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-5.0.2.tgz",
+      "integrity": "sha512-2ustYUX1R2rL/Br5B/FMhi8d5/QzvkJ912rBYxskcpu0myTHzSZfTr1LAS2Sm7jxRUObRrSBFoyzwAhL49aVSg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
       "bin": {
-        "nanoid": "bin/nanoid.cjs"
+        "nanoid": "bin/nanoid.js"
       },
       "engines": {
-        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+        "node": "^18 || >=20"
       }
     },
     "node_modules/natural-compare": {
@@ -18658,6 +18665,23 @@
       "resolved": "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz",
       "integrity": "sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ=="
     },
+    "node_modules/postcss/node_modules/nanoid": {
+      "version": "3.3.6",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.6.tgz",
+      "integrity": "sha512-BGcqMMJuToF7i1rt+2PWSNVnWIkGCU78jBG3RxO/bZlnZPK2Cmi2QaffxGO/2RvWi9sL+FAiRiXMgsyxQ1DIDA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
     "node_modules/prelude-ls": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
@@ -35471,9 +35495,9 @@
       "integrity": "sha512-2ZTgtl0nJsO0KQCjEpxcIr5D+Yv90plTitZt9JBfQvVJDS5seMl3FOvsh3+9CoYWXf/1l5OaZzzF6nDm4cagaQ=="
     },
     "nanoid": {
-      "version": "3.3.4",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.4.tgz",
-      "integrity": "sha512-MqBkQh/OHTS2egovRtLk45wEyNXwF+cokD+1YPf9u5VfJiRdAiRwB2froX5Co9Rh20xs4siNPm8naNotSD6RBw=="
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-5.0.2.tgz",
+      "integrity": "sha512-2ustYUX1R2rL/Br5B/FMhi8d5/QzvkJ912rBYxskcpu0myTHzSZfTr1LAS2Sm7jxRUObRrSBFoyzwAhL49aVSg=="
     },
     "natural-compare": {
       "version": "1.4.0",
@@ -36252,6 +36276,13 @@
         "nanoid": "^3.3.4",
         "picocolors": "^1.0.0",
         "source-map-js": "^1.0.2"
+      },
+      "dependencies": {
+        "nanoid": {
+          "version": "3.3.6",
+          "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.6.tgz",
+          "integrity": "sha512-BGcqMMJuToF7i1rt+2PWSNVnWIkGCU78jBG3RxO/bZlnZPK2Cmi2QaffxGO/2RvWi9sL+FAiRiXMgsyxQ1DIDA=="
+        }
       }
     },
     "postcss-attribute-case-insensitive": {

client/package.json

@@ -65,6 +65,7 @@
     "js-cookie": "^3.0.1",
     "jwt-decode": "^3.1.2",
     "lodash": "^4.17.21",
+    "nanoid": "^5.0.2",
     "node-sass": "^8.0.0",
     "photoswipe": "^5.3.3",
     "prop-types": "^15.8.1",

client/src/actions/core.js

@@ -39,6 +39,14 @@ const initializeCore = (
   },
 });
 
+// TODO: with success?
+initializeCore.fetchConfig = (config) => ({
+  type: ActionTypes.CORE_INITIALIZE__CONFIG_FETCH,
+  payload: {
+    config,
+  },
+});
+
 const logout = () => ({
   type: ActionTypes.LOGOUT,
   payload: {},

client/src/actions/login.js

@@ -1,5 +1,12 @@
 import ActionTypes from '../constants/ActionTypes';
 
+const initializeLogin = (config) => ({
+  type: ActionTypes.LOGIN_INITIALIZE,
+  payload: {
+    config,
+  },
+});
+
 const authenticate = (data) => ({
   type: ActionTypes.AUTHENTICATE,
   payload: {
@@ -21,12 +28,33 @@ authenticate.failure = (error) => ({
   },
 });
 
+const authenticateUsingOidc = () => ({
+  type: ActionTypes.USING_OIDC_AUTHENTICATE,
+  payload: {},
+});
+
+authenticateUsingOidc.success = (accessToken) => ({
+  type: ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS,
+  payload: {
+    accessToken,
+  },
+});
+
+authenticateUsingOidc.failure = (error) => ({
+  type: ActionTypes.USING_OIDC_AUTHENTICATE__FAILURE,
+  payload: {
+    error,
+  },
+});
+
 const clearAuthenticateError = () => ({
   type: ActionTypes.AUTHENTICATE_ERROR_CLEAR,
   payload: {},
 });
 
 export default {
+  initializeLogin,
   authenticate,
+  authenticateUsingOidc,
   clearAuthenticateError,
 };

client/src/api/access-tokens.js

@@ -5,10 +5,14 @@ import socket from './socket';
 
 const createAccessToken = (data, headers) => http.post('/access-tokens', data, headers);
 
+const exchangeForAccessTokenUsingOidc = (data, headers) =>
+  http.post('/access-tokens/exchange-using-oidc', data, headers);
+
 const deleteCurrentAccessToken = (headers) =>
   socket.delete('/access-tokens/me', undefined, headers);
 
 export default {
   createAccessToken,
+  exchangeForAccessTokenUsingOidc,
   deleteCurrentAccessToken,
 };

client/src/api/http.js

@@ -5,9 +5,11 @@ import Config from '../constants/Config';
 const http = {};
 
 // TODO: add all methods
-['POST'].forEach((method) => {
+['GET', 'POST'].forEach((method) => {
   http[method.toLowerCase()] = (url, data, headers) => {
-    const formData = Object.keys(data).reduce((result, key) => {
+    const formData =
+      data &&
+      Object.keys(data).reduce((result, key) => {
         result.append(key, data[key]);
 
         return result;

client/src/api/index.js

@@ -1,5 +1,6 @@
 import http from './http';
 import socket from './socket';
+import root from './root';
 import accessTokens from './access-tokens';
 import users from './users';
 import projects from './projects';
@@ -20,6 +21,7 @@ import notifications from './notifications';
 export { http, socket };
 
 export default {
+  ...root,
   ...accessTokens,
   ...users,
   ...projects,

client/src/api/root.js

@@ -0,0 +1,9 @@
+import http from './http';
+
+/* Actions */
+
+const getConfig = (headers) => http.get('/config', undefined, headers);
+
+export default {
+  getConfig,
+};

client/src/components/CardModal/Activities/CommentEdit.jsx

@@ -5,7 +5,7 @@ import { useTranslation } from 'react-i18next';
 import TextareaAutosize from 'react-textarea-autosize';
 import { Button, Form, TextArea } from 'semantic-ui-react';
 
-import { useClosableForm, useForm } from '../../../hooks';
+import { useForm } from '../../../hooks';
 
 import styles from './CommentEdit.module.scss';
 
@@ -35,12 +35,7 @@ const CommentEdit = React.forwardRef(({ children, defaultData, onUpdate }, ref)
       text: data.text.trim(),
     };
 
-    if (!cleanData.text) {
-      textField.current.ref.current.select();
-      return;
-    }
-
-    if (!dequal(cleanData, defaultData)) {
+    if (cleanData.text && !dequal(cleanData, defaultData)) {
       onUpdate(cleanData);
     }
 
@@ -65,10 +60,9 @@ const CommentEdit = React.forwardRef(({ children, defaultData, onUpdate }, ref)
     [submit],
   );
 
-  const [handleFieldBlur, handleControlMouseOver, handleControlMouseOut] = useClosableForm(
-    close,
-    isOpened,
-  );
+  const handleFieldBlur = useCallback(() => {
+    submit();
+  }, [submit]);
 
   const handleSubmit = useCallback(() => {
     submit();
@@ -99,13 +93,7 @@ const CommentEdit = React.forwardRef(({ children, defaultData, onUpdate }, ref)
         onBlur={handleFieldBlur}
       />
       <div className={styles.controls}>
-        {/* eslint-disable-next-line jsx-a11y/mouse-events-have-key-events */}
-        <Button
-          positive
-          content={t('action.save')}
-          onMouseOver={handleControlMouseOver}
-          onMouseOut={handleControlMouseOut}
-        />
+        <Button positive content={t('action.save')} />
       </div>
     </Form>
   );

client/src/components/CardModal/DescriptionEdit.jsx

@@ -100,7 +100,6 @@ const DescriptionEdit = React.forwardRef(({ children, defaultValue, onUpdate },
         onChange={setValue}
       />
       <div className={styles.controls}>
-        {/* eslint-disable-next-line jsx-a11y/mouse-events-have-key-events */}
         <Button positive content={t('action.save')} />
       </div>
     </Form>

client/src/components/CardModal/Tasks/NameEdit.jsx

@@ -4,7 +4,7 @@ import { useTranslation } from 'react-i18next';
 import TextareaAutosize from 'react-textarea-autosize';
 import { Button, Form, TextArea } from 'semantic-ui-react';
 
-import { useClosableForm, useField } from '../../../hooks';
+import { useField } from '../../../hooks';
 
 import styles from './NameEdit.module.scss';
 
@@ -28,12 +28,7 @@ const NameEdit = React.forwardRef(({ children, defaultValue, onUpdate }, ref) =>
   const submit = useCallback(() => {
     const cleanValue = value.trim();
 
-    if (!cleanValue) {
-      field.current.ref.current.select();
-      return;
-    }
-
-    if (cleanValue !== defaultValue) {
+    if (cleanValue && cleanValue !== defaultValue) {
       onUpdate(cleanValue);
     }
 
@@ -60,10 +55,9 @@ const NameEdit = React.forwardRef(({ children, defaultValue, onUpdate }, ref) =>
     [submit],
   );
 
-  const [handleFieldBlur, handleControlMouseOver, handleControlMouseOut] = useClosableForm(
-    close,
-    isOpened,
-  );
+  const handleFieldBlur = useCallback(() => {
+    submit();
+  }, [submit]);
 
   const handleSubmit = useCallback(() => {
     submit();
@@ -93,13 +87,7 @@ const NameEdit = React.forwardRef(({ children, defaultValue, onUpdate }, ref) =>
         onBlur={handleFieldBlur}
       />
       <div className={styles.controls}>
-        {/* eslint-disable-next-line jsx-a11y/mouse-events-have-key-events */}
-        <Button
-          positive
-          content={t('action.save')}
-          onMouseOver={handleControlMouseOver}
-          onMouseOut={handleControlMouseOut}
-        />
+        <Button positive content={t('action.save')} />
       </div>
     </Form>
   );

client/src/components/CardModal/Tasks/Tasks.jsx

@@ -48,6 +48,8 @@ const Tasks = React.memo(({ items, canEdit, onCreate, onUpdate, onMove, onDelete
   return (
     <>
       {items.length > 0 && (
+        <>
+          <span className={styles.progressWrapper}>
             <Progress
               autoSuccess
               value={completedItems.length}
@@ -56,6 +58,11 @@ const Tasks = React.memo(({ items, canEdit, onCreate, onUpdate, onMove, onDelete
               size="tiny"
               className={styles.progress}
             />
+          </span>
+          <span className={styles.count}>
+            {completedItems.length}/{items.length}
+          </span>
+        </>
       )}
       <DragDropContext onDragStart={handleDragStart} onDragEnd={handleDragEnd}>
         <Droppable droppableId="tasks" type={DroppableTypes.TASK}>

client/src/components/CardModal/Tasks/Tasks.module.scss

@@ -3,6 +3,23 @@
     margin: 0 0 16px;
   }
 
+  .progressWrapper {
+    display: inline-block;
+    padding: 3px 0;
+    vertical-align: top;
+    width: calc(100% - 50px);
+  }
+
+  .count {
+    color: #8c8c8c;
+    display: inline-block;
+    font-size: 14px;
+    line-height: 14px;
+    text-align: right;
+    vertical-align: top;
+    width: 50px;
+  }
+
   .taskButton {
     background: transparent;
     border: none;

client/src/components/Header/Header.jsx

@@ -2,7 +2,7 @@ import React, { useCallback } from 'react';
 import PropTypes from 'prop-types';
 import classNames from 'classnames';
 import { Link } from 'react-router-dom';
-import { Icon, Menu } from 'semantic-ui-react';
+import { Button, Icon, Menu } from 'semantic-ui-react';
 import { usePopup } from '../../lib/popup';
 
 import Paths from '../../constants/Paths';
@@ -55,15 +55,16 @@ const Header = React.memo(
               >
                 <Icon fitted name="arrow left" />
               </Menu.Item>
-              <Menu.Item
-                className={classNames(
-                  styles.item,
-                  canEditProject && styles.itemHoverable,
-                  styles.title,
-                )}
+              <Menu.Item className={classNames(styles.item, styles.title)}>
+                {project.name}
+                {canEditProject && (
+                  <Button
+                    className={classNames(styles.editButton, styles.target)}
                     onClick={handleProjectSettingsClick}
                   >
-                {project.name}
+                    <Icon fitted name="pencil" size="small" />
+                  </Button>
+                )}
               </Menu.Item>
             </Menu.Menu>
           )}

client/src/components/Header/Header.module.scss

@@ -1,4 +1,20 @@
 :global(#app) {
+  .editButton {
+    background: transparent;
+    box-shadow: none;
+    color: #fff;
+    font-size: 15px;
+    line-height: 34px;
+    margin-left: 8px;
+    opacity: 0;
+    padding: 0;
+    width: 34px;
+
+    &:hover {
+      background: rgba(255, 255, 255, 0.08);
+    }
+  }
+
   .item {
     cursor: auto;
     user-select: auto;
@@ -11,6 +27,10 @@
     &:hover {
       background: transparent;
       color: rgba(255, 255, 255, 0.9);
+
+      .target {
+        opacity: 1;
+      }
     }
   }
 

client/src/components/Login/Login.jsx

@@ -3,7 +3,7 @@ import React, { useCallback, useEffect, useMemo, useRef } from 'react';
 import PropTypes from 'prop-types';
 import classNames from 'classnames';
 import { useTranslation } from 'react-i18next';
-import { Form, Grid, Header, Message } from 'semantic-ui-react';
+import { Button, Form, Grid, Header, Message } from 'semantic-ui-react';
 import { useDidUpdate, usePrevious, useToggle } from '../../lib/hooks';
 import { Input } from '../../lib/custom-ui';
 
@@ -28,6 +28,21 @@ const createMessage = (error) => {
         type: 'error',
         content: 'common.invalidPassword',
       };
+    case 'Use single sign-on':
+      return {
+        type: 'error',
+        content: 'common.useSingleSignOn',
+      };
+    case 'Email already in use':
+      return {
+        type: 'error',
+        content: 'common.emailAlreadyInUse',
+      };
+    case 'Username already in use':
+      return {
+        type: 'error',
+        content: 'common.usernameAlreadyInUse',
+      };
     case 'Failed to fetch':
       return {
         type: 'warning',
@@ -47,7 +62,16 @@ const createMessage = (error) => {
 };
 
 const Login = React.memo(
-  ({ defaultData, isSubmitting, error, onAuthenticate, onMessageDismiss }) => {
+  ({
+    defaultData,
+    isSubmitting,
+    isSubmittingUsingOidc,
+    error,
+    withOidc,
+    onAuthenticate,
+    onAuthenticateUsingOidc,
+    onMessageDismiss,
+  }) => {
     const [t] = useTranslation();
     const wasSubmitting = usePrevious(isSubmitting);
 
@@ -168,9 +192,19 @@ const Login = React.memo(
                         content={t('action.logIn')}
                         floated="right"
                         loading={isSubmitting}
-                        disabled={isSubmitting}
+                        disabled={isSubmitting || isSubmittingUsingOidc}
                       />
                     </Form>
+                    {withOidc && (
+                      <Button
+                        type="button"
+                        loading={isSubmittingUsingOidc}
+                        disabled={isSubmitting || isSubmittingUsingOidc}
+                        onClick={onAuthenticateUsingOidc}
+                      >
+                        {t('action.logInWithSSO')}
+                      </Button>
+                    )}
                   </div>
                 </div>
               </Grid.Column>
@@ -201,10 +235,15 @@ const Login = React.memo(
 );
 
 Login.propTypes = {
-  defaultData: PropTypes.object.isRequired, // eslint-disable-line react/forbid-prop-types
+  /* eslint-disable react/forbid-prop-types */
+  defaultData: PropTypes.object.isRequired,
+  /* eslint-enable react/forbid-prop-types */
   isSubmitting: PropTypes.bool.isRequired,
+  isSubmittingUsingOidc: PropTypes.bool.isRequired,
   error: PropTypes.object, // eslint-disable-line react/forbid-prop-types
+  withOidc: PropTypes.bool.isRequired,
   onAuthenticate: PropTypes.func.isRequired,
+  onAuthenticateUsingOidc: PropTypes.func.isRequired,
   onMessageDismiss: PropTypes.func.isRequired,
 };
 

client/src/components/LoginWrapper.jsx

@@ -0,0 +1,19 @@
+import React from 'react';
+import PropTypes from 'prop-types';
+import { Loader } from 'semantic-ui-react';
+
+import LoginContainer from '../containers/LoginContainer';
+
+const LoginWrapper = React.memo(({ isInitializing }) => {
+  if (isInitializing) {
+    return <Loader active size="massive" />;
+  }
+
+  return <LoginContainer />;
+});
+
+LoginWrapper.propTypes = {
+  isInitializing: PropTypes.bool.isRequired,
+};
+
+export default LoginWrapper;

client/src/components/Root.jsx

@@ -5,7 +5,7 @@ import { Route, Routes } from 'react-router-dom';
 import { ReduxRouter } from '../lib/redux-router';
 
 import Paths from '../constants/Paths';
-import LoginContainer from '../containers/LoginContainer';
+import LoginWrapperContainer from '../containers/LoginWrapperContainer';
 import CoreContainer from '../containers/CoreContainer';
 import NotFound from './NotFound';
 
@@ -13,7 +13,6 @@ import 'react-datepicker/dist/react-datepicker.css';
 import 'photoswipe/dist/photoswipe.css';
 import 'easymde/dist/easymde.min.css';
 import '../lib/custom-ui/styles.css';
-
 import '../styles.module.scss';
 
 function Root({ store, history }) {
@@ -21,7 +20,8 @@ function Root({ store, history }) {
     <Provider store={store}>
       <ReduxRouter history={history}>
         <Routes>
-          <Route path={Paths.LOGIN} element={<LoginContainer />} />
+          <Route path={Paths.LOGIN} element={<LoginWrapperContainer />} />
+          <Route path={Paths.OIDC_CALLBACK} element={<LoginWrapperContainer />} />
           <Route path={Paths.ROOT} element={<CoreContainer />} />
           <Route path={Paths.PROJECTS} element={<CoreContainer />} />
           <Route path={Paths.BOARDS} element={<CoreContainer />} />

client/src/components/UserInformationEdit/UserInformationEdit.jsx

@@ -1,4 +1,5 @@
 import { dequal } from 'dequal';
+import omit from 'lodash/omit';
 import pickBy from 'lodash/pickBy';
 import React, { useCallback, useMemo, useRef } from 'react';
 import PropTypes from 'prop-types';
@@ -9,7 +10,7 @@ import { useForm } from '../../hooks';
 
 import styles from './UserInformationEdit.module.scss';
 
-const UserInformationEdit = React.memo(({ defaultData, onUpdate }) => {
+const UserInformationEdit = React.memo(({ defaultData, isNameEditable, onUpdate }) => {
   const [t] = useTranslation();
 
   const [data, handleFieldChange] = useForm(() => ({
@@ -32,13 +33,17 @@ const UserInformationEdit = React.memo(({ defaultData, onUpdate }) => {
   const nameField = useRef(null);
 
   const handleSubmit = useCallback(() => {
+    if (isNameEditable) {
       if (!cleanData.name) {
         nameField.current.select();
         return;
       }
 
       onUpdate(cleanData);
-  }, [onUpdate, cleanData]);
+    } else {
+      onUpdate(omit(cleanData, 'name'));
+    }
+  }, [isNameEditable, onUpdate, cleanData]);
 
   return (
     <Form onSubmit={handleSubmit}>
@@ -48,6 +53,7 @@ const UserInformationEdit = React.memo(({ defaultData, onUpdate }) => {
         ref={nameField}
         name="name"
         value={data.name}
+        disabled={!isNameEditable}
         className={styles.field}
         onChange={handleFieldChange}
       />
@@ -74,6 +80,7 @@ const UserInformationEdit = React.memo(({ defaultData, onUpdate }) => {
 
 UserInformationEdit.propTypes = {
   defaultData: PropTypes.object.isRequired, // eslint-disable-line react/forbid-prop-types
+  isNameEditable: PropTypes.bool.isRequired,
   onUpdate: PropTypes.func.isRequired,
 };
 

client/src/components/UserInformationEditStep.jsx

@@ -5,7 +5,8 @@ import { Popup } from '../lib/custom-ui';
 
 import UserInformationEdit from './UserInformationEdit';
 
-const UserInformationEditStep = React.memo(({ defaultData, onUpdate, onBack, onClose }) => {
+const UserInformationEditStep = React.memo(
+  ({ defaultData, isNameEditable, onUpdate, onBack, onClose }) => {
     const [t] = useTranslation();
 
     const handleUpdate = useCallback(
@@ -24,14 +25,20 @@ const UserInformationEditStep = React.memo(({ defaultData, onUpdate, onBack, onC
           })}
         </Popup.Header>
         <Popup.Content>
-        <UserInformationEdit defaultData={defaultData} onUpdate={handleUpdate} />
+          <UserInformationEdit
+            defaultData={defaultData}
+            isNameEditable={isNameEditable}
+            onUpdate={handleUpdate}
+          />
         </Popup.Content>
       </>
     );
-});
+  },
+);
 
 UserInformationEditStep.propTypes = {
   defaultData: PropTypes.object.isRequired, // eslint-disable-line react/forbid-prop-types
+  isNameEditable: PropTypes.bool.isRequired,
   onUpdate: PropTypes.func.isRequired,
   onBack: PropTypes.func,
   onClose: PropTypes.func.isRequired,

client/src/components/UserSettingsModal/AccountPane/AccountPane.jsx

@@ -23,6 +23,7 @@ const AccountPane = React.memo(
     phone,
     organization,
     language,
+    isLocked,
     isAvatarUpdating,
     usernameUpdateForm,
     emailUpdateForm,
@@ -74,6 +75,7 @@ const AccountPane = React.memo(
             phone,
             organization,
           }}
+          isNameEditable={!isLocked}
           onUpdate={onUpdate}
         />
         <Divider horizontal section>
@@ -102,6 +104,8 @@ const AccountPane = React.memo(
           value={language || 'auto'}
           onChange={handleLanguageChange}
         />
+        {!isLocked && (
+          <>
             <Divider horizontal section>
               <Header as="h4">
                 {t('common.authentication', {
@@ -159,6 +163,8 @@ const AccountPane = React.memo(
                 </Button>
               </UserPasswordEditPopup>
             </div>
+          </>
+        )}
       </Tab.Pane>
     );
   },
@@ -172,6 +178,7 @@ AccountPane.propTypes = {
   phone: PropTypes.string,
   organization: PropTypes.string,
   language: PropTypes.string,
+  isLocked: PropTypes.bool.isRequired,
   isAvatarUpdating: PropTypes.bool.isRequired,
   /* eslint-disable react/forbid-prop-types */
   usernameUpdateForm: PropTypes.object.isRequired,

client/src/components/UserSettingsModal/UserSettingsModal.jsx

@@ -17,6 +17,7 @@ const UserSettingsModal = React.memo(
     organization,
     language,
     subscribeToOwnCards,
+    isLocked,
     isAvatarUpdating,
     usernameUpdateForm,
     emailUpdateForm,
@@ -48,6 +49,7 @@ const UserSettingsModal = React.memo(
             phone={phone}
             organization={organization}
             language={language}
+            isLocked={isLocked}
             isAvatarUpdating={isAvatarUpdating}
             usernameUpdateForm={usernameUpdateForm}
             emailUpdateForm={emailUpdateForm}
@@ -105,6 +107,7 @@ UserSettingsModal.propTypes = {
   organization: PropTypes.string,
   language: PropTypes.string,
   subscribeToOwnCards: PropTypes.bool.isRequired,
+  isLocked: PropTypes.bool.isRequired,
   isAvatarUpdating: PropTypes.bool.isRequired,
   /* eslint-disable react/forbid-prop-types */
   usernameUpdateForm: PropTypes.object.isRequired,

client/src/components/UsersModal/Item/ActionsStep.jsx

@@ -64,6 +64,7 @@ const ActionsStep = React.memo(
           return (
             <UserInformationEditStep
               defaultData={pick(user, ['name', 'phone', 'organization'])}
+              isNameEditable={!user.isLocked}
               onUpdate={onUpdate}
               onBack={handleBack}
               onClose={onClose}
@@ -135,6 +136,8 @@ const ActionsStep = React.memo(
                 context: 'title',
               })}
             </Menu.Item>
+            {!user.isLocked && (
+              <>
                 <Menu.Item className={styles.menuItem} onClick={handleEditUsernameClick}>
                   {t('action.editUsername', {
                     context: 'title',
@@ -150,11 +153,15 @@ const ActionsStep = React.memo(
                     context: 'title',
                   })}
                 </Menu.Item>
+              </>
+            )}
+            {!user.isDeletionLocked && (
               <Menu.Item className={styles.menuItem} onClick={handleDeleteClick}>
                 {t('action.deleteUser', {
                   context: 'title',
                 })}
               </Menu.Item>
+            )}
           </Menu>
         </Popup.Content>
       </>

client/src/components/UsersModal/Item/Item.jsx

@@ -17,6 +17,9 @@ const Item = React.memo(
     organization,
     phone,
     isAdmin,
+    isLocked,
+    isRoleLocked,
+    isDeletionLocked,
     emailUpdateForm,
     passwordUpdateForm,
     usernameUpdateForm,
@@ -46,7 +49,7 @@ const Item = React.memo(
         <Table.Cell>{username || '-'}</Table.Cell>
         <Table.Cell>{email}</Table.Cell>
         <Table.Cell>
-          <Radio toggle checked={isAdmin} onChange={handleIsAdminChange} />
+          <Radio toggle checked={isAdmin} disabled={isRoleLocked} onChange={handleIsAdminChange} />
         </Table.Cell>
         <Table.Cell textAlign="right">
           <ActionsPopup
@@ -57,6 +60,8 @@ const Item = React.memo(
               organization,
               phone,
               isAdmin,
+              isLocked,
+              isDeletionLocked,
               emailUpdateForm,
               passwordUpdateForm,
               usernameUpdateForm,
@@ -88,6 +93,9 @@ Item.propTypes = {
   organization: PropTypes.string,
   phone: PropTypes.string,
   isAdmin: PropTypes.bool.isRequired,
+  isLocked: PropTypes.bool.isRequired,
+  isRoleLocked: PropTypes.bool.isRequired,
+  isDeletionLocked: PropTypes.bool.isRequired,
   /* eslint-disable react/forbid-prop-types */
   emailUpdateForm: PropTypes.object.isRequired,
   passwordUpdateForm: PropTypes.object.isRequired,

client/src/components/UsersModal/UsersModal.jsx

@@ -110,6 +110,9 @@ const UsersModal = React.memo(
                   organization={item.organization}
                   phone={item.phone}
                   isAdmin={item.isAdmin}
+                  isLocked={item.isLocked}
+                  isRoleLocked={item.isRoleLocked}
+                  isDeletionLocked={item.isDeletionLocked}
                   emailUpdateForm={item.emailUpdateForm}
                   passwordUpdateForm={item.passwordUpdateForm}
                   usernameUpdateForm={item.usernameUpdateForm}

client/src/constants/ActionTypes.js

@@ -12,14 +12,19 @@ export default {
 
   /* Login */
 
+  LOGIN_INITIALIZE: 'LOGIN_INITIALIZE',
   AUTHENTICATE: 'AUTHENTICATE',
   AUTHENTICATE__SUCCESS: 'AUTHENTICATE__SUCCESS',
   AUTHENTICATE__FAILURE: 'AUTHENTICATE__FAILURE',
+  USING_OIDC_AUTHENTICATE: 'USING_OIDC_AUTHENTICATE',
+  USING_OIDC_AUTHENTICATE__SUCCESS: 'USING_OIDC_AUTHENTICATE__SUCCESS',
+  USING_OIDC_AUTHENTICATE__FAILURE: 'USING_OIDC_AUTHENTICATE__FAILURE',
   AUTHENTICATE_ERROR_CLEAR: 'AUTHENTICATE_ERROR_CLEAR',
 
   /* Core */
 
   CORE_INITIALIZE: 'CORE_INITIALIZE',
+  CORE_INITIALIZE__CONFIG_FETCH: 'CORE_INITIALIZE__CONFIG_FETCH',
   LOGOUT: 'LOGOUT',
   LOGOUT__ACCESS_TOKEN_INVALIDATE: 'LOGOUT__ACCESS_TOKEN_INVALIDATE',
 

client/src/constants/EntryActionTypes.js

@@ -11,11 +11,11 @@ export default {
   /* Login */
 
   AUTHENTICATE: `${PREFIX}/AUTHENTICATE`,
+  USING_OIDC_AUTHENTICATE: `${PREFIX}/USING_OIDC_AUTHENTICATE`,
   AUTHENTICATE_ERROR_CLEAR: `${PREFIX}/AUTHENTICATE_ERROR_CLEAR`,
 
   /* Core */
 
-  CORE_INITIALIZE: `${PREFIX}/CORE_INITIALIZE`,
   LOGOUT: `${PREFIX}/LOGOUT`,
 
   /* Modals */

client/src/constants/Paths.js

@@ -2,6 +2,7 @@ import Config from './Config';
 
 const ROOT = `${Config.BASE_PATH}/`;
 const LOGIN = `${Config.BASE_PATH}/login`;
+const OIDC_CALLBACK = `${Config.BASE_PATH}/oidc-callback`;
 const PROJECTS = `${Config.BASE_PATH}/projects/:id`;
 const BOARDS = `${Config.BASE_PATH}/boards/:id`;
 const CARDS = `${Config.BASE_PATH}/cards/:id`;
@@ -9,6 +10,7 @@ const CARDS = `${Config.BASE_PATH}/cards/:id`;
 export default {
   ROOT,
   LOGIN,
+  OIDC_CALLBACK,
   PROJECTS,
   BOARDS,
   CARDS,

client/src/containers/CoreContainer.js

@@ -4,18 +4,18 @@ import selectors from '../selectors';
 import Core from '../components/Core';
 
 const mapStateToProps = (state) => {
-  const isCoreInitializing = selectors.selectIsCoreInitializing(state);
+  const isInitializing = selectors.selectIsInitializing(state);
   const isSocketDisconnected = selectors.selectIsSocketDisconnected(state);
   const currentModal = selectors.selectCurrentModal(state);
   const currentProject = selectors.selectCurrentProject(state);
   const currentBoard = selectors.selectCurrentBoard(state);
 
   return {
+    isInitializing,
     isSocketDisconnected,
     currentModal,
     currentProject,
     currentBoard,
-    isInitializing: isCoreInitializing,
   };
 };
 

client/src/containers/LoginContainer.js

@@ -1,23 +1,33 @@
 import { bindActionCreators } from 'redux';
 import { connect } from 'react-redux';
 
+import selectors from '../selectors';
 import entryActions from '../entry-actions';
 import Login from '../components/Login';
 
-const mapStateToProps = ({
+const mapStateToProps = (state) => {
+  const oidcConfig = selectors.selectOidcConfig(state);
+
+  const {
     ui: {
-    authenticateForm: { data: defaultData, isSubmitting, error },
+      authenticateForm: { data: defaultData, isSubmitting, isSubmittingUsingOidc, error },
     },
-}) => ({
+  } = state;
+
+  return {
     defaultData,
     isSubmitting,
+    isSubmittingUsingOidc,
     error,
-});
+    withOidc: !!oidcConfig,
+  };
+};
 
 const mapDispatchToProps = (dispatch) =>
   bindActionCreators(
     {
       onAuthenticate: entryActions.authenticate,
+      onAuthenticateUsingOidc: entryActions.authenticateUsingOidc,
       onMessageDismiss: entryActions.clearAuthenticateError,
     },
     dispatch,

client/src/containers/LoginWrapperContainer.js

@@ -0,0 +1,14 @@
+import { connect } from 'react-redux';
+
+import selectors from '../selectors';
+import LoginWrapper from '../components/LoginWrapper';
+
+const mapStateToProps = (state) => {
+  const isInitializing = selectors.selectIsInitializing(state);
+
+  return {
+    isInitializing,
+  };
+};
+
+export default connect(mapStateToProps)(LoginWrapper);

client/src/containers/UserSettingsModalContainer.js

@@ -15,6 +15,7 @@ const mapStateToProps = (state) => {
     organization,
     language,
     subscribeToOwnCards,
+    isLocked,
     isAvatarUpdating,
     emailUpdateForm,
     passwordUpdateForm,
@@ -30,6 +31,7 @@ const mapStateToProps = (state) => {
     organization,
     language,
     subscribeToOwnCards,
+    isLocked,
     isAvatarUpdating,
     emailUpdateForm,
     passwordUpdateForm,

client/src/entry-actions/core.js

@@ -1,16 +1,10 @@
 import EntryActionTypes from '../constants/EntryActionTypes';
 
-const initializeCore = () => ({
-  type: EntryActionTypes.CORE_INITIALIZE,
-  payload: {},
-});
-
 const logout = () => ({
   type: EntryActionTypes.LOGOUT,
   payload: {},
 });
 
 export default {
-  initializeCore,
   logout,
 };

client/src/entry-actions/login.js

@@ -7,6 +7,11 @@ const authenticate = (data) => ({
   },
 });
 
+const authenticateUsingOidc = () => ({
+  type: EntryActionTypes.USING_OIDC_AUTHENTICATE,
+  payload: {},
+});
+
 const clearAuthenticateError = () => ({
   type: EntryActionTypes.AUTHENTICATE_ERROR_CLEAR,
   payload: {},
@@ -14,5 +19,6 @@ const clearAuthenticateError = () => ({
 
 export default {
   authenticate,
+  authenticateUsingOidc,
   clearAuthenticateError,
 };

client/src/locales/cs/core.js

@@ -13,6 +13,7 @@ export default {
 
   translation: {
     common: {
+      aboutPlanka: 'O aplikaci Planka',
       account: 'Účet',
       actions: 'Akce',
       addAttachment_title: 'Přidat přílohu',
@@ -45,6 +46,9 @@ export default {
       background: 'Pozadí',
       board: 'Tabule',
       boardNotFound_title: 'Tabule nenalezena',
+      canComment: 'Může komentovat',
+      canEditContentOfBoard: 'Může upravovat obsah tabule',
+      canOnlyViewBoard: 'Může zobrazit pouze tabuli',
       cardActions_title: 'Akce na kartě',
       cardNotFound_title: 'Karta nenalezena',
       cardOrActionAreDeleted: 'Karta nebo akce je smazána',
@@ -68,14 +72,18 @@ export default {
       deleteTask_title: 'Smazat úkol',
       deleteUser_title: 'Smazat uživatele',
       description: 'Popis',
+      detectAutomatically: 'Automatická detekce',
       dropFileToUpload: 'Přetáhnutím nahraj soubor',
+      editor: 'Editor',
       editAttachment_title: 'Upravit přílohu',
       editAvatar_title: 'Upravit avatar',
       editBoard_title: 'Upravit tabuli',
       editDueDate_title: 'Upravit Termín do',
       editEmail_title: 'Upravit e-mail',
+      editInformation_title: 'Upravit informace',
       editLabel_title: 'Upravit štítek',
       editPassword_title: 'Upravit heslo',
+      editPermissions_title: 'Upravit oprávnění',
       editStopwatch_title: 'Upravit časovač',
       editUsername_title: 'Upravit uživatelské jméno',
       email: 'E-mail',
@@ -89,10 +97,13 @@ export default {
       filterByLabels_title: 'Filtruj podle štítku',
       filterByMembers_title: 'Filtruj podle člena',
       fromComputer_title: 'Z počítače',
+      fromTrello: 'Z Trella',
       general: 'Obecné',
       hours: 'Hodiny',
+      importBoard_title: 'Importovat tabuli',
       invalidCurrentPassword: 'Neplatné aktuální heslo',
       labels: 'Štítky',
+      language: 'Jazyk',
       leaveBoard_title: 'Opustit tabuli',
       leaveProject_title: 'Opustit projekt',
       list: 'Seznam',
@@ -122,15 +133,20 @@ export default {
       projectNotFound_title: 'Projekt nenalezen',
       removeManager_title: 'Odstranit vedoucího',
       removeMember_title: 'Odstranit člena',
+      searchLabels: 'Hledat štítky...',
+      searchMembers: 'Hledat členy...',
+      searchUsers: 'Hledat uživatele...',
       seconds: 'Vteřin',
       selectBoard: 'Vybrat tabuli',
       selectList: 'Vybrat seznam',
+      selectPermissions_title: 'Vybrat oprávnění',
       selectProject: 'Vybrat projekt',
       settings: 'Nastavení',
       stopwatch: 'Časovač',
       subscribeToMyOwnCardsByDefault: 'Ve výchozím nastavení odebírat vlastní karty',
       taskActions_title: 'Akce na úkolu',
       tasks: 'Úkoly',
+      thereIsNoPreviewAvailableForThisAttachment: 'Pro tuto přílohu není k dispozici žádný náhled',
       time: 'Čas',
       title: 'Titulek',
       userActions_title: 'Akce na uživateli',
@@ -142,6 +158,8 @@ export default {
       username: 'Uživatelské jméno',
       usernameAlreadyInUse: 'Uživatelské jméno se již používá',
       users: 'Uživatelé',
+      version: 'Verze',
+      viewer: 'Prohlížeč',
       writeComment: 'Napsat komentář...',
     },
 
@@ -153,6 +171,7 @@ export default {
       addCard_title: 'Přidat kartu',
       addComment: 'Přidat komentář',
       addList: 'Přidat seznam',
+      addMember: 'Přidat člena',
       addMoreDetailedDescription: 'Přidat další detailní popis',
       addTask: 'Přidat úkol',
       addToCard: 'Přidat na kartu',
@@ -182,10 +201,14 @@ export default {
       editDueDate_title: 'Upravit termín do',
       editDescription_title: 'Upravit popis',
       editEmail_title: 'Upravit e-mail',
+      editInformation_title: 'Upravit informace',
       editPassword_title: 'Upravit heslo',
+      editPermissions: 'Upravit oprávnění',
       editStopwatch_title: 'Upravit časovač',
       editTitle_title: 'Upravit titulek',
       editUsername_title: 'Upravit uživatelské jméno',
+      hideDetails: 'Skrýt detaily',
+      import: 'Import',
       leaveBoard: 'Opustit tabuli',
       leaveProject: 'Opustit projekt',
       logOut_title: 'Odhlásit se',
@@ -202,6 +225,7 @@ export default {
       save: 'Uložit',
       showAllAttachments: 'Zozbrazit všechny přílohy ({{hidden}} skryté)',
       showFewerAttachments: 'Zobrazit méně příloh',
+      showDetails: 'Zobrazit detaily',
       start: 'Start',
       stop: 'Stop',
       subscribe: 'Odebírat',

client/src/locales/en/login.js

@@ -11,10 +11,12 @@ export default {
       projectManagement: 'Project management',
       serverConnectionFailed: 'Server connection failed',
       unknownError: 'Unknown error, try again later',
+      useSingleSignOn: 'Use single sign-on',
     },
 
     action: {
       logIn: 'Log in',
+      logInWithSSO: 'Log in with SSO',
     },
   },
 };

client/src/locales/index.js

@@ -11,10 +11,11 @@ import pl from './pl';
 import ru from './ru';
 import sk from './sk';
 import sv from './sv';
+import tr from './tr';
 import uz from './uz';
 import zh from './zh';
 
-const locales = [cs, da, de, en, es, fr, it, ja, ko, pl, ru, sk, sv, uz, zh];
+const locales = [cs, da, de, en, es, fr, it, ja, ko, pl, ru, sk, sv, tr, uz, zh];
 
 export default locales;
 

client/src/locales/ru/core.js

@@ -13,10 +13,12 @@ export default {
 
   translation: {
     common: {
+      aboutPlanka: 'О проекте Planka',
       account: 'Учетная запись',
       actions: 'Действия',
       addAttachment: 'Добавление вложения',
       addComment: 'Добавление комментария',
+      addManager_title: 'Добавление менеджера',
       addMember: 'Добавление участника',
       addUser: 'Добавление пользователя',
       administrator: 'Администратор',
@@ -32,11 +34,16 @@ export default {
       areYouSureYouWantToDeleteThisProject: 'Вы уверены, что хотите удалить этот проект?',
       areYouSureYouWantToDeleteThisTask: 'Вы уверены, что хотите удалить эту задачу?',
       areYouSureYouWantToDeleteThisUser: 'Вы уверены, что хотите удалить этого пользователя?',
-      areYouSureYouWantToRemoveThisMemberFromProject:
-        'Вы уверены, что хотите удалить этого участника из проекта?',
+      areYouSureYouWantToLeaveBoard: 'Вы уверены, что хотите покинуть эту доску?',
+      areYouSureYouWantToLeaveProject: 'Вы уверены, что хотите покинуть этот проект?',
+      areYouSureYouWantToRemoveThisManagerFromProject:
+        'Вы уверены, что хотите удалить этого менеджера из проекта?',
+      areYouSureYouWantToRemoveThisMemberFromBoard:
+        'Вы уверены, что хотите удалить этого участника из доски?',
       attachment: 'Вложение',
       attachments: 'Вложения',
       authentication: 'Аутентификация',
+      background: 'Фон',
       board: 'Доска',
       boardNotFound: 'Доска не найдена',
       canComment: 'Может комментировать',
@@ -53,6 +60,7 @@ export default {
       createProject: 'Создание проекта',
       createTextFile: 'Создание текстового файла',
       currentPassword: 'Текущий пароль',
+      dangerZone_title: 'Опасная зона',
       date: 'Дата',
       dueDate: 'Срок',
       deleteAttachment: 'Удаление вложения',
@@ -74,7 +82,8 @@ export default {
       editBackground: 'Изменение фона',
       editDueDate: 'Изменение срока',
       editEmail: 'Изменение e-mail',
-      editLabel: 'Изменения метки',
+      editInformation: 'Изменение информации',
+      editLabel: 'Изменение метки',
       editPassword: 'Изменение пароля',
       editPermissions: 'Редактирование разрешений',
       editStopwatch: 'Изменение секундомера',
@@ -91,12 +100,18 @@ export default {
       filterByLabels: 'Фильтр по меткам',
       filterByMembers: 'Фильтр по участникам',
       fromComputer: 'С компьютера',
+      fromTrello: 'Из Trello',
+      general: 'Основные',
       hours: 'Часы',
+      importBoard: 'Импорт доски',
       invalidCurrentPassword: 'Неверный текущий пароль',
       labels: 'Метки',
       language: 'Язык',
+      leaveBoard: 'Покинуть доску',
+      leaveProject: 'Покинуть проект',
       list: 'Список',
       listActions: 'Действия со списком',
+      managers: 'Менеджеры',
       members: 'Участники',
       minutes: 'Минуты',
       moveCard: 'Перемещение карточки',
@@ -120,6 +135,7 @@ export default {
       project: 'Проект',
       projectActions: 'Действия с проектом',
       projectNotFound: 'Проект не найден',
+      removeManager: 'Удалить менеджера',
       removeMember: 'Удаление участника',
       searchLabels: 'Поиск меток...',
       searchMembers: 'Поиск участников...',
@@ -131,7 +147,7 @@ export default {
       selectProject: 'Выберите проект',
       settings: 'Настройки',
       stopwatch: 'Секундомер',
-      subscribeToMyOwnCardsByDefault: 'По умолчанию подписаться на мои собственные карточки',
+      subscribeToMyOwnCardsByDefault: 'По умолчанию подписываться на мои собственные карточки',
       taskActions: 'Действия с задачей',
       tasks: 'Задачи',
       thereIsNoPreviewAvailableForThisAttachment: 'Предпросмотр для этого вложения недоступен',
@@ -147,6 +163,7 @@ export default {
       username: 'Имя пользователя',
       usernameAlreadyInUse: 'Имя пользователя уже занято',
       users: 'Пользователи',
+      version: 'Версия',
       viewer: 'Читатель',
       writeComment: 'Напишите комментарий...',
     },
@@ -185,6 +202,7 @@ export default {
       editDueDate: 'Изменить срок',
       editDescription: 'Изменить описание',
       editEmail: 'Изменить e-mail',
+      editInformation: 'Изменить информацию',
       editPassword: 'Изменить пароль',
       editPermissions: 'Изменить разрешения',
       editStopwatch: 'Изменить секундомер',
@@ -192,6 +210,9 @@ export default {
       editTitle: 'Изменить название',
       editUsername: 'Изменить имя пользователя',
       hideDetails: 'Скрыть подробности',
+      import: 'Импорт',
+      leaveBoard: 'Покинуть доску',
+      leaveProject: 'Покинуть проект',
       logOut: 'Выйти',
       makeCover: 'Сделать обложкой',
       move: 'Переместить',
@@ -199,7 +220,9 @@ export default {
       remove: 'Убрать',
       removeBackground: 'Убрать фон',
       removeCover: 'Убрать обложку',
+      removeFromBoard: 'Удалить из доски',
       removeFromProject: 'Удалить из проекта',
+      removeManager: 'Удалить менеджера',
       removeMember: 'Удалить участника',
       save: 'Сохранить',
       showAllAttachments: 'Показать все вложения ({{hidden}} скрыто)',

client/src/locales/tr/core.js

@@ -0,0 +1,219 @@
+import dateFns from 'date-fns/locale/tr';
+
+export default {
+  dateFns,
+
+  format: {
+    date: 'd.MM.yyyy',
+    time: 'p',
+    dateTime: '$t(format:date) $t(format:time)',
+    longDate: 'd. MMM',
+    longDateTime: "d. MMMM 'Saat' p",
+  },
+
+  translation: {
+    common: {
+      account: 'Hesap',
+      actions: 'Eylemler',
+      addAttachment_title: 'Dosya ekle',
+      addComment: 'Yorum ekle',
+      addManager_title: 'Yönetici ekle',
+      addMember_title: 'Üye ekle',
+      addUser_title: 'Kullanıcı ekle',
+      administrator: 'Administrator',
+      all: 'Tümü',
+      allChangesWillBeAutomaticallySavedAfterConnectionRestored:
+        'Bağlantı yeniden kurulduğunda tüm değişiklikler kaydedilecektir.',
+      areYouSureYouWantToDeleteThisAttachment: 'Bu eki silmek istediğinize emin misiniz?',
+      areYouSureYouWantToDeleteThisBoard: 'Bu panoyu silmek istediğinizden emin misiniz?',
+      areYouSureYouWantToDeleteThisCard: 'Bu kartı silmek istediğinizden emin misiniz?',
+      areYouSureYouWantToDeleteThisComment: 'Bu yorumu silmek istediğinizden emin misiniz?',
+      areYouSureYouWantToDeleteThisLabel: 'Bu etiketi silmek istediğinizden emin misiniz?',
+      areYouSureYouWantToDeleteThisList: 'Bu listeyi silmek istediğinizden emin misiniz?',
+      areYouSureYouWantToDeleteThisProject: 'Bu projeyi silmek istediğinizden emin misiniz?',
+      areYouSureYouWantToDeleteThisTask: 'Bu görevi silmek istediğinizden emin misiniz?',
+      areYouSureYouWantToDeleteThisUser: 'Bu kullanıcıyı silmek istediğinizden emin misiniz?',
+      areYouSureYouWantToLeaveBoard: 'Panodan ayrılmak istediğinizden emin misiniz?',
+      areYouSureYouWantToLeaveProject: 'Projeden ayrılmak istediğinizden emin misiniz?',
+      areYouSureYouWantToRemoveThisManagerFromProject:
+        'Bu yöneticiyi projeden çıkarmak istediğinizden emin misiniz?',
+      areYouSureYouWantToRemoveThisMemberFromBoard:
+        'Bu üyeyi panodan çıkarmak istediğinizden emin misiniz?',
+      attachment: 'ek',
+      attachments: 'ekler',
+      authentication: 'kimlik doğrulama',
+      background: 'arka plan',
+      board: 'pano',
+      boardNotFound_title: 'Pano bulunamadı',
+      cardActions_title: 'Kart İşlemleri',
+      cardNotFound_title: 'Kart bulunamadı',
+      cardOrActionAreDeleted: 'Kart veya işlem silindi',
+      color: 'renk',
+      createBoard_title: 'Pano Oluştur',
+      createLabel_title: 'Etiket Oluştur',
+      createNewOneOrSelectExistingOne: 'Yeni bir tane oluşturun veya mevcut bir tanesini seçin.',
+      createProject_title: 'Proje Oluştur',
+      createTextFile_title: 'Metin Dosyası Oluştur',
+      currentPassword: 'Geçerli şifre',
+      dangerZone_title: 'Tehlikeli Bölge',
+      date: 'tarih',
+      dueDate_title: 'Termin Tarihi',
+      deleteAttachment_title: 'Eki Sil',
+      deleteBoard_title: 'Panoyu Sil',
+      deleteCard_title: 'Kartı Sil',
+      deleteComment_title: 'Yorumu Sil',
+      deleteLabel_title: 'Etiketi Sil',
+      deleteList_title: 'Listeyi Sil',
+      deleteProject_title: 'Projeyi Sil',
+      deleteTask_title: 'Görevi Sil',
+      deleteUser_title: 'Kullanıcıyı Sil',
+      description: 'açıklama',
+      detectAutomaically: 'Otomatik olarak algıla',
+      dropFileToUpload: 'Yüklenecek dosyayı buraya bırakın',
+      editAttachment_title: 'Eki Düzenle',
+      editAvatar_title: 'Avatarı Düzenle',
+      editBoard_title: 'Panoyu Düzenle',
+      editDueDate_title: 'Son Tarihi Düzenle',
+      editEmail_title: 'E-posta Adresini Düzenle',
+      editLabel_title: 'Etiketi Düzenle',
+      editPassword_title: 'Şifreyi Değiştir',
+      editStopwatch_title: 'Kronometreyi Düzenle',
+      editUsername_title: 'Kullanıcı Adını Düzenle',
+      email: 'e-posta',
+      emailAlreadyInUse: 'E-posta adresi zaten kullanımda',
+      enterCardTitle: 'Kart başlığını girin',
+      enterDescription: 'Açıklamayı girin',
+      enterFilename: 'Dosya adını girin',
+      enterListTitle: 'Liste başlığını girin',
+      enterProjectTitle: 'Proje başlığını girin',
+      enterTaskDescription: 'Görev açıklamasını girin',
+      filterByLabels_title: 'Etikete Göre Filtrele',
+      filterByMembers_title: 'Üyelere göre filtrele',
+      fromComputer_title: 'Bilgisayardan',
+      general: 'Genel',
+      hours: 'saat',
+      invalidCurrentPassword: 'Mevcut şifre yanlış',
+      labels: 'etiketler',
+      language: 'dil',
+      leaveBoard_title: 'Panodan Ayrıl',
+      leaveProject_title: 'Projeden Ayrıl',
+      list: 'Listeler',
+      listActions_title: 'Görevleri Listele',
+      managers: 'Yöneticiler',
+      members: 'Üyeler',
+      minutes: 'dakika',
+      moveCard_title: 'Kartı Taşı',
+      name: 'isim',
+      newEmail: 'Yeni e-posta adresi',
+      newPassword: 'Yeni şifre',
+      newUsername: 'Yeni kullanıcı adı',
+      noConnectionToServer: 'Sunucuya bağlantı yok',
+      noBoards: 'Pano yok',
+      noLists: 'Liste yok',
+      noProjects: 'Proje yok',
+      notifications: 'Bildirimler',
+      noUnreadNotifications: 'Okunmamış bildirim yok',
+      openBoard_title: 'Açık Pano',
+      optional_inline: 'İsteğe bağlı',
+      organization: 'Organizasyon',
+      phone: 'telefon',
+      preferences: 'Tercihler',
+      pressPasteShortcutToAddAttachmentFromClipboard:
+        'İpucu: Panodan bir ek eklemek için CTRL-V ye (Macte Cmd-V) basın',
+      project: 'Proje',
+      projectNotFound_title: 'Proje bulunamadı',
+      removeManager_title: 'Yöneticiyi Kaldır',
+      removeMember_title: 'Üyeyi Kaldır',
+      seconds: 'saniye',
+      selectBoard: 'Pano Seç',
+      selectList: 'Liste seç',
+      selectProject: 'Proje seç',
+      settings: 'Ayarlar',
+      stopwatch: 'kronometre',
+      subscribeToMyOwnCardsByDefault: 'Varsayılan olarak kendi kartlarıma abone ol',
+      taskActions_title: 'Görev Eylemleri',
+      tasks: 'Görevler',
+      thereIsNoPreviewAvailableForThisAttachment: 'Bu ek için önizleme mevcut değil',
+      time: 'zaman',
+      title: 'başlık',
+      userActions_title: 'Kullanıcı İşlemleri',
+      userAddedThisCardToList: '<0>{{user}}</0><1> bu kartı {{list}</1> listesine ekledi',
+      userLeftNewCommentToCard:
+        '{{user}} yeni bir yorum yazdı: <2>{{card}</2> kartına «{{comment}}»',
+      userMovedCardFromListToList:
+        '{{user}}, <2>{{card}></2> kartını {{fromList}} listesinden {{toList}} listesine taşıdı',
+      userMovedThisCardFromListToList:
+        '<0>{{user}}</0><1> bu kartı {{fromList}} konumundan {{toList}}</1> konumuna taşıdı',
+      username: 'kullanıcı adı',
+      usernameAlreadyInUse: 'Kullanıcı adı zaten kullanımda',
+      users: 'kullanıcı',
+      writeComment: 'Yorum yazın',
+    },
+    action: {
+      addAnotherCard: 'Başka bir kart ekle',
+      addAnotherList: 'Başka bir liste ekle',
+      addAnotherTask: 'Başka bir görev ekle',
+      addCard: 'Kart ekle',
+      addCard_title: 'Kart Ekle',
+      addComment: 'Yorum ekle',
+      addList: 'Liste ekle',
+      addMoreDetailedDescription: 'Ayrıntılı bir açıklama ekleyin',
+      addTask: 'Görev ekle',
+      addToCard: 'Karta ekle',
+      addUser: 'Kullanıcı ekle',
+      createBoard: 'Pano oluştur',
+      createFile: 'Dosya oluştur',
+      createLabel: 'Etiket Oluştur',
+      createNewLabel: 'Yeni etiket oluştur',
+      createProject: 'Proje oluştur',
+      delete: 'Sil',
+      deleteAttachment: 'Eki sil',
+      deleteAvatar: 'Avatarı sil',
+      deleteBoard: 'Panoyu Sil',
+      deleteCard: 'Kartı sil',
+      deleteCard_title: 'Kartı Sil',
+      deleteComment: 'Yorumu sil',
+      deleteImage: 'Resmi sil',
+      deleteLabel: 'Etiketi sil',
+      deleteList: 'Listeyi sil',
+      deleteList_title: 'Listeyi Sil',
+      deleteProject: 'Projeyi sil',
+      deleteProject_title: 'Projeyi Sil',
+      deleteTask: 'Görevi sil',
+      deleteTask_title: 'Görevi Sil',
+      deleteUser: 'Kullanıcıyı sil',
+      edit: 'Düzenle',
+      editDueDate_title: 'Son Tarihi Düzenle',
+      editDescription_title: 'Açıklamayı Düzenle',
+      editEmail_title: 'E-posta Adresini Düzenle',
+      editPassword_title: 'Şifreyi Değiştir',
+      editStopwatch_title: 'Kronometreyi Düzenle',
+      editTitle_title: 'Başlığı düzenle',
+      editUsername_title: 'Kullanıcı Adını Düzenle',
+      hideDetails: 'Ayrıntıları gizle',
+      leaveBoard: 'Panodan Ayrıl',
+      leaveProject: 'Projeden ayrıl',
+      logOut_title: 'Çıkış',
+      makeCover_title: 'Önizleme olarak ayarla',
+      move: 'Taşı',
+      moveCard_title: 'Kartı Taşı',
+      remove: 'Sil',
+      removeBackground: 'Arka planı kaldır',
+      removeCover_title: 'Önizlemeyi Kaldır',
+      removeFromBoard: 'Panodan kaldır',
+      removeFromProject: 'Projeden kaldır',
+      removeManager: 'Yöneticiyi kaldır',
+      removeMember: 'Üyeyi kaldır',
+      save: 'Kaydet',
+      showAllAttachments: 'Tüm ekleri göster ({{hidden}} gizli)',
+      showDetails: 'Ayrıntıları göster',
+      showFewerAttachments: 'Daha az ek göster',
+      start: 'başlat',
+      stop: 'dur',
+      subscribe: 'Abone ol',
+      unsubscribe: 'Abonelikten çık',
+      uploadNewAvatar: 'Yeni avatar yükle',
+      uploadNewImage: 'Yeni resim yükle',
+    },
+  },
+};

client/src/locales/tr/index.js

@@ -0,0 +1,8 @@
+import login from './login';
+
+export default {
+  language: 'tr',
+  country: 'tr',
+  name: 'Türkçe',
+  embeddedLocale: login,
+};

client/src/locales/tr/login.js

@@ -0,0 +1,20 @@
+export default {
+  translation: {
+    common: {
+      emailOrUsername: 'E-posta adresi veya Kullanıcı adı',
+      invalidEmailOrUsername: 'Geçersiz e-posta adresi veya kullanıcı adı',
+      invalidPassword: 'Hatalı Şifre',
+      logInToPlanka: 'Giriş Yap',
+      noInternetConnection: 'Internet bağlantısı yok',
+      pageNotFound_title: 'Sayfa bulunamadı',
+      password: 'Şifre',
+      projectManagement: 'Proje Yönetimi',
+      serverConnectionFailed: 'Sunucu bağlantı hatası',
+      unknownError: 'Bilinmeyen Hata, daha sonra tekrar deneyin',
+    },
+
+    action: {
+      logIn: 'Giriş Yap',
+    },
+  },
+};

client/src/models/User.js

@@ -43,13 +43,14 @@ export default class extends BaseModel {
     organization: attr(),
     language: attr(),
     subscribeToOwnCards: attr(),
+    isAdmin: attr(),
+    isLocked: attr(),
+    isRoleLocked: attr(),
+    isDeletionLocked: attr(),
+    deletedAt: attr(),
     createdAt: attr({
       getDefault: () => new Date(),
     }),
-    deletedAt: attr(),
-    isAdmin: attr({
-      getDefault: () => false,
-    }),
     isAvatarUpdating: attr({
       getDefault: () => false,
     }),

client/src/reducers/auth.js

@@ -10,6 +10,7 @@ const initialState = {
 export default (state = initialState, { type, payload }) => {
   switch (type) {
     case ActionTypes.AUTHENTICATE__SUCCESS:
+    case ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS:
       return {
         ...state,
         accessToken: payload.accessToken,

client/src/reducers/core.js

@@ -4,7 +4,6 @@ import ActionTypes from '../constants/ActionTypes';
 import ModalTypes from '../constants/ModalTypes';
 
 const initialState = {
-  isInitializing: true,
   isLogouting: false,
   currentModal: null,
 };
@@ -18,11 +17,6 @@ export default (state = initialState, { type, payload }) => {
         ...state,
         currentModal: null,
       };
-    case ActionTypes.CORE_INITIALIZE:
-      return {
-        ...state,
-        isInitializing: false,
-      };
     case ActionTypes.LOGOUT__ACCESS_TOKEN_INVALIDATE:
       return {
         ...state,

client/src/reducers/index.js

@@ -3,6 +3,7 @@ import { combineReducers } from 'redux';
 import router from './router';
 import socket from './socket';
 import orm from './orm';
+import root from './root';
 import auth from './auth';
 import core from './core';
 import ui from './ui';
@@ -11,6 +12,7 @@ export default combineReducers({
   router,
   socket,
   orm,
+  root,
   auth,
   core,
   ui,

client/src/reducers/root.js

@@ -0,0 +1,36 @@
+import ActionTypes from '../constants/ActionTypes';
+
+const initialState = {
+  isInitializing: true,
+  config: null,
+};
+
+// eslint-disable-next-line default-param-last
+export default (state = initialState, { type, payload }) => {
+  switch (type) {
+    case ActionTypes.LOGIN_INITIALIZE:
+      return {
+        ...state,
+        isInitializing: false,
+        config: payload.config,
+      };
+    case ActionTypes.AUTHENTICATE__SUCCESS:
+    case ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS:
+      return {
+        ...state,
+        isInitializing: true,
+      };
+    case ActionTypes.CORE_INITIALIZE:
+      return {
+        ...state,
+        isInitializing: false,
+      };
+    case ActionTypes.CORE_INITIALIZE__CONFIG_FETCH:
+      return {
+        ...state,
+        config: payload.config,
+      };
+    default:
+      return state;
+  }
+};

client/src/reducers/ui/authenticate-form.js

@@ -1,4 +1,7 @@
+import { LOCATION_CHANGE_HANDLE } from '../../lib/redux-router';
+
 import ActionTypes from '../../constants/ActionTypes';
+import Paths from '../../constants/Paths';
 
 const initialState = {
   data: {
@@ -6,12 +9,22 @@ const initialState = {
     password: '',
   },
   isSubmitting: false,
+  isSubmittingUsingOidc: false,
   error: null,
 };
 
 // eslint-disable-next-line default-param-last
 export default (state = initialState, { type, payload }) => {
   switch (type) {
+    case LOCATION_CHANGE_HANDLE:
+      if (payload.location.pathname === Paths.OIDC_CALLBACK) {
+        return {
+          ...state,
+          isSubmittingUsingOidc: true,
+        };
+      }
+
+      return state;
     case ActionTypes.AUTHENTICATE:
       return {
         ...state,
@@ -22,6 +35,7 @@ export default (state = initialState, { type, payload }) => {
         isSubmitting: true,
       };
     case ActionTypes.AUTHENTICATE__SUCCESS:
+    case ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS:
       return initialState;
     case ActionTypes.AUTHENTICATE__FAILURE:
       return {
@@ -29,6 +43,12 @@ export default (state = initialState, { type, payload }) => {
         isSubmitting: false,
         error: payload.error,
       };
+    case ActionTypes.USING_OIDC_AUTHENTICATE__FAILURE:
+      return {
+        ...state,
+        isSubmittingUsingOidc: false,
+        error: payload.error,
+      };
     case ActionTypes.AUTHENTICATE_ERROR_CLEAR:
       return {
         ...state,

client/src/sagas/core/index.js

@@ -1,7 +1,8 @@
-import { all, apply, fork, take } from 'redux-saga/effects';
+import { all, apply, fork, select, take } from 'redux-saga/effects';
 
 import watchers from './watchers';
 import services from './services';
+import selectors from '../../selectors';
 import { socket } from '../../api';
 import ActionTypes from '../../constants/ActionTypes';
 import Paths from '../../constants/Paths';
@@ -14,5 +15,12 @@ export default function* coreSaga() {
 
   yield take(ActionTypes.LOGOUT);
 
+  const oidcConfig = yield select(selectors.selectOidcConfig);
+
+  if (oidcConfig && oidcConfig.endSessionUrl !== null) {
+    // Redirect the user to the IDP to log out.
+    window.location.href = oidcConfig.endSessionUrl;
+  } else {
     window.location.href = Paths.LOGIN;
+  }
 }

client/src/sagas/core/services/core.js

@@ -1,13 +1,23 @@
-import { call, put, take } from 'redux-saga/effects';
+import { call, put, select, take } from 'redux-saga/effects';
 
 import request from '../request';
 import requests from '../requests';
+import selectors from '../../../selectors';
 import actions from '../../../actions';
 import api from '../../../api';
 import i18n from '../../../i18n';
 import { removeAccessToken } from '../../../utils/access-token-storage';
 
 export function* initializeCore() {
+  const currentConfig = yield select(selectors.selectConfig); // TODO: add boolean selector?
+
+  let config;
+  if (!currentConfig) {
+    ({ item: config } = yield call(api.getConfig)); // TODO: handle error
+
+    yield put(actions.initializeCore.fetchConfig(config));
+  }
+
   const {
     user,
     board,

client/src/sagas/core/services/router.js

@@ -33,15 +33,16 @@ export function* handleLocationChange() {
 
   switch (pathsMatch.pattern.path) {
     case Paths.LOGIN:
+    case Paths.OIDC_CALLBACK:
       yield call(goToRoot);
 
-      break;
+      return;
     default:
   }
 
-  const isCoreInitializing = yield select(selectors.selectIsCoreInitializing);
+  const isInitializing = yield select(selectors.selectIsInitializing);
 
-  if (isCoreInitializing) {
+  if (isInitializing) {
     yield take(ActionTypes.CORE_INITIALIZE);
   }
 

client/src/sagas/core/watchers/core.js

@@ -4,8 +4,5 @@ import services from '../services';
 import EntryActionTypes from '../../../constants/EntryActionTypes';
 
 export default function* coreWatchers() {
-  yield all([
-    takeEvery(EntryActionTypes.CORE_INITIALIZE, () => services.initializeCore()),
-    takeEvery(EntryActionTypes.LOGOUT, () => services.logout()),
-  ]);
+  yield all([takeEvery(EntryActionTypes.LOGOUT, () => services.logout())]);
 }

client/src/sagas/login/index.js

@@ -7,7 +7,9 @@ import ActionTypes from '../../constants/ActionTypes';
 export default function* loginSaga() {
   const watcherTasks = yield all(watchers.map((watcher) => fork(watcher)));
 
-  yield take(ActionTypes.AUTHENTICATE__SUCCESS);
+  yield fork(services.initializeLogin);
+
+  yield take([ActionTypes.AUTHENTICATE__SUCCESS, ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS]);
 
   yield cancel(watcherTasks);
   yield call(services.goToRoot);

client/src/sagas/login/services/login.js

@@ -1,8 +1,18 @@
-import { call, put } from 'redux-saga/effects';
+import { nanoid } from 'nanoid';
+import { call, put, select } from 'redux-saga/effects';
+import { replace } from '../../../lib/redux-router';
 
+import selectors from '../../../selectors';
 import actions from '../../../actions';
 import api from '../../../api';
 import { setAccessToken } from '../../../utils/access-token-storage';
+import Paths from '../../../constants/Paths';
+
+export function* initializeLogin() {
+  const { item: config } = yield call(api.getConfig); // TODO: handle error
+
+  yield put(actions.initializeLogin(config));
+}
 
 export function* authenticate(data) {
   yield put(actions.authenticate(data));
@@ -19,11 +29,76 @@ export function* authenticate(data) {
   yield put(actions.authenticate.success(accessToken));
 }
 
+export function* authenticateUsingOidc() {
+  const oidcConfig = yield select(selectors.selectOidcConfig);
+
+  const nonce = nanoid();
+  window.sessionStorage.setItem('oidc-nonce', nonce);
+  window.location.href = `${oidcConfig.authorizationUrl}&nonce=${encodeURIComponent(nonce)}`;
+}
+
+export function* authenticateUsingOidcCallback() {
+  // https://github.com/plankanban/planka/issues/511#issuecomment-1771385639
+  const params = new URLSearchParams(window.location.hash.substring(1) || window.location.search);
+
+  yield put(replace(Paths.LOGIN));
+
+  if (params.get('error') !== null) {
+    yield put(
+      actions.authenticateUsingOidc.failure(
+        new Error(
+          `OIDC Authorization error: ${params.get('error')}: ${params.get('error_description')}`,
+        ),
+      ),
+    );
+    return;
+  }
+
+  const nonce = window.sessionStorage.getItem('oidc-nonce');
+  if (nonce === null) {
+    yield put(
+      actions.authenticateUsingOidc.failure(
+        new Error('Unable to process OIDC response: no nonce issued'),
+      ),
+    );
+    return;
+  }
+
+  const code = params.get('code');
+  if (code === null) {
+    yield put(
+      actions.authenticateUsingOidc.failure(new Error('Invalid OIDC response: no code parameter')),
+    );
+    return;
+  }
+
+  window.sessionStorage.removeItem('oidc-nonce');
+
+  if (code !== null) {
+    let accessToken;
+    try {
+      ({ item: accessToken } = yield call(api.exchangeForAccessTokenUsingOidc, {
+        code,
+        nonce,
+      }));
+    } catch (error) {
+      yield put(actions.authenticateUsingOidc.failure(error));
+      return;
+    }
+
+    yield call(setAccessToken, accessToken);
+    yield put(actions.authenticateUsingOidc.success(accessToken));
+  }
+}
+
 export function* clearAuthenticateError() {
   yield put(actions.clearAuthenticateError());
 }
 
 export default {
+  initializeLogin,
   authenticate,
+  authenticateUsingOidc,
+  authenticateUsingOidcCallback,
   clearAuthenticateError,
 };

client/src/sagas/login/services/router.js

@@ -1,7 +1,9 @@
-import { call, put, select } from 'redux-saga/effects';
+import { call, put, select, take } from 'redux-saga/effects';
 import { push } from '../../../lib/redux-router';
 
+import { authenticateUsingOidcCallback } from './login';
 import selectors from '../../../selectors';
+import ActionTypes from '../../../constants/ActionTypes';
 import Paths from '../../../constants/Paths';
 
 export function* goToLogin() {
@@ -27,6 +29,17 @@ export function* handleLocationChange() {
       yield call(goToLogin);
 
       break;
+    case Paths.OIDC_CALLBACK: {
+      const isInitializing = yield select(selectors.selectIsInitializing);
+
+      if (isInitializing) {
+        yield take(ActionTypes.LOGIN_INITIALIZE);
+      }
+
+      yield call(authenticateUsingOidcCallback);
+
+      break;
+    }
     default:
   }
 }

client/src/sagas/login/watchers/login.js

@@ -8,6 +8,7 @@ export default function* loginWatchers() {
     takeEvery(EntryActionTypes.AUTHENTICATE, ({ payload: { data } }) =>
       services.authenticate(data),
     ),
+    takeEvery(EntryActionTypes.USING_OIDC_AUTHENTICATE, () => services.authenticateUsingOidc()),
     takeEvery(EntryActionTypes.AUTHENTICATE_ERROR_CLEAR, () => services.clearAuthenticateError()),
   ]);
 }

client/src/selectors/core.js

@@ -6,8 +6,6 @@ import Config from '../constants/Config';
 
 export const selectAccessToken = ({ auth: { accessToken } }) => accessToken;
 
-export const selectIsCoreInitializing = ({ core: { isInitializing } }) => isInitializing;
-
 export const selectIsLogouting = ({ core: { isLogouting } }) => isLogouting;
 
 const nextPosition = (items, index, excludedId) => {
@@ -115,7 +113,6 @@ export const selectNextTaskPosition = createSelector(
 
 export default {
   selectAccessToken,
-  selectIsCoreInitializing,
   selectIsLogouting,
   selectNextBoardPosition,
   selectNextLabelPosition,

client/src/selectors/index.js

@@ -1,5 +1,6 @@
 import router from './router';
 import socket from './socket';
+import root from './root';
 import core from './core';
 import modals from './modals';
 import users from './users';
@@ -16,6 +17,7 @@ import attachments from './attachments';
 export default {
   ...router,
   ...socket,
+  ...root,
   ...core,
   ...modals,
   ...users,

client/src/selectors/root.js

@@ -0,0 +1,11 @@
+export const selectIsInitializing = ({ root: { isInitializing } }) => isInitializing;
+
+export const selectConfig = ({ root: { config } }) => config;
+
+export const selectOidcConfig = (state) => selectConfig(state).oidc;
+
+export default {
+  selectIsInitializing,
+  selectConfig,
+  selectOidcConfig,
+};

docker-compose-db.yml

@@ -0,0 +1,16 @@
+version: '3'
+
+services:
+  postgres:
+    image: postgres:alpine
+    restart: unless-stopped
+    volumes:
+      - db-data:/var/lib/postgresql/data
+    ports:
+      - 5432:5432
+    environment:
+      - POSTGRES_DB=planka
+      - POSTGRES_HOST_AUTH_METHOD=trust
+
+volumes:
+  db-data:

docker-compose-dev.yml

@@ -1,16 +1,65 @@
 version: '3'
 
 services:
+  planka:
+    image: ghcr.io/plankanban/planka:dev
+    command: >
+      bash -c
+        "for i in `seq 1 30`; do
+          ./start.sh &&
+          s=$$? && break || s=$$?;
+          echo \"Tried $$i times. Waiting 5 seconds...\";
+          sleep 5;
+        done; (exit $$s)"
+    restart: unless-stopped
+    volumes:
+      - user-avatars:/app/public/user-avatars
+      - project-background-images:/app/public/project-background-images
+      - attachments:/app/private/attachments
+    ports:
+      - 3000:1337
+    environment:
+      - BASE_URL=http://localhost:3000
+      - DATABASE_URL=postgresql://postgres@postgres/planka
+      - SECRET_KEY=notsecretkey
+
+      # - TRUST_PROXY=0
+      # - TOKEN_EXPIRES_IN=365 # In days
+
+      # related: https://github.com/knex/knex/issues/2354
+      # As knex does not pass query parameters from the connection string we
+      # have to use environment variables in order to pass the desired values, e.g.
+      # - PGSSLMODE=<value>
+
+      # Configure knex to accept SSL certificates
+      # - KNEX_REJECT_UNAUTHORIZED_SSL_CERTIFICATE=false
+
+      # - DEFAULT_ADMIN_EMAIL=demo@demo.demo # Do not remove if you want to prevent this user from being edited/deleted
+      # - DEFAULT_ADMIN_PASSWORD=demo
+      # - DEFAULT_ADMIN_NAME=Demo Demo
+      # - DEFAULT_ADMIN_USERNAME=demo
+
+      # - OIDC_ISSUER=
+      # - OIDC_CLIENT_ID=
+      # - OIDC_CLIENT_SECRET=
+      # - OIDC_SCOPES=openid email profile
+      # - OIDC_ADMIN_ROLES=admin
+      # - OIDC_ROLES_ATTRIBUTE=groups
+      # - OIDC_IGNORE_ROLES=true
+    depends_on:
+      - postgres
+
   postgres:
-    image: postgres:alpine
+    image: postgres:14-alpine
     restart: unless-stopped
     volumes:
       - db-data:/var/lib/postgresql/data
-    ports:
-      - 5432:5432
     environment:
       - POSTGRES_DB=planka
       - POSTGRES_HOST_AUTH_METHOD=trust
 
 volumes:
+  user-avatars:
+  project-background-images:
+  attachments:
   db-data:

docker-compose.yml

@@ -20,10 +20,12 @@ services:
       - 3000:1337
     environment:
       - BASE_URL=http://localhost:3000
-      - TRUST_PROXY=0
       - DATABASE_URL=postgresql://postgres@postgres/planka
       - SECRET_KEY=notsecretkey
 
+      # - TRUST_PROXY=0
+      # - TOKEN_EXPIRES_IN=365 # In days
+
       # related: https://github.com/knex/knex/issues/2354
       # As knex does not pass query parameters from the connection string we
       # have to use environment variables in order to pass the desired values, e.g.
@@ -31,6 +33,19 @@ services:
 
       # Configure knex to accept SSL certificates
       # - KNEX_REJECT_UNAUTHORIZED_SSL_CERTIFICATE=false
+
+      # - DEFAULT_ADMIN_EMAIL=demo@demo.demo # Do not remove if you want to prevent this user from being edited/deleted
+      # - DEFAULT_ADMIN_PASSWORD=demo
+      # - DEFAULT_ADMIN_NAME=Demo Demo
+      # - DEFAULT_ADMIN_USERNAME=demo
+
+      # - OIDC_ISSUER=
+      # - OIDC_CLIENT_ID=
+      # - OIDC_CLIENT_SECRET=
+      # - OIDC_SCOPES=openid email profile
+      # - OIDC_ADMIN_ROLES=admin
+      # - OIDC_ROLES_ATTRIBUTE=groups
+      # - OIDC_IGNORE_ROLES=true
     depends_on:
       - postgres
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "planka",
-  "version": "1.12.0",
+  "version": "1.14.3",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "planka",
-      "version": "1.12.0",
+      "version": "1.14.3",
       "hasInstallScript": true,
       "license": "AGPL-3.0",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "planka",
-  "version": "1.12.0",
+  "version": "1.14.3",
   "private": true,
   "homepage": "https://plankanban.github.io/planka",
   "repository": {

server/.env.sample

@@ -17,6 +17,19 @@ SECRET_KEY=notsecretkey
 # Configure knex to accept SSL certificates
 # KNEX_REJECT_UNAUTHORIZED_SSL_CERTIFICATE=false
 
+# DEFAULT_ADMIN_EMAIL=demo@demo.demo # Do not remove if you want to prevent this user from being edited/deleted
+# DEFAULT_ADMIN_PASSWORD=demo
+# DEFAULT_ADMIN_NAME=Demo Demo
+# DEFAULT_ADMIN_USERNAME=demo
+
+# OIDC_ISSUER=
+# OIDC_CLIENT_ID=
+# OIDC_CLIENT_SECRET=
+# OIDC_SCOPES=openid email profile
+# OIDC_ADMIN_ROLES=admin
+# OIDC_ROLES_ATTRIBUTE=groups
+# OIDC_IGNORE_ROLES=true
+
 ## Do not edit this
 
 TZ=UTC

server/api/controllers/access-tokens/create.js

@@ -10,6 +10,9 @@ const Errors = {
   INVALID_PASSWORD: {
     invalidPassword: 'Invalid password',
   },
+  USE_SINGLE_SIGN_ON: {
+    useSingleSignOn: 'Use single sign-on',
+  },
 };
 
 const emailOrUsernameValidator = (value) =>
@@ -37,6 +40,9 @@ module.exports = {
     invalidPassword: {
       responseType: 'unauthorized',
     },
+    useSingleSignOn: {
+      responseType: 'forbidden',
+    },
   },
 
   async fn(inputs) {
@@ -51,6 +57,10 @@ module.exports = {
       throw Errors.INVALID_EMAIL_OR_USERNAME;
     }
 
+    if (user.isSso) {
+      throw Errors.USE_SINGLE_SIGN_ON;
+    }
+
     if (!bcrypt.compareSync(inputs.password, user.password)) {
       sails.log.warn(`Invalid password! (IP: ${remoteAddress})`);
       throw Errors.INVALID_PASSWORD;

server/api/controllers/access-tokens/exchange-using-oidc.js

@@ -0,0 +1,71 @@
+const { getRemoteAddress } = require('../../../utils/remoteAddress');
+
+const Errors = {
+  INVALID_CODE_OR_NONCE: {
+    invalidCodeOrNonce: 'Invalid code or nonce',
+  },
+  EMAIL_ALREADY_IN_USE: {
+    emailAlreadyInUse: 'Email already in use',
+  },
+  USERNAME_ALREADY_IN_USE: {
+    usernameAlreadyInUse: 'Username already in use',
+  },
+  MISSING_VALUES: {
+    missingValues: 'Unable to retrieve required values (email, name)',
+  },
+};
+
+module.exports = {
+  inputs: {
+    code: {
+      type: 'string',
+      required: true,
+    },
+    nonce: {
+      type: 'string',
+      required: true,
+    },
+  },
+
+  exits: {
+    invalidCodeOrNonce: {
+      responseType: 'unauthorized',
+    },
+    emailAlreadyInUse: {
+      responseType: 'conflict',
+    },
+    usernameAlreadyInUse: {
+      responseType: 'conflict',
+    },
+    missingValues: {
+      responseType: 'unprocessableEntity',
+    },
+  },
+
+  async fn(inputs) {
+    const remoteAddress = getRemoteAddress(this.req);
+
+    const user = await sails.helpers.users
+      .getOrCreateOneUsingOidc(inputs.code, inputs.nonce)
+      .intercept('invalidCodeOrNonce', () => {
+        sails.log.warn(`Invalid code or nonce! (IP: ${remoteAddress})`);
+        return Errors.INVALID_CODE_OR_NONCE;
+      })
+      .intercept('emailAlreadyInUse', () => Errors.EMAIL_ALREADY_IN_USE)
+      .intercept('usernameAlreadyInUse', () => Errors.USERNAME_ALREADY_IN_USE)
+      .intercept('missingValues', () => Errors.MISSING_VALUES);
+
+    const accessToken = sails.helpers.utils.createToken(user.id);
+
+    await Session.create({
+      accessToken,
+      remoteAddress,
+      userId: user.id,
+      userAgent: this.req.headers['user-agent'],
+    });
+
+    return {
+      item: accessToken,
+    };
+  },
+};

server/api/controllers/show-config.js

@@ -0,0 +1,22 @@
+module.exports = {
+  fn() {
+    let oidc = null;
+    if (sails.hooks.oidc.isActive()) {
+      const oidcClient = sails.hooks.oidc.getClient();
+
+      oidc = {
+        authorizationUrl: oidcClient.authorizationUrl({
+          scope: sails.config.custom.oidcScopes,
+          response_mode: 'fragment',
+        }),
+        endSessionUrl: oidcClient.issuer.end_session_endpoint ? oidcClient.endSessionUrl({}) : null,
+      };
+    }
+
+    return {
+      item: {
+        oidc,
+      },
+    };
+  },
+};

server/api/controllers/users/delete.js

@@ -1,4 +1,7 @@
 const Errors = {
+  NOT_ENOUGH_RIGHTS: {
+    notEnoughRights: 'Not enough rights',
+  },
   USER_NOT_FOUND: {
     userNotFound: 'User not found',
   },
@@ -14,6 +17,9 @@ module.exports = {
   },
 
   exits: {
+    notEnoughRights: {
+      responseType: 'forbidden',
+    },
     userNotFound: {
       responseType: 'notFound',
     },
@@ -26,6 +32,10 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
+    if (user.email === sails.config.custom.defaultAdminEmail) {
+      throw Errors.NOT_ENOUGH_RIGHTS;
+    }
+
     user = await sails.helpers.users.deleteOne.with({
       record: user,
       request: this.req,

server/api/controllers/users/update-email.js

@@ -1,6 +1,9 @@
 const bcrypt = require('bcrypt');
 
 const Errors = {
+  NOT_ENOUGH_RIGHTS: {
+    notEnoughRights: 'Not enough rights',
+  },
   USER_NOT_FOUND: {
     userNotFound: 'User not found',
   },
@@ -31,6 +34,9 @@ module.exports = {
   },
 
   exits: {
+    notEnoughRights: {
+      responseType: 'forbidden',
+    },
     userNotFound: {
       responseType: 'notFound',
     },
@@ -59,6 +65,10 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
+    if (user.email === sails.config.custom.defaultAdminEmail || user.isSso) {
+      throw Errors.NOT_ENOUGH_RIGHTS;
+    }
+
     if (
       inputs.id === currentUser.id &&
       !bcrypt.compareSync(inputs.currentPassword, user.password)

server/api/controllers/users/update-password.js

@@ -4,6 +4,9 @@ const zxcvbn = require('zxcvbn');
 const { getRemoteAddress } = require('../../../utils/remoteAddress');
 
 const Errors = {
+  NOT_ENOUGH_RIGHTS: {
+    notEnoughRights: 'Not enough rights',
+  },
   USER_NOT_FOUND: {
     userNotFound: 'User not found',
   },
@@ -33,6 +36,9 @@ module.exports = {
   },
 
   exits: {
+    notEnoughRights: {
+      responseType: 'forbidden',
+    },
     userNotFound: {
       responseType: 'notFound',
     },
@@ -58,6 +64,10 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
+    if (user.email === sails.config.custom.defaultAdminEmail || user.isSso) {
+      throw Errors.NOT_ENOUGH_RIGHTS;
+    }
+
     if (
       inputs.id === currentUser.id &&
       !bcrypt.compareSync(inputs.currentPassword, user.password)

server/api/controllers/users/update-username.js

@@ -1,6 +1,9 @@
 const bcrypt = require('bcrypt');
 
 const Errors = {
+  NOT_ENOUGH_RIGHTS: {
+    notEnoughRights: 'Not enough rights',
+  },
   USER_NOT_FOUND: {
     userNotFound: 'User not found',
   },
@@ -33,6 +36,9 @@ module.exports = {
   },
 
   exits: {
+    notEnoughRights: {
+      responseType: 'forbidden',
+    },
     userNotFound: {
       responseType: 'notFound',
     },
@@ -61,6 +67,10 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
+    if (user.email === sails.config.custom.defaultAdminEmail || user.isSso) {
+      throw Errors.NOT_ENOUGH_RIGHTS;
+    }
+
     if (
       inputs.id === currentUser.id &&
       !bcrypt.compareSync(inputs.currentPassword, user.password)

server/api/controllers/users/update.js

@@ -67,6 +67,19 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
+    if (user.email === sails.config.custom.defaultAdminEmail) {
+      /* eslint-disable no-param-reassign */
+      delete inputs.isAdmin;
+      delete inputs.name;
+      /* eslint-enable no-param-reassign */
+    } else if (user.isSso) {
+      if (!sails.config.custom.oidcIgnoreRoles) {
+        delete inputs.isAdmin; // eslint-disable-line no-param-reassign
+      }
+
+      delete inputs.name; // eslint-disable-line no-param-reassign
+    }
+
     const values = {
       ..._.pick(inputs, [
         'isAdmin',

server/api/helpers/users/create-one.js

@@ -9,7 +9,7 @@ const valuesValidator = (value) => {
     return false;
   }
 
-  if (!_.isString(value.password)) {
+  if (!_.isNil(value.password) && !_.isString(value.password)) {
     return false;
   }
 
@@ -40,6 +40,10 @@ module.exports = {
   async fn(inputs) {
     const { values } = inputs;
 
+    if (values.password) {
+      values.password = bcrypt.hashSync(values.password, 10);
+    }
+
     if (values.username) {
       values.username = values.username.toLowerCase();
     }
@@ -47,7 +51,6 @@ module.exports = {
     const user = await User.create({
       ...values,
       email: values.email.toLowerCase(),
-      password: bcrypt.hashSync(values.password, 10),
     })
       .intercept(
         {

server/api/helpers/users/delete-one.js

@@ -10,6 +10,10 @@ module.exports = {
   },
 
   async fn(inputs) {
+    await IdentityProviderUser.destroy({
+      userId: inputs.record.id,
+    });
+
     await ProjectManager.destroy({
       userId: inputs.record.id,
     });

server/api/helpers/users/get-or-create-one-using-oidc.js

@@ -0,0 +1,113 @@
+module.exports = {
+  inputs: {
+    code: {
+      type: 'string',
+      required: true,
+    },
+    nonce: {
+      type: 'string',
+      required: true,
+    },
+  },
+
+  exits: {
+    invalidCodeOrNonce: {},
+    missingValues: {},
+    emailAlreadyInUse: {},
+    usernameAlreadyInUse: {},
+  },
+
+  async fn(inputs) {
+    const client = sails.hooks.oidc.getClient();
+
+    let userInfo;
+    try {
+      const tokenSet = await client.callback(
+        sails.config.custom.oidcRedirectUri,
+        { code: inputs.code },
+        { nonce: inputs.nonce },
+      );
+      userInfo = await client.userinfo(tokenSet);
+    } catch (e) {
+      sails.log.warn(`Error while exchanging OIDC code: ${e}`);
+      throw 'invalidCodeOrNonce';
+    }
+
+    if (!userInfo.email || !userInfo.name) {
+      throw 'missingValues';
+    }
+
+    let isAdmin = false;
+    if (sails.config.custom.oidcAdminRoles.includes('*')) {
+      isAdmin = true;
+    } else {
+      const roles = userInfo[sails.config.custom.oidcRolesAttribute];
+      if (Array.isArray(roles)) {
+        // Use a Set here to avoid quadratic time complexity
+        const userRoles = new Set(userInfo[sails.config.custom.oidcRolesAttribute]);
+        isAdmin = sails.config.custom.oidcAdminRoles.findIndex((role) => userRoles.has(role)) > -1;
+      }
+    }
+
+    const values = {
+      isAdmin,
+      email: userInfo.email,
+      isSso: true,
+      name: userInfo.name,
+      username: userInfo.preferred_username,
+      subscribeToOwnCards: false,
+    };
+
+    let user;
+    // This whole block technically needs to be executed in a transaction
+    // with SERIALIZABLE isolation level (but Waterline does not support
+    // that), so this will result in errors if for example users are deleted
+    // concurrently with logging in via OIDC.
+    let identityProviderUser = await IdentityProviderUser.findOne({
+      issuer: sails.config.custom.oidcIssuer,
+      sub: userInfo.sub,
+    });
+
+    if (identityProviderUser) {
+      user = await sails.helpers.users.getOne(identityProviderUser.userId);
+    } else {
+      // If no IDP/User mapping exists, search for the user by email.
+      user = await sails.helpers.users.getOne({
+        email: values.email.toLowerCase(),
+      });
+
+      // Otherwise, create a new user.
+      if (!user) {
+        user = await sails.helpers.users
+          .createOne(values)
+          .intercept('usernameAlreadyInUse', 'usernameAlreadyInUse');
+      }
+
+      identityProviderUser = await IdentityProviderUser.create({
+        userId: user.id,
+        issuer: sails.config.custom.oidcIssuer,
+        sub: userInfo.sub,
+      });
+    }
+
+    const updateFieldKeys = ['email', 'isSso', 'name', 'username'];
+    if (!sails.config.custom.oidcIgnoreRoles) {
+      updateFieldKeys.push('isAdmin');
+    }
+
+    const updateValues = {};
+    // eslint-disable-next-line no-restricted-syntax
+    for (const k of updateFieldKeys) {
+      if (values[k] !== user[k]) updateValues[k] = values[k];
+    }
+
+    if (Object.keys(updateValues).length > 0) {
+      user = await sails.helpers.users
+        .updateOne(user, updateValues, {}) // FIXME: hack for last parameter
+        .intercept('emailAlreadyInUse', 'emailAlreadyInUse')
+        .intercept('usernameAlreadyInUse', 'usernameAlreadyInUse');
+    }
+
+    return user;
+  },
+};

server/api/hooks/oidc/index.js

@@ -0,0 +1,33 @@
+const openidClient = require('openid-client');
+
+module.exports = function oidcServiceHook(sails) {
+  let client = null;
+
+  return {
+    /**
+     * Runs when this Sails app loads/lifts.
+     */
+
+    async initialize() {
+      if (sails.config.custom.oidcIssuer) {
+        const issuer = await openidClient.Issuer.discover(sails.config.custom.oidcIssuer);
+
+        client = new issuer.Client({
+          client_id: sails.config.custom.oidcClientId,
+          client_secret: sails.config.custom.oidcClientSecret,
+          redirect_uris: [sails.config.custom.oidcRedirectUri],
+          response_types: ['code'],
+        });
+        sails.log.info('OIDC hook has been loaded successfully');
+      }
+    },
+
+    getClient() {
+      return client;
+    },
+
+    isActive() {
+      return client !== null;
+    },
+  };
+};

server/api/models/IdentityProviderUser.js

@@ -0,0 +1,40 @@
+/**
+ * ProjectManager.js
+ *
+ * @description :: A model definition represents a database table/collection.
+ * @docs        :: https://sailsjs.com/docs/concepts/models-and-orm/models
+ */
+
+module.exports = {
+  attributes: {
+    issuer: {
+      type: 'string',
+      isNotEmptyString: true,
+      allowNull: true,
+    },
+    sub: {
+      type: 'string',
+      isNotEmptyString: true,
+      allowNull: true,
+    },
+    //  ╔═╗╦═╗╦╔╦╗╦╔╦╗╦╦  ╦╔═╗╔═╗
+    //  ╠═╝╠╦╝║║║║║ ║ ║╚╗╔╝║╣ ╚═╗
+    //  ╩  ╩╚═╩╩ ╩╩ ╩ ╩ ╚╝ ╚═╝╚═╝
+
+    //  ╔═╗╔╦╗╔╗ ╔═╗╔╦╗╔═╗
+    //  ║╣ ║║║╠╩╗║╣  ║║╚═╗
+    //  ╚═╝╩ ╩╚═╝╚═╝═╩╝╚═╝
+
+    //  ╔═╗╔═╗╔═╗╔═╗╔═╗╦╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+    //  ╠═╣╚═╗╚═╗║ ║║  ║╠═╣ ║ ║║ ║║║║╚═╗
+    //  ╩ ╩╚═╝╚═╝╚═╝╚═╝╩╩ ╩ ╩ ╩╚═╝╝╚╝╚═╝
+
+    userId: {
+      model: 'User',
+      required: true,
+      columnName: 'user_id',
+    },
+  },
+
+  tableName: 'identity_provider_user',
+};

server/api/models/User.js

@@ -18,13 +18,17 @@ module.exports = {
     },
     password: {
       type: 'string',
-      required: true,
     },
     isAdmin: {
       type: 'boolean',
       defaultsTo: false,
       columnName: 'is_admin',
     },
+    isSso: {
+      type: 'boolean',
+      defaultsTo: false,
+      columnName: 'is_sso',
+    },
     name: {
       type: 'string',
       required: true,
@@ -97,13 +101,22 @@ module.exports = {
       via: 'userId',
       through: 'CardMembership',
     },
+    identityProviders: {
+      collection: 'IdentityProviderUser',
+      via: 'userId',
+    },
   },
 
   tableName: 'user_account',
 
   customToJSON() {
+    const isDefaultAdmin = this.email === sails.config.custom.defaultAdminEmail;
+
     return {
-      ..._.omit(this, ['password', 'avatar', 'passwordChangedAt']),
+      ..._.omit(this, ['password', 'isSso', 'avatar', 'passwordChangedAt']),
+      isLocked: this.isSso || isDefaultAdmin,
+      isRoleLocked: (this.isSso && !sails.config.custom.oidcIgnoreRoles) || isDefaultAdmin,
+      isDeletionLocked: isDefaultAdmin,
       avatarUrl:
         this.avatar &&
         `${sails.config.custom.userAvatarsUrl}/${this.avatar.dirname}/square-100.${this.avatar.extension}`,

server/config/custom.js

@@ -30,4 +30,19 @@ module.exports.custom = {
 
   attachmentsPath: path.join(sails.config.appPath, 'private', 'attachments'),
   attachmentsUrl: `${process.env.BASE_URL}/attachments`,
+
+  defaultAdminEmail: process.env.DEFAULT_ADMIN_EMAIL,
+
+  oidcIssuer: process.env.OIDC_ISSUER,
+  oidcClientId: process.env.OIDC_CLIENT_ID,
+  oidcClientSecret: process.env.OIDC_CLIENT_SECRET,
+  oidcScopes: process.env.OIDC_SCOPES || 'openid email profile',
+  oidcAdminRoles: process.env.OIDC_ADMIN_ROLES ? process.env.OIDC_ADMIN_ROLES.split(',') : [],
+  oidcRolesAttribute: process.env.OIDC_ROLES_ATTRIBUTE || 'groups',
+  oidcIgnoreRoles: process.env.OIDC_IGNORE_ROLES === 'true',
+
+  // TODO: move client base url to environment variable?
+  oidcRedirectUri: `${
+    sails.config.environment === 'production' ? process.env.BASE_URL : 'http://localhost:3000'
+  }/oidc-callback`,
 };

server/config/policies.js

@@ -23,5 +23,7 @@ module.exports.policies = {
 
   'projects/create': ['is-authenticated', 'is-admin'],
 
+  'show-config': true,
   'access-tokens/create': true,
+  'access-tokens/exchange-using-oidc': true,
 };

server/config/routes.js

@@ -9,7 +9,10 @@
  */
 
 module.exports.routes = {
+  'GET /api/config': 'show-config',
+
   'POST /api/access-tokens': 'access-tokens/create',
+  'POST /api/access-tokens/exchange-using-oidc': 'access-tokens/exchange-using-oidc',
   'DELETE /api/access-tokens/me': 'access-tokens/delete',
 
   'GET /api/users': 'users/index',

server/db/init.js

@@ -6,12 +6,8 @@ const knex = initKnex(knexfile);
 
 (async () => {
   try {
-    const isExists = await knex.schema.hasTable(knexfile.migrations.tableName);
-
     await knex.migrate.latest();
-    if (!isExists) {
     await knex.seed.run();
-    }
   } catch (error) {
     process.exitCode = 1;
 

server/db/migrations/20230809022050_oidc_with_pkce_flow.js

@@ -0,0 +1,44 @@
+module.exports.up = async (knex) => {
+  await knex.schema.createTable('identity_provider_user', (table) => {
+    /* Columns */
+
+    table.bigInteger('id').primary().defaultTo(knex.raw('next_id()'));
+
+    table.bigInteger('user_id').notNullable();
+
+    table.text('issuer').notNullable();
+    table.text('sub').notNullable();
+
+    table.timestamp('created_at', true);
+    table.timestamp('updated_at', true);
+
+    /* Indexes */
+
+    table.unique(['issuer', 'sub']);
+    table.index('user_id');
+  });
+
+  await knex.schema.table('user_account', (table) => {
+    /* Columns */
+
+    table.boolean('is_sso').notNullable().default(false);
+
+    /* Modifications */
+
+    table.setNullable('password');
+  });
+
+  return knex.schema.alterTable('user_account', (table) => {
+    table.boolean('is_sso').notNullable().alter();
+  });
+};
+
+module.exports.down = async (knex) => {
+  await knex.schema.dropTable('identity_provider_user');
+
+  return knex.schema.table('user_account', (table) => {
+    table.dropColumn('is_sso');
+
+    table.dropNullable('password');
+  });
+};

server/db/seeds/default.js

@@ -1,12 +1,39 @@
 const bcrypt = require('bcrypt');
 
-exports.seed = (knex) =>
-  knex('user_account').insert({
-    email: 'demo@demo.demo',
-    password: bcrypt.hashSync('demo', 10),
+const buildData = () => {
+  const data = {
     isAdmin: true,
-    name: 'Demo Demo',
-    username: 'demo',
+    isSso: false,
+  };
+
+  if (process.env.DEFAULT_ADMIN_PASSWORD) {
+    data.password = bcrypt.hashSync(process.env.DEFAULT_ADMIN_PASSWORD, 10);
+  }
+  if (process.env.DEFAULT_ADMIN_NAME) {
+    data.name = process.env.DEFAULT_ADMIN_NAME;
+  }
+  if (process.env.DEFAULT_ADMIN_USERNAME) {
+    data.username = process.env.DEFAULT_ADMIN_USERNAME;
+  }
+
+  return data;
+};
+
+exports.seed = async (knex) => {
+  if (!process.env.DEFAULT_ADMIN_EMAIL) {
+    return;
+  }
+
+  const data = buildData();
+
+  try {
+    await knex('user_account').insert({
+      ...data,
+      email: process.env.DEFAULT_ADMIN_EMAIL,
       subscribeToOwnCards: false,
       createdAt: new Date().toISOString(),
     });
+  } catch (error) {
+    await knex('user_account').update(data).where('email', process.env.DEFAULT_ADMIN_EMAIL);
+  }
+};

server/package-lock.json

@@ -15,8 +15,9 @@
         "lodash": "^4.17.21",
         "moment": "^2.29.4",
         "move-file": "^2.1.0",
+        "openid-client": "^5.4.3",
         "rimraf": "^3.0.2",
-        "sails": "^1.5.3",
+        "sails": "^1.5.7",
         "sails-hook-orm": "^4.0.2",
         "sails-hook-sockets": "^2.0.3",
         "sails-postgresql-redacted": "^1.0.2-9",
@@ -554,29 +555,29 @@
       "integrity": "sha512-OfdwXncy2KqoGIlXUqxe+xb7G54s8y5pdo96+KGQMkQMZ5C/rT26tT2IJxWtgiAPeklwAU6iXxxjX8b8blcTPQ=="
     },
     "node_modules/body-parser": {
-      "version": "1.19.0",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.19.0.tgz",
-      "integrity": "sha512-dhEPs72UPbDnAQJ9ZKMNTP6ptJaionhP5cBb541nXPlW60Jepo9RV/a4fX4XWW9CuFNK22krhrj1+rgzifNCsw==",
+      "version": "1.19.2",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.19.2.tgz",
+      "integrity": "sha512-SAAwOxgoCKMGs9uUAUFHygfLAyaniaoun6I8mFY9pRAJL9+Kec34aU+oIjDhTycub1jozEfEwx1W1IuOYxVSFw==",
       "dependencies": {
-        "bytes": "3.1.0",
+        "bytes": "3.1.2",
         "content-type": "~1.0.4",
         "debug": "2.6.9",
         "depd": "~1.1.2",
-        "http-errors": "1.7.2",
+        "http-errors": "1.8.1",
         "iconv-lite": "0.4.24",
         "on-finished": "~2.3.0",
-        "qs": "6.7.0",
-        "raw-body": "2.4.0",
-        "type-is": "~1.6.17"
+        "qs": "6.9.7",
+        "raw-body": "2.4.3",
+        "type-is": "~1.6.18"
       },
       "engines": {
         "node": ">= 0.8"
       }
     },
     "node_modules/body-parser/node_modules/bytes": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.0.tgz",
-      "integrity": "sha512-zauLjrfCG+xvoyaqLoV8bLVXXNGC4JqlxFCutSDWA6fJrTo2ZuvLYTqZ7aHBLZSMOopbzwv8f+wZcVzfVTI2Dg==",
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
       "engines": {
         "node": ">= 0.8"
       }
@@ -590,30 +591,38 @@
       }
     },
     "node_modules/body-parser/node_modules/http-errors": {
-      "version": "1.7.2",
-      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.7.2.tgz",
-      "integrity": "sha512-uUQBt3H/cSIVfch6i1EuPNy/YsRSOUBXTVfZ+yR7Zjez3qjBz6i9+i4zjNaoqcoFVI4lQJ5plg63TvGfRSDCRg==",
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.8.1.tgz",
+      "integrity": "sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==",
       "dependencies": {
         "depd": "~1.1.2",
-        "inherits": "2.0.3",
-        "setprototypeof": "1.1.1",
+        "inherits": "2.0.4",
+        "setprototypeof": "1.2.0",
         "statuses": ">= 1.5.0 < 2",
-        "toidentifier": "1.0.0"
+        "toidentifier": "1.0.1"
       },
       "engines": {
         "node": ">= 0.6"
       }
     },
-    "node_modules/body-parser/node_modules/inherits": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
-      "integrity": "sha512-x00IRNXNy63jwGkJmzPigoySHbaqpNuzKbBOmzK+g2OdZpQ9w+sxCN+VSB3ja7IAge2OP2qpfxTjeNcyjmW1uw=="
-    },
     "node_modules/body-parser/node_modules/ms": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
       "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
     },
+    "node_modules/body-parser/node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="
+    },
+    "node_modules/body-parser/node_modules/toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "engines": {
+        "node": ">=0.6"
+      }
+    },
     "node_modules/brace-expansion": {
       "version": "1.1.11",
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
@@ -1115,21 +1124,16 @@
       "integrity": "sha512-ty/fTekppD2fIwRvnZAVdeOiGd1c7YXEixbgJTNzqcxJWKQnjJ/V1bNEEE6hygpM3WjwHFUVK6HTjWSzV4a8sQ=="
     },
     "node_modules/content-disposition": {
-      "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.3.tgz",
-      "integrity": "sha512-ExO0774ikEObIAEV9kDo50o+79VCUdEB6n6lzKgGwupcVeRlhrj3qGAfwq8G6uBJjkqLrhT0qEYFcWng8z1z0g==",
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
+      "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
       "dependencies": {
-        "safe-buffer": "5.1.2"
+        "safe-buffer": "5.2.1"
       },
       "engines": {
         "node": ">= 0.6"
       }
     },
-    "node_modules/content-disposition/node_modules/safe-buffer": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
-    },
     "node_modules/content-type": {
       "version": "1.0.4",
       "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.4.tgz",
@@ -2067,16 +2071,16 @@
       }
     },
     "node_modules/express": {
-      "version": "4.17.1",
-      "resolved": "https://registry.npmjs.org/express/-/express-4.17.1.tgz",
-      "integrity": "sha512-mHJ9O79RqluphRrcw2X/GTh3k9tVv8YcoyY4Kkh4WDMUYKRZUq0h1o0w2rrrxBqM7VoeUVqgb27xlEMXTnYt4g==",
+      "version": "4.17.3",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.17.3.tgz",
+      "integrity": "sha512-yuSQpz5I+Ch7gFrPCk4/c+dIBKlQUxtgwqzph132bsT6qhuzss6I8cLJQz7B3rFblzd6wtcI0ZbGltH/C4LjUg==",
       "dependencies": {
-        "accepts": "~1.3.7",
+        "accepts": "~1.3.8",
         "array-flatten": "1.1.1",
-        "body-parser": "1.19.0",
-        "content-disposition": "0.5.3",
+        "body-parser": "1.19.2",
+        "content-disposition": "0.5.4",
         "content-type": "~1.0.4",
-        "cookie": "0.4.0",
+        "cookie": "0.4.2",
         "cookie-signature": "1.0.6",
         "debug": "2.6.9",
         "depd": "~1.1.2",
@@ -2090,13 +2094,13 @@
         "on-finished": "~2.3.0",
         "parseurl": "~1.3.3",
         "path-to-regexp": "0.1.7",
-        "proxy-addr": "~2.0.5",
-        "qs": "6.7.0",
+        "proxy-addr": "~2.0.7",
+        "qs": "6.9.7",
         "range-parser": "~1.2.1",
-        "safe-buffer": "5.1.2",
-        "send": "0.17.1",
-        "serve-static": "1.14.1",
-        "setprototypeof": "1.1.1",
+        "safe-buffer": "5.2.1",
+        "send": "0.17.2",
+        "serve-static": "1.14.2",
+        "setprototypeof": "1.2.0",
         "statuses": "~1.5.0",
         "type-is": "~1.6.18",
         "utils-merge": "1.0.1",
@@ -2163,6 +2167,14 @@
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.0.tgz",
       "integrity": "sha512-fZEwUGbVl7kouZs1jCdMLdt95hdIv0ZeHg6L7qPeciMZhZ+/gdesW4wgTARkrFWEpspjEATAzUGPG8N2jJiwbg=="
     },
+    "node_modules/express/node_modules/cookie": {
+      "version": "0.4.2",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.4.2.tgz",
+      "integrity": "sha512-aSWTXFzaKWkvHO1Ny/s+ePFpvKsPnjc551iI41v3ny/ow6tBG5Vd+FuqGNhh1LxOmVzOlGUriIlOaokOvhaStA==",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/express/node_modules/cookie-signature": {
       "version": "1.0.6",
       "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
@@ -2211,25 +2223,25 @@
       "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz",
       "integrity": "sha512-5DFkuoqlv1uYQKxy8omFBeJPQcdoE07Kv2sferDCrAq1ohOU+MSDswDIbnx3YAM60qIOnYa53wBhXW0EbMonrQ=="
     },
-    "node_modules/express/node_modules/safe-buffer": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
-    },
     "node_modules/express/node_modules/serve-static": {
-      "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.14.1.tgz",
-      "integrity": "sha512-JMrvUwE54emCYWlTI+hGrGv5I8dEwmco/00EvkzIIsR7MqrHonbD9pO2MOfFnpFntl7ecpZs+3mW+XbQZu9QCg==",
+      "version": "1.14.2",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.14.2.tgz",
+      "integrity": "sha512-+TMNA9AFxUEGuC0z2mevogSnn9MXKb4fa7ngeRMJaaGv8vTwnIEkKi+QGvPt33HSnf8pRS+WGM0EbMtCJLKMBQ==",
       "dependencies": {
         "encodeurl": "~1.0.2",
         "escape-html": "~1.0.3",
         "parseurl": "~1.3.3",
-        "send": "0.17.1"
+        "send": "0.17.2"
       },
       "engines": {
         "node": ">= 0.8.0"
       }
     },
+    "node_modules/express/node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="
+    },
     "node_modules/extend": {
       "version": "3.0.2",
       "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
@@ -3634,6 +3646,14 @@
       "resolved": "https://registry.npmjs.org/async/-/async-3.2.4.tgz",
       "integrity": "sha512-iAB+JbDEGXhyIUavoDl9WP/Jj106Kz9DEn1DPgYw5ruDn0e3Wgi3sKFm55sASdGBNOQB8F59d9qQ7deqrHA8wQ=="
     },
+    "node_modules/jose": {
+      "version": "4.14.4",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-4.14.4.tgz",
+      "integrity": "sha512-j8GhLiKmUAh+dsFXlX1aJCbt5KMibuKb+d7j1JaOJG6s2UjX1PQlW+OKB/sD4a/5ZYF4RcmYmLSndOoU3Lt/3g==",
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
+    },
     "node_modules/js-sdsl": {
       "version": "4.1.5",
       "resolved": "https://registry.npmjs.org/js-sdsl/-/js-sdsl-4.1.5.tgz",
@@ -4546,6 +4566,14 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/object-hash": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/object-hash/-/object-hash-2.2.0.tgz",
+      "integrity": "sha512-gScRMn0bS5fH+IuwyIFgnh9zBdo4DV+6GhygmWM9HyNJSgS0hScp1f5vjtm7oIIOiT9trXrShAkLFSc2IqKNgw==",
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/object-inspect": {
       "version": "1.12.2",
       "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.12.2.tgz",
@@ -4625,6 +4653,14 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/oidc-token-hash": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/oidc-token-hash/-/oidc-token-hash-5.0.3.tgz",
+      "integrity": "sha512-IF4PcGgzAr6XXSff26Sk/+P4KZFJVuHAJZj3wgO3vX2bMdNVp/QXTP3P7CEm9V1IdG8lDLY3HhiqpsE/nOwpPw==",
+      "engines": {
+        "node": "^10.13.0 || >=12.0.0"
+      }
+    },
     "node_modules/on-finished": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.3.0.tgz",
@@ -4660,6 +4696,20 @@
         "fn.name": "1.x.x"
       }
     },
+    "node_modules/openid-client": {
+      "version": "5.4.3",
+      "resolved": "https://registry.npmjs.org/openid-client/-/openid-client-5.4.3.tgz",
+      "integrity": "sha512-sVQOvjsT/sbSfYsQI/9liWQGVZH/Pp3rrtlGEwgk/bbHfrUDZ24DN57lAagIwFtuEu+FM9Ev7r85s8S/yPjimQ==",
+      "dependencies": {
+        "jose": "^4.14.4",
+        "lru-cache": "^6.0.0",
+        "object-hash": "^2.2.0",
+        "oidc-token-hash": "^5.0.3"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
+    },
     "node_modules/opn": {
       "version": "5.3.0",
       "resolved": "https://registry.npmjs.org/opn/-/opn-5.3.0.tgz",
@@ -5138,11 +5188,14 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.7.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.7.0.tgz",
-      "integrity": "sha512-VCdBRNFTX1fyE7Nb6FYoURo/SPe62QCaAyzJvUjwRaIsc+NePBEniHlvxFmmX56+HZphIGtV0XeCirBtpDrTyQ==",
+      "version": "6.9.7",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.9.7.tgz",
+      "integrity": "sha512-IhMFgUmuNpyRfxA90umL7ByLlgRXu6tIfKPpF5TmcfRLlLCckfP/g3IQmju6jjpu+Hh8rA+2p6A27ZSPOOHdKw==",
       "engines": {
         "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
       }
     },
     "node_modules/queue-microtask": {
@@ -5220,12 +5273,12 @@
       }
     },
     "node_modules/raw-body": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.4.0.tgz",
-      "integrity": "sha512-4Oz8DUIwdvoa5qMJelxipzi/iJIi40O5cGV1wNYp5hvZP8ZN0T+jiNkL0QepXs+EsQ9XJ8ipEDoiH70ySUJP3Q==",
+      "version": "2.4.3",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.4.3.tgz",
+      "integrity": "sha512-UlTNLIcu0uzb4D2f4WltY6cVjLi+/jEN4lgEUj3E04tpMDpUlkBo/eSn6zou9hum2VMNpCCUone0O0WeJim07g==",
       "dependencies": {
-        "bytes": "3.1.0",
-        "http-errors": "1.7.2",
+        "bytes": "3.1.2",
+        "http-errors": "1.8.1",
         "iconv-lite": "0.4.24",
         "unpipe": "1.0.0"
       },
@@ -5234,32 +5287,40 @@
       }
     },
     "node_modules/raw-body/node_modules/bytes": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.0.tgz",
-      "integrity": "sha512-zauLjrfCG+xvoyaqLoV8bLVXXNGC4JqlxFCutSDWA6fJrTo2ZuvLYTqZ7aHBLZSMOopbzwv8f+wZcVzfVTI2Dg==",
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
       "engines": {
         "node": ">= 0.8"
       }
     },
     "node_modules/raw-body/node_modules/http-errors": {
-      "version": "1.7.2",
-      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.7.2.tgz",
-      "integrity": "sha512-uUQBt3H/cSIVfch6i1EuPNy/YsRSOUBXTVfZ+yR7Zjez3qjBz6i9+i4zjNaoqcoFVI4lQJ5plg63TvGfRSDCRg==",
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.8.1.tgz",
+      "integrity": "sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==",
       "dependencies": {
         "depd": "~1.1.2",
-        "inherits": "2.0.3",
-        "setprototypeof": "1.1.1",
+        "inherits": "2.0.4",
+        "setprototypeof": "1.2.0",
         "statuses": ">= 1.5.0 < 2",
-        "toidentifier": "1.0.0"
+        "toidentifier": "1.0.1"
       },
       "engines": {
         "node": ">= 0.6"
       }
     },
-    "node_modules/raw-body/node_modules/inherits": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
-      "integrity": "sha512-x00IRNXNy63jwGkJmzPigoySHbaqpNuzKbBOmzK+g2OdZpQ9w+sxCN+VSB3ja7IAge2OP2qpfxTjeNcyjmW1uw=="
+    "node_modules/raw-body/node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="
+    },
+    "node_modules/raw-body/node_modules/toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "engines": {
+        "node": ">=0.6"
+      }
     },
     "node_modules/rc": {
       "version": "1.2.8",
@@ -5657,9 +5718,9 @@
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
     },
     "node_modules/sails": {
-      "version": "1.5.3",
-      "resolved": "https://registry.npmjs.org/sails/-/sails-1.5.3.tgz",
-      "integrity": "sha512-JH9kKEtkBnb3NRNe7wMgbrlCpwIymiqMvFN8nG3S77gXBqnEGh2JMrmoiwLhRsK05Lisze8YvZ4ip27e7xoWHA==",
+      "version": "1.5.8",
+      "resolved": "https://registry.npmjs.org/sails/-/sails-1.5.8.tgz",
+      "integrity": "sha512-S1omXwRYsnJzQtnDG0pDOmLUT8WssFV3KMIE15grYo6gtOwUwPhITs8dSw1rzTCyV8TIt5vQzVbeL82vvfwINA==",
       "dependencies": {
         "@sailshq/lodash": "^3.10.2",
         "async": "2.6.4",
@@ -5674,7 +5735,7 @@
         "cookie-signature": "1.1.0",
         "csurf": "1.10.0",
         "ejs": "3.1.7",
-        "express": "4.17.1",
+        "express": "4.17.3",
         "express-session": "1.17.0",
         "flaverr": "^1.10.0",
         "glob": "7.1.2",
@@ -5697,7 +5758,7 @@
         "rttc": "^10.0.0-0",
         "sails-generate": "^2.0.3",
         "sails-stringfile": "^0.3.3",
-        "semver": "4.3.6",
+        "semver": "7.5.2",
         "serve-favicon": "2.4.5",
         "serve-static": "1.13.1",
         "skipper": "^0.9.0-0",
@@ -6073,14 +6134,6 @@
       "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.6.tgz",
       "integrity": "sha512-Jsjnk4bw3YJqYzbdyBiNsPWHPfO++UGG749Cxs6peCu5Xg4nrena6OVxOYxrQTqww0Jmwt+Ref8rggumkTLz9Q=="
     },
-    "node_modules/sails/node_modules/semver": {
-      "version": "4.3.6",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-4.3.6.tgz",
-      "integrity": "sha512-IrpJ+yoG4EOH8DFWuVg+8H1kW1Oaof0Wxe7cPcXW3x9BjkN/eVo54F15LyqemnDIUYskQWr9qvl/RihmSy6+xQ==",
-      "bin": {
-        "semver": "bin/semver"
-      }
-    },
     "node_modules/sails/node_modules/supports-color": {
       "version": "4.5.0",
       "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-4.5.0.tgz",
@@ -6093,9 +6146,9 @@
       }
     },
     "node_modules/semver": {
-      "version": "7.3.8",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.8.tgz",
-      "integrity": "sha512-NB1ctGL5rlHrPJtFDVIVzTyQylMLu9N9VICA6HSFJo8MCGVTMW6gfpicwKmmK/dAjTOrqu5l63JJOpDSrAis3A==",
+      "version": "7.5.2",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.2.tgz",
+      "integrity": "sha512-SoftuTROv/cRjCze/scjGyiDtcUyxw1rgYQSZY7XTmtR5hX+dm76iDbTH8TkLPHCQmlbQVSSbNZCPM2hb0knnQ==",
       "dependencies": {
         "lru-cache": "^6.0.0"
       },
@@ -6107,9 +6160,9 @@
       }
     },
     "node_modules/send": {
-      "version": "0.17.1",
-      "resolved": "https://registry.npmjs.org/send/-/send-0.17.1.tgz",
-      "integrity": "sha512-BsVKsiGcQMFwT8UxypobUKyv7irCNRHk1T0G680vk88yf6LBByGcZJOTJCrTP2xVN6yI+XjPJcNuE3V4fT9sAg==",
+      "version": "0.17.2",
+      "resolved": "https://registry.npmjs.org/send/-/send-0.17.2.tgz",
+      "integrity": "sha512-UJYB6wFSJE3G00nEivR5rgWp8c2xXvJ3OPWPhmuteU0IKj8nKbG3DrjiOmLwpnHGYWAVwA69zmTm++YG0Hmwww==",
       "dependencies": {
         "debug": "2.6.9",
         "depd": "~1.1.2",
@@ -6118,9 +6171,9 @@
         "escape-html": "~1.0.3",
         "etag": "~1.8.1",
         "fresh": "0.5.2",
-        "http-errors": "~1.7.2",
+        "http-errors": "1.8.1",
         "mime": "1.6.0",
-        "ms": "2.1.1",
+        "ms": "2.1.3",
         "on-finished": "~2.3.0",
         "range-parser": "~1.2.1",
         "statuses": "~1.5.0"
@@ -6142,10 +6195,38 @@
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
       "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
     },
+    "node_modules/send/node_modules/http-errors": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.8.1.tgz",
+      "integrity": "sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==",
+      "dependencies": {
+        "depd": "~1.1.2",
+        "inherits": "2.0.4",
+        "setprototypeof": "1.2.0",
+        "statuses": ">= 1.5.0 < 2",
+        "toidentifier": "1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/send/node_modules/ms": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.1.tgz",
-      "integrity": "sha512-tgp+dl5cGk28utYktBsrFqA7HKgrhgPsg6Z/EfhWI4gl1Hwq8B/GmY/0oXZ6nF8hDVesS/FpnYaD/kOWhYQvyg=="
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
+    },
+    "node_modules/send/node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="
+    },
+    "node_modules/send/node_modules/toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "engines": {
+        "node": ">=0.6"
+      }
     },
     "node_modules/serialize-javascript": {
       "version": "6.0.0",
@@ -8308,26 +8389,26 @@
       "integrity": "sha512-OfdwXncy2KqoGIlXUqxe+xb7G54s8y5pdo96+KGQMkQMZ5C/rT26tT2IJxWtgiAPeklwAU6iXxxjX8b8blcTPQ=="
     },
     "body-parser": {
-      "version": "1.19.0",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.19.0.tgz",
-      "integrity": "sha512-dhEPs72UPbDnAQJ9ZKMNTP6ptJaionhP5cBb541nXPlW60Jepo9RV/a4fX4XWW9CuFNK22krhrj1+rgzifNCsw==",
+      "version": "1.19.2",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.19.2.tgz",
+      "integrity": "sha512-SAAwOxgoCKMGs9uUAUFHygfLAyaniaoun6I8mFY9pRAJL9+Kec34aU+oIjDhTycub1jozEfEwx1W1IuOYxVSFw==",
       "requires": {
-        "bytes": "3.1.0",
+        "bytes": "3.1.2",
         "content-type": "~1.0.4",
         "debug": "2.6.9",
         "depd": "~1.1.2",
-        "http-errors": "1.7.2",
+        "http-errors": "1.8.1",
         "iconv-lite": "0.4.24",
         "on-finished": "~2.3.0",
-        "qs": "6.7.0",
-        "raw-body": "2.4.0",
-        "type-is": "~1.6.17"
+        "qs": "6.9.7",
+        "raw-body": "2.4.3",
+        "type-is": "~1.6.18"
       },
       "dependencies": {
         "bytes": {
-          "version": "3.1.0",
-          "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.0.tgz",
-          "integrity": "sha512-zauLjrfCG+xvoyaqLoV8bLVXXNGC4JqlxFCutSDWA6fJrTo2ZuvLYTqZ7aHBLZSMOopbzwv8f+wZcVzfVTI2Dg=="
+          "version": "3.1.2",
+          "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+          "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg=="
         },
         "debug": {
           "version": "2.6.9",
@@ -8338,26 +8419,31 @@
           }
         },
         "http-errors": {
-          "version": "1.7.2",
-          "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.7.2.tgz",
-          "integrity": "sha512-uUQBt3H/cSIVfch6i1EuPNy/YsRSOUBXTVfZ+yR7Zjez3qjBz6i9+i4zjNaoqcoFVI4lQJ5plg63TvGfRSDCRg==",
+          "version": "1.8.1",
+          "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.8.1.tgz",
+          "integrity": "sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==",
           "requires": {
             "depd": "~1.1.2",
-            "inherits": "2.0.3",
-            "setprototypeof": "1.1.1",
+            "inherits": "2.0.4",
+            "setprototypeof": "1.2.0",
             "statuses": ">= 1.5.0 < 2",
-            "toidentifier": "1.0.0"
+            "toidentifier": "1.0.1"
           }
         },
-        "inherits": {
-          "version": "2.0.3",
-          "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
-          "integrity": "sha512-x00IRNXNy63jwGkJmzPigoySHbaqpNuzKbBOmzK+g2OdZpQ9w+sxCN+VSB3ja7IAge2OP2qpfxTjeNcyjmW1uw=="
-        },
         "ms": {
           "version": "2.0.0",
           "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
           "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
+        },
+        "setprototypeof": {
+          "version": "1.2.0",
+          "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+          "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="
+        },
+        "toidentifier": {
+          "version": "1.0.1",
+          "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+          "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA=="
         }
       }
     },
@@ -8760,18 +8846,11 @@
       "integrity": "sha512-ty/fTekppD2fIwRvnZAVdeOiGd1c7YXEixbgJTNzqcxJWKQnjJ/V1bNEEE6hygpM3WjwHFUVK6HTjWSzV4a8sQ=="
     },
     "content-disposition": {
-      "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.3.tgz",
-      "integrity": "sha512-ExO0774ikEObIAEV9kDo50o+79VCUdEB6n6lzKgGwupcVeRlhrj3qGAfwq8G6uBJjkqLrhT0qEYFcWng8z1z0g==",
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
+      "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
       "requires": {
-        "safe-buffer": "5.1.2"
-      },
-      "dependencies": {
-        "safe-buffer": {
-          "version": "5.1.2",
-          "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-          "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
-        }
+        "safe-buffer": "5.2.1"
       }
     },
     "content-type": {
@@ -9503,16 +9582,16 @@
       }
     },
     "express": {
-      "version": "4.17.1",
-      "resolved": "https://registry.npmjs.org/express/-/express-4.17.1.tgz",
-      "integrity": "sha512-mHJ9O79RqluphRrcw2X/GTh3k9tVv8YcoyY4Kkh4WDMUYKRZUq0h1o0w2rrrxBqM7VoeUVqgb27xlEMXTnYt4g==",
+      "version": "4.17.3",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.17.3.tgz",
+      "integrity": "sha512-yuSQpz5I+Ch7gFrPCk4/c+dIBKlQUxtgwqzph132bsT6qhuzss6I8cLJQz7B3rFblzd6wtcI0ZbGltH/C4LjUg==",
       "requires": {
-        "accepts": "~1.3.7",
+        "accepts": "~1.3.8",
         "array-flatten": "1.1.1",
-        "body-parser": "1.19.0",
-        "content-disposition": "0.5.3",
+        "body-parser": "1.19.2",
+        "content-disposition": "0.5.4",
         "content-type": "~1.0.4",
-        "cookie": "0.4.0",
+        "cookie": "0.4.2",
         "cookie-signature": "1.0.6",
         "debug": "2.6.9",
         "depd": "~1.1.2",
@@ -9526,19 +9605,24 @@
         "on-finished": "~2.3.0",
         "parseurl": "~1.3.3",
         "path-to-regexp": "0.1.7",
-        "proxy-addr": "~2.0.5",
-        "qs": "6.7.0",
+        "proxy-addr": "~2.0.7",
+        "qs": "6.9.7",
         "range-parser": "~1.2.1",
-        "safe-buffer": "5.1.2",
-        "send": "0.17.1",
-        "serve-static": "1.14.1",
-        "setprototypeof": "1.1.1",
+        "safe-buffer": "5.2.1",
+        "send": "0.17.2",
+        "serve-static": "1.14.2",
+        "setprototypeof": "1.2.0",
         "statuses": "~1.5.0",
         "type-is": "~1.6.18",
         "utils-merge": "1.0.1",
         "vary": "~1.1.2"
       },
       "dependencies": {
+        "cookie": {
+          "version": "0.4.2",
+          "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.4.2.tgz",
+          "integrity": "sha512-aSWTXFzaKWkvHO1Ny/s+ePFpvKsPnjc551iI41v3ny/ow6tBG5Vd+FuqGNhh1LxOmVzOlGUriIlOaokOvhaStA=="
+        },
         "cookie-signature": {
           "version": "1.0.6",
           "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
@@ -9581,21 +9665,21 @@
           "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz",
           "integrity": "sha512-5DFkuoqlv1uYQKxy8omFBeJPQcdoE07Kv2sferDCrAq1ohOU+MSDswDIbnx3YAM60qIOnYa53wBhXW0EbMonrQ=="
         },
-        "safe-buffer": {
-          "version": "5.1.2",
-          "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-          "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
-        },
         "serve-static": {
-          "version": "1.14.1",
-          "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.14.1.tgz",
-          "integrity": "sha512-JMrvUwE54emCYWlTI+hGrGv5I8dEwmco/00EvkzIIsR7MqrHonbD9pO2MOfFnpFntl7ecpZs+3mW+XbQZu9QCg==",
+          "version": "1.14.2",
+          "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.14.2.tgz",
+          "integrity": "sha512-+TMNA9AFxUEGuC0z2mevogSnn9MXKb4fa7ngeRMJaaGv8vTwnIEkKi+QGvPt33HSnf8pRS+WGM0EbMtCJLKMBQ==",
           "requires": {
             "encodeurl": "~1.0.2",
             "escape-html": "~1.0.3",
             "parseurl": "~1.3.3",
-            "send": "0.17.1"
+            "send": "0.17.2"
           }
+        },
+        "setprototypeof": {
+          "version": "1.2.0",
+          "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+          "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="
         }
       }
     },
@@ -10706,6 +10790,11 @@
         }
       }
     },
+    "jose": {
+      "version": "4.14.4",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-4.14.4.tgz",
+      "integrity": "sha512-j8GhLiKmUAh+dsFXlX1aJCbt5KMibuKb+d7j1JaOJG6s2UjX1PQlW+OKB/sD4a/5ZYF4RcmYmLSndOoU3Lt/3g=="
+    },
     "js-sdsl": {
       "version": "4.1.5",
       "resolved": "https://registry.npmjs.org/js-sdsl/-/js-sdsl-4.1.5.tgz",
@@ -11406,6 +11495,11 @@
       "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
       "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg=="
     },
+    "object-hash": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/object-hash/-/object-hash-2.2.0.tgz",
+      "integrity": "sha512-gScRMn0bS5fH+IuwyIFgnh9zBdo4DV+6GhygmWM9HyNJSgS0hScp1f5vjtm7oIIOiT9trXrShAkLFSc2IqKNgw=="
+    },
     "object-inspect": {
       "version": "1.12.2",
       "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.12.2.tgz",
@@ -11461,6 +11555,11 @@
         "es-abstract": "^1.20.4"
       }
     },
+    "oidc-token-hash": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/oidc-token-hash/-/oidc-token-hash-5.0.3.tgz",
+      "integrity": "sha512-IF4PcGgzAr6XXSff26Sk/+P4KZFJVuHAJZj3wgO3vX2bMdNVp/QXTP3P7CEm9V1IdG8lDLY3HhiqpsE/nOwpPw=="
+    },
     "on-finished": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.3.0.tgz",
@@ -11490,6 +11589,17 @@
         "fn.name": "1.x.x"
       }
     },
+    "openid-client": {
+      "version": "5.4.3",
+      "resolved": "https://registry.npmjs.org/openid-client/-/openid-client-5.4.3.tgz",
+      "integrity": "sha512-sVQOvjsT/sbSfYsQI/9liWQGVZH/Pp3rrtlGEwgk/bbHfrUDZ24DN57lAagIwFtuEu+FM9Ev7r85s8S/yPjimQ==",
+      "requires": {
+        "jose": "^4.14.4",
+        "lru-cache": "^6.0.0",
+        "object-hash": "^2.2.0",
+        "oidc-token-hash": "^5.0.3"
+      }
+    },
     "opn": {
       "version": "5.3.0",
       "resolved": "https://registry.npmjs.org/opn/-/opn-5.3.0.tgz",
@@ -11859,9 +11969,9 @@
       "dev": true
     },
     "qs": {
-      "version": "6.7.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.7.0.tgz",
-      "integrity": "sha512-VCdBRNFTX1fyE7Nb6FYoURo/SPe62QCaAyzJvUjwRaIsc+NePBEniHlvxFmmX56+HZphIGtV0XeCirBtpDrTyQ=="
+      "version": "6.9.7",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.9.7.tgz",
+      "integrity": "sha512-IhMFgUmuNpyRfxA90umL7ByLlgRXu6tIfKPpF5TmcfRLlLCckfP/g3IQmju6jjpu+Hh8rA+2p6A27ZSPOOHdKw=="
     },
     "queue-microtask": {
       "version": "1.2.3",
@@ -11911,37 +12021,42 @@
       "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg=="
     },
     "raw-body": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.4.0.tgz",
-      "integrity": "sha512-4Oz8DUIwdvoa5qMJelxipzi/iJIi40O5cGV1wNYp5hvZP8ZN0T+jiNkL0QepXs+EsQ9XJ8ipEDoiH70ySUJP3Q==",
+      "version": "2.4.3",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.4.3.tgz",
+      "integrity": "sha512-UlTNLIcu0uzb4D2f4WltY6cVjLi+/jEN4lgEUj3E04tpMDpUlkBo/eSn6zou9hum2VMNpCCUone0O0WeJim07g==",
       "requires": {
-        "bytes": "3.1.0",
-        "http-errors": "1.7.2",
+        "bytes": "3.1.2",
+        "http-errors": "1.8.1",
         "iconv-lite": "0.4.24",
         "unpipe": "1.0.0"
       },
       "dependencies": {
         "bytes": {
-          "version": "3.1.0",
-          "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.0.tgz",
-          "integrity": "sha512-zauLjrfCG+xvoyaqLoV8bLVXXNGC4JqlxFCutSDWA6fJrTo2ZuvLYTqZ7aHBLZSMOopbzwv8f+wZcVzfVTI2Dg=="
+          "version": "3.1.2",
+          "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+          "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg=="
         },
         "http-errors": {
-          "version": "1.7.2",
-          "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.7.2.tgz",
-          "integrity": "sha512-uUQBt3H/cSIVfch6i1EuPNy/YsRSOUBXTVfZ+yR7Zjez3qjBz6i9+i4zjNaoqcoFVI4lQJ5plg63TvGfRSDCRg==",
+          "version": "1.8.1",
+          "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.8.1.tgz",
+          "integrity": "sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==",
           "requires": {
             "depd": "~1.1.2",
-            "inherits": "2.0.3",
-            "setprototypeof": "1.1.1",
+            "inherits": "2.0.4",
+            "setprototypeof": "1.2.0",
             "statuses": ">= 1.5.0 < 2",
-            "toidentifier": "1.0.0"
+            "toidentifier": "1.0.1"
           }
         },
-        "inherits": {
-          "version": "2.0.3",
-          "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
-          "integrity": "sha512-x00IRNXNy63jwGkJmzPigoySHbaqpNuzKbBOmzK+g2OdZpQ9w+sxCN+VSB3ja7IAge2OP2qpfxTjeNcyjmW1uw=="
+        "setprototypeof": {
+          "version": "1.2.0",
+          "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+          "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="
+        },
+        "toidentifier": {
+          "version": "1.0.1",
+          "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+          "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA=="
         }
       }
     },
@@ -12224,9 +12339,9 @@
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
     },
     "sails": {
-      "version": "1.5.3",
-      "resolved": "https://registry.npmjs.org/sails/-/sails-1.5.3.tgz",
-      "integrity": "sha512-JH9kKEtkBnb3NRNe7wMgbrlCpwIymiqMvFN8nG3S77gXBqnEGh2JMrmoiwLhRsK05Lisze8YvZ4ip27e7xoWHA==",
+      "version": "1.5.8",
+      "resolved": "https://registry.npmjs.org/sails/-/sails-1.5.8.tgz",
+      "integrity": "sha512-S1omXwRYsnJzQtnDG0pDOmLUT8WssFV3KMIE15grYo6gtOwUwPhITs8dSw1rzTCyV8TIt5vQzVbeL82vvfwINA==",
       "requires": {
         "@sailshq/lodash": "^3.10.2",
         "async": "2.6.4",
@@ -12241,7 +12356,7 @@
         "cookie-signature": "1.1.0",
         "csurf": "1.10.0",
         "ejs": "3.1.7",
-        "express": "4.17.1",
+        "express": "4.17.3",
         "express-session": "1.17.0",
         "flaverr": "^1.10.0",
         "glob": "7.1.2",
@@ -12264,7 +12379,7 @@
         "rttc": "^10.0.0-0",
         "sails-generate": "^2.0.3",
         "sails-stringfile": "^0.3.3",
-        "semver": "4.3.6",
+        "semver": "7.5.2",
         "serve-favicon": "2.4.5",
         "serve-static": "1.13.1",
         "skipper": "^0.9.0-0",
@@ -12338,11 +12453,6 @@
           "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.6.tgz",
           "integrity": "sha512-Jsjnk4bw3YJqYzbdyBiNsPWHPfO++UGG749Cxs6peCu5Xg4nrena6OVxOYxrQTqww0Jmwt+Ref8rggumkTLz9Q=="
         },
-        "semver": {
-          "version": "4.3.6",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-4.3.6.tgz",
-          "integrity": "sha512-IrpJ+yoG4EOH8DFWuVg+8H1kW1Oaof0Wxe7cPcXW3x9BjkN/eVo54F15LyqemnDIUYskQWr9qvl/RihmSy6+xQ=="
-        },
         "supports-color": {
           "version": "4.5.0",
           "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-4.5.0.tgz",
@@ -12591,17 +12701,17 @@
       "integrity": "sha512-fBMdntawlqd5N/1xL9Vu6l+J5zvy86jLUf0nFDal5McUeZzUy7PpNqq+Vx/F9KgItAyFJ7RoO3YltO9dD0Q5OQ=="
     },
     "semver": {
-      "version": "7.3.8",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.8.tgz",
-      "integrity": "sha512-NB1ctGL5rlHrPJtFDVIVzTyQylMLu9N9VICA6HSFJo8MCGVTMW6gfpicwKmmK/dAjTOrqu5l63JJOpDSrAis3A==",
+      "version": "7.5.2",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.2.tgz",
+      "integrity": "sha512-SoftuTROv/cRjCze/scjGyiDtcUyxw1rgYQSZY7XTmtR5hX+dm76iDbTH8TkLPHCQmlbQVSSbNZCPM2hb0knnQ==",
       "requires": {
         "lru-cache": "^6.0.0"
       }
     },
     "send": {
-      "version": "0.17.1",
-      "resolved": "https://registry.npmjs.org/send/-/send-0.17.1.tgz",
-      "integrity": "sha512-BsVKsiGcQMFwT8UxypobUKyv7irCNRHk1T0G680vk88yf6LBByGcZJOTJCrTP2xVN6yI+XjPJcNuE3V4fT9sAg==",
+      "version": "0.17.2",
+      "resolved": "https://registry.npmjs.org/send/-/send-0.17.2.tgz",
+      "integrity": "sha512-UJYB6wFSJE3G00nEivR5rgWp8c2xXvJ3OPWPhmuteU0IKj8nKbG3DrjiOmLwpnHGYWAVwA69zmTm++YG0Hmwww==",
       "requires": {
         "debug": "2.6.9",
         "depd": "~1.1.2",
@@ -12610,9 +12720,9 @@
         "escape-html": "~1.0.3",
         "etag": "~1.8.1",
         "fresh": "0.5.2",
-        "http-errors": "~1.7.2",
+        "http-errors": "1.8.1",
         "mime": "1.6.0",
-        "ms": "2.1.1",
+        "ms": "2.1.3",
         "on-finished": "~2.3.0",
         "range-parser": "~1.2.1",
         "statuses": "~1.5.0"
@@ -12633,10 +12743,32 @@
             }
           }
         },
+        "http-errors": {
+          "version": "1.8.1",
+          "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.8.1.tgz",
+          "integrity": "sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==",
+          "requires": {
+            "depd": "~1.1.2",
+            "inherits": "2.0.4",
+            "setprototypeof": "1.2.0",
+            "statuses": ">= 1.5.0 < 2",
+            "toidentifier": "1.0.1"
+          }
+        },
         "ms": {
-          "version": "2.1.1",
-          "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.1.tgz",
-          "integrity": "sha512-tgp+dl5cGk28utYktBsrFqA7HKgrhgPsg6Z/EfhWI4gl1Hwq8B/GmY/0oXZ6nF8hDVesS/FpnYaD/kOWhYQvyg=="
+          "version": "2.1.3",
+          "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+          "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
+        },
+        "setprototypeof": {
+          "version": "1.2.0",
+          "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+          "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="
+        },
+        "toidentifier": {
+          "version": "1.0.1",
+          "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+          "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA=="
         }
       }
     },

server/package.json

@@ -36,8 +36,9 @@
     "lodash": "^4.17.21",
     "moment": "^2.29.4",
     "move-file": "^2.1.0",
+    "openid-client": "^5.4.3",
     "rimraf": "^3.0.2",
-    "sails": "^1.5.3",
+    "sails": "^1.5.7",
     "sails-hook-orm": "^4.0.2",
     "sails-hook-sockets": "^2.0.3",
     "sails-postgresql-redacted": "^1.0.2-9",