chore: Update version

fix: Attempt to fix error that occurs during reconnection
fix: Add state parameter to OIDC authorization url
2023-12-09 17:23:01 +01:00 · 2023-12-09 17:19:40 +01:00 · 2023-12-09 17:06:45 +01:00 · 2023-12-09 16:28:24 +01:00 · 2023-12-04 11:42:15 +01:00 · 2023-12-04 11:40:04 +01:00
67 changed files with 8780 additions and 24930 deletions
@@ -2,6 +2,11 @@ name: Build and push Docker DEV image

 on:
  push:
+    paths-ignore:
+      - '.github/**'
+      - 'charts/**'
+      - 'docker-*.sh'
+      - '*.md'
    branches: [master]

 jobs:
@@ -38,5 +38,6 @@ jobs:
        uses: helm/chart-releaser-action@v1.5.0
        with:
          charts_dir: charts
+          mark_as_latest: false
        env:
          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
@@ -1,4 +1,8 @@
-FROM ghcr.io/plankanban/planka:base-latest as server-dependencies
+FROM node:18-alpine as server-dependencies
+
+RUN apk -U upgrade \
+  && apk add build-base python3 \
+  --no-cache

 WORKDIR /app

@@ -6,6 +10,7 @@ COPY server/package.json server/package-lock.json .

 RUN npm install npm@latest --global \
  && npm install pnpm --global \
+  && pnpm import \
  && pnpm install --prod

 FROM node:lts AS client
@@ -16,14 +21,17 @@ COPY client/package.json client/package-lock.json .

 RUN npm install npm@latest --global \
  && npm install pnpm --global \
+  && pnpm import \
  && pnpm install --prod

 COPY client .
 RUN DISABLE_ESLINT_PLUGIN=true npm run build

-FROM ghcr.io/plankanban/planka:base-latest
+FROM node:18-alpine

-RUN apk del vips-dependencies --purge
+RUN apk -U upgrade \
+  && apk add bash \
+  --no-cache

 USER node
 WORKDIR /app
@@ -1,27 +1,22 @@
-FROM node:lts-alpine
+FROM node:18-alpine

-ARG ALPINE_VERSION=3.16
-ARG VIPS_VERSION=8.13.3
+ARG VIPS_VERSION=8.14.5

 RUN apk -U upgrade \
  && apk add \
-  bash giflib glib lcms2 libexif \
-  libgsf libjpeg-turbo libpng librsvg libwebp \
-  orc pango tiff \
-  --repository https://alpine.global.ssl.fastly.net/alpine/v${ALPINE_VERSION}/community/ \
-  --repository https://alpine.global.ssl.fastly.net/alpine/v${ALPINE_VERSION}/main/ \
+  bash pkgconf \
+  libjpeg-turbo libexif librsvg cgif tiff libspng libimagequant \
  --no-cache \
  && apk add \
-  build-base giflib-dev glib-dev lcms2-dev libexif-dev \
-  libgsf-dev libjpeg-turbo-dev libpng-dev librsvg-dev libwebp-dev \
-  orc-dev pango-dev tiff-dev \
+  build-base gobject-introspection-dev meson \
+  libjpeg-turbo-dev libexif-dev librsvg-dev cgif-dev tiff-dev libspng-dev libimagequant-dev \
  --virtual vips-dependencies \
-  --repository https://alpine.global.ssl.fastly.net/alpine/v${ALPINE_VERSION}/community/ \
-  --repository https://alpine.global.ssl.fastly.net/alpine/v${ALPINE_VERSION}/main/ \
  --no-cache \
-  && wget -O- https://github.com/libvips/libvips/releases/download/v${VIPS_VERSION}/vips-${VIPS_VERSION}.tar.gz | tar xzC /tmp \
+  && wget -O- https://github.com/libvips/libvips/releases/download/v${VIPS_VERSION}/vips-${VIPS_VERSION}.tar.xz | tar xJC /tmp \
  && cd /tmp/vips-${VIPS_VERSION} \
-  && ./configure \
-  && make \
-  && make install-strip \
+  && meson setup build-dir \
+  && cd build-dir \
+  && ninja \
+  && ninja test \
+  && ninja install \
  && rm -rf /tmp/vips-${VIPS_VERSION}
@@ -20,10 +20,9 @@

 ## How to deploy Planka

-There are 2 types of installation:
- [Without Docker](https://docs.planka.cloud/docs/installl-planka/Debian%20&%20Ubuntu) ([for Windows](https://docs.planka.cloud/docs/installl-planka/Windows))
- [Dockerized](https://docs.planka.cloud/docs/installl-planka/Docker%20Compose)
- [Automated installation](https://github.com/plankanban/planka-installer)
+There are many ways to install Planka
+
+[Check them out](https://docs.planka.cloud/docs/intro)

 For configuration, please see the [configuration section](https://docs.planka.cloud/docs/category/configuration).

@@ -15,13 +15,13 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.3
+version: 0.1.12

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "1.13.0"
+appVersion: "1.15.1"

 dependencies:
  - alias: postgresql
@@ -21,7 +21,11 @@ git clone https://github.com/Chris-Greaves/planka-helm-chart.git
 cd planka-helm-chart
 helm dependency build
 export SECRETKEY=$(openssl rand -hex 64)
-helm install planka . --set secretkey=$SECRETKEY
+helm install planka . --set secretkey=$SECRETKEY  \
+--set admin_email="demo@demo.demo"  \
+--set admin_password="demo"  \
+--set admin_name="Demo Demo" \
+--set admin_username="demo"
 ```

 > **NOTE:** The command `openssl rand -hex 64` is needed to create a random hexadecimal key for planka. On Windows you can use Git Bash to run that command.
@@ -39,11 +43,19 @@ To access Planka externally you can use the following configuration
 ```bash
 # HTTP only
 helm install planka . --set secretkey=$SECRETKEY \
+--set admin_email="demo@demo.demo"  \
+--set admin_password="demo"  \
+--set admin_name="Demo Demo" \
+--set admin_username="demo"
 --set ingress.enabled=true \
 --set ingress.hosts[0].host=planka.example.dev \

 # HTTPS
 helm install planka . --set secretkey=$SECRETKEY \
+--set admin_email="demo@demo.demo"  \
+--set admin_password="demo"  \
+--set admin_name="Demo Demo" \
+--set admin_username="demo"
 --set ingress.enabled=true \
 --set ingress.hosts[0].host=planka.example.dev \
 --set ingress.tls[0].secretName=planka-tls \
@@ -54,6 +66,16 @@ or create a values.yaml file like:

 ```yaml
 secretkey: "<InsertSecretKey>"
+# The admin section needs to be present for new instances of Planka, after the first start you can remove the lines starting with admin_. If you want the admin user to be unchangeable admin_email: has to stay
+# After changing the config you have to run ```helm upgrade  planka . -f values.yaml```
+
+# Admin user
+admin_email: "demo@demo.demo" # Do not remove if you want to prevent this user from being edited/deleted
+admin_password: "demo"
+admin_name: "Demo Demo"
+admin_username: "demo"
+# Admin user
+
 ingress:
  enabled: true
  hosts:
@@ -35,7 +35,7 @@ spec:
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          ports:
            - name: http
-              containerPort: {{ .Values.service.port }}
+              containerPort: {{ .Values.service.containerPort | default 1337 }}
              protocol: TCP
          livenessProbe:
            httpGet:
@@ -75,10 +75,45 @@ spec:
              value: {{ required "A secret key needs to be generated using 'openssl rand -hex 64' and assigned to secretkey." .Values.secretkey }}
            - name: TRUST_PROXY
              value: "0"
+            - name: DEFAULT_ADMIN_EMAIL
+              value: {{ .Values.admin_email }}
+            - name: DEFAULT_ADMIN_PASSWORD
+              value: {{ .Values.admin_password }}
+            - name: DEFAULT_ADMIN_NAME
+              value: {{ .Values.admin_name }}
+            - name: DEFAULT_ADMIN_USERNAME
+              value: {{ .Values.admin_username }}
          {{ range $k, $v := .Values.env }}
            - name: {{ $k | quote }}
              value: {{ $v | quote }}
          {{- end }}
+          {{- if .Values.oidc.enabled }}
+          {{- $secretName := default (printf "%s-oidc" (include "planka.fullname" .)) .Values.oidc.existingSecret }}
+            - name: OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  key:  clientId
+                  name: {{ $secretName }}
+            - name: OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  key:  clientSecret
+                  name: {{ $secretName }}
+            - name: OIDC_ISSUER
+              value: {{ required "issuerUrl is required when configuring OIDC" .Values.oidc.issuerUrl | quote }}
+            - name: OIDC_SCOPES
+              value: {{ join " " .Values.oidc.scopes | default "openid profile email" | quote }}
+          {{- if .Values.oidc.admin.roles }}
+            - name: OIDC_ADMIN_ROLES
+              value: {{ join "," .Values.oidc.admin.roles | quote }}
+          {{- end }}
+            - name: OIDC_ROLES_ATTRIBUTE
+              value: {{ .Values.oidc.admin.rolesAttribute | default "groups" | quote }}
+          {{- if .Values.oidc.admin.ignoreRoles }}
+            - name: OIDC_IGNORE_ROLES
+              value: {{ .Values.oidc.admin.ignoreRoles | quote }}
+          {{- end }}
+          {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
@@ -0,0 +1,17 @@
+{{- if .Values.oidc.enabled }}
+{{- if eq (and (not (empty .Values.oidc.clientId)) (not (empty .Values.oidc.clientSecret))) (not (empty .Values.oidc.existingSecret)) -}}
+  {{- fail "Either specify inline `clientId` and `clientSecret` or refer to them via `existingSecret`" -}}
+{{- end }}
+{{- if (and (and (not (empty .Values.oidc.clientId)) (not (empty .Values.oidc.clientSecret))) (empty .Values.oidc.existingSecret)) -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "planka.fullname" . }}-oidc
+  labels:
+    {{- include "planka.labels" . | nindent 4 }}
+type: Opaque
+data:
+  clientId: {{ .Values.oidc.clientId | b64enc | quote }}
+  clientSecret: {{ .Values.oidc.clientSecret | b64enc | quote }}
+{{- end }}
+{{- end }}
@@ -46,6 +46,10 @@ securityContext: {}
 service:
  type: ClusterIP
  port: 1337
+  ## @param service.containerPort Planka HTTP container port
+  ## If empty will default to 1337
+  ##
+  containerPort: 1337

 ingress:
  enabled: false
@@ -109,3 +113,68 @@ persistence:
  
  accessMode: ReadWriteOnce
  size: 10Gi
+
+## OpenID Identity Management configuration
+##
+## Example:
+## ---------------
+## oidc:
+##   enabled: true
+##   clientId: sxxaAIAxVXlCxTmc1YLHBbQr8NL8MqLI2DUbt42d
+##   clientSecret: om4RTMRVHRszU7bqxB7RZNkHIzA8e4sGYWxeCwIMYQXPwEBWe4SY5a0wwCe9ltB3zrq5f0dnFnp34cEHD7QSMHsKvV9AiV5Z7eqDraMnv0I8IFivmuV5wovAECAYreSI
+##   issuerUrl: https://auth.local/application/o/planka/
+##   admin:
+##     roles:
+##       - planka-admin
+##
+## ---------------
+## NOTE: A minimal configuration requires setting `clientId`, `clientSecret` and `issuerUrl`. (plus `admin.roles` for administrators)
+## ref: https://docs.planka.cloud/docs/Configuration/OIDC
+##
+oidc:
+  ## @param oidc.enabled Enable single sign-on (SSO) with OpenID Connect (OIDC)
+  ##
+  enabled: false
+
+  ## OIDC credentials
+  ## @param oidc.clientId A string unique to the provider that identifies your app.
+  ## @param oidc.clientSecret A secret string that the provider uses to confirm ownership of a client ID.
+  ##
+  ## NOTE: Either specify inline `clientId` and `clientSecret` or refer to them via `existingSecret`
+  ##
+  clientId: ""
+  clientSecret: ""
+
+  ## @param oidc.existingSecret Name of an existing secret containing OIDC credentials
+  ## NOTE: Must contain key `clientId` and `clientSecret`
+  ## NOTE: When it's set, the `clientId` and `clientSecret` parameters are ignored
+  ##
+  existingSecret: ""
+
+  ## @param oidc.issuerUrl The OpenID connect metadata document endpoint
+  ##
+  issuerUrl: ""
+
+  ## @param oidc.scopes A list of scopes required for OIDC client.
+  ## If empty will default to `openid`, `profile` and `email`
+  ## NOTE: Planka needs the email and name claims
+  ##
+  scopes: []
+
+  ## Admin permissions configuration
+  admin:
+    ## @param oidc.admin.ignoreRoles If set to true, the admin roles will be ignored.
+    ## It is useful if you want to use OIDC for authentication but not for authorization.
+    ## If empty will default to `false`
+    ##
+    ignoreRoles: false
+
+    ## @param oidc.admin.rolesAttribute The name of a custom group claim that you have configured in your OIDC provider
+    ## If empty will default to `groups`
+    ##
+    rolesAttribute: groups
+
+    ## @param oidc.admin.roles The names of the admin groups
+    ##
+    roles: []
+      # - planka-admin
@@ -1 +1 @@
-REACT_APP_VERSION=1.13.0
+REACT_APP_VERSION=1.15.1
@@ -55,60 +55,60 @@
  "dependencies": {
    "@juggle/resize-observer": "^3.4.0",
    "classnames": "^2.3.2",
-    "date-fns": "^2.29.3",
+    "date-fns": "^2.30.0",
    "dequal": "^2.0.3",
    "easymde": "^2.18.0",
    "history": "^5.3.0",
-    "i18next": "^22.0.6",
-    "i18next-browser-languagedetector": "^7.0.1",
+    "i18next": "^23.7.6",
+    "i18next-browser-languagedetector": "^7.2.0",
    "initials": "^3.1.2",
-    "js-cookie": "^3.0.1",
-    "jwt-decode": "^3.1.2",
+    "js-cookie": "^3.0.5",
+    "jwt-decode": "^4.0.0",
    "lodash": "^4.17.21",
-    "node-sass": "^8.0.0",
-    "oidc-client-ts": "^2.3.0",
-    "photoswipe": "^5.3.3",
+    "nanoid": "^5.0.3",
+    "node-sass": "^9.0.0",
+    "photoswipe": "^5.4.2",
    "prop-types": "^15.8.1",
    "react": "^18.2.0",
    "react-app-rewired": "^2.2.1",
    "react-beautiful-dnd": "^13.1.1",
-    "react-datepicker": "^4.8.0",
+    "react-datepicker": "^4.21.0",
    "react-dom": "^18.2.0",
    "react-dropzone": "^14.2.3",
-    "react-i18next": "^12.0.0",
+    "react-i18next": "^13.5.0",
    "react-input-mask": "^2.0.4",
-    "react-markdown": "^8.0.3",
-    "react-photoswipe-gallery": "^2.2.2",
-    "react-redux": "^8.0.5",
-    "react-router-dom": "^6.4.3",
+    "react-markdown": "^8.0.7",
+    "react-photoswipe-gallery": "^2.2.7",
+    "react-redux": "^8.1.3",
+    "react-router-dom": "^6.19.0",
    "react-scripts": "5.0.1",
    "react-simplemde-editor": "^5.2.0",
-    "react-textarea-autosize": "^8.4.0",
-    "redux": "^4.2.0",
+    "react-textarea-autosize": "^8.5.3",
+    "redux": "^4.2.1",
    "redux-logger": "^3.0.6",
    "redux-orm": "^0.16.2",
-    "redux-saga": "^1.2.1",
-    "remark-breaks": "^3.0.2",
+    "redux-saga": "^1.2.3",
+    "remark-breaks": "^4.0.0",
    "remark-gfm": "^3.0.1",
-    "reselect": "^4.1.7",
+    "reselect": "^4.1.8",
    "sails.io.js": "^1.2.1",
-    "semantic-ui-react": "^2.1.3",
+    "semantic-ui-react": "^2.1.4",
    "socket.io-client": "^2.5.0",
-    "validator": "^13.7.0",
-    "whatwg-fetch": "^3.6.2",
+    "validator": "^13.11.0",
+    "whatwg-fetch": "^3.6.19",
    "zxcvbn": "^4.4.2"
  },
  "devDependencies": {
-    "@testing-library/jest-dom": "^5.16.5",
-    "@testing-library/react": "^13.4.0",
-    "@testing-library/user-event": "^13.5.0",
+    "@testing-library/jest-dom": "^6.1.4",
+    "@testing-library/react": "^14.1.0",
+    "@testing-library/user-event": "^14.5.1",
    "babel-preset-airbnb": "^5.0.0",
-    "chai": "^4.3.7",
-    "eslint": "^8.28.0",
+    "chai": "^4.3.10",
+    "eslint": "^8.53.0",
    "eslint-config-airbnb": "^19.0.4",
-    "eslint-plugin-import": "^2.26.0",
-    "eslint-plugin-jsx-a11y": "^6.6.1",
-    "eslint-plugin-react": "^7.31.11",
+    "eslint-plugin-import": "^2.29.0",
+    "eslint-plugin-jsx-a11y": "^6.8.0",
+    "eslint-plugin-react": "^7.33.2",
    "eslint-plugin-react-hooks": "^4.6.0",
    "react-test-renderer": "^18.2.0"
  }
@@ -1,7 +1,6 @@
 import ActionTypes from '../constants/ActionTypes';

 const initializeCore = (
-  config,
  user,
  board,
  users,
@@ -21,7 +20,6 @@ const initializeCore = (
 ) => ({
  type: ActionTypes.CORE_INITIALIZE,
  payload: {
-    config,
    user,
    board,
    users,
@@ -41,6 +39,14 @@ const initializeCore = (
  },
 });

+// TODO: with success?
+initializeCore.fetchConfig = (config) => ({
+  type: ActionTypes.CORE_INITIALIZE__CONFIG_FETCH,
+  payload: {
+    config,
+  },
+});
+
 const logout = () => ({
  type: ActionTypes.LOGOUT,
  payload: {},
@@ -28,20 +28,20 @@ authenticate.failure = (error) => ({
  },
 });

-const authenticateWithOidc = () => ({
-  type: ActionTypes.WITH_OIDC_AUTHENTICATE,
+const authenticateUsingOidc = () => ({
+  type: ActionTypes.USING_OIDC_AUTHENTICATE,
  payload: {},
 });

-authenticateWithOidc.success = (accessToken) => ({
-  type: ActionTypes.WITH_OIDC_AUTHENTICATE__SUCCESS,
+authenticateUsingOidc.success = (accessToken) => ({
+  type: ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS,
  payload: {
    accessToken,
  },
 });

-authenticateWithOidc.failure = (error) => ({
-  type: ActionTypes.WITH_OIDC_AUTHENTICATE__FAILURE,
+authenticateUsingOidc.failure = (error) => ({
+  type: ActionTypes.USING_OIDC_AUTHENTICATE__FAILURE,
  payload: {
    error,
  },
@@ -55,6 +55,6 @@ const clearAuthenticateError = () => ({
 export default {
  initializeLogin,
  authenticate,
-  authenticateWithOidc,
+  authenticateUsingOidc,
  clearAuthenticateError,
 };
@@ -5,14 +5,14 @@ import socket from './socket';

 const createAccessToken = (data, headers) => http.post('/access-tokens', data, headers);

-const exchangeToAccessToken = (data, headers) =>
-  http.post('/access-tokens/exchange', data, headers);
+const exchangeForAccessTokenUsingOidc = (data, headers) =>
+  http.post('/access-tokens/exchange-using-oidc', data, headers);

 const deleteCurrentAccessToken = (headers) =>
  socket.delete('/access-tokens/me', undefined, headers);

 export default {
  createAccessToken,
-  exchangeToAccessToken,
+  exchangeForAccessTokenUsingOidc,
  deleteCurrentAccessToken,
 };
@@ -217,6 +217,7 @@ const CardModal = React.memo(
                        onUserSelect={onUserAdd}
                        onUserDeselect={onUserRemove}
                      >
+                        {/* eslint-disable-next-line jsx-a11y/control-has-associated-label */}
                        <button
                          type="button"
                          className={classNames(styles.attachment, styles.dueDate)}
@@ -266,6 +267,7 @@ const CardModal = React.memo(
                        onMove={onLabelMove}
                        onDelete={onLabelDelete}
                      >
+                        {/* eslint-disable-next-line jsx-a11y/control-has-associated-label */}
                        <button
                          type="button"
                          className={classNames(styles.attachment, styles.dueDate)}
@@ -314,10 +316,11 @@ const CardModal = React.memo(
                      )}
                    </span>
                    {canEdit && (
+                      // eslint-disable-next-line jsx-a11y/control-has-associated-label
                      <button
-                        onClick={handleToggleStopwatchClick}
                        type="button"
                        className={classNames(styles.attachment, styles.dueDate)}
+                        onClick={handleToggleStopwatchClick}
                      >
                        <Icon
                          name={stopwatch.startedAt ? 'pause' : 'play'}
@@ -48,14 +48,21 @@ const Tasks = React.memo(({ items, canEdit, onCreate, onUpdate, onMove, onDelete
  return (
    <>
      {items.length > 0 && (
-        <Progress
-          autoSuccess
-          value={completedItems.length}
-          total={items.length}
-          color="blue"
-          size="tiny"
-          className={styles.progress}
-        />
+        <>
+          <span className={styles.progressWrapper}>
+            <Progress
+              autoSuccess
+              value={completedItems.length}
+              total={items.length}
+              color="blue"
+              size="tiny"
+              className={styles.progress}
+            />
+          </span>
+          <span className={styles.count}>
+            {completedItems.length}/{items.length}
+          </span>
+        </>
      )}
      <DragDropContext onDragStart={handleDragStart} onDragEnd={handleDragEnd}>
        <Droppable droppableId="tasks" type={DroppableTypes.TASK}>
@@ -3,6 +3,23 @@
    margin: 0 0 16px;
  }

+  .progressWrapper {
+    display: inline-block;
+    padding: 3px 0;
+    vertical-align: top;
+    width: calc(100% - 50px);
+  }
+
+  .count {
+    color: #8c8c8c;
+    display: inline-block;
+    font-size: 14px;
+    line-height: 14px;
+    text-align: right;
+    vertical-align: top;
+    width: 50px;
+  }
+
  .taskButton {
    background: transparent;
    border: none;
@@ -65,11 +65,11 @@ const Login = React.memo(
  ({
    defaultData,
    isSubmitting,
-    isSubmittingWithOidc,
+    isSubmittingUsingOidc,
    error,
    withOidc,
    onAuthenticate,
-    onAuthenticateWithOidc,
+    onAuthenticateUsingOidc,
    onMessageDismiss,
  }) => {
    const [t] = useTranslation();
@@ -192,15 +192,15 @@ const Login = React.memo(
                        content={t('action.logIn')}
                        floated="right"
                        loading={isSubmitting}
-                        disabled={isSubmitting || isSubmittingWithOidc}
+                        disabled={isSubmitting || isSubmittingUsingOidc}
                      />
                    </Form>
                    {withOidc && (
                      <Button
                        type="button"
-                        loading={isSubmittingWithOidc}
-                        disabled={isSubmitting || isSubmittingWithOidc}
-                        onClick={onAuthenticateWithOidc}
+                        loading={isSubmittingUsingOidc}
+                        disabled={isSubmitting || isSubmittingUsingOidc}
+                        onClick={onAuthenticateUsingOidc}
                      >
                        {t('action.logInWithSSO')}
                      </Button>
@@ -239,11 +239,11 @@ Login.propTypes = {
  defaultData: PropTypes.object.isRequired,
  /* eslint-enable react/forbid-prop-types */
  isSubmitting: PropTypes.bool.isRequired,
-  isSubmittingWithOidc: PropTypes.bool.isRequired,
+  isSubmittingUsingOidc: PropTypes.bool.isRequired,
  error: PropTypes.object, // eslint-disable-line react/forbid-prop-types
  withOidc: PropTypes.bool.isRequired,
  onAuthenticate: PropTypes.func.isRequired,
-  onAuthenticateWithOidc: PropTypes.func.isRequired,
+  onAuthenticateUsingOidc: PropTypes.func.isRequired,
  onMessageDismiss: PropTypes.func.isRequired,
 };

@@ -155,7 +155,7 @@ const ActionsStep = React.memo(
                </Menu.Item>
              </>
            )}
-            {!user.isLockedAdmin && (
+            {!user.isDeletionLocked && (
              <Menu.Item className={styles.menuItem} onClick={handleDeleteClick}>
                {t('action.deleteUser', {
                  context: 'title',
@@ -18,7 +18,8 @@ const Item = React.memo(
    phone,
    isAdmin,
    isLocked,
-    isLockedAdmin,
+    isRoleLocked,
+    isDeletionLocked,
    emailUpdateForm,
    passwordUpdateForm,
    usernameUpdateForm,
@@ -48,7 +49,7 @@ const Item = React.memo(
        <Table.Cell>{username || '-'}</Table.Cell>
        <Table.Cell>{email}</Table.Cell>
        <Table.Cell>
-          <Radio toggle checked={isAdmin} disabled={isLockedAdmin} onChange={handleIsAdminChange} />
+          <Radio toggle checked={isAdmin} disabled={isRoleLocked} onChange={handleIsAdminChange} />
        </Table.Cell>
        <Table.Cell textAlign="right">
          <ActionsPopup
@@ -60,7 +61,7 @@ const Item = React.memo(
              phone,
              isAdmin,
              isLocked,
-              isLockedAdmin,
+              isDeletionLocked,
              emailUpdateForm,
              passwordUpdateForm,
              usernameUpdateForm,
@@ -93,7 +94,8 @@ Item.propTypes = {
  phone: PropTypes.string,
  isAdmin: PropTypes.bool.isRequired,
  isLocked: PropTypes.bool.isRequired,
-  isLockedAdmin: PropTypes.bool.isRequired,
+  isRoleLocked: PropTypes.bool.isRequired,
+  isDeletionLocked: PropTypes.bool.isRequired,
  /* eslint-disable react/forbid-prop-types */
  emailUpdateForm: PropTypes.object.isRequired,
  passwordUpdateForm: PropTypes.object.isRequired,
@@ -111,7 +111,8 @@ const UsersModal = React.memo(
                  phone={item.phone}
                  isAdmin={item.isAdmin}
                  isLocked={item.isLocked}
-                  isLockedAdmin={item.isLockedAdmin}
+                  isRoleLocked={item.isRoleLocked}
+                  isDeletionLocked={item.isDeletionLocked}
                  emailUpdateForm={item.emailUpdateForm}
                  passwordUpdateForm={item.passwordUpdateForm}
                  usernameUpdateForm={item.usernameUpdateForm}
@@ -16,14 +16,15 @@ export default {
  AUTHENTICATE: 'AUTHENTICATE',
  AUTHENTICATE__SUCCESS: 'AUTHENTICATE__SUCCESS',
  AUTHENTICATE__FAILURE: 'AUTHENTICATE__FAILURE',
-  WITH_OIDC_AUTHENTICATE: 'WITH_OIDC_AUTHENTICATE',
-  WITH_OIDC_AUTHENTICATE__SUCCESS: 'WITH_OIDC_AUTHENTICATE__SUCCESS',
-  WITH_OIDC_AUTHENTICATE__FAILURE: 'WITH_OIDC_AUTHENTICATE__FAILURE',
+  USING_OIDC_AUTHENTICATE: 'USING_OIDC_AUTHENTICATE',
+  USING_OIDC_AUTHENTICATE__SUCCESS: 'USING_OIDC_AUTHENTICATE__SUCCESS',
+  USING_OIDC_AUTHENTICATE__FAILURE: 'USING_OIDC_AUTHENTICATE__FAILURE',
  AUTHENTICATE_ERROR_CLEAR: 'AUTHENTICATE_ERROR_CLEAR',

  /* Core */

  CORE_INITIALIZE: 'CORE_INITIALIZE',
+  CORE_INITIALIZE__CONFIG_FETCH: 'CORE_INITIALIZE__CONFIG_FETCH',
  LOGOUT: 'LOGOUT',
  LOGOUT__ACCESS_TOKEN_INVALIDATE: 'LOGOUT__ACCESS_TOKEN_INVALIDATE',

@@ -11,7 +11,7 @@ export default {
  /* Login */

  AUTHENTICATE: `${PREFIX}/AUTHENTICATE`,
-  WITH_OIDC_AUTHENTICATE: `${PREFIX}/WITH_OIDC_AUTHENTICATE`,
+  USING_OIDC_AUTHENTICATE: `${PREFIX}/USING_OIDC_AUTHENTICATE`,
  AUTHENTICATE_ERROR_CLEAR: `${PREFIX}/AUTHENTICATE_ERROR_CLEAR`,

  /* Core */
@@ -10,14 +10,14 @@ const mapStateToProps = (state) => {

  const {
    ui: {
-      authenticateForm: { data: defaultData, isSubmitting, isSubmittingWithOidc, error },
+      authenticateForm: { data: defaultData, isSubmitting, isSubmittingUsingOidc, error },
    },
  } = state;

  return {
    defaultData,
    isSubmitting,
-    isSubmittingWithOidc,
+    isSubmittingUsingOidc,
    error,
    withOidc: !!oidcConfig,
  };
@@ -27,7 +27,7 @@ const mapDispatchToProps = (dispatch) =>
  bindActionCreators(
    {
      onAuthenticate: entryActions.authenticate,
-      onAuthenticateWithOidc: entryActions.authenticateWithOidc,
+      onAuthenticateUsingOidc: entryActions.authenticateUsingOidc,
      onMessageDismiss: entryActions.clearAuthenticateError,
    },
    dispatch,
@@ -7,8 +7,8 @@ const authenticate = (data) => ({
  },
 });

-const authenticateWithOidc = () => ({
-  type: EntryActionTypes.WITH_OIDC_AUTHENTICATE,
+const authenticateUsingOidc = () => ({
+  type: EntryActionTypes.USING_OIDC_AUTHENTICATE,
  payload: {},
 });

@@ -19,6 +19,6 @@ const clearAuthenticateError = () => ({

 export default {
  authenticate,
-  authenticateWithOidc,
+  authenticateUsingOidc,
  clearAuthenticateError,
 };
@@ -8,6 +8,7 @@ import it from './it';
 import ja from './ja';
 import ko from './ko';
 import pl from './pl';
+import ro from './ro';
 import ru from './ru';
 import sk from './sk';
 import sv from './sv';
@@ -15,7 +16,7 @@ import tr from './tr';
 import uz from './uz';
 import zh from './zh';

-const locales = [cs, da, de, en, es, fr, it, ja, ko, pl, ru, sk, sv, tr, uz, zh];
+const locales = [cs, da, de, en, es, fr, it, ja, ko, pl, ro, ru, sk, sv, tr, uz, zh];

 export default locales;

@@ -8,7 +8,7 @@ export default {
    time: 'HH:mm',
    dateTime: '$t(format:date) $t(format:time)',
    longDate: 'MMMMd日',
-    longDateTime: "MMMMd'日 ' HH:MM",
+    longDateTime: "MMMMd'日 ' HH:mm",
  },

  translation: {
@@ -1,7 +1,5 @@
 import dateFns from 'date-fns/locale/ko';

-/* Translated by Park Seok Ho */
-
 export default {
  dateFns,

@@ -15,205 +13,225 @@ export default {

  translation: {
    common: {
+      aboutPlanka: 'Planka에 대해서',
      account: '계정',
      actions: '활동',
-      addAttachment_title: '첨부파일 추가',
+      addAttachment_title: '첨부 파일 추가',
      addComment: '댓글',
-      addManager_title: '관리자 추가',
-      addMember_title: '회원 추가',
+      addManager_title: '매니저 추가',
+      addMember_title: '멤버 추가',
      addUser_title: '사용자 추가',
-      administrator: '시스템 관리자',
-      all: 'All',
+      administrator: '관리자',
+      all: '모두',
      allChangesWillBeAutomaticallySavedAfterConnectionRestored:
-        '모든 변경 사항은 연결이 복원된 후 자동으로 저장됩니다',
-      areYouSureYouWantToDeleteThisAttachment: '첨부 파일을 삭제하시겠습니까?',
-      areYouSureYouWantToDeleteThisBoard: '보드를 삭제하시겠습니까?',
-      areYouSureYouWantToDeleteThisCard: '항목카드를 삭제하시겠습니까?',
-      areYouSureYouWantToDeleteThisComment: '댓글을 삭제하시겠습니까?',
-      areYouSureYouWantToDeleteThisLabel: '라벨을 삭제하시겠습니까?',
-      areYouSureYouWantToDeleteThisList: '리스트를 삭제하시겠습니까?',
-      areYouSureYouWantToDeleteThisProject: '프로젝트를 삭제하시겠습니까?',
-      areYouSureYouWantToDeleteThisTask: '태스트를 삭제하겠습니까?',
-      areYouSureYouWantToDeleteThisUser: '이 유저를 삭제하겠습니까?',
+        '연결이 복원되면 모든 변경 사항이 자동으로 저장됩니다.',
+      areYouSureYouWantToDeleteThisAttachment: '해당하는 첨부 파일을 삭제하시겠습니까?',
+      areYouSureYouWantToDeleteThisBoard: '해당하는 보드를 삭제하시겠습니까?',
+      areYouSureYouWantToDeleteThisCard: '해당하는 항목카드를 삭제하시겠습니까?',
+      areYouSureYouWantToDeleteThisComment: '해당하는 댓글을 삭제하시겠습니까?',
+      areYouSureYouWantToDeleteThisLabel: '해당하는 레이블을 삭제하시겠습니까?',
+      areYouSureYouWantToDeleteThisList: '해당하는 리스트를 삭제하시겠습니까?',
+      areYouSureYouWantToDeleteThisProject: '해당하는 프로젝트를 삭제하시겠습니까?',
+      areYouSureYouWantToDeleteThisTask: '해당하는 태스크를 삭제하겠습니까?',
+      areYouSureYouWantToDeleteThisUser: '해당하는 사용자를 삭제하겠습니까?',
      areYouSureYouWantToLeaveBoard: '이 보드에서 나가시겠습니까?',
      areYouSureYouWantToLeaveProject: '이 프로젝트에서 나가시겠습니까?',
-      areYouSureYouWantToRemoveThisManagerFromProject: '프로젝트에서 관리자를 제거하시겠습니까?',
-      areYouSureYouWantToRemoveThisMemberFromBoard: '이 회원을 보드에서 탈퇴시키겠습니까?',
-      attachment: '첨부파일',
-      attachments: '첨부파일',
-      authentication: '계정 관리',
-      background: 'Background',
+      areYouSureYouWantToRemoveThisManagerFromProject:
+        '해당하는 프로젝트에서 매니저를 제거하시겠습니까?',
+      areYouSureYouWantToRemoveThisMemberFromBoard: '해당하는 멤버를 보드에서 삭제하시겠습니까?',
+      attachment: '첨부',
+      attachments: '첨부 파일',
+      authentication: '인증',
+      background: '배경',
      board: '보드',
-      boardNotFound_title: '보드를 찾을 수 없습니다.',
-      cardActions_title: 'Card Actions',
-      cardNotFound_title: '항목카드를 찾을 수 없습니다.',
-      cardOrActionAreDeleted: '항목카드 혹은 활동내역이 삭제되었습니다.',
-      color: 'Color',
-      createBoard_title: '보드명칭을 입력하세요.',
-      createLabel_title: '라벨 생성',
-      createNewOneOrSelectExistingOne: '새 항목을 만들거나<br />기존 항목을 선택하세요.',
+      boardNotFound_title: '보드를 찾을 수 없음',
+      canComment: '댓글 달기 가능',
+      canEditContentOfBoard: '보드 콘텐츠 수정 가능',
+      canOnlyViewBoard: '보드를 보는 것만 가능합니다.',
+      cardActions_title: '카드 액션',
+      cardNotFound_title: '카드를 찾을 수 없음',
+      cardOrActionAreDeleted: '카드 또는 액션이 삭제됨',
+      color: '색상',
+      createBoard_title: '보드 생성',
+      createLabel_title: '레이블 생성',
+      createNewOneOrSelectExistingOne: '새로 생성하거나<br />기존 항목을 선택하세요.',
      createProject_title: '프로젝트 생성',
-      createTextFile_title: 'Text File 생성',
+      createTextFile_title: '텍스트 파일 생성',
      currentPassword: '현재 비밀번호',
-      dangerZone_title: 'Danger Zone',
+      dangerZone_title: '위험 구역',
      date: '날짜',
-      dueDate_title: '완료일',
-      deleteAttachment_title: '첨부파일 삭제',
+      dueDate_title: '마감일',
+      deleteAttachment_title: '첨부 파일 삭제',
      deleteBoard_title: '보드 삭제',
-      deleteCard_title: '항목 카드 삭제',
+      deleteCard_title: '카드 삭제',
      deleteComment_title: '댓글 삭제',
-      deleteLabel_title: '라벨 삭제',
+      deleteLabel_title: '레이블 삭제',
      deleteList_title: '리스트 삭제',
      deleteProject_title: '프로젝트 삭제',
      deleteTask_title: '태스크 삭제',
      deleteUser_title: '사용자 삭제',
      description: '설명',
      detectAutomatically: '자동으로 감지',
-      dropFileToUpload: '업로드 하기 위해서 파일을 Drop 하세요.',
+      dropFileToUpload: '업로드할 파일 놓기',
+      editor: '편집기',
      editAttachment_title: '첨부 수정',
-      editAvatar_title: '프로필사진 수정',
+      editAvatar_title: '아바타 수정',
      editBoard_title: '보드 수정',
-      editDueDate_title: '완료일 수정',
-      editEmail_title: '메일 수정',
+      editDueDate_title: '마감일 수정',
+      editEmail_title: '이메일 수정',
      editInformation_title: '정보 수정',
-      editLabel_title: '라벨 수정',
+      editLabel_title: '레이블 수정',
      editPassword_title: '비밀번호 수정',
-      editStopwatch_title: '타이머 수정',
-      editUsername_title: '사용자이름 수정',
-      email: '메일',
-      emailAlreadyInUse: '기 가입된 이메일이 존재합니다.',
-      enterCardTitle: '항목카드명을 입력하세요...',
-      enterDescription: '자세한 설명을 작성하세요...',
-      enterFilename: '파일이름을 입력하세요...',
-      enterListTitle: '리스트명을 입력 (예,todo,완료,이슈등...)',
-      enterProjectTitle: '프로젝트명칭을 입력하세요.',
-      enterTaskDescription: '태스크 설명을 입력하세요...',
-      filterByLabels_title: '라벨 검색',
-      filterByMembers_title: '회원으로 검색',
-      fromComputer_title: 'PC로 부터',
-      general: 'General',
+      editPermissions_title: '권한 수정',
+      editStopwatch_title: '스톱워치 수정',
+      editUsername_title: '사용자 이름 수정',
+      email: '이메일',
+      emailAlreadyInUse: '이미 사용 중인 이메일입니다.',
+      enterCardTitle: '카드 제목 입력... [Ctrl+Enter]로 자동으로 열기',
+      enterDescription: '설명 입력...',
+      enterFilename: '파일 이름 입력...',
+      enterListTitle: '리스트 제목 입력...',
+      enterProjectTitle: '프로젝트 제목 입력',
+      enterTaskDescription: '태스크 설명 입력...',
+      filterByLabels_title: '레이블로 필터링',
+      filterByMembers_title: '멤버로 필터링',
+      fromComputer_title: 'PC에서',
+      fromTrello: '트렐로에서',
+      general: '일반',
      hours: '시',
-      invalidCurrentPassword: '현재 패스워드는 유효하지 않습니다.',
-      labels: '라벨',
-      language: '언어 선택',
-      leaveBoard_title: '보드 탈퇴',
-      leaveProject_title: '프로젝트 탈퇴',
-      list: '내역',
-      listActions_title: '활용 내역',
-      managers: '관리자',
-      members: '팀원',
+      importBoard_title: '보드 가져오기',
+      invalidCurrentPassword: '현재 비밀번호가 일치하지 않습니다.',
+      labels: '레이블',
+      language: '언어',
+      leaveBoard_title: '보드 떠나기',
+      leaveProject_title: '프로젝트 떠나기',
+      list: '리스트',
+      listActions_title: '리스트 액션',
+      managers: '매니저',
+      members: '멤버',
      minutes: '분',
-      moveCard_title: '항목카드 이동',
+      moveCard_title: '카드 옮기기',
      name: '이름',
-      newEmail: '새로운 메일',
-      newPassword: '새로운 패스워드',
+      newEmail: '새로운 이메일',
+      newPassword: '새로운 비밀번호',
      newUsername: '새로운 사용자 이름',
-      noConnectionToServer: '서버에 연결할수 없습니다.',
-      noBoards: '보드가 존재하지 않습니다.',
-      noLists: '리스트가 존재하지 않습니다.',
-      noProjects: '프로젝트가 존재하지 않습니다.',
+      noConnectionToServer: '서버에 연결되지 않음',
+      noBoards: '보드가 존재하지 않음',
+      noLists: '리스트가 존재하지 않음',
+      noProjects: '프로젝트가 존재하지 않음',
      notifications: '알림',
-      noUnreadNotifications: '알림을 모두 확인했습니다.',
-      openBoard_title: '보드열기',
+      noUnreadNotifications: '읽지 않은 알림 없음',
+      openBoard_title: '보드 열기',
      optional_inline: '옵션',
      organization: '조직',
      phone: '전화번호',
-      preferences: '환경설정',
+      preferences: '기본설정',
      pressPasteShortcutToAddAttachmentFromClipboard:
-        'Tip: 클립보드에서 첨부 파일을 추가하려면 Ctrl-V(Mac의 경우 Cmd-V) 입니다..',
+        '팁: 클립보드에서 첨부 파일을 추가하려면 Ctrl-V(Mac의 경우 Cmd-V)를 누릅니다.',
      project: '프로젝트',
-      projectNotFound_title: '프로젝트가 존재하지 않습니다.',
-      removeManager_title: '관리자 삭제',
-      removeMember_title: '맴버 삭제',
+      projectNotFound_title: '프로젝트를 찾을 수 없음',
+      removeManager_title: '매니저 삭제',
+      removeMember_title: '멤버 삭제',
+      searchLabels: '레이블 검색하기...',
+      searchMembers: '멤버 검색하기...',
+      searchUsers: '사용자 검색하기...',
      seconds: '초',
      selectBoard: '보드 선택',
      selectList: '리스트 선택',
+      selectPermissions_title: '권한 선택',
      selectProject: '프로젝트 선택',
      settings: '설정',
-      stopwatch: '활동시간',
-      subscribeToMyOwnCardsByDefault: '내 항목카드는 기본으로 구독',
-      taskActions_title: '태스크 활동',
+      stopwatch: '스톱워치',
+      subscribeToMyOwnCardsByDefault: '기본적으로 내 카드 구독하기',
+      taskActions_title: '태스크 액션',
      tasks: '태스크',
-      thereIsNoPreviewAvailableForThisAttachment:
-        '이 첨부 파일에 사용할 수 있는 미리보기가 없습니다.',
+      thereIsNoPreviewAvailableForThisAttachment: '이 첨부 파일은 미리 보기를 사용할 수 없습니다.',
      time: '시간',
      title: '제목',
-      userActions_title: '',
-      userAddedThisCardToList: '<0>{{user}}</0><1>이 카드를 {{list}}</1>에 추가했습니다.',
+      userActions_title: '사용자 액션',
+      userAddedThisCardToList: '<0>{{user}}</0><1>님이 {{list}}</1>에 카드를 추가했습니다.',
      userLeftNewCommentToCard:
-        '{{user}}이(가) <2>{{card}}</2>에 «{{comment}}»라는 댓글을 남겼습니다',
-      userMovedCardFromListToList: '{{user}} moved <2>{{card}}</2> from {{fromList}} to {{toList}}',
+        '{{user}}님이 <2>{{card}}</2>에 «{{comment}}»라는 댓글을 남겼습니다.',
+      userMovedCardFromListToList:
+        '{{user}}님이 {{fromList}}에서 {{toList}}로 <2>{{card}}</2>를 옮겼습니다.',
      userMovedThisCardFromListToList:
-        '<0>{{user}}</0><1> 이 항목카드를  {{fromList}} 에서 {{toList}} 으로 이동했습니다. </1>',
-      username: '아이디',
-      usernameAlreadyInUse: '이미 사용중인 사용자입니다.',
+        '<0>{{user}}</0><1> 님이 {{fromList}}에서 {{toList}}로 이 카드를 옮겼습니다.</1>',
+      username: '사용자 이름',
+      usernameAlreadyInUse: '이미 사용중인 사용자 이름입니다.',
      users: '사용자',
-      writeComment: '댓글 작성...',
+      version: '버전',
+      viewer: '열람자',
+      writeComment: '댓글 쓰기...',
    },

    action: {
-      addAnotherCard: '다른 항목카드 추가',
+      addAnotherCard: '다른 카드 추가',
      addAnotherList: '다른 리스트 추가',
-      addAnotherTask: '다른 TASK 추가',
-      addCard: '항목카드 추가',
-      addCard_title: '항목카드 추가',
+      addAnotherTask: '다른 태스크 추가',
+      addCard: '카드 추가',
+      addCard_title: '카드 추가',
      addComment: '댓글 추가',
      addList: '리스트 추가',
+      addMember: '멤버 추가',
      addMoreDetailedDescription: '자세한 설명 추가',
-      addTask: '태스트 추가',
-      addToCard: '항목카드 추가',
+      addTask: '태스크 추가',
+      addToCard: '카드에 추가',
      addUser: '사용자 추가',
      createBoard: '보드 생성',
      createFile: '파일 생성',
-      createLabel: '라벨 생성',
-      createNewLabel: '새로운 라벨 생성',
+      createLabel: '레이블 생성',
+      createNewLabel: '새로운 레이블 생성',
      createProject: '프로젝트 생성',
      delete: '삭제',
-      deleteAttachment: '첨부삭제',
-      deleteAvatar: '프로필 사진 삭제',
+      deleteAttachment: '첨부 삭제',
+      deleteAvatar: '아바타 삭제',
      deleteBoard: '보드 삭제',
-      deleteCard: '항목카드 삭제',
-      deleteCard_title: '항목카드 삭제',
+      deleteCard: '카드 삭제',
+      deleteCard_title: '카드 삭제',
      deleteComment: '댓글 삭제',
      deleteImage: '이미지 삭제',
-      deleteLabel: '라벨 삭제',
+      deleteLabel: '레이블 삭제',
      deleteList: '리스트 삭제',
      deleteList_title: '리스트 삭제',
      deleteProject: '프로젝트 삭제',
      deleteProject_title: '프로젝트 삭제',
-      deleteTask: '태스트 삭제',
-      deleteTask_title: '태스트 삭제',
+      deleteTask: '태스크 삭제',
+      deleteTask_title: '태스크 삭제',
      deleteUser: '사용자 삭제',
      edit: '수정',
-      editDueDate_title: '완료일 수정',
+      editDueDate_title: '마감일 수정',
      editDescription_title: '설명 수정',
-      editEmail_title: '메일 수정',
+      editEmail_title: '이메일 수정',
      editInformation_title: '정보 수정',
-      editPassword_title: '패스워드 수정',
-      editStopwatch_title: '시간 수정',
+      editPassword_title: '비밀번호 수정',
+      editPermissions: '권한 수정',
+      editStopwatch_title: '스톱워치 수정',
      editTitle_title: '제목 수정',
-      editUsername_title: '이름 수정',
-      leaveBoard: '보드에서 나가기',
-      leaveProject: '프로젝트에서 나가기',
+      editUsername_title: '사용자 이름 수정',
+      hideDetails: '세부 사항 숨기기',
+      import: '가져오기',
+      leaveBoard: '보드 나가기',
+      leaveProject: '프로젝트 나가기',
      logOut_title: '로그아웃',
      makeCover_title: '커버 만들기',
      move: '이동',
-      moveCard_title: '항목카드 이동',
+      moveCard_title: '카드 이동',
      remove: '제거',
-      removeBackground: '백그라운드 제거',
+      removeBackground: '배경 제거',
      removeCover_title: '커버 제거',
-      removeFromBoard: '보드에서 제거',
-      removeFromProject: '프로젝트에서 제거',
-      removeManager: '관리자 삭제',
-      removeMember: '멤버 삭제',
+      removeFromBoard: '보드 제거',
+      removeFromProject: '프로젝트 제거',
+      removeManager: '매니저 제거',
+      removeMember: '멤버 제거',
      save: '저장',
-      showAllAttachments: '모든 첨부파일 표시 ({{hidden}} hidden)',
-      showFewerAttachments: '일부 첨부파일만 표시',
+      showAllAttachments: '모든 첨부 파일 표시 ({{hidden}} 숨겨짐)',
+      showDetails: '세부 사항 보기',
+      showFewerAttachments: '일부 첨부 파일만 표시',
      start: '시작',
-      stop: '끝',
+      stop: '종료',
      subscribe: '구독하기',
-      unsubscribe: '구독 취소',
-      uploadNewAvatar: '새로운 프로필 사진 업로드',
+      unsubscribe: '구독취소',
+      uploadNewAvatar: '새로운 아바타 업로드',
      uploadNewImage: '새로운 이미지 업로드',
    },
  },
@@ -1,22 +1,22 @@
-/* Translated by Park Seok Ho */
-
 export default {
  translation: {
    common: {
-      emailOrUsername: '이메일 혹은 아이디',
-      invalidEmailOrUsername: '이메일이나 사용자 이름이 유효하지 않습니다.',
-      invalidPassword: '잘못된 비밀번호',
+      emailOrUsername: '이메일 혹은 사용자 이름',
+      invalidEmailOrUsername: '이메일 혹은 사용자 이름이 유효하지 않습니다.',
+      invalidPassword: '유효하지 않은 비밀번호',
      logInToPlanka: 'Planka에 로그인',
-      noInternetConnection: '인터넷에 연결되지 않음',
-      pageNotFound_title: '페이지를 찾을수 없습니다.',
-      password: '패스워드',
+      noInternetConnection: '인터넷 연결이 없음',
+      pageNotFound_title: '페이지를 찾을 수 없습니다.',
+      password: '비밀번호',
      projectManagement: '프로젝트 관리',
-      serverConnectionFailed: '서버 연결 실패',
-      unknownError: '알 수 없는 오류가 발생하였습니다, 나중에 다시 시도하세요.',
+      serverConnectionFailed: '서버 연결에 실패함',
+      unknownError: '알 수 없는 오류, 나중에 다시 시도하십시오.',
+      useSingleSignOn: 'single sign-on(SSO) 사용',
    },

    action: {
      logIn: '로그인',
+      logInWithSSO: 'single sign-on(SSO)으로 로그인',
    },
  },
 };
@@ -0,0 +1,240 @@
+import dateFns from 'date-fns/locale/ro';
+
+export default {
+  dateFns,
+
+  format: {
+    date: 'P',
+    time: 'HH:mm',
+    dateTime: '$t(format:date) $t(format:time)',
+    longDate: 'd MMM',
+    longDateTime: "d MMMM 'в' p",
+  },
+
+  translation: {
+    common: {
+      aboutPlanka: 'Despre Planka',
+      account: 'Cont',
+      actions: 'Acțiuni',
+      addAttachment_title: 'Adauga atasament',
+      addComment: 'Adaugă comentariu',
+      addManager_title: 'Adaugă Manager',
+      addMember_title: 'Adaugă Membru',
+      addUser_title: 'Adaugă Utilizator',
+      administrator: 'Administrator',
+      all: 'Toate',
+      allChangesWillBeAutomaticallySavedAfterConnectionRestored:
+        'Toate modificarile vor fi salvate automat<br />dupa restabilirea conexiunii',
+      areYouSureYouWantToDeleteThisAttachment: 'Sigur doriți să ștergeți acest atașament?',
+      areYouSureYouWantToDeleteThisBoard: 'Sigur doriți să ștergeți acest panou?',
+      areYouSureYouWantToDeleteThisCard: 'Sigur doriți să ștergeți acest card?',
+      areYouSureYouWantToDeleteThisComment: 'Sigur doriți să ștergeți acest comentariu?',
+      areYouSureYouWantToDeleteThisLabel: 'Sigur doriți să ștergeți această etichetă?',
+      areYouSureYouWantToDeleteThisList: 'Sigur doriți să ștergeți această listă?',
+      areYouSureYouWantToDeleteThisProject: 'Sigur doriți să ștergeți acest proiect?',
+      areYouSureYouWantToDeleteThisTask: 'Sigur doriți să ștergeți această sarcină?',
+      areYouSureYouWantToDeleteThisUser: 'Sigur doriți să ștergeți acest utilizator?',
+      areYouSureYouWantToLeaveBoard: 'Ești sigur că vrei să părăsești tabla?',
+      areYouSureYouWantToLeaveProject: 'Ești sigur că vrei să părăsești proiectul?',
+      areYouSureYouWantToRemoveThisManagerFromProject:
+        'Sigur doriți să eliminați acest manager din proiect?',
+      areYouSureYouWantToRemoveThisMemberFromBoard:
+        'Sigur doriți să eliminați acest membru din consiliu?',
+      attachment: 'Atașament',
+      attachments: 'Atasamente',
+      authentication: 'Autentificare',
+      background: 'Fundal',
+      board: 'Tabla',
+      boardNotFound_title: 'Tabla nu a fost găsită',
+      canComment: 'Poate comenta',
+      canEditContentOfBoard: 'Poate edita conținutul tablei',
+      canOnlyViewBoard: 'Poate doar vizualiza tabla',
+      cardActions_title: 'Acțiuni cu carduri',
+      cardNotFound_title: 'Cardul nu a fost găsit',
+      cardOrActionAreDeleted: 'Cardul sau acțiunea sunt șterse',
+      color: 'Culoarea',
+      createBoard_title: 'Creare Tabla',
+      createLabel_title: 'Creați etichetă',
+      createNewOneOrSelectExistingOne: 'Crează unu nou sau selectează<br />unu deja existent',
+      createProject_title: 'Crează Proiect',
+      createTextFile_title: 'Crează un Fișier Text',
+      currentPassword: 'Parola Curentă',
+      dangerZone_title: 'Zona periculoasă',
+      date: 'Data',
+      dueDate_title: 'Data scadentă',
+      deleteAttachment_title: 'Ștergeți atașamentul',
+      deleteBoard_title: 'Ștergeți Tabla',
+      deleteCard_title: 'Ștergeți cardul',
+      deleteComment_title: 'Șterge comentariul',
+      deleteLabel_title: 'Ștergeți eticheta',
+      deleteList_title: 'Șterge lista',
+      deleteProject_title: 'Șterge proiectul',
+      deleteTask_title: 'Ștergeți sarcina',
+      deleteUser_title: 'Șterge utilizator',
+      description: 'Descriere',
+      detectAutomatically: 'Detectează automat',
+      dropFileToUpload: 'Aruncă fișierul pentru a încărca',
+      editor: 'Editor',
+      editAttachment_title: 'Editați atașamentul',
+      editAvatar_title: 'Editați avatarul',
+      editBoard_title: 'Editați tabla',
+      editDueDate_title: 'Editați data scadentă',
+      editEmail_title: 'Editați E-mail',
+      editInformation_title: 'Editați informații',
+      editLabel_title: 'Editați eticheta',
+      editPassword_title: 'Editați parola',
+      editPermissions_title: 'Editați permisiunile',
+      editStopwatch_title: 'Editați cronometrul',
+      editUsername_title: 'Editați numele de utilizator',
+      email: 'E-mail',
+      emailAlreadyInUse: 'E-mail deja utilizat',
+      enterCardTitle: 'Introduceți titlul cardului... [Ctrl+Enter] pentru a se deschide automat',
+      enterDescription: 'Introduceți descrierea...',
+      enterFilename: 'Introduceți numele fișierului',
+      enterListTitle: 'Introduceți titlul listei...',
+      enterProjectTitle: 'Introduceți titlul proiectului',
+      enterTaskDescription: 'Introduceți descrierea sarcinii...',
+      filterByLabels_title: 'Filtrați după etichete',
+      filterByMembers_title: 'Filtrați după membri',
+      fromComputer_title: 'De pe computer',
+      fromTrello: 'De pe Trello',
+      general: 'General',
+      hours: 'Ore',
+      importBoard_title: 'Import Tabla',
+      invalidCurrentPassword: 'Parolă actuală nevalidă',
+      labels: 'Etichete',
+      language: 'Limba',
+      leaveBoard_title: 'Părăsiți Tabla',
+      leaveProject_title: 'Părăsiți proiectul',
+      list: 'Lista',
+      listActions_title: 'Listează acțiuni',
+      managers: 'Managerii',
+      members: 'Membri',
+      minutes: 'Minute',
+      moveCard_title: 'Mutați cardul',
+      name: 'Nume',
+      newEmail: 'Email nou',
+      newPassword: 'Parolă Nouă',
+      newUsername: 'Nume de utilizator nou',
+      noConnectionToServer: 'Nicio conexiune la server',
+      noBoards: 'Fără Table',
+      noLists: 'Fără Liste',
+      noProjects: 'Fără proiecte',
+      notifications: 'Notificări',
+      noUnreadNotifications: 'Fără notificări necitite',
+      openBoard_title: 'Tablă deschisă',
+      optional_inline: 'optional',
+      organization: 'Organizatia',
+      phone: 'Telefon',
+      preferences: 'Preferințe',
+      pressPasteShortcutToAddAttachmentFromClipboard:
+        'Sfat: apăsați Ctrl-V (Cmd-V pe Mac) pentru a adăuga un atașament din clipboard',
+      project: 'Proiect',
+      projectNotFound_title: 'Proiectul nu a fost găsit',
+      removeManager_title: 'Eliminați Manager',
+      removeMember_title: 'Eliminați membru',
+      searchLabels: 'Căutați etichete...',
+      searchMembers: 'Căutați membri...',
+      searchUsers: 'Căutați utilizatori...',
+      seconds: 'Secunde',
+      selectBoard: 'Selectați tabla',
+      selectList: 'Selectați lista',
+      selectPermissions_title: 'Selectați Permisiuni',
+      selectProject: 'Selectați proiectul',
+      settings: 'Setări',
+      stopwatch: 'Cronometru',
+      subscribeToMyOwnCardsByDefault: 'Abonați-vă la propriile carduri în mod implicit',
+      taskActions_title: 'Acțiuni de sarcină',
+      tasks: 'Sarcini',
+      thereIsNoPreviewAvailableForThisAttachment:
+        'Nu există nicio previzualizare disponibilă pentru acest atașament',
+      time: 'Timp',
+      title: 'Titlu',
+      userActions_title: 'Acțiunile utilizatorului',
+      userAddedThisCardToList: '<0>{{user}}</0><1> a adăugat acest card în {{list}}</1>',
+      userLeftNewCommentToCard:
+        '{{user}} a lăsat un nou comentariu «{{comment}}» în <2>{{card}}</2>',
+      userMovedCardFromListToList:
+        '{{user}} a mutat <2>{{card}}</2> din {{fromList}} în {{toList}}',
+      userMovedThisCardFromListToList:
+        '<0>{{user}}</0><1> a mutat aceast card din {{fromList}} în {{toList}}</1>',
+      username: 'Nume utilizator',
+      usernameAlreadyInUse: 'Nume utilizator deja exista',
+      users: 'Utilizatori',
+      version: 'Versiunea',
+      viewer: 'Vizualizator',
+      writeComment: 'Scrie un comentariu...',
+    },
+
+    action: {
+      addAnotherCard: 'Adăugați un alt card',
+      addAnotherList: 'Adăugați o altă listă',
+      addAnotherTask: 'Adăugați o altă sarcină',
+      addCard: 'Adăugați card',
+      addCard_title: 'Adăugați card',
+      addComment: 'Adauga comentariu',
+      addList: 'Adăugați listă',
+      addMember: 'Adăugați membru',
+      addMoreDetailedDescription: 'Adăugați descrierea mai detaliata',
+      addTask: 'Adăugați sarcină',
+      addToCard: 'Adauga în card',
+      addUser: 'Adăugați utilizator',
+      createBoard: 'Creați tablă',
+      createFile: 'Creați fișier',
+      createLabel: 'Creați eticheta',
+      createNewLabel: 'Creați o nouă etichetă',
+      createProject: 'Creați proiect',
+      delete: 'Ștergeți',
+      deleteAttachment: 'Ștergeți atașamentul',
+      deleteAvatar: 'Ștergeți avatarul',
+      deleteBoard: 'Ștergeți tabla',
+      deleteCard: 'Ștergeți cardul',
+      deleteCard_title: 'Ștergeți Cardul',
+      deleteComment: 'Șterge comentariu',
+      deleteImage: 'Șterge imaginea',
+      deleteLabel: 'Ștergeți Eticheta',
+      deleteList: 'Ștergeți lista',
+      deleteList_title: 'Ștergeți Lista',
+      deleteProject: 'Ștergeți proiectul',
+      deleteProject_title: 'Ștergeți Proiectul',
+      deleteTask: 'Ștergeți sarcina',
+      deleteTask_title: 'Ștergeți Sarcina',
+      deleteUser: 'Ștergeți utilizatorul',
+      edit: 'Editați',
+      editDueDate_title: 'Editați data scadentă',
+      editDescription_title: 'Editați descrierea',
+      editEmail_title: 'Editați e-mailul',
+      editInformation_title: 'Editați informații',
+      editPassword_title: 'Editați parola',
+      editPermissions: 'Editați permisiunile',
+      editStopwatch_title: 'Editați cronometrul',
+      editTitle_title: 'Editați Titlul',
+      editUsername_title: 'Editați Numele Utilizator',
+      hideDetails: 'Ascunde detalii',
+      import: 'Import',
+      leaveBoard: 'Părăsiți bordul',
+      leaveProject: 'Părăsiți proiect',
+      logOut_title: 'Deconectați-vă',
+      makeCover_title: 'Faceți Coperta',
+      move: 'Mutați',
+      moveCard_title: 'Mutați cardul',
+      remove: 'Eliminați',
+      removeBackground: 'Eliminați fundalul',
+      removeCover_title: 'Eliminați Coperta',
+      removeFromBoard: 'Eliminați din Tabla',
+      removeFromProject: 'Eliminați din proiect',
+      removeManager: 'Eliminați managerul',
+      removeMember: 'Eliminați membrul',
+      save: 'Salveaza',
+      showAllAttachments: 'Afișați toate atașamentele ({{hidden}} ascunse)',
+      showDetails: 'Arată detalii',
+      showFewerAttachments: 'Afișați mai puține atașamente',
+      start: 'Start',
+      stop: 'Stop',
+      subscribe: 'Abonati-va',
+      unsubscribe: 'Dezabonați-vă',
+      uploadNewAvatar: 'Încărcați un avatar nou',
+      uploadNewImage: 'Încărcați o nouă imagine',
+    },
+  },
+};
@@ -0,0 +1,8 @@
+import login from './login';
+
+export default {
+  language: 'ro',
+  country: 'ro',
+  name: 'Română',
+  embeddedLocale: login,
+};
@@ -0,0 +1,22 @@
+export default {
+  translation: {
+    common: {
+      emailOrUsername: 'E-mail sau nume de utilizator',
+      invalidEmailOrUsername: 'E-mail sau nume de utilizator introduse greșit',
+      invalidPassword: 'Parola greșita',
+      logInToPlanka: 'Autentificarea în Planka',
+      noInternetConnection: 'Lipsește conexiunea cu internet',
+      pageNotFound_title: 'Pagina n-a fost găsită',
+      password: 'Parola',
+      projectManagement: 'Gestionarea proiectului',
+      serverConnectionFailed: 'Conexiunea cu Server a eșuat',
+      unknownError: 'Eroarea necunoscuta, mai incercați',
+      useSingleSignOn: 'Folosiți autentificarea unica',
+    },
+
+    action: {
+      logIn: 'Autentificarea',
+      logInWithSSO: 'Autentificarea cu SSO',
+    },
+  },
+};
@@ -45,7 +45,8 @@ export default class extends BaseModel {
    subscribeToOwnCards: attr(),
    isAdmin: attr(),
    isLocked: attr(),
-    isLockedAdmin: attr(),
+    isRoleLocked: attr(),
+    isDeletionLocked: attr(),
    deletedAt: attr(),
    createdAt: attr({
      getDefault: () => new Date(),
@@ -10,7 +10,7 @@ const initialState = {
 export default (state = initialState, { type, payload }) => {
  switch (type) {
    case ActionTypes.AUTHENTICATE__SUCCESS:
-    case ActionTypes.WITH_OIDC_AUTHENTICATE__SUCCESS:
+    case ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS:
      return {
        ...state,
        accessToken: payload.accessToken,
@@ -15,7 +15,7 @@ export default (state = initialState, { type, payload }) => {
        config: payload.config,
      };
    case ActionTypes.AUTHENTICATE__SUCCESS:
-    case ActionTypes.WITH_OIDC_AUTHENTICATE__SUCCESS:
+    case ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS:
      return {
        ...state,
        isInitializing: true,
@@ -24,9 +24,11 @@ export default (state = initialState, { type, payload }) => {
      return {
        ...state,
        isInitializing: false,
-        ...(payload.config && {
-          config: payload.config,
-        }),
+      };
+    case ActionTypes.CORE_INITIALIZE__CONFIG_FETCH:
+      return {
+        ...state,
+        config: payload.config,
      };
    default:
      return state;
@@ -9,7 +9,7 @@ const initialState = {
    password: '',
  },
  isSubmitting: false,
-  isSubmittingWithOidc: false,
+  isSubmittingUsingOidc: false,
  error: null,
 };

@@ -20,7 +20,7 @@ export default (state = initialState, { type, payload }) => {
      if (payload.location.pathname === Paths.OIDC_CALLBACK) {
        return {
          ...state,
-          isSubmittingWithOidc: true,
+          isSubmittingUsingOidc: true,
        };
      }

@@ -35,7 +35,7 @@ export default (state = initialState, { type, payload }) => {
        isSubmitting: true,
      };
    case ActionTypes.AUTHENTICATE__SUCCESS:
-    case ActionTypes.WITH_OIDC_AUTHENTICATE__SUCCESS:
+    case ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS:
      return initialState;
    case ActionTypes.AUTHENTICATE__FAILURE:
      return {
@@ -43,10 +43,10 @@ export default (state = initialState, { type, payload }) => {
        isSubmitting: false,
        error: payload.error,
      };
-    case ActionTypes.WITH_OIDC_AUTHENTICATE__FAILURE:
+    case ActionTypes.USING_OIDC_AUTHENTICATE__FAILURE:
      return {
        ...state,
-        isSubmittingWithOidc: false,
+        isSubmittingUsingOidc: false,
        error: payload.error,
      };
    case ActionTypes.AUTHENTICATE_ERROR_CLEAR:
@@ -1,7 +1,8 @@
-import { all, apply, fork, take } from 'redux-saga/effects';
+import { all, apply, fork, select, take } from 'redux-saga/effects';

 import watchers from './watchers';
 import services from './services';
+import selectors from '../../selectors';
 import { socket } from '../../api';
 import ActionTypes from '../../constants/ActionTypes';
 import Paths from '../../constants/Paths';
@@ -14,5 +15,12 @@ export default function* coreSaga() {

  yield take(ActionTypes.LOGOUT);

-  window.location.href = Paths.LOGIN;
+  const oidcConfig = yield select(selectors.selectOidcConfig);
+
+  if (oidcConfig && oidcConfig.endSessionUrl !== null) {
+    // Redirect the user to the IDP to log out.
+    window.location.href = oidcConfig.endSessionUrl;
+  } else {
+    window.location.href = Paths.LOGIN;
+  }
 }
@@ -1,4 +1,4 @@
-import { apply, call, put, select, take } from 'redux-saga/effects';
+import { call, put, select, take } from 'redux-saga/effects';

 import request from '../request';
 import requests from '../requests';
@@ -6,7 +6,6 @@ import selectors from '../../../selectors';
 import actions from '../../../actions';
 import api from '../../../api';
 import i18n from '../../../i18n';
-import { createOidcManager } from '../../../utils/oidc-manager';
 import { removeAccessToken } from '../../../utils/access-token-storage';

 export function* initializeCore() {
@@ -15,6 +14,8 @@ export function* initializeCore() {
  let config;
  if (!currentConfig) {
    ({ item: config } = yield call(api.getConfig)); // TODO: handle error
+
+    yield put(actions.initializeCore.fetchConfig(config));
  }

  const {
@@ -41,7 +42,6 @@ export function* initializeCore() {

  yield put(
    actions.initializeCore(
-      config,
      user,
      board,
      users,
@@ -84,16 +84,6 @@ export function* logout(invalidateAccessToken = true) {
    } catch (error) {} // eslint-disable-line no-empty
  }

-  const oidcConfig = yield select(selectors.selectOidcConfig);
-
-  if (oidcConfig) {
-    const oidcManager = createOidcManager(oidcConfig);
-
-    try {
-      yield apply(oidcManager, oidcManager.logout);
-    } catch (error) {} // eslint-disable-line no-empty
-  }
-
  yield put(actions.logout());
  yield take();
 }
@@ -14,24 +14,45 @@ export function* handleSocketReconnect() {

  yield put(actions.handleSocketReconnect.fetchCore(currentUserId, boardId));

-  const {
-    user,
-    board,
-    users,
-    projects,
-    projectManagers,
-    boards,
-    boardMemberships,
-    labels,
-    lists,
-    cards,
-    cardMemberships,
-    cardLabels,
-    tasks,
-    attachments,
-    activities,
-    notifications,
-  } = yield call(requests.fetchCore); // TODO: handle error
+  let user;
+  let board;
+  let users;
+  let projects;
+  let projectManagers;
+  let boards;
+  let boardMemberships;
+  let labels;
+  let lists;
+  let cards;
+  let cardMemberships;
+  let cardLabels;
+  let tasks;
+  let attachments;
+  let activities;
+  let notifications;
+
+  try {
+    ({
+      user,
+      board,
+      users,
+      projects,
+      projectManagers,
+      boards,
+      boardMemberships,
+      labels,
+      lists,
+      cards,
+      cardMemberships,
+      cardLabels,
+      tasks,
+      attachments,
+      activities,
+      notifications,
+    } = yield call(requests.fetchCore));
+  } catch (error) {
+    return;
+  }

  yield put(
    actions.handleSocketReconnect(
@@ -9,7 +9,7 @@ export default function* loginSaga() {

  yield fork(services.initializeLogin);

-  yield take([ActionTypes.AUTHENTICATE__SUCCESS, ActionTypes.WITH_OIDC_AUTHENTICATE__SUCCESS]);
+  yield take([ActionTypes.AUTHENTICATE__SUCCESS, ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS]);

  yield cancel(watcherTasks);
  yield call(services.goToRoot);
@@ -1,10 +1,10 @@
-import { apply, call, put, select } from 'redux-saga/effects';
+import { nanoid } from 'nanoid';
+import { call, put, select } from 'redux-saga/effects';
 import { replace } from '../../../lib/redux-router';

 import selectors from '../../../selectors';
 import actions from '../../../actions';
 import api from '../../../api';
-import { createOidcManager } from '../../../utils/oidc-manager';
 import { setAccessToken } from '../../../utils/access-token-storage';
 import Paths from '../../../constants/Paths';

@@ -29,40 +29,84 @@ export function* authenticate(data) {
  yield put(actions.authenticate.success(accessToken));
 }

-export function* authenticateWithOidc() {
+export function* authenticateUsingOidc() {
  const oidcConfig = yield select(selectors.selectOidcConfig);
-  const oidcManager = createOidcManager(oidcConfig);

-  yield apply(oidcManager, oidcManager.login);
+  const state = nanoid();
+  window.sessionStorage.setItem('oidc-state', state);
+
+  const nonce = nanoid();
+  window.sessionStorage.setItem('oidc-nonce', nonce);
+
+  let redirectUrl = `${oidcConfig.authorizationUrl}`;
+  redirectUrl += `&state=${encodeURIComponent(state)}`;
+  redirectUrl += `&nonce=${encodeURIComponent(nonce)}`;
+
+  window.location.href = redirectUrl;
 }

-export function* authenticateWithOidcCallback() {
-  const oidcConfig = yield select(selectors.selectOidcConfig);
-  const oidcManager = createOidcManager(oidcConfig);
+export function* authenticateUsingOidcCallback() {
+  // https://github.com/plankanban/planka/issues/511#issuecomment-1771385639
+  const params = new URLSearchParams(window.location.hash.substring(1) || window.location.search);

-  let oidcToken;
-  try {
-    ({ access_token: oidcToken } = yield apply(oidcManager, oidcManager.loginCallback));
-  } catch (error) {
-    yield put(actions.authenticateWithOidc.failure(error));
-  }
+  const state = window.sessionStorage.getItem('oidc-state');
+  window.sessionStorage.removeItem('oidc-state');
+
+  const nonce = window.sessionStorage.getItem('oidc-nonce');
+  window.sessionStorage.removeItem('oidc-nonce');

  yield put(replace(Paths.LOGIN));

-  if (oidcToken) {
-    let accessToken;
-    try {
-      ({ item: accessToken } = yield call(api.exchangeToAccessToken, {
-        token: oidcToken,
-      }));
-    } catch (error) {
-      yield put(actions.authenticateWithOidc.failure(error));
-      return;
-    }
-
-    yield call(setAccessToken, accessToken);
-    yield put(actions.authenticateWithOidc.success(accessToken));
+  if (params.get('error') !== null) {
+    yield put(
+      actions.authenticateUsingOidc.failure(
+        new Error(
+          `OIDC Authorization error: ${params.get('error')}: ${params.get('error_description')}`,
+        ),
+      ),
+    );
+    return;
  }
+
+  const code = params.get('code');
+  if (code === null) {
+    yield put(
+      actions.authenticateUsingOidc.failure(new Error('Invalid OIDC response: no code parameter')),
+    );
+    return;
+  }
+
+  if (params.get('state') !== state) {
+    yield put(
+      actions.authenticateUsingOidc.failure(
+        new Error('Unable to process OIDC response: state mismatch'),
+      ),
+    );
+    return;
+  }
+
+  if (nonce === null) {
+    yield put(
+      actions.authenticateUsingOidc.failure(
+        new Error('Unable to process OIDC response: no nonce issued'),
+      ),
+    );
+    return;
+  }
+
+  let accessToken;
+  try {
+    ({ item: accessToken } = yield call(api.exchangeForAccessTokenUsingOidc, {
+      code,
+      nonce,
+    }));
+  } catch (error) {
+    yield put(actions.authenticateUsingOidc.failure(error));
+    return;
+  }
+
+  yield call(setAccessToken, accessToken);
+  yield put(actions.authenticateUsingOidc.success(accessToken));
 }

 export function* clearAuthenticateError() {
@@ -72,7 +116,7 @@ export function* clearAuthenticateError() {
 export default {
  initializeLogin,
  authenticate,
-  authenticateWithOidc,
-  authenticateWithOidcCallback,
+  authenticateUsingOidc,
+  authenticateUsingOidcCallback,
  clearAuthenticateError,
 };
@@ -1,7 +1,7 @@
 import { call, put, select, take } from 'redux-saga/effects';
 import { push } from '../../../lib/redux-router';

-import { authenticateWithOidcCallback } from './login';
+import { authenticateUsingOidcCallback } from './login';
 import selectors from '../../../selectors';
 import ActionTypes from '../../../constants/ActionTypes';
 import Paths from '../../../constants/Paths';
@@ -36,9 +36,7 @@ export function* handleLocationChange() {
        yield take(ActionTypes.LOGIN_INITIALIZE);
      }

-      // TODO: check if OIDC is enabled
-
-      yield call(authenticateWithOidcCallback);
+      yield call(authenticateUsingOidcCallback);

      break;
    }
@@ -8,7 +8,7 @@ export default function* loginWatchers() {
    takeEvery(EntryActionTypes.AUTHENTICATE, ({ payload: { data } }) =>
      services.authenticate(data),
    ),
-    takeEvery(EntryActionTypes.WITH_OIDC_AUTHENTICATE, () => services.authenticateWithOidc()),
+    takeEvery(EntryActionTypes.USING_OIDC_AUTHENTICATE, () => services.authenticateUsingOidc()),
    takeEvery(EntryActionTypes.AUTHENTICATE_ERROR_CLEAR, () => services.clearAuthenticateError()),
  ]);
 }
@@ -1,5 +1,5 @@
 import Cookies from 'js-cookie';
-import jwtDecode from 'jwt-decode';
+import { jwtDecode } from 'jwt-decode';

 import Config from '../constants/Config';

@@ -1,27 +0,0 @@
-import { UserManager } from 'oidc-client-ts';
-
-export default class OidcManager {
-  constructor(config) {
-    this.userManager = new UserManager({
-      ...config,
-      authority: config.issuer,
-      client_id: config.clientId,
-      redirect_uri: config.redirectUri,
-      scope: config.scopes,
-    });
-  }
-
-  login() {
-    return this.userManager.signinRedirect();
-  }
-
-  loginCallback() {
-    return this.userManager.signinRedirectCallback();
-  }
-
-  logout() {
-    return this.userManager.signoutSilent();
-  }
-}
-
-export const createOidcManager = (config) => new OidcManager(config);
@@ -0,0 +1,16 @@
+version: '3'
+
+services:
+  postgres:
+    image: postgres:alpine
+    restart: unless-stopped
+    volumes:
+      - db-data:/var/lib/postgresql/data
+    ports:
+      - 5432:5432
+    environment:
+      - POSTGRES_DB=planka
+      - POSTGRES_HOST_AUTH_METHOD=trust
+
+volumes:
+  db-data:
@@ -1,16 +1,65 @@
 version: '3'

 services:
+  planka:
+    image: ghcr.io/plankanban/planka:dev
+    command: >
+      bash -c
+        "for i in `seq 1 30`; do
+          ./start.sh &&
+          s=$$? && break || s=$$?;
+          echo \"Tried $$i times. Waiting 5 seconds...\";
+          sleep 5;
+        done; (exit $$s)"
+    restart: unless-stopped
+    volumes:
+      - user-avatars:/app/public/user-avatars
+      - project-background-images:/app/public/project-background-images
+      - attachments:/app/private/attachments
+    ports:
+      - 3000:1337
+    environment:
+      - BASE_URL=http://localhost:3000
+      - DATABASE_URL=postgresql://postgres@postgres/planka
+      - SECRET_KEY=notsecretkey
+
+      # - TRUST_PROXY=0
+      # - TOKEN_EXPIRES_IN=365 # In days
+
+      # related: https://github.com/knex/knex/issues/2354
+      # As knex does not pass query parameters from the connection string we
+      # have to use environment variables in order to pass the desired values, e.g.
+      # - PGSSLMODE=<value>
+
+      # Configure knex to accept SSL certificates
+      # - KNEX_REJECT_UNAUTHORIZED_SSL_CERTIFICATE=false
+
+      # - DEFAULT_ADMIN_EMAIL=demo@demo.demo # Do not remove if you want to prevent this user from being edited/deleted
+      # - DEFAULT_ADMIN_PASSWORD=demo
+      # - DEFAULT_ADMIN_NAME=Demo Demo
+      # - DEFAULT_ADMIN_USERNAME=demo
+
+      # - OIDC_ISSUER=
+      # - OIDC_CLIENT_ID=
+      # - OIDC_CLIENT_SECRET=
+      # - OIDC_SCOPES=openid email profile
+      # - OIDC_ADMIN_ROLES=admin
+      # - OIDC_ROLES_ATTRIBUTE=groups
+      # - OIDC_IGNORE_ROLES=true
+    depends_on:
+      - postgres
+
  postgres:
-    image: postgres:alpine
+    image: postgres:14-alpine
    restart: unless-stopped
    volumes:
      - db-data:/var/lib/postgresql/data
-    ports:
-      - 5432:5432
    environment:
      - POSTGRES_DB=planka
      - POSTGRES_HOST_AUTH_METHOD=trust

 volumes:
+  user-avatars:
+  project-background-images:
+  attachments:
  db-data:
@@ -20,15 +20,11 @@ services:
      - 3000:1337
    environment:
      - BASE_URL=http://localhost:3000
-      - TRUST_PROXY=0
      - DATABASE_URL=postgresql://postgres@postgres/planka
      - SECRET_KEY=notsecretkey

-      # Can be removed after installation
-      - DEFAULT_ADMIN_EMAIL=demo@demo.demo # Do not remove if you want to prevent this user from being edited/deleted
-      - DEFAULT_ADMIN_PASSWORD=demo
-      - DEFAULT_ADMIN_NAME=Demo Demo
-      - DEFAULT_ADMIN_USERNAME=demo
+      # - TRUST_PROXY=0
+      # - TOKEN_EXPIRES_IN=365 # In days

      # related: https://github.com/knex/knex/issues/2354
      # As knex does not pass query parameters from the connection string we
@@ -38,15 +34,18 @@ services:
      # Configure knex to accept SSL certificates
      # - KNEX_REJECT_UNAUTHORIZED_SSL_CERTIFICATE=false

+      # - DEFAULT_ADMIN_EMAIL=demo@demo.demo # Do not remove if you want to prevent this user from being edited/deleted
+      # - DEFAULT_ADMIN_PASSWORD=demo
+      # - DEFAULT_ADMIN_NAME=Demo Demo
+      # - DEFAULT_ADMIN_USERNAME=demo
+
      # - OIDC_ISSUER=
      # - OIDC_CLIENT_ID=
-      # - OIDC_REDIRECT_URI=http://localhost:3000/oidc-callback
+      # - OIDC_CLIENT_SECRET=
      # - OIDC_SCOPES=openid email profile
-      # - OIDC_JWKS_URI=
-      # - OIDC_AUDIENCE=
      # - OIDC_ADMIN_ROLES=admin
      # - OIDC_ROLES_ATTRIBUTE=groups
-      # - OIDC_SKIP_USER_INFO=true
+      # - OIDC_IGNORE_ROLES=true
    depends_on:
      - postgres

@@ -1,6 +1,6 @@
 {
  "name": "planka",
-  "version": "1.13.0",
+  "version": "1.15.1",
  "private": true,
  "homepage": "https://plankanban.github.io/planka",
  "repository": {
@@ -56,14 +56,14 @@
    }
  },
  "dependencies": {
-    "concurrently": "^7.6.0",
-    "husky": "^8.0.2",
-    "lint-staged": "^13.0.3"
+    "concurrently": "^8.2.2",
+    "husky": "^8.0.3",
+    "lint-staged": "^15.1.0"
  },
  "devDependencies": {
-    "eslint": "^8.28.0",
-    "eslint-config-prettier": "^8.5.0",
-    "eslint-plugin-prettier": "^4.2.1",
-    "prettier": "^2.7.1"
+    "eslint": "^8.53.0",
+    "eslint-config-prettier": "^9.0.0",
+    "eslint-plugin-prettier": "^5.0.1",
+    "prettier": "^3.1.0"
  }
 }
@@ -4,13 +4,6 @@ BASE_URL=http://localhost:1337
 DATABASE_URL=postgresql://postgres@localhost/planka
 SECRET_KEY=notsecretkey

-## Can be removed after installation
-
-DEFAULT_ADMIN_EMAIL=demo@demo.demo # Do not remove if you want to prevent this user from being edited/deleted
-DEFAULT_ADMIN_PASSWORD=demo
-DEFAULT_ADMIN_NAME=Demo Demo
-DEFAULT_ADMIN_USERNAME=demo
-
 ## Optional

 # TRUST_PROXY=0
@@ -24,15 +17,18 @@ DEFAULT_ADMIN_USERNAME=demo
 # Configure knex to accept SSL certificates
 # KNEX_REJECT_UNAUTHORIZED_SSL_CERTIFICATE=false

+# DEFAULT_ADMIN_EMAIL=demo@demo.demo # Do not remove if you want to prevent this user from being edited/deleted
+# DEFAULT_ADMIN_PASSWORD=demo
+# DEFAULT_ADMIN_NAME=Demo Demo
+# DEFAULT_ADMIN_USERNAME=demo
+
 # OIDC_ISSUER=
 # OIDC_CLIENT_ID=
-# OIDC_REDIRECT_URI=http://localhost:1337/oidc-callback
+# OIDC_CLIENT_SECRET=
 # OIDC_SCOPES=openid email profile
-# OIDC_JWKS_URI=
-# OIDC_AUDIENCE=
 # OIDC_ADMIN_ROLES=admin
 # OIDC_ROLES_ATTRIBUTE=groups
-# OIDC_SKIP_USER_INFO=true
+# OIDC_IGNORE_ROLES=true

 ## Do not edit this

@@ -50,10 +50,6 @@ module.exports = {

    const user = await sails.helpers.users.getOneByEmailOrUsername(inputs.emailOrUsername);

-    if (user.isSso) {
-      throw Errors.USE_SINGLE_SIGN_ON;
-    }
-
    if (!user) {
      sails.log.warn(
        `Invalid email or username: "${inputs.emailOrUsername}"! (IP: ${remoteAddress})`,
@@ -61,6 +57,10 @@ module.exports = {
      throw Errors.INVALID_EMAIL_OR_USERNAME;
    }

+    if (user.isSso) {
+      throw Errors.USE_SINGLE_SIGN_ON;
+    }
+
    if (!bcrypt.compareSync(inputs.password, user.password)) {
      sails.log.warn(`Invalid password! (IP: ${remoteAddress})`);
      throw Errors.INVALID_PASSWORD;
@@ -1,8 +1,8 @@
 const { getRemoteAddress } = require('../../../utils/remoteAddress');

 const Errors = {
-  INVALID_TOKEN: {
-    invalidToken: 'Invalid token',
+  INVALID_CODE_OR_NONCE: {
+    invalidCodeOrNonce: 'Invalid code or nonce',
  },
  EMAIL_ALREADY_IN_USE: {
    emailAlreadyInUse: 'Email already in use',
@@ -17,14 +17,18 @@ const Errors = {

 module.exports = {
  inputs: {
-    token: {
+    code: {
+      type: 'string',
+      required: true,
+    },
+    nonce: {
      type: 'string',
      required: true,
    },
  },

  exits: {
-    invalidToken: {
+    invalidCodeOrNonce: {
      responseType: 'unauthorized',
    },
    emailAlreadyInUse: {
@@ -42,10 +46,10 @@ module.exports = {
    const remoteAddress = getRemoteAddress(this.req);

    const user = await sails.helpers.users
-      .getOrCreateOneByOidcToken(inputs.token)
-      .intercept('invalidToken', () => {
-        sails.log.warn(`Invalid token! (IP: ${remoteAddress})`);
-        return Errors.INVALID_TOKEN;
+      .getOrCreateOneUsingOidc(inputs.code, inputs.nonce)
+      .intercept('invalidCodeOrNonce', () => {
+        sails.log.warn(`Invalid code or nonce! (IP: ${remoteAddress})`);
+        return Errors.INVALID_CODE_OR_NONCE;
      })
      .intercept('emailAlreadyInUse', () => Errors.EMAIL_ALREADY_IN_USE)
      .intercept('usernameAlreadyInUse', () => Errors.USERNAME_ALREADY_IN_USE)
@@ -1,15 +1,21 @@
 module.exports = {
  fn() {
+    let oidc = null;
+    if (sails.hooks.oidc.isActive()) {
+      const oidcClient = sails.hooks.oidc.getClient();
+
+      oidc = {
+        authorizationUrl: oidcClient.authorizationUrl({
+          scope: sails.config.custom.oidcScopes,
+          response_mode: 'fragment',
+        }),
+        endSessionUrl: oidcClient.issuer.end_session_endpoint ? oidcClient.endSessionUrl({}) : null,
+      };
+    }
+
    return {
      item: {
-        oidc: sails.config.custom.oidcIssuer
-          ? {
-              issuer: sails.config.custom.oidcIssuer,
-              clientId: sails.config.custom.oidcClientId,
-              redirectUri: sails.config.custom.oidcRedirectUri,
-              scopes: sails.config.custom.oidcScopes,
-            }
-          : null,
+        oidc,
      },
    };
  },
@@ -73,6 +73,10 @@ module.exports = {
      delete inputs.name;
      /* eslint-enable no-param-reassign */
    } else if (user.isSso) {
+      if (!sails.config.custom.oidcIgnoreRoles) {
+        delete inputs.isAdmin; // eslint-disable-line no-param-reassign
+      }
+
      delete inputs.name; // eslint-disable-line no-param-reassign
    }

@@ -1,159 +0,0 @@
-const jwt = require('jsonwebtoken');
-const jwksClient = require('jwks-rsa');
-const openidClient = require('openid-client');
-
-const jwks = jwksClient({
-  jwksUri: sails.config.custom.oidcJwksUri,
-});
-
-const verifyOidcToken = async (oidcToken) => {
-  const signingKeys = await jwks.getSigningKeys();
-
-  const options = {
-    issuer: sails.config.custom.oidcIssuer,
-  };
-
-  if (sails.config.custom.oidcAudience) {
-    options.audience = sails.config.custom.oidcAudience;
-  }
-
-  let payload = null;
-  signingKeys.some((signingKey) => {
-    try {
-      const publicKey = signingKey.getPublicKey();
-      payload = jwt.verify(oidcToken, publicKey, options);
-    } catch (error) {
-      sails.log.error(error);
-    }
-
-    return !!payload;
-  });
-
-  return payload;
-};
-
-const getUserInfo = async (oidcToken) => {
-  const issuer = await openidClient.Issuer.discover(sails.config.custom.oidcIssuer);
-
-  const client = new issuer.Client({
-    client_id: 'irrelevant',
-  });
-
-  return client.userinfo(oidcToken);
-};
-
-module.exports = {
-  inputs: {
-    token: {
-      type: 'string',
-      required: true,
-    },
-  },
-
-  exits: {
-    invalidToken: {},
-    missingValues: {},
-    emailAlreadyInUse: {},
-    usernameAlreadyInUse: {},
-  },
-
-  async fn(inputs) {
-    const oidcUser = await verifyOidcToken(inputs.token);
-
-    if (!oidcUser) {
-      throw 'invalidToken';
-    }
-
-    if (!sails.config.custom.oidcSkipUserInfo) {
-      const userInfo = await getUserInfo(inputs.token);
-      Object.assign(oidcUser, userInfo);
-    }
-
-    if (!oidcUser.email || !oidcUser.name) {
-      throw 'missingValues';
-    }
-
-    let isAdmin = false;
-    if (sails.config.custom.oidcAdminRoles.includes('*')) {
-      isAdmin = true;
-    } else {
-      const roles = oidcUser[sails.config.custom.oidcRolesAttribute];
-
-      if (Array.isArray(roles)) {
-        isAdmin = sails.config.custom.oidcAdminRoles.some((role) => roles.includes(role));
-      }
-    }
-
-    const values = {
-      isAdmin,
-      email: oidcUser.email,
-      isSso: true,
-      name: oidcUser.name,
-      username: oidcUser.preferred_username,
-      subscribeToOwnCards: false,
-    };
-
-    let user;
-    /* eslint-disable no-constant-condition, no-await-in-loop */
-    while (true) {
-      let identityProviderUser = await IdentityProviderUser.findOne({
-        issuer: oidcUser.iss,
-        sub: oidcUser.sub,
-      });
-
-      if (identityProviderUser) {
-        user = await sails.helpers.users.getOne(identityProviderUser.userId);
-      } else {
-        while (true) {
-          user = await sails.helpers.users.getOne({
-            email: values.email,
-          });
-
-          if (!user) {
-            user = await sails.helpers.users
-              .createOne(values)
-              .tolerate('emailAlreadyInUse')
-              .intercept('usernameAlreadyInUse', 'usernameAlreadyInUse');
-          }
-
-          if (user) {
-            break;
-          }
-        }
-
-        identityProviderUser = await IdentityProviderUser.create({
-          userId: user.id,
-          issuer: oidcUser.iss,
-          sub: oidcUser.sub,
-        }).tolerate('E_UNIQUE');
-      }
-
-      if (identityProviderUser) {
-        break;
-      }
-    }
-    /* eslint-enable no-constant-condition, no-await-in-loop */
-
-    const updateFieldKeys = ['email', 'isAdmin', 'isSso', 'name', 'username'];
-
-    const updateValues = updateFieldKeys.reduce((result, fieldKey) => {
-      if (values[fieldKey] === user[fieldKey]) {
-        return result;
-      }
-
-      return {
-        ...result,
-        [fieldKey]: values[fieldKey],
-      };
-    }, {});
-
-    if (Object.keys(updateValues).length > 0) {
-      user = await sails.helpers.users
-        .updateOne(user, updateValues, {}) // FIXME: hack for last parameter
-        .intercept('emailAlreadyInUse', 'emailAlreadyInUse')
-        .intercept('usernameAlreadyInUse', 'usernameAlreadyInUse');
-    }
-
-    return user;
-  },
-};
@@ -0,0 +1,118 @@
+module.exports = {
+  inputs: {
+    code: {
+      type: 'string',
+      required: true,
+    },
+    nonce: {
+      type: 'string',
+      required: true,
+    },
+  },
+
+  exits: {
+    invalidCodeOrNonce: {},
+    missingValues: {},
+    emailAlreadyInUse: {},
+    usernameAlreadyInUse: {},
+  },
+
+  async fn(inputs) {
+    const client = sails.hooks.oidc.getClient();
+
+    let userInfo;
+    try {
+      const tokenSet = await client.callback(
+        sails.config.custom.oidcRedirectUri,
+        {
+          iss: sails.config.custom.oidcIssuer,
+          code: inputs.code,
+        },
+        {
+          nonce: inputs.nonce,
+        },
+      );
+      userInfo = await client.userinfo(tokenSet);
+    } catch (e) {
+      sails.log.warn(`Error while exchanging OIDC code: ${e}`);
+      throw 'invalidCodeOrNonce';
+    }
+
+    if (!userInfo.email || !userInfo.name) {
+      throw 'missingValues';
+    }
+
+    let isAdmin = false;
+    if (sails.config.custom.oidcAdminRoles.includes('*')) {
+      isAdmin = true;
+    } else {
+      const roles = userInfo[sails.config.custom.oidcRolesAttribute];
+      if (Array.isArray(roles)) {
+        // Use a Set here to avoid quadratic time complexity
+        const userRoles = new Set(userInfo[sails.config.custom.oidcRolesAttribute]);
+        isAdmin = sails.config.custom.oidcAdminRoles.findIndex((role) => userRoles.has(role)) > -1;
+      }
+    }
+
+    const values = {
+      isAdmin,
+      email: userInfo.email,
+      isSso: true,
+      name: userInfo.name,
+      username: userInfo.preferred_username,
+      subscribeToOwnCards: false,
+    };
+
+    let user;
+    // This whole block technically needs to be executed in a transaction
+    // with SERIALIZABLE isolation level (but Waterline does not support
+    // that), so this will result in errors if for example users are deleted
+    // concurrently with logging in via OIDC.
+    let identityProviderUser = await IdentityProviderUser.findOne({
+      issuer: sails.config.custom.oidcIssuer,
+      sub: userInfo.sub,
+    });
+
+    if (identityProviderUser) {
+      user = await sails.helpers.users.getOne(identityProviderUser.userId);
+    } else {
+      // If no IDP/User mapping exists, search for the user by email.
+      user = await sails.helpers.users.getOne({
+        email: values.email.toLowerCase(),
+      });
+
+      // Otherwise, create a new user.
+      if (!user) {
+        user = await sails.helpers.users
+          .createOne(values)
+          .intercept('usernameAlreadyInUse', 'usernameAlreadyInUse');
+      }
+
+      identityProviderUser = await IdentityProviderUser.create({
+        userId: user.id,
+        issuer: sails.config.custom.oidcIssuer,
+        sub: userInfo.sub,
+      });
+    }
+
+    const updateFieldKeys = ['email', 'isSso', 'name', 'username'];
+    if (!sails.config.custom.oidcIgnoreRoles) {
+      updateFieldKeys.push('isAdmin');
+    }
+
+    const updateValues = {};
+    // eslint-disable-next-line no-restricted-syntax
+    for (const k of updateFieldKeys) {
+      if (values[k] !== user[k]) updateValues[k] = values[k];
+    }
+
+    if (Object.keys(updateValues).length > 0) {
+      user = await sails.helpers.users
+        .updateOne(user, updateValues, {}) // FIXME: hack for last parameter
+        .intercept('emailAlreadyInUse', 'emailAlreadyInUse')
+        .intercept('usernameAlreadyInUse', 'usernameAlreadyInUse');
+    }
+
+    return user;
+  },
+};
@@ -0,0 +1,33 @@
+const openidClient = require('openid-client');
+
+module.exports = function oidcServiceHook(sails) {
+  let client = null;
+
+  return {
+    /**
+     * Runs when this Sails app loads/lifts.
+     */
+
+    async initialize() {
+      if (sails.config.custom.oidcIssuer) {
+        const issuer = await openidClient.Issuer.discover(sails.config.custom.oidcIssuer);
+
+        client = new issuer.Client({
+          client_id: sails.config.custom.oidcClientId,
+          client_secret: sails.config.custom.oidcClientSecret,
+          redirect_uris: [sails.config.custom.oidcRedirectUri],
+          response_types: ['code'],
+        });
+        sails.log.info('OIDC hook has been loaded successfully');
+      }
+    },
+
+    getClient() {
+      return client;
+    },
+
+    isActive() {
+      return client !== null;
+    },
+  };
+};
@@ -110,12 +110,13 @@ module.exports = {
  tableName: 'user_account',

  customToJSON() {
-    const isLockedAdmin = this.email === sails.config.custom.defaultAdminEmail;
+    const isDefaultAdmin = this.email === sails.config.custom.defaultAdminEmail;

    return {
      ..._.omit(this, ['password', 'isSso', 'avatar', 'passwordChangedAt']),
-      isLockedAdmin,
-      isLocked: this.isSso || isLockedAdmin,
+      isLocked: this.isSso || isDefaultAdmin,
+      isRoleLocked: (this.isSso && !sails.config.custom.oidcIgnoreRoles) || isDefaultAdmin,
+      isDeletionLocked: isDefaultAdmin,
      avatarUrl:
        this.avatar &&
        `${sails.config.custom.userAvatarsUrl}/${this.avatar.dirname}/square-100.${this.avatar.extension}`,
@@ -35,11 +35,14 @@ module.exports.custom = {

  oidcIssuer: process.env.OIDC_ISSUER,
  oidcClientId: process.env.OIDC_CLIENT_ID,
-  oidcRedirectUri: process.env.OIDC_REDIRECT_URI,
+  oidcClientSecret: process.env.OIDC_CLIENT_SECRET,
  oidcScopes: process.env.OIDC_SCOPES || 'openid email profile',
-  oidcJwksUri: process.env.OIDC_JWKS_URI,
-  oidcAudience: process.env.OIDC_AUDIENCE,
  oidcAdminRoles: process.env.OIDC_ADMIN_ROLES ? process.env.OIDC_ADMIN_ROLES.split(',') : [],
  oidcRolesAttribute: process.env.OIDC_ROLES_ATTRIBUTE || 'groups',
-  oidcSkipUserInfo: process.env.OIDC_SKIP_USER_INFO === 'true',
+  oidcIgnoreRoles: process.env.OIDC_IGNORE_ROLES === 'true',
+
+  // TODO: move client base url to environment variable?
+  oidcRedirectUri: `${
+    sails.config.environment === 'production' ? process.env.BASE_URL : 'http://localhost:3000'
+  }/oidc-callback`,
 };
@@ -25,5 +25,5 @@ module.exports.policies = {

  'show-config': true,
  'access-tokens/create': true,
-  'access-tokens/exchange': true,
+  'access-tokens/exchange-using-oidc': true,
 };
@@ -12,7 +12,7 @@ module.exports.routes = {
  'GET /api/config': 'show-config',

  'POST /api/access-tokens': 'access-tokens/create',
-  'POST /api/access-tokens/exchange': 'access-tokens/exchange',
+  'POST /api/access-tokens/exchange-using-oidc': 'access-tokens/exchange-using-oidc',
  'DELETE /api/access-tokens/me': 'access-tokens/delete',

  'GET /api/users': 'users/index',
@@ -34,10 +34,6 @@ exports.seed = async (knex) => {
      createdAt: new Date().toISOString(),
    });
  } catch (error) {
-    if (Object.keys(data).length === 0) {
-      return;
-    }
-
    await knex('user_account').update(data).where('email', process.env.DEFAULT_ADMIN_EMAIL);
  }
 };
@@ -27,39 +27,38 @@
    }
  },
  "dependencies": {
-    "bcrypt": "^5.1.0",
-    "dotenv": "^16.0.3",
-    "dotenv-cli": "^6.0.0",
+    "bcrypt": "^5.1.1",
+    "dotenv": "^16.3.1",
+    "dotenv-cli": "^7.3.0",
    "filenamify": "^4.3.0",
-    "jsonwebtoken": "^9.0.0",
-    "jwks-rsa": "^3.0.1",
-    "knex": "^2.3.0",
+    "jsonwebtoken": "^9.0.2",
+    "knex": "^3.0.1",
    "lodash": "^4.17.21",
    "moment": "^2.29.4",
    "move-file": "^2.1.0",
-    "openid-client": "^5.4.3",
-    "rimraf": "^3.0.2",
+    "openid-client": "^5.6.1",
+    "rimraf": "^5.0.5",
    "sails": "^1.5.7",
    "sails-hook-orm": "^4.0.2",
-    "sails-hook-sockets": "^2.0.3",
+    "sails-hook-sockets": "^2.0.4",
    "sails-postgresql-redacted": "^1.0.2-9",
-    "sharp": "^0.31.2",
+    "sharp": "^0.33.0",
    "stream-to-array": "^2.3.0",
-    "uuid": "^9.0.0",
-    "validator": "^13.7.0",
-    "winston": "^3.8.2",
+    "uuid": "^9.0.1",
+    "validator": "^13.11.0",
+    "winston": "^3.11.0",
    "zxcvbn": "^4.4.2"
  },
  "devDependencies": {
-    "chai": "^4.3.7",
-    "eslint": "^8.28.0",
+    "chai": "^4.3.10",
+    "eslint": "^8.53.0",
    "eslint-config-airbnb-base": "^15.0.0",
-    "eslint-plugin-import": "^2.26.0",
-    "mocha": "^10.1.0",
-    "nodemon": "^2.0.20",
-    "supertest": "^6.3.1"
+    "eslint-plugin-import": "^2.29.0",
+    "mocha": "^10.2.0",
+    "nodemon": "^3.0.1",
+    "supertest": "^6.3.3"
  },
  "engines": {
-    "node": "^12.10"
+    "node": ">=18"
  }
 }
Author	SHA1	Message	Date
Maksim Eltyshev	5f2723623a	chore: Update version	2023-12-09 17:23:01 +01:00
Maksim Eltyshev	fee6841d0a	fix: Attempt to fix error that occurs during reconnection	2023-12-09 17:19:40 +01:00
Maksim Eltyshev	ca6fb3b962	fix: Add state parameter to OIDC authorization url Closes #558	2023-12-09 17:06:45 +01:00
Maksim Eltyshev	28c3f28e01	fix: Add issuer to OIDC callback parameters Closes #562	2023-12-09 16:28:24 +01:00
Maksim Eltyshev	80d12aaeeb	fix: Fix Korean translation linting	2023-12-04 11:42:15 +01:00
NavyStack	89af209a2e	fix: Update Korean translation (#560 )	2023-12-04 11:40:04 +01:00
Maksim Eltyshev	f1fed3e533	build: Stop using base image	2023-12-01 18:02:19 +01:00
Maksim Eltyshev	eddeb96b16	fix: Fix Romanian translation linting	2023-11-24 12:43:00 +01:00
Maksim Eltyshev	9e8ff3b579	chore: Revert remark-gfm update	2023-11-23 14:40:44 +01:00
Maksim Eltyshev	fc1278011c	build: Use pnpm import before installing dependencies	2023-11-23 11:54:28 +01:00
Andrei Covali	24163463fc	feat: Add Romanian translation (#555 )	2023-11-22 14:58:13 +01:00
Yu Inoue	fdef87e3b9	fix: Add support for OIDC configuration thru Helm (#550 ) Closes #548	2023-11-20 14:16:19 +01:00
Maksim Eltyshev	964498dbaa	chore: Use Node v18	2023-11-18 09:26:31 +01:00
Maksim Eltyshev	5b519cb62f	chore: Update version	2023-11-17 22:13:04 +01:00
Yu Inoue	11fc3b4485	fix: Separate service port and container port in Helm (#549 )	2023-11-17 22:11:35 +01:00
Maksim Eltyshev	37c0b59f82	chore: Update vips version	2023-11-17 21:48:26 +01:00
Maksim Eltyshev	239611ad51	chore: Update dependencies	2023-11-17 14:34:10 +01:00
Yu Inoue	0575e665fe	fix: Fix time format in Japanese locale (#546 ) Closes #542	2023-11-13 12:51:00 +01:00
Maksim Eltyshev	019766dced	chore: Update version	2023-10-25 23:41:48 +02:00
Maksim Eltyshev	6dc9e4ed99	fix: Disable role change when OIDC roles are not ignored	2023-10-25 23:39:34 +02:00
Balthasar Hofer	d4b64b90fc	feat: Add ability to ignore roles when logging in with SSO (#534 ) Closes #533	2023-10-26 02:01:35 +05:00
Daniel Hiller	1a49826b85	docs: adjust filenames to match the docs	2023-10-24 13:17:49 +02:00
Daniel Hiller	815643eb2c	ci: ignore some paths on push	2023-10-22 22:47:39 +02:00
Daniel Hiller	bcc4c0d923	chore: update version	2023-10-22 22:31:10 +02:00
Daniel Hiller	cf7810b067	fix: add admin user variables	2023-10-22 22:27:25 +02:00
Maksim Eltyshev	f1c72df8b6	chore: Update version	2023-10-20 22:38:43 +02:00
Maksim Eltyshev	5056d38848	fix: Fix logging out with invalid token	2023-10-20 22:34:58 +02:00
Maksim Eltyshev	3ef5b3ead8	fix: Make default admin environment variables optional Closes #526	2023-10-20 21:52:12 +02:00
Vishnu Kaushik	ded58dc8b0	fix: Add task counter in card modal (#525 ) Closes #467	2023-10-21 00:20:04 +05:00
Maksim Eltyshev	d8ee1ecdd1	ci: Do not mark released chart as latest	2023-10-19 23:30:58 +02:00
Maksim Eltyshev	fc2f4cd5d3	chore: Update version	2023-10-19 23:08:40 +02:00
Maksim Eltyshev	7ef457157e	fix: Fallback to query if there is no fragment	2023-10-19 23:06:37 +02:00
Maksim Eltyshev	23ee815200	chore: Update version	2023-10-19 16:07:52 +02:00
Maksim Eltyshev	40c04c35ff	ref: Refactoring	2023-10-19 16:05:34 +02:00
Lorenz Brun	743f2956c8	feat: Improve OIDC SSO (#524 ) The OIDC implementation merged in https://github.com/plankanban/planka/pull/491 is flawed for multiple reasons. It assumes that the access_token returned by the IDP has to be a JWT parseable by the RP which is not the case [1]. Many major IDPs do issue tokens which are not JWTs and RPs should not rely on the contents of these at all. The only signed token which has a standardized format for direct RP consumption is the OIDC ID token (id_token), but this by default doesn't contain many claims, especially role claims are omitted from them by default for size reasons. To get these additional claims into the ID token, one needs an IDP with support for the "claims" parameter. It requires manual specification of the JWKS URL which is mandatory in any OIDC discovery document and thus never needs to be manually specified. It also makes the questionable decision to use a client-side code flow with PKCE where a normal code flow would be much more appropriate as all user data is processed in the backend which can securely hold a client secret (confidential client). This has far wider IDP support, is safer (due to direct involvement of the IDP in obtaining user information) and doesn't require working with ID tokens and claim parameters. By using a server-side code flow we can also offload most complexity to the server alone, no longer requiring an additional OIDC library on the web client. Also silent logout doesn't work on most IDPs for security reasons, one needs to actually redirect the user over to the IDP, which then prompts them once more if they actually want to log out. This implementation should work with any OIDC-compliant IDP and even OAuth 2.0-only IDPs as long as they serve and OIDC discovery document. [1] rfc-editor.org/rfc/rfc6749#section-5.1	2023-10-19 17:39:21 +05:00
Maksim Eltyshev	5bf5db27d8	chore: Update chart version	2023-10-18 23:33:30 +02:00
Maksim Eltyshev	667c5daf25	chore: Update version	2023-10-18 23:20:30 +02:00
Maksim Eltyshev	6662b0a717	fix: Fix order of checks when logging in	2023-10-18 23:07:57 +02:00