chore: Update version

Closes #533

.github/workflows/build-and-push-docker-image-dev.yml

@@ -2,6 +2,11 @@ name: Build and push Docker DEV image
 
 on:
   push:
+    paths-ignore:
+      - '.github/**'
+      - 'charts/**'
+      - 'docker-*.sh'
+      - '*.md'
     branches: [master]
 
 jobs:

.github/workflows/helm-chart-release.yml

@@ -38,5 +38,6 @@ jobs:
         uses: helm/chart-releaser-action@v1.5.0
         with:
           charts_dir: charts
+          mark_as_latest: false
         env:
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

README.md

@@ -20,10 +20,9 @@
 
 ## How to deploy Planka
 
-There are 2 types of installation:
+There are many ways to install Planka
-- [Without Docker](https://docs.planka.cloud/docs/installl-planka/Debian%20&%20Ubuntu) ([for Windows](https://docs.planka.cloud/docs/installl-planka/Windows))
+
-- [Dockerized](https://docs.planka.cloud/docs/installl-planka/Docker%20Compose)
+[Check them out](https://docs.planka.cloud/docs/intro)
-- [Automated installation](https://github.com/plankanban/planka-installer)
 
 For configuration, please see the [configuration section](https://docs.planka.cloud/docs/category/configuration).
 

charts/planka/Chart.yaml

@@ -15,17 +15,17 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.3
+version: 0.1.9
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "1.13.0"
+appVersion: "1.14.3"
 
 dependencies:
-- alias: postgresql
+  - alias: postgresql
-  condition: postgresql.enabled
+    condition: postgresql.enabled
-  name: postgresql
+    name: postgresql
-  repository: &bitnami-repo https://charts.bitnami.com/bitnami
+    repository: &bitnami-repo https://charts.bitnami.com/bitnami
-  version: 12.5.1
+    version: 12.5.1

charts/planka/README.md

@@ -21,7 +21,11 @@ git clone https://github.com/Chris-Greaves/planka-helm-chart.git
 cd planka-helm-chart
 helm dependency build
 export SECRETKEY=$(openssl rand -hex 64)
-helm install planka . --set secretkey=$SECRETKEY
+helm install planka . --set secretkey=$SECRETKEY  \
+--set admin_email="demo@demo.demo"  \
+--set admin_password="demo"  \
+--set admin_name="Demo Demo" \
+--set admin_username="demo"
 ```
 
 > **NOTE:** The command `openssl rand -hex 64` is needed to create a random hexadecimal key for planka. On Windows you can use Git Bash to run that command.
@@ -39,11 +43,19 @@ To access Planka externally you can use the following configuration
 ```bash
 # HTTP only
 helm install planka . --set secretkey=$SECRETKEY \
+--set admin_email="demo@demo.demo"  \
+--set admin_password="demo"  \
+--set admin_name="Demo Demo" \
+--set admin_username="demo"
 --set ingress.enabled=true \
 --set ingress.hosts[0].host=planka.example.dev \
 
 # HTTPS
 helm install planka . --set secretkey=$SECRETKEY \
+--set admin_email="demo@demo.demo"  \
+--set admin_password="demo"  \
+--set admin_name="Demo Demo" \
+--set admin_username="demo"
 --set ingress.enabled=true \
 --set ingress.hosts[0].host=planka.example.dev \
 --set ingress.tls[0].secretName=planka-tls \
@@ -54,6 +66,16 @@ or create a values.yaml file like:
 
 ```yaml
 secretkey: "<InsertSecretKey>"
+# The admin section needs to be present for new instances of Planka, after the first start you can remove the lines starting with admin_. If you want the admin user to be unchangeable admin_email: has to stay
+# After changing the config you have to run ```helm upgrade  planka . -f values.yaml```
+
+# Admin user
+admin_email: "demo@demo.demo" # Do not remove if you want to prevent this user from being edited/deleted
+admin_password: "demo"
+admin_name: "Demo Demo"
+admin_username: "demo"
+# Admin user
+
 ingress:
   enabled: true
   hosts:

charts/planka/templates/deployment.yaml

@@ -75,6 +75,18 @@ spec:
               value: {{ required "A secret key needs to be generated using 'openssl rand -hex 64' and assigned to secretkey." .Values.secretkey }}
             - name: TRUST_PROXY
               value: "0"
+            - name: DEFAULT_ADMIN_EMAIL
+              value: {{ .Values.admin_email }}
+            - name: DEFAULT_ADMIN_PASSWORD
+              value: {{ .Values.admin_password }}
+            - name: DEFAULT_ADMIN_NAME
+              value: {{ .Values.admin_name }}
+            - name: DEFAULT_ADMIN_USERNAME
+              value: {{ .Values.admin_username }}
+          {{ range $k, $v := .Values.env }}
+            - name: {{ $k | quote }}
+              value: {{ $v | quote }}
+          {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

client/.env

@@ -1 +1 @@
-REACT_APP_VERSION=1.13.0
+REACT_APP_VERSION=1.14.3

client/package-lock.json

@@ -18,8 +18,8 @@
         "js-cookie": "^3.0.1",
         "jwt-decode": "^3.1.2",
         "lodash": "^4.17.21",
+        "nanoid": "^5.0.2",
         "node-sass": "^8.0.0",
-        "oidc-client-ts": "^2.3.0",
         "photoswipe": "^5.3.3",
         "prop-types": "^15.8.1",
         "react": "^18.2.0",
@@ -7190,11 +7190,6 @@
         "node": ">= 8"
       }
     },
-    "node_modules/crypto-js": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/crypto-js/-/crypto-js-4.1.1.tgz",
-      "integrity": "sha512-o2JlM7ydqd3Qk9CA0L4NL6mTzU2sdx96a+oOfPu8Mkl/PK51vSyoi8/rQ8NknZtk44vq15lmhAj9CIAGwgeWKw=="
-    },
     "node_modules/crypto-random-string": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/crypto-random-string/-/crypto-random-string-2.0.0.tgz",
@@ -16413,14 +16408,20 @@
       "integrity": "sha512-2ZTgtl0nJsO0KQCjEpxcIr5D+Yv90plTitZt9JBfQvVJDS5seMl3FOvsh3+9CoYWXf/1l5OaZzzF6nDm4cagaQ=="
     },
     "node_modules/nanoid": {
-      "version": "3.3.4",
+      "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.4.tgz",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-5.0.2.tgz",
-      "integrity": "sha512-MqBkQh/OHTS2egovRtLk45wEyNXwF+cokD+1YPf9u5VfJiRdAiRwB2froX5Co9Rh20xs4siNPm8naNotSD6RBw==",
+      "integrity": "sha512-2ustYUX1R2rL/Br5B/FMhi8d5/QzvkJ912rBYxskcpu0myTHzSZfTr1LAS2Sm7jxRUObRrSBFoyzwAhL49aVSg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
       "bin": {
-        "nanoid": "bin/nanoid.cjs"
+        "nanoid": "bin/nanoid.js"
       },
       "engines": {
-        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+        "node": "^18 || >=20"
       }
     },
     "node_modules/natural-compare": {
@@ -17041,18 +17042,6 @@
       "resolved": "https://registry.npmjs.org/obuf/-/obuf-1.1.2.tgz",
       "integrity": "sha512-PX1wu0AmAdPqOL1mWhqmlOd8kOIZQwGZw6rh7uby9fTc5lhaOWFLX3I6R1hrF9k3zUY40e6igsLGkDXK92LJNg=="
     },
-    "node_modules/oidc-client-ts": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/oidc-client-ts/-/oidc-client-ts-2.3.0.tgz",
-      "integrity": "sha512-7RUKU+TJFQo+4X9R50IGJAIDF18uRBaFXyZn4VVCfwmwbSUhKcdDnw4zgeut3uEXkiD3NqURq+d88sDPxjf1FA==",
-      "dependencies": {
-        "crypto-js": "^4.1.1",
-        "jwt-decode": "^3.1.2"
-      },
-      "engines": {
-        "node": ">=12.13.0"
-      }
-    },
     "node_modules/on-finished": {
       "version": "2.4.1",
       "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
@@ -18676,6 +18665,23 @@
       "resolved": "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz",
       "integrity": "sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ=="
     },
+    "node_modules/postcss/node_modules/nanoid": {
+      "version": "3.3.6",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.6.tgz",
+      "integrity": "sha512-BGcqMMJuToF7i1rt+2PWSNVnWIkGCU78jBG3RxO/bZlnZPK2Cmi2QaffxGO/2RvWi9sL+FAiRiXMgsyxQ1DIDA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
     "node_modules/prelude-ls": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
@@ -28785,11 +28791,6 @@
         "which": "^2.0.1"
       }
     },
-    "crypto-js": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/crypto-js/-/crypto-js-4.1.1.tgz",
-      "integrity": "sha512-o2JlM7ydqd3Qk9CA0L4NL6mTzU2sdx96a+oOfPu8Mkl/PK51vSyoi8/rQ8NknZtk44vq15lmhAj9CIAGwgeWKw=="
-    },
     "crypto-random-string": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/crypto-random-string/-/crypto-random-string-2.0.0.tgz",
@@ -35494,9 +35495,9 @@
       "integrity": "sha512-2ZTgtl0nJsO0KQCjEpxcIr5D+Yv90plTitZt9JBfQvVJDS5seMl3FOvsh3+9CoYWXf/1l5OaZzzF6nDm4cagaQ=="
     },
     "nanoid": {
-      "version": "3.3.4",
+      "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.4.tgz",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-5.0.2.tgz",
-      "integrity": "sha512-MqBkQh/OHTS2egovRtLk45wEyNXwF+cokD+1YPf9u5VfJiRdAiRwB2froX5Co9Rh20xs4siNPm8naNotSD6RBw=="
+      "integrity": "sha512-2ustYUX1R2rL/Br5B/FMhi8d5/QzvkJ912rBYxskcpu0myTHzSZfTr1LAS2Sm7jxRUObRrSBFoyzwAhL49aVSg=="
     },
     "natural-compare": {
       "version": "1.4.0",
@@ -35956,15 +35957,6 @@
       "resolved": "https://registry.npmjs.org/obuf/-/obuf-1.1.2.tgz",
       "integrity": "sha512-PX1wu0AmAdPqOL1mWhqmlOd8kOIZQwGZw6rh7uby9fTc5lhaOWFLX3I6R1hrF9k3zUY40e6igsLGkDXK92LJNg=="
     },
-    "oidc-client-ts": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/oidc-client-ts/-/oidc-client-ts-2.3.0.tgz",
-      "integrity": "sha512-7RUKU+TJFQo+4X9R50IGJAIDF18uRBaFXyZn4VVCfwmwbSUhKcdDnw4zgeut3uEXkiD3NqURq+d88sDPxjf1FA==",
-      "requires": {
-        "crypto-js": "^4.1.1",
-        "jwt-decode": "^3.1.2"
-      }
-    },
     "on-finished": {
       "version": "2.4.1",
       "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
@@ -36284,6 +36276,13 @@
         "nanoid": "^3.3.4",
         "picocolors": "^1.0.0",
         "source-map-js": "^1.0.2"
+      },
+      "dependencies": {
+        "nanoid": {
+          "version": "3.3.6",
+          "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.6.tgz",
+          "integrity": "sha512-BGcqMMJuToF7i1rt+2PWSNVnWIkGCU78jBG3RxO/bZlnZPK2Cmi2QaffxGO/2RvWi9sL+FAiRiXMgsyxQ1DIDA=="
+        }
       }
     },
     "postcss-attribute-case-insensitive": {

client/package.json

@@ -65,8 +65,8 @@
     "js-cookie": "^3.0.1",
     "jwt-decode": "^3.1.2",
     "lodash": "^4.17.21",
+    "nanoid": "^5.0.2",
     "node-sass": "^8.0.0",
-    "oidc-client-ts": "^2.3.0",
     "photoswipe": "^5.3.3",
     "prop-types": "^15.8.1",
     "react": "^18.2.0",

client/src/actions/core.js

@@ -1,7 +1,6 @@
 import ActionTypes from '../constants/ActionTypes';
 
 const initializeCore = (
-  config,
   user,
   board,
   users,
@@ -21,7 +20,6 @@ const initializeCore = (
 ) => ({
   type: ActionTypes.CORE_INITIALIZE,
   payload: {
-    config,
     user,
     board,
     users,
@@ -41,6 +39,14 @@ const initializeCore = (
   },
 });
 
+// TODO: with success?
+initializeCore.fetchConfig = (config) => ({
+  type: ActionTypes.CORE_INITIALIZE__CONFIG_FETCH,
+  payload: {
+    config,
+  },
+});
+
 const logout = () => ({
   type: ActionTypes.LOGOUT,
   payload: {},

client/src/actions/login.js

@@ -28,20 +28,20 @@ authenticate.failure = (error) => ({
   },
 });
 
-const authenticateWithOidc = () => ({
+const authenticateUsingOidc = () => ({
-  type: ActionTypes.WITH_OIDC_AUTHENTICATE,
+  type: ActionTypes.USING_OIDC_AUTHENTICATE,
   payload: {},
 });
 
-authenticateWithOidc.success = (accessToken) => ({
+authenticateUsingOidc.success = (accessToken) => ({
-  type: ActionTypes.WITH_OIDC_AUTHENTICATE__SUCCESS,
+  type: ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS,
   payload: {
     accessToken,
   },
 });
 
-authenticateWithOidc.failure = (error) => ({
+authenticateUsingOidc.failure = (error) => ({
-  type: ActionTypes.WITH_OIDC_AUTHENTICATE__FAILURE,
+  type: ActionTypes.USING_OIDC_AUTHENTICATE__FAILURE,
   payload: {
     error,
   },
@@ -55,6 +55,6 @@ const clearAuthenticateError = () => ({
 export default {
   initializeLogin,
   authenticate,
-  authenticateWithOidc,
+  authenticateUsingOidc,
   clearAuthenticateError,
 };

client/src/api/access-tokens.js

@@ -5,14 +5,14 @@ import socket from './socket';
 
 const createAccessToken = (data, headers) => http.post('/access-tokens', data, headers);
 
-const exchangeToAccessToken = (data, headers) =>
+const exchangeForAccessTokenUsingOidc = (data, headers) =>
-  http.post('/access-tokens/exchange', data, headers);
+  http.post('/access-tokens/exchange-using-oidc', data, headers);
 
 const deleteCurrentAccessToken = (headers) =>
   socket.delete('/access-tokens/me', undefined, headers);
 
 export default {
   createAccessToken,
-  exchangeToAccessToken,
+  exchangeForAccessTokenUsingOidc,
   deleteCurrentAccessToken,
 };

client/src/components/CardModal/Tasks/Tasks.jsx

@@ -48,14 +48,21 @@ const Tasks = React.memo(({ items, canEdit, onCreate, onUpdate, onMove, onDelete
   return (
     <>
       {items.length > 0 && (
-        <Progress
+        <>
-          autoSuccess
+          <span className={styles.progressWrapper}>
-          value={completedItems.length}
+            <Progress
-          total={items.length}
+              autoSuccess
-          color="blue"
+              value={completedItems.length}
-          size="tiny"
+              total={items.length}
-          className={styles.progress}
+              color="blue"
-        />
+              size="tiny"
+              className={styles.progress}
+            />
+          </span>
+          <span className={styles.count}>
+            {completedItems.length}/{items.length}
+          </span>
+        </>
       )}
       <DragDropContext onDragStart={handleDragStart} onDragEnd={handleDragEnd}>
         <Droppable droppableId="tasks" type={DroppableTypes.TASK}>

client/src/components/CardModal/Tasks/Tasks.module.scss

@@ -3,6 +3,23 @@
     margin: 0 0 16px;
   }
 
+  .progressWrapper {
+    display: inline-block;
+    padding: 3px 0;
+    vertical-align: top;
+    width: calc(100% - 50px);
+  }
+
+  .count {
+    color: #8c8c8c;
+    display: inline-block;
+    font-size: 14px;
+    line-height: 14px;
+    text-align: right;
+    vertical-align: top;
+    width: 50px;
+  }
+
   .taskButton {
     background: transparent;
     border: none;

client/src/components/Login/Login.jsx

@@ -65,11 +65,11 @@ const Login = React.memo(
   ({
     defaultData,
     isSubmitting,
-    isSubmittingWithOidc,
+    isSubmittingUsingOidc,
     error,
     withOidc,
     onAuthenticate,
-    onAuthenticateWithOidc,
+    onAuthenticateUsingOidc,
     onMessageDismiss,
   }) => {
     const [t] = useTranslation();
@@ -192,15 +192,15 @@ const Login = React.memo(
                         content={t('action.logIn')}
                         floated="right"
                         loading={isSubmitting}
-                        disabled={isSubmitting || isSubmittingWithOidc}
+                        disabled={isSubmitting || isSubmittingUsingOidc}
                       />
                     </Form>
                     {withOidc && (
                       <Button
                         type="button"
-                        loading={isSubmittingWithOidc}
+                        loading={isSubmittingUsingOidc}
-                        disabled={isSubmitting || isSubmittingWithOidc}
+                        disabled={isSubmitting || isSubmittingUsingOidc}
-                        onClick={onAuthenticateWithOidc}
+                        onClick={onAuthenticateUsingOidc}
                       >
                         {t('action.logInWithSSO')}
                       </Button>
@@ -239,11 +239,11 @@ Login.propTypes = {
   defaultData: PropTypes.object.isRequired,
   /* eslint-enable react/forbid-prop-types */
   isSubmitting: PropTypes.bool.isRequired,
-  isSubmittingWithOidc: PropTypes.bool.isRequired,
+  isSubmittingUsingOidc: PropTypes.bool.isRequired,
   error: PropTypes.object, // eslint-disable-line react/forbid-prop-types
   withOidc: PropTypes.bool.isRequired,
   onAuthenticate: PropTypes.func.isRequired,
-  onAuthenticateWithOidc: PropTypes.func.isRequired,
+  onAuthenticateUsingOidc: PropTypes.func.isRequired,
   onMessageDismiss: PropTypes.func.isRequired,
 };
 

client/src/components/UsersModal/Item/ActionsStep.jsx

@@ -155,7 +155,7 @@ const ActionsStep = React.memo(
                 </Menu.Item>
               </>
             )}
-            {!user.isLockedAdmin && (
+            {!user.isDeletionLocked && (
               <Menu.Item className={styles.menuItem} onClick={handleDeleteClick}>
                 {t('action.deleteUser', {
                   context: 'title',

client/src/components/UsersModal/Item/Item.jsx

@@ -18,7 +18,8 @@ const Item = React.memo(
     phone,
     isAdmin,
     isLocked,
-    isLockedAdmin,
+    isRoleLocked,
+    isDeletionLocked,
     emailUpdateForm,
     passwordUpdateForm,
     usernameUpdateForm,
@@ -48,7 +49,7 @@ const Item = React.memo(
         <Table.Cell>{username || '-'}</Table.Cell>
         <Table.Cell>{email}</Table.Cell>
         <Table.Cell>
-          <Radio toggle checked={isAdmin} disabled={isLockedAdmin} onChange={handleIsAdminChange} />
+          <Radio toggle checked={isAdmin} disabled={isRoleLocked} onChange={handleIsAdminChange} />
         </Table.Cell>
         <Table.Cell textAlign="right">
           <ActionsPopup
@@ -60,7 +61,7 @@ const Item = React.memo(
               phone,
               isAdmin,
               isLocked,
-              isLockedAdmin,
+              isDeletionLocked,
               emailUpdateForm,
               passwordUpdateForm,
               usernameUpdateForm,
@@ -93,7 +94,8 @@ Item.propTypes = {
   phone: PropTypes.string,
   isAdmin: PropTypes.bool.isRequired,
   isLocked: PropTypes.bool.isRequired,
-  isLockedAdmin: PropTypes.bool.isRequired,
+  isRoleLocked: PropTypes.bool.isRequired,
+  isDeletionLocked: PropTypes.bool.isRequired,
   /* eslint-disable react/forbid-prop-types */
   emailUpdateForm: PropTypes.object.isRequired,
   passwordUpdateForm: PropTypes.object.isRequired,

client/src/components/UsersModal/UsersModal.jsx

@@ -111,7 +111,8 @@ const UsersModal = React.memo(
                   phone={item.phone}
                   isAdmin={item.isAdmin}
                   isLocked={item.isLocked}
-                  isLockedAdmin={item.isLockedAdmin}
+                  isRoleLocked={item.isRoleLocked}
+                  isDeletionLocked={item.isDeletionLocked}
                   emailUpdateForm={item.emailUpdateForm}
                   passwordUpdateForm={item.passwordUpdateForm}
                   usernameUpdateForm={item.usernameUpdateForm}

client/src/constants/ActionTypes.js

@@ -16,14 +16,15 @@ export default {
   AUTHENTICATE: 'AUTHENTICATE',
   AUTHENTICATE__SUCCESS: 'AUTHENTICATE__SUCCESS',
   AUTHENTICATE__FAILURE: 'AUTHENTICATE__FAILURE',
-  WITH_OIDC_AUTHENTICATE: 'WITH_OIDC_AUTHENTICATE',
+  USING_OIDC_AUTHENTICATE: 'USING_OIDC_AUTHENTICATE',
-  WITH_OIDC_AUTHENTICATE__SUCCESS: 'WITH_OIDC_AUTHENTICATE__SUCCESS',
+  USING_OIDC_AUTHENTICATE__SUCCESS: 'USING_OIDC_AUTHENTICATE__SUCCESS',
-  WITH_OIDC_AUTHENTICATE__FAILURE: 'WITH_OIDC_AUTHENTICATE__FAILURE',
+  USING_OIDC_AUTHENTICATE__FAILURE: 'USING_OIDC_AUTHENTICATE__FAILURE',
   AUTHENTICATE_ERROR_CLEAR: 'AUTHENTICATE_ERROR_CLEAR',
 
   /* Core */
 
   CORE_INITIALIZE: 'CORE_INITIALIZE',
+  CORE_INITIALIZE__CONFIG_FETCH: 'CORE_INITIALIZE__CONFIG_FETCH',
   LOGOUT: 'LOGOUT',
   LOGOUT__ACCESS_TOKEN_INVALIDATE: 'LOGOUT__ACCESS_TOKEN_INVALIDATE',
 

client/src/constants/EntryActionTypes.js

@@ -11,7 +11,7 @@ export default {
   /* Login */
 
   AUTHENTICATE: `${PREFIX}/AUTHENTICATE`,
-  WITH_OIDC_AUTHENTICATE: `${PREFIX}/WITH_OIDC_AUTHENTICATE`,
+  USING_OIDC_AUTHENTICATE: `${PREFIX}/USING_OIDC_AUTHENTICATE`,
   AUTHENTICATE_ERROR_CLEAR: `${PREFIX}/AUTHENTICATE_ERROR_CLEAR`,
 
   /* Core */

client/src/containers/LoginContainer.js

@@ -10,14 +10,14 @@ const mapStateToProps = (state) => {
 
   const {
     ui: {
-      authenticateForm: { data: defaultData, isSubmitting, isSubmittingWithOidc, error },
+      authenticateForm: { data: defaultData, isSubmitting, isSubmittingUsingOidc, error },
     },
   } = state;
 
   return {
     defaultData,
     isSubmitting,
-    isSubmittingWithOidc,
+    isSubmittingUsingOidc,
     error,
     withOidc: !!oidcConfig,
   };
@@ -27,7 +27,7 @@ const mapDispatchToProps = (dispatch) =>
   bindActionCreators(
     {
       onAuthenticate: entryActions.authenticate,
-      onAuthenticateWithOidc: entryActions.authenticateWithOidc,
+      onAuthenticateUsingOidc: entryActions.authenticateUsingOidc,
       onMessageDismiss: entryActions.clearAuthenticateError,
     },
     dispatch,

client/src/entry-actions/login.js

@@ -7,8 +7,8 @@ const authenticate = (data) => ({
   },
 });
 
-const authenticateWithOidc = () => ({
+const authenticateUsingOidc = () => ({
-  type: EntryActionTypes.WITH_OIDC_AUTHENTICATE,
+  type: EntryActionTypes.USING_OIDC_AUTHENTICATE,
   payload: {},
 });
 
@@ -19,6 +19,6 @@ const clearAuthenticateError = () => ({
 
 export default {
   authenticate,
-  authenticateWithOidc,
+  authenticateUsingOidc,
   clearAuthenticateError,
 };

client/src/models/User.js

@@ -45,7 +45,8 @@ export default class extends BaseModel {
     subscribeToOwnCards: attr(),
     isAdmin: attr(),
     isLocked: attr(),
-    isLockedAdmin: attr(),
+    isRoleLocked: attr(),
+    isDeletionLocked: attr(),
     deletedAt: attr(),
     createdAt: attr({
       getDefault: () => new Date(),

client/src/reducers/auth.js

@@ -10,7 +10,7 @@ const initialState = {
 export default (state = initialState, { type, payload }) => {
   switch (type) {
     case ActionTypes.AUTHENTICATE__SUCCESS:
-    case ActionTypes.WITH_OIDC_AUTHENTICATE__SUCCESS:
+    case ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS:
       return {
         ...state,
         accessToken: payload.accessToken,

client/src/reducers/root.js

@@ -15,7 +15,7 @@ export default (state = initialState, { type, payload }) => {
         config: payload.config,
       };
     case ActionTypes.AUTHENTICATE__SUCCESS:
-    case ActionTypes.WITH_OIDC_AUTHENTICATE__SUCCESS:
+    case ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS:
       return {
         ...state,
         isInitializing: true,
@@ -24,9 +24,11 @@ export default (state = initialState, { type, payload }) => {
       return {
         ...state,
         isInitializing: false,
-        ...(payload.config && {
+      };
-          config: payload.config,
+    case ActionTypes.CORE_INITIALIZE__CONFIG_FETCH:
-        }),
+      return {
+        ...state,
+        config: payload.config,
       };
     default:
       return state;

client/src/reducers/ui/authenticate-form.js

@@ -9,7 +9,7 @@ const initialState = {
     password: '',
   },
   isSubmitting: false,
-  isSubmittingWithOidc: false,
+  isSubmittingUsingOidc: false,
   error: null,
 };
 
@@ -20,7 +20,7 @@ export default (state = initialState, { type, payload }) => {
       if (payload.location.pathname === Paths.OIDC_CALLBACK) {
         return {
           ...state,
-          isSubmittingWithOidc: true,
+          isSubmittingUsingOidc: true,
         };
       }
 
@@ -35,7 +35,7 @@ export default (state = initialState, { type, payload }) => {
         isSubmitting: true,
       };
     case ActionTypes.AUTHENTICATE__SUCCESS:
-    case ActionTypes.WITH_OIDC_AUTHENTICATE__SUCCESS:
+    case ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS:
       return initialState;
     case ActionTypes.AUTHENTICATE__FAILURE:
       return {
@@ -43,10 +43,10 @@ export default (state = initialState, { type, payload }) => {
         isSubmitting: false,
         error: payload.error,
       };
-    case ActionTypes.WITH_OIDC_AUTHENTICATE__FAILURE:
+    case ActionTypes.USING_OIDC_AUTHENTICATE__FAILURE:
       return {
         ...state,
-        isSubmittingWithOidc: false,
+        isSubmittingUsingOidc: false,
         error: payload.error,
       };
     case ActionTypes.AUTHENTICATE_ERROR_CLEAR:

client/src/sagas/core/index.js

@@ -1,7 +1,8 @@
-import { all, apply, fork, take } from 'redux-saga/effects';
+import { all, apply, fork, select, take } from 'redux-saga/effects';
 
 import watchers from './watchers';
 import services from './services';
+import selectors from '../../selectors';
 import { socket } from '../../api';
 import ActionTypes from '../../constants/ActionTypes';
 import Paths from '../../constants/Paths';
@@ -14,5 +15,12 @@ export default function* coreSaga() {
 
   yield take(ActionTypes.LOGOUT);
 
-  window.location.href = Paths.LOGIN;
+  const oidcConfig = yield select(selectors.selectOidcConfig);
+
+  if (oidcConfig && oidcConfig.endSessionUrl !== null) {
+    // Redirect the user to the IDP to log out.
+    window.location.href = oidcConfig.endSessionUrl;
+  } else {
+    window.location.href = Paths.LOGIN;
+  }
 }

client/src/sagas/core/services/core.js

@@ -1,4 +1,4 @@
-import { apply, call, put, select, take } from 'redux-saga/effects';
+import { call, put, select, take } from 'redux-saga/effects';
 
 import request from '../request';
 import requests from '../requests';
@@ -6,7 +6,6 @@ import selectors from '../../../selectors';
 import actions from '../../../actions';
 import api from '../../../api';
 import i18n from '../../../i18n';
-import { createOidcManager } from '../../../utils/oidc-manager';
 import { removeAccessToken } from '../../../utils/access-token-storage';
 
 export function* initializeCore() {
@@ -15,6 +14,8 @@ export function* initializeCore() {
   let config;
   if (!currentConfig) {
     ({ item: config } = yield call(api.getConfig)); // TODO: handle error
+
+    yield put(actions.initializeCore.fetchConfig(config));
   }
 
   const {
@@ -41,7 +42,6 @@ export function* initializeCore() {
 
   yield put(
     actions.initializeCore(
-      config,
       user,
       board,
       users,
@@ -84,16 +84,6 @@ export function* logout(invalidateAccessToken = true) {
     } catch (error) {} // eslint-disable-line no-empty
   }
 
-  const oidcConfig = yield select(selectors.selectOidcConfig);
-
-  if (oidcConfig) {
-    const oidcManager = createOidcManager(oidcConfig);
-
-    try {
-      yield apply(oidcManager, oidcManager.logout);
-    } catch (error) {} // eslint-disable-line no-empty
-  }
-
   yield put(actions.logout());
   yield take();
 }

client/src/sagas/login/index.js

@@ -9,7 +9,7 @@ export default function* loginSaga() {
 
   yield fork(services.initializeLogin);
 
-  yield take([ActionTypes.AUTHENTICATE__SUCCESS, ActionTypes.WITH_OIDC_AUTHENTICATE__SUCCESS]);
+  yield take([ActionTypes.AUTHENTICATE__SUCCESS, ActionTypes.USING_OIDC_AUTHENTICATE__SUCCESS]);
 
   yield cancel(watcherTasks);
   yield call(services.goToRoot);

client/src/sagas/login/services/login.js

@@ -1,10 +1,10 @@
-import { apply, call, put, select } from 'redux-saga/effects';
+import { nanoid } from 'nanoid';
+import { call, put, select } from 'redux-saga/effects';
 import { replace } from '../../../lib/redux-router';
 
 import selectors from '../../../selectors';
 import actions from '../../../actions';
 import api from '../../../api';
-import { createOidcManager } from '../../../utils/oidc-manager';
 import { setAccessToken } from '../../../utils/access-token-storage';
 import Paths from '../../../constants/Paths';
 
@@ -29,39 +29,65 @@ export function* authenticate(data) {
   yield put(actions.authenticate.success(accessToken));
 }
 
-export function* authenticateWithOidc() {
+export function* authenticateUsingOidc() {
   const oidcConfig = yield select(selectors.selectOidcConfig);
-  const oidcManager = createOidcManager(oidcConfig);
 
-  yield apply(oidcManager, oidcManager.login);
+  const nonce = nanoid();
+  window.sessionStorage.setItem('oidc-nonce', nonce);
+  window.location.href = `${oidcConfig.authorizationUrl}&nonce=${encodeURIComponent(nonce)}`;
 }
 
-export function* authenticateWithOidcCallback() {
+export function* authenticateUsingOidcCallback() {
-  const oidcConfig = yield select(selectors.selectOidcConfig);
+  // https://github.com/plankanban/planka/issues/511#issuecomment-1771385639
-  const oidcManager = createOidcManager(oidcConfig);
+  const params = new URLSearchParams(window.location.hash.substring(1) || window.location.search);
-
-  let oidcToken;
-  try {
-    ({ access_token: oidcToken } = yield apply(oidcManager, oidcManager.loginCallback));
-  } catch (error) {
-    yield put(actions.authenticateWithOidc.failure(error));
-  }
 
   yield put(replace(Paths.LOGIN));
 
-  if (oidcToken) {
+  if (params.get('error') !== null) {
+    yield put(
+      actions.authenticateUsingOidc.failure(
+        new Error(
+          `OIDC Authorization error: ${params.get('error')}: ${params.get('error_description')}`,
+        ),
+      ),
+    );
+    return;
+  }
+
+  const nonce = window.sessionStorage.getItem('oidc-nonce');
+  if (nonce === null) {
+    yield put(
+      actions.authenticateUsingOidc.failure(
+        new Error('Unable to process OIDC response: no nonce issued'),
+      ),
+    );
+    return;
+  }
+
+  const code = params.get('code');
+  if (code === null) {
+    yield put(
+      actions.authenticateUsingOidc.failure(new Error('Invalid OIDC response: no code parameter')),
+    );
+    return;
+  }
+
+  window.sessionStorage.removeItem('oidc-nonce');
+
+  if (code !== null) {
     let accessToken;
     try {
-      ({ item: accessToken } = yield call(api.exchangeToAccessToken, {
+      ({ item: accessToken } = yield call(api.exchangeForAccessTokenUsingOidc, {
-        token: oidcToken,
+        code,
+        nonce,
       }));
     } catch (error) {
-      yield put(actions.authenticateWithOidc.failure(error));
+      yield put(actions.authenticateUsingOidc.failure(error));
       return;
     }
 
     yield call(setAccessToken, accessToken);
-    yield put(actions.authenticateWithOidc.success(accessToken));
+    yield put(actions.authenticateUsingOidc.success(accessToken));
   }
 }
 
@@ -72,7 +98,7 @@ export function* clearAuthenticateError() {
 export default {
   initializeLogin,
   authenticate,
-  authenticateWithOidc,
+  authenticateUsingOidc,
-  authenticateWithOidcCallback,
+  authenticateUsingOidcCallback,
   clearAuthenticateError,
 };

client/src/sagas/login/services/router.js

@@ -1,7 +1,7 @@
 import { call, put, select, take } from 'redux-saga/effects';
 import { push } from '../../../lib/redux-router';
 
-import { authenticateWithOidcCallback } from './login';
+import { authenticateUsingOidcCallback } from './login';
 import selectors from '../../../selectors';
 import ActionTypes from '../../../constants/ActionTypes';
 import Paths from '../../../constants/Paths';
@@ -36,9 +36,7 @@ export function* handleLocationChange() {
         yield take(ActionTypes.LOGIN_INITIALIZE);
       }
 
-      // TODO: check if OIDC is enabled
+      yield call(authenticateUsingOidcCallback);
-
-      yield call(authenticateWithOidcCallback);
 
       break;
     }

client/src/sagas/login/watchers/login.js

@@ -8,7 +8,7 @@ export default function* loginWatchers() {
     takeEvery(EntryActionTypes.AUTHENTICATE, ({ payload: { data } }) =>
       services.authenticate(data),
     ),
-    takeEvery(EntryActionTypes.WITH_OIDC_AUTHENTICATE, () => services.authenticateWithOidc()),
+    takeEvery(EntryActionTypes.USING_OIDC_AUTHENTICATE, () => services.authenticateUsingOidc()),
     takeEvery(EntryActionTypes.AUTHENTICATE_ERROR_CLEAR, () => services.clearAuthenticateError()),
   ]);
 }

client/src/utils/oidc-manager.js

@@ -1,27 +0,0 @@
-import { UserManager } from 'oidc-client-ts';
-
-export default class OidcManager {
-  constructor(config) {
-    this.userManager = new UserManager({
-      ...config,
-      authority: config.issuer,
-      client_id: config.clientId,
-      redirect_uri: config.redirectUri,
-      scope: config.scopes,
-    });
-  }
-
-  login() {
-    return this.userManager.signinRedirect();
-  }
-
-  loginCallback() {
-    return this.userManager.signinRedirectCallback();
-  }
-
-  logout() {
-    return this.userManager.signoutSilent();
-  }
-}
-
-export const createOidcManager = (config) => new OidcManager(config);

docker-compose-db.yml

@@ -0,0 +1,16 @@
+version: '3'
+
+services:
+  postgres:
+    image: postgres:alpine
+    restart: unless-stopped
+    volumes:
+      - db-data:/var/lib/postgresql/data
+    ports:
+      - 5432:5432
+    environment:
+      - POSTGRES_DB=planka
+      - POSTGRES_HOST_AUTH_METHOD=trust
+
+volumes:
+  db-data:

docker-compose-dev.yml

@@ -1,16 +1,65 @@
 version: '3'
 
 services:
+  planka:
+    image: ghcr.io/plankanban/planka:dev
+    command: >
+      bash -c
+        "for i in `seq 1 30`; do
+          ./start.sh &&
+          s=$$? && break || s=$$?;
+          echo \"Tried $$i times. Waiting 5 seconds...\";
+          sleep 5;
+        done; (exit $$s)"
+    restart: unless-stopped
+    volumes:
+      - user-avatars:/app/public/user-avatars
+      - project-background-images:/app/public/project-background-images
+      - attachments:/app/private/attachments
+    ports:
+      - 3000:1337
+    environment:
+      - BASE_URL=http://localhost:3000
+      - DATABASE_URL=postgresql://postgres@postgres/planka
+      - SECRET_KEY=notsecretkey
+
+      # - TRUST_PROXY=0
+      # - TOKEN_EXPIRES_IN=365 # In days
+
+      # related: https://github.com/knex/knex/issues/2354
+      # As knex does not pass query parameters from the connection string we
+      # have to use environment variables in order to pass the desired values, e.g.
+      # - PGSSLMODE=<value>
+
+      # Configure knex to accept SSL certificates
+      # - KNEX_REJECT_UNAUTHORIZED_SSL_CERTIFICATE=false
+
+      # - DEFAULT_ADMIN_EMAIL=demo@demo.demo # Do not remove if you want to prevent this user from being edited/deleted
+      # - DEFAULT_ADMIN_PASSWORD=demo
+      # - DEFAULT_ADMIN_NAME=Demo Demo
+      # - DEFAULT_ADMIN_USERNAME=demo
+
+      # - OIDC_ISSUER=
+      # - OIDC_CLIENT_ID=
+      # - OIDC_CLIENT_SECRET=
+      # - OIDC_SCOPES=openid email profile
+      # - OIDC_ADMIN_ROLES=admin
+      # - OIDC_ROLES_ATTRIBUTE=groups
+      # - OIDC_IGNORE_ROLES=true
+    depends_on:
+      - postgres
+
   postgres:
-    image: postgres:alpine
+    image: postgres:14-alpine
     restart: unless-stopped
     volumes:
       - db-data:/var/lib/postgresql/data
-    ports:
-      - 5432:5432
     environment:
       - POSTGRES_DB=planka
       - POSTGRES_HOST_AUTH_METHOD=trust
 
 volumes:
+  user-avatars:
+  project-background-images:
+  attachments:
   db-data:

docker-compose.yml

@@ -20,15 +20,11 @@ services:
       - 3000:1337
     environment:
       - BASE_URL=http://localhost:3000
-      - TRUST_PROXY=0
       - DATABASE_URL=postgresql://postgres@postgres/planka
       - SECRET_KEY=notsecretkey
 
-      # Can be removed after installation
+      # - TRUST_PROXY=0
-      - DEFAULT_ADMIN_EMAIL=demo@demo.demo # Do not remove if you want to prevent this user from being edited/deleted
+      # - TOKEN_EXPIRES_IN=365 # In days
-      - DEFAULT_ADMIN_PASSWORD=demo
-      - DEFAULT_ADMIN_NAME=Demo Demo
-      - DEFAULT_ADMIN_USERNAME=demo
 
       # related: https://github.com/knex/knex/issues/2354
       # As knex does not pass query parameters from the connection string we
@@ -38,15 +34,18 @@ services:
       # Configure knex to accept SSL certificates
       # - KNEX_REJECT_UNAUTHORIZED_SSL_CERTIFICATE=false
 
+      # - DEFAULT_ADMIN_EMAIL=demo@demo.demo # Do not remove if you want to prevent this user from being edited/deleted
+      # - DEFAULT_ADMIN_PASSWORD=demo
+      # - DEFAULT_ADMIN_NAME=Demo Demo
+      # - DEFAULT_ADMIN_USERNAME=demo
+
       # - OIDC_ISSUER=
       # - OIDC_CLIENT_ID=
-      # - OIDC_REDIRECT_URI=http://localhost:3000/oidc-callback
+      # - OIDC_CLIENT_SECRET=
       # - OIDC_SCOPES=openid email profile
-      # - OIDC_JWKS_URI=
-      # - OIDC_AUDIENCE=
       # - OIDC_ADMIN_ROLES=admin
       # - OIDC_ROLES_ATTRIBUTE=groups
-      # - OIDC_SKIP_USER_INFO=true
+      # - OIDC_IGNORE_ROLES=true
     depends_on:
       - postgres
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "planka",
-  "version": "1.13.0",
+  "version": "1.14.3",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "planka",
-      "version": "1.13.0",
+      "version": "1.14.3",
       "hasInstallScript": true,
       "license": "AGPL-3.0",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "planka",
-  "version": "1.13.0",
+  "version": "1.14.3",
   "private": true,
   "homepage": "https://plankanban.github.io/planka",
   "repository": {

server/.env.sample

@@ -4,13 +4,6 @@ BASE_URL=http://localhost:1337
 DATABASE_URL=postgresql://postgres@localhost/planka
 SECRET_KEY=notsecretkey
 
-## Can be removed after installation
-
-DEFAULT_ADMIN_EMAIL=demo@demo.demo # Do not remove if you want to prevent this user from being edited/deleted
-DEFAULT_ADMIN_PASSWORD=demo
-DEFAULT_ADMIN_NAME=Demo Demo
-DEFAULT_ADMIN_USERNAME=demo
-
 ## Optional
 
 # TRUST_PROXY=0
@@ -24,15 +17,18 @@ DEFAULT_ADMIN_USERNAME=demo
 # Configure knex to accept SSL certificates
 # KNEX_REJECT_UNAUTHORIZED_SSL_CERTIFICATE=false
 
+# DEFAULT_ADMIN_EMAIL=demo@demo.demo # Do not remove if you want to prevent this user from being edited/deleted
+# DEFAULT_ADMIN_PASSWORD=demo
+# DEFAULT_ADMIN_NAME=Demo Demo
+# DEFAULT_ADMIN_USERNAME=demo
+
 # OIDC_ISSUER=
 # OIDC_CLIENT_ID=
-# OIDC_REDIRECT_URI=http://localhost:1337/oidc-callback
+# OIDC_CLIENT_SECRET=
 # OIDC_SCOPES=openid email profile
-# OIDC_JWKS_URI=
-# OIDC_AUDIENCE=
 # OIDC_ADMIN_ROLES=admin
 # OIDC_ROLES_ATTRIBUTE=groups
-# OIDC_SKIP_USER_INFO=true
+# OIDC_IGNORE_ROLES=true
 
 ## Do not edit this
 

server/api/controllers/access-tokens/create.js

@@ -50,10 +50,6 @@ module.exports = {
 
     const user = await sails.helpers.users.getOneByEmailOrUsername(inputs.emailOrUsername);
 
-    if (user.isSso) {
-      throw Errors.USE_SINGLE_SIGN_ON;
-    }
-
     if (!user) {
       sails.log.warn(
         `Invalid email or username: "${inputs.emailOrUsername}"! (IP: ${remoteAddress})`,
@@ -61,6 +57,10 @@ module.exports = {
       throw Errors.INVALID_EMAIL_OR_USERNAME;
     }
 
+    if (user.isSso) {
+      throw Errors.USE_SINGLE_SIGN_ON;
+    }
+
     if (!bcrypt.compareSync(inputs.password, user.password)) {
       sails.log.warn(`Invalid password! (IP: ${remoteAddress})`);
       throw Errors.INVALID_PASSWORD;

server/api/controllers/access-tokens/exchange-using-oidc.js

@@ -1,8 +1,8 @@
 const { getRemoteAddress } = require('../../../utils/remoteAddress');
 
 const Errors = {
-  INVALID_TOKEN: {
+  INVALID_CODE_OR_NONCE: {
-    invalidToken: 'Invalid token',
+    invalidCodeOrNonce: 'Invalid code or nonce',
   },
   EMAIL_ALREADY_IN_USE: {
     emailAlreadyInUse: 'Email already in use',
@@ -17,14 +17,18 @@ const Errors = {
 
 module.exports = {
   inputs: {
-    token: {
+    code: {
+      type: 'string',
+      required: true,
+    },
+    nonce: {
       type: 'string',
       required: true,
     },
   },
 
   exits: {
-    invalidToken: {
+    invalidCodeOrNonce: {
       responseType: 'unauthorized',
     },
     emailAlreadyInUse: {
@@ -42,10 +46,10 @@ module.exports = {
     const remoteAddress = getRemoteAddress(this.req);
 
     const user = await sails.helpers.users
-      .getOrCreateOneByOidcToken(inputs.token)
+      .getOrCreateOneUsingOidc(inputs.code, inputs.nonce)
-      .intercept('invalidToken', () => {
+      .intercept('invalidCodeOrNonce', () => {
-        sails.log.warn(`Invalid token! (IP: ${remoteAddress})`);
+        sails.log.warn(`Invalid code or nonce! (IP: ${remoteAddress})`);
-        return Errors.INVALID_TOKEN;
+        return Errors.INVALID_CODE_OR_NONCE;
       })
       .intercept('emailAlreadyInUse', () => Errors.EMAIL_ALREADY_IN_USE)
       .intercept('usernameAlreadyInUse', () => Errors.USERNAME_ALREADY_IN_USE)

server/api/controllers/show-config.js

@@ -1,15 +1,21 @@
 module.exports = {
   fn() {
+    let oidc = null;
+    if (sails.hooks.oidc.isActive()) {
+      const oidcClient = sails.hooks.oidc.getClient();
+
+      oidc = {
+        authorizationUrl: oidcClient.authorizationUrl({
+          scope: sails.config.custom.oidcScopes,
+          response_mode: 'fragment',
+        }),
+        endSessionUrl: oidcClient.issuer.end_session_endpoint ? oidcClient.endSessionUrl({}) : null,
+      };
+    }
+
     return {
       item: {
-        oidc: sails.config.custom.oidcIssuer
+        oidc,
-          ? {
-              issuer: sails.config.custom.oidcIssuer,
-              clientId: sails.config.custom.oidcClientId,
-              redirectUri: sails.config.custom.oidcRedirectUri,
-              scopes: sails.config.custom.oidcScopes,
-            }
-          : null,
       },
     };
   },

server/api/controllers/users/update.js

@@ -73,6 +73,10 @@ module.exports = {
       delete inputs.name;
       /* eslint-enable no-param-reassign */
     } else if (user.isSso) {
+      if (!sails.config.custom.oidcIgnoreRoles) {
+        delete inputs.isAdmin; // eslint-disable-line no-param-reassign
+      }
+
       delete inputs.name; // eslint-disable-line no-param-reassign
     }
 

server/api/helpers/users/get-or-create-one-by-oidc-token.js

@@ -1,159 +0,0 @@
-const jwt = require('jsonwebtoken');
-const jwksClient = require('jwks-rsa');
-const openidClient = require('openid-client');
-
-const jwks = jwksClient({
-  jwksUri: sails.config.custom.oidcJwksUri,
-});
-
-const verifyOidcToken = async (oidcToken) => {
-  const signingKeys = await jwks.getSigningKeys();
-
-  const options = {
-    issuer: sails.config.custom.oidcIssuer,
-  };
-
-  if (sails.config.custom.oidcAudience) {
-    options.audience = sails.config.custom.oidcAudience;
-  }
-
-  let payload = null;
-  signingKeys.some((signingKey) => {
-    try {
-      const publicKey = signingKey.getPublicKey();
-      payload = jwt.verify(oidcToken, publicKey, options);
-    } catch (error) {
-      sails.log.error(error);
-    }
-
-    return !!payload;
-  });
-
-  return payload;
-};
-
-const getUserInfo = async (oidcToken) => {
-  const issuer = await openidClient.Issuer.discover(sails.config.custom.oidcIssuer);
-
-  const client = new issuer.Client({
-    client_id: 'irrelevant',
-  });
-
-  return client.userinfo(oidcToken);
-};
-
-module.exports = {
-  inputs: {
-    token: {
-      type: 'string',
-      required: true,
-    },
-  },
-
-  exits: {
-    invalidToken: {},
-    missingValues: {},
-    emailAlreadyInUse: {},
-    usernameAlreadyInUse: {},
-  },
-
-  async fn(inputs) {
-    const oidcUser = await verifyOidcToken(inputs.token);
-
-    if (!oidcUser) {
-      throw 'invalidToken';
-    }
-
-    if (!sails.config.custom.oidcSkipUserInfo) {
-      const userInfo = await getUserInfo(inputs.token);
-      Object.assign(oidcUser, userInfo);
-    }
-
-    if (!oidcUser.email || !oidcUser.name) {
-      throw 'missingValues';
-    }
-
-    let isAdmin = false;
-    if (sails.config.custom.oidcAdminRoles.includes('*')) {
-      isAdmin = true;
-    } else {
-      const roles = oidcUser[sails.config.custom.oidcRolesAttribute];
-
-      if (Array.isArray(roles)) {
-        isAdmin = sails.config.custom.oidcAdminRoles.some((role) => roles.includes(role));
-      }
-    }
-
-    const values = {
-      isAdmin,
-      email: oidcUser.email,
-      isSso: true,
-      name: oidcUser.name,
-      username: oidcUser.preferred_username,
-      subscribeToOwnCards: false,
-    };
-
-    let user;
-    /* eslint-disable no-constant-condition, no-await-in-loop */
-    while (true) {
-      let identityProviderUser = await IdentityProviderUser.findOne({
-        issuer: oidcUser.iss,
-        sub: oidcUser.sub,
-      });
-
-      if (identityProviderUser) {
-        user = await sails.helpers.users.getOne(identityProviderUser.userId);
-      } else {
-        while (true) {
-          user = await sails.helpers.users.getOne({
-            email: values.email,
-          });
-
-          if (!user) {
-            user = await sails.helpers.users
-              .createOne(values)
-              .tolerate('emailAlreadyInUse')
-              .intercept('usernameAlreadyInUse', 'usernameAlreadyInUse');
-          }
-
-          if (user) {
-            break;
-          }
-        }
-
-        identityProviderUser = await IdentityProviderUser.create({
-          userId: user.id,
-          issuer: oidcUser.iss,
-          sub: oidcUser.sub,
-        }).tolerate('E_UNIQUE');
-      }
-
-      if (identityProviderUser) {
-        break;
-      }
-    }
-    /* eslint-enable no-constant-condition, no-await-in-loop */
-
-    const updateFieldKeys = ['email', 'isAdmin', 'isSso', 'name', 'username'];
-
-    const updateValues = updateFieldKeys.reduce((result, fieldKey) => {
-      if (values[fieldKey] === user[fieldKey]) {
-        return result;
-      }
-
-      return {
-        ...result,
-        [fieldKey]: values[fieldKey],
-      };
-    }, {});
-
-    if (Object.keys(updateValues).length > 0) {
-      user = await sails.helpers.users
-        .updateOne(user, updateValues, {}) // FIXME: hack for last parameter
-        .intercept('emailAlreadyInUse', 'emailAlreadyInUse')
-        .intercept('usernameAlreadyInUse', 'usernameAlreadyInUse');
-    }
-
-    return user;
-  },
-};

server/api/helpers/users/get-or-create-one-using-oidc.js

@@ -0,0 +1,113 @@
+module.exports = {
+  inputs: {
+    code: {
+      type: 'string',
+      required: true,
+    },
+    nonce: {
+      type: 'string',
+      required: true,
+    },
+  },
+
+  exits: {
+    invalidCodeOrNonce: {},
+    missingValues: {},
+    emailAlreadyInUse: {},
+    usernameAlreadyInUse: {},
+  },
+
+  async fn(inputs) {
+    const client = sails.hooks.oidc.getClient();
+
+    let userInfo;
+    try {
+      const tokenSet = await client.callback(
+        sails.config.custom.oidcRedirectUri,
+        { code: inputs.code },
+        { nonce: inputs.nonce },
+      );
+      userInfo = await client.userinfo(tokenSet);
+    } catch (e) {
+      sails.log.warn(`Error while exchanging OIDC code: ${e}`);
+      throw 'invalidCodeOrNonce';
+    }
+
+    if (!userInfo.email || !userInfo.name) {
+      throw 'missingValues';
+    }
+
+    let isAdmin = false;
+    if (sails.config.custom.oidcAdminRoles.includes('*')) {
+      isAdmin = true;
+    } else {
+      const roles = userInfo[sails.config.custom.oidcRolesAttribute];
+      if (Array.isArray(roles)) {
+        // Use a Set here to avoid quadratic time complexity
+        const userRoles = new Set(userInfo[sails.config.custom.oidcRolesAttribute]);
+        isAdmin = sails.config.custom.oidcAdminRoles.findIndex((role) => userRoles.has(role)) > -1;
+      }
+    }
+
+    const values = {
+      isAdmin,
+      email: userInfo.email,
+      isSso: true,
+      name: userInfo.name,
+      username: userInfo.preferred_username,
+      subscribeToOwnCards: false,
+    };
+
+    let user;
+    // This whole block technically needs to be executed in a transaction
+    // with SERIALIZABLE isolation level (but Waterline does not support
+    // that), so this will result in errors if for example users are deleted
+    // concurrently with logging in via OIDC.
+    let identityProviderUser = await IdentityProviderUser.findOne({
+      issuer: sails.config.custom.oidcIssuer,
+      sub: userInfo.sub,
+    });
+
+    if (identityProviderUser) {
+      user = await sails.helpers.users.getOne(identityProviderUser.userId);
+    } else {
+      // If no IDP/User mapping exists, search for the user by email.
+      user = await sails.helpers.users.getOne({
+        email: values.email.toLowerCase(),
+      });
+
+      // Otherwise, create a new user.
+      if (!user) {
+        user = await sails.helpers.users
+          .createOne(values)
+          .intercept('usernameAlreadyInUse', 'usernameAlreadyInUse');
+      }
+
+      identityProviderUser = await IdentityProviderUser.create({
+        userId: user.id,
+        issuer: sails.config.custom.oidcIssuer,
+        sub: userInfo.sub,
+      });
+    }
+
+    const updateFieldKeys = ['email', 'isSso', 'name', 'username'];
+    if (!sails.config.custom.oidcIgnoreRoles) {
+      updateFieldKeys.push('isAdmin');
+    }
+
+    const updateValues = {};
+    // eslint-disable-next-line no-restricted-syntax
+    for (const k of updateFieldKeys) {
+      if (values[k] !== user[k]) updateValues[k] = values[k];
+    }
+
+    if (Object.keys(updateValues).length > 0) {
+      user = await sails.helpers.users
+        .updateOne(user, updateValues, {}) // FIXME: hack for last parameter
+        .intercept('emailAlreadyInUse', 'emailAlreadyInUse')
+        .intercept('usernameAlreadyInUse', 'usernameAlreadyInUse');
+    }
+
+    return user;
+  },
+};

server/api/hooks/oidc/index.js

@@ -0,0 +1,33 @@
+const openidClient = require('openid-client');
+
+module.exports = function oidcServiceHook(sails) {
+  let client = null;
+
+  return {
+    /**
+     * Runs when this Sails app loads/lifts.
+     */
+
+    async initialize() {
+      if (sails.config.custom.oidcIssuer) {
+        const issuer = await openidClient.Issuer.discover(sails.config.custom.oidcIssuer);
+
+        client = new issuer.Client({
+          client_id: sails.config.custom.oidcClientId,
+          client_secret: sails.config.custom.oidcClientSecret,
+          redirect_uris: [sails.config.custom.oidcRedirectUri],
+          response_types: ['code'],
+        });
+        sails.log.info('OIDC hook has been loaded successfully');
+      }
+    },
+
+    getClient() {
+      return client;
+    },
+
+    isActive() {
+      return client !== null;
+    },
+  };
+};

server/api/models/User.js

@@ -110,12 +110,13 @@ module.exports = {
   tableName: 'user_account',
 
   customToJSON() {
-    const isLockedAdmin = this.email === sails.config.custom.defaultAdminEmail;
+    const isDefaultAdmin = this.email === sails.config.custom.defaultAdminEmail;
 
     return {
       ..._.omit(this, ['password', 'isSso', 'avatar', 'passwordChangedAt']),
-      isLockedAdmin,
+      isLocked: this.isSso || isDefaultAdmin,
-      isLocked: this.isSso || isLockedAdmin,
+      isRoleLocked: (this.isSso && !sails.config.custom.oidcIgnoreRoles) || isDefaultAdmin,
+      isDeletionLocked: isDefaultAdmin,
       avatarUrl:
         this.avatar &&
         `${sails.config.custom.userAvatarsUrl}/${this.avatar.dirname}/square-100.${this.avatar.extension}`,

server/config/custom.js

@@ -35,11 +35,14 @@ module.exports.custom = {
 
   oidcIssuer: process.env.OIDC_ISSUER,
   oidcClientId: process.env.OIDC_CLIENT_ID,
-  oidcRedirectUri: process.env.OIDC_REDIRECT_URI,
+  oidcClientSecret: process.env.OIDC_CLIENT_SECRET,
   oidcScopes: process.env.OIDC_SCOPES || 'openid email profile',
-  oidcJwksUri: process.env.OIDC_JWKS_URI,
-  oidcAudience: process.env.OIDC_AUDIENCE,
   oidcAdminRoles: process.env.OIDC_ADMIN_ROLES ? process.env.OIDC_ADMIN_ROLES.split(',') : [],
   oidcRolesAttribute: process.env.OIDC_ROLES_ATTRIBUTE || 'groups',
-  oidcSkipUserInfo: process.env.OIDC_SKIP_USER_INFO === 'true',
+  oidcIgnoreRoles: process.env.OIDC_IGNORE_ROLES === 'true',
+
+  // TODO: move client base url to environment variable?
+  oidcRedirectUri: `${
+    sails.config.environment === 'production' ? process.env.BASE_URL : 'http://localhost:3000'
+  }/oidc-callback`,
 };

server/config/policies.js

@@ -25,5 +25,5 @@ module.exports.policies = {
 
   'show-config': true,
   'access-tokens/create': true,
-  'access-tokens/exchange': true,
+  'access-tokens/exchange-using-oidc': true,
 };

server/config/routes.js

@@ -12,7 +12,7 @@ module.exports.routes = {
   'GET /api/config': 'show-config',
 
   'POST /api/access-tokens': 'access-tokens/create',
-  'POST /api/access-tokens/exchange': 'access-tokens/exchange',
+  'POST /api/access-tokens/exchange-using-oidc': 'access-tokens/exchange-using-oidc',
   'DELETE /api/access-tokens/me': 'access-tokens/delete',
 
   'GET /api/users': 'users/index',

server/db/seeds/default.js

@@ -34,10 +34,6 @@ exports.seed = async (knex) => {
       createdAt: new Date().toISOString(),
     });
   } catch (error) {
-    if (Object.keys(data).length === 0) {
-      return;
-    }
-
     await knex('user_account').update(data).where('email', process.env.DEFAULT_ADMIN_EMAIL);
   }
 };

server/package-lock.json

@@ -11,7 +11,6 @@
         "dotenv-cli": "^6.0.0",
         "filenamify": "^4.3.0",
         "jsonwebtoken": "^9.0.0",
-        "jwks-rsa": "^3.0.1",
         "knex": "^2.3.0",
         "lodash": "^4.17.21",
         "moment": "^2.29.4",
@@ -200,103 +199,12 @@
       "resolved": "https://registry.npmjs.org/async/-/async-0.2.10.tgz",
       "integrity": "sha512-eAkdoKxU6/LkKDBzLpT+t6Ff5EtfSF4wx1WfJiPEEV7WNLnDaRXk0oVysiEPm262roaachGexwUv94WhSgN5TQ=="
     },
-    "node_modules/@types/body-parser": {
-      "version": "1.19.2",
-      "resolved": "https://registry.npmjs.org/@types/body-parser/-/body-parser-1.19.2.tgz",
-      "integrity": "sha512-ALYone6pm6QmwZoAgeyNksccT9Q4AWZQ6PvfwR37GT6r6FWUPguq6sUmNGSMV2Wr761oQoBxwGGa6DR5o1DC9g==",
-      "dependencies": {
-        "@types/connect": "*",
-        "@types/node": "*"
-      }
-    },
-    "node_modules/@types/connect": {
-      "version": "3.4.35",
-      "resolved": "https://registry.npmjs.org/@types/connect/-/connect-3.4.35.tgz",
-      "integrity": "sha512-cdeYyv4KWoEgpBISTxWvqYsVy444DOqehiF3fM3ne10AmJ62RSyNkUnxMJXHQWRQQX2eR94m5y1IZyDwBjV9FQ==",
-      "dependencies": {
-        "@types/node": "*"
-      }
-    },
-    "node_modules/@types/express": {
-      "version": "4.17.17",
-      "resolved": "https://registry.npmjs.org/@types/express/-/express-4.17.17.tgz",
-      "integrity": "sha512-Q4FmmuLGBG58btUnfS1c1r/NQdlp3DMfGDGig8WhfpA2YRUtEkxAjkZb0yvplJGYdF1fsQ81iMDcH24sSCNC/Q==",
-      "dependencies": {
-        "@types/body-parser": "*",
-        "@types/express-serve-static-core": "^4.17.33",
-        "@types/qs": "*",
-        "@types/serve-static": "*"
-      }
-    },
-    "node_modules/@types/express-serve-static-core": {
-      "version": "4.17.35",
-      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-4.17.35.tgz",
-      "integrity": "sha512-wALWQwrgiB2AWTT91CB62b6Yt0sNHpznUXeZEcnPU3DRdlDIz74x8Qg1UUYKSVFi+va5vKOLYRBI1bRKiLLKIg==",
-      "dependencies": {
-        "@types/node": "*",
-        "@types/qs": "*",
-        "@types/range-parser": "*",
-        "@types/send": "*"
-      }
-    },
-    "node_modules/@types/http-errors": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@types/http-errors/-/http-errors-2.0.1.tgz",
-      "integrity": "sha512-/K3ds8TRAfBvi5vfjuz8y6+GiAYBZ0x4tXv1Av6CWBWn0IlADc+ZX9pMq7oU0fNQPnBwIZl3rmeLp6SBApbxSQ=="
-    },
     "node_modules/@types/json5": {
       "version": "0.0.29",
       "resolved": "https://registry.npmjs.org/@types/json5/-/json5-0.0.29.tgz",
       "integrity": "sha512-dRLjCWHYg4oaA77cxO64oO+7JwCwnIzkZPdrrC71jQmQtlhM556pwKo5bUzqvZndkVbeFLIIi+9TC40JNF5hNQ==",
       "dev": true
     },
-    "node_modules/@types/jsonwebtoken": {
-      "version": "9.0.2",
-      "resolved": "https://registry.npmjs.org/@types/jsonwebtoken/-/jsonwebtoken-9.0.2.tgz",
-      "integrity": "sha512-drE6uz7QBKq1fYqqoFKTDRdFCPHd5TCub75BM+D+cMx7NU9hUz7SESLfC2fSCXVFMO5Yj8sOWHuGqPgjc+fz0Q==",
-      "dependencies": {
-        "@types/node": "*"
-      }
-    },
-    "node_modules/@types/mime": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@types/mime/-/mime-1.3.2.tgz",
-      "integrity": "sha512-YATxVxgRqNH6nHEIsvg6k2Boc1JHI9ZbH5iWFFv/MTkchz3b1ieGDa5T0a9RznNdI0KhVbdbWSN+KWWrQZRxTw=="
-    },
-    "node_modules/@types/node": {
-      "version": "20.4.5",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.4.5.tgz",
-      "integrity": "sha512-rt40Nk13II9JwQBdeYqmbn2Q6IVTA5uPhvSO+JVqdXw/6/4glI6oR9ezty/A9Hg5u7JH4OmYmuQ+XvjKm0Datg=="
-    },
-    "node_modules/@types/qs": {
-      "version": "6.9.7",
-      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.9.7.tgz",
-      "integrity": "sha512-FGa1F62FT09qcrueBA6qYTrJPVDzah9a+493+o2PCXsesWHIn27G98TsSMs3WPNbZIEj4+VJf6saSFpvD+3Zsw=="
-    },
-    "node_modules/@types/range-parser": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@types/range-parser/-/range-parser-1.2.4.tgz",
-      "integrity": "sha512-EEhsLsD6UsDM1yFhAvy0Cjr6VwmpMWqFBCb9w07wVugF7w9nfajxLuVmngTIpgS6svCnm6Vaw+MZhoDCKnOfsw=="
-    },
-    "node_modules/@types/send": {
-      "version": "0.17.1",
-      "resolved": "https://registry.npmjs.org/@types/send/-/send-0.17.1.tgz",
-      "integrity": "sha512-Cwo8LE/0rnvX7kIIa3QHCkcuF21c05Ayb0ZfxPiv0W8VRiZiNW/WuRupHKpqqGVGf7SUA44QSOUKaEd9lIrd/Q==",
-      "dependencies": {
-        "@types/mime": "^1",
-        "@types/node": "*"
-      }
-    },
-    "node_modules/@types/serve-static": {
-      "version": "1.15.2",
-      "resolved": "https://registry.npmjs.org/@types/serve-static/-/serve-static-1.15.2.tgz",
-      "integrity": "sha512-J2LqtvFYCzaj8pVYKw8klQXrLLk7TBZmQ4ShlcdkELFKGwGMfevMLneMMRkMgZxotOD9wg497LpC7O8PcvAmfw==",
-      "dependencies": {
-        "@types/http-errors": "*",
-        "@types/mime": "*",
-        "@types/node": "*"
-      }
-    },
     "node_modules/abbrev": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-1.1.1.tgz",
@@ -3821,22 +3729,6 @@
         "safe-buffer": "^5.0.1"
       }
     },
-    "node_modules/jwks-rsa": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/jwks-rsa/-/jwks-rsa-3.0.1.tgz",
-      "integrity": "sha512-UUOZ0CVReK1QVU3rbi9bC7N5/le8ziUj0A2ef1Q0M7OPD2KvjEYizptqIxGIo6fSLYDkqBrazILS18tYuRc8gw==",
-      "dependencies": {
-        "@types/express": "^4.17.14",
-        "@types/jsonwebtoken": "^9.0.0",
-        "debug": "^4.3.4",
-        "jose": "^4.10.4",
-        "limiter": "^1.1.5",
-        "lru-memoizer": "^2.1.4"
-      },
-      "engines": {
-        "node": ">=14"
-      }
-    },
     "node_modules/jws": {
       "version": "3.2.2",
       "resolved": "https://registry.npmjs.org/jws/-/jws-3.2.2.tgz",
@@ -3967,11 +3859,6 @@
         "node": ">= 0.10"
       }
     },
-    "node_modules/limiter": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/limiter/-/limiter-1.1.5.tgz",
-      "integrity": "sha512-FWWMIEOxz3GwUI4Ts/IvgVy6LPvoMPgjMdQ185nN6psJyBJ4yOpzqm695/h5umdLJg2vW3GR5iG11MAkR2AzJA=="
-    },
     "node_modules/localforage": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/localforage/-/localforage-1.3.0.tgz",
@@ -4000,11 +3887,6 @@
       "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
       "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg=="
     },
-    "node_modules/lodash.clonedeep": {
-      "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/lodash.clonedeep/-/lodash.clonedeep-4.5.0.tgz",
-      "integrity": "sha512-H5ZhCF25riFd9uB5UCkVKo61m3S/xZk1x4wA6yp/L3RFP6Z/eHH1ymQcGLo7J3GMPfm0V/7m1tryHuGVxpqEBQ=="
-    },
     "node_modules/lodash.issafeinteger": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/lodash.issafeinteger/-/lodash.issafeinteger-4.0.4.tgz",
@@ -4064,29 +3946,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/lru-memoizer": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/lru-memoizer/-/lru-memoizer-2.2.0.tgz",
-      "integrity": "sha512-QfOZ6jNkxCcM/BkIPnFsqDhtrazLRsghi9mBwFAzol5GCvj4EkFT899Za3+QwikCg5sRX8JstioBDwOxEyzaNw==",
-      "dependencies": {
-        "lodash.clonedeep": "^4.5.0",
-        "lru-cache": "~4.0.0"
-      }
-    },
-    "node_modules/lru-memoizer/node_modules/lru-cache": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-4.0.2.tgz",
-      "integrity": "sha512-uQw9OqphAGiZhkuPlpFGmdTU2tEuhxTourM/19qGJrxBPHAr/f8BT1a0i/lOclESnGatdJG/UCkP9kZB/Lh1iw==",
-      "dependencies": {
-        "pseudomap": "^1.0.1",
-        "yallist": "^2.0.0"
-      }
-    },
-    "node_modules/lru-memoizer/node_modules/yallist": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-2.1.2.tgz",
-      "integrity": "sha512-ncTzHV7NvsQZkYe1DW7cbDLm0YpzHmZF5r/iyP3ZnQtMiJ+pjzisCiMNI+Sj+xQF5pXhSHxSB3uDbsBTzY/c2A=="
-    },
     "node_modules/machine": {
       "version": "15.2.2",
       "resolved": "https://registry.npmjs.org/machine/-/machine-15.2.2.tgz",
@@ -8261,103 +8120,12 @@
         }
       }
     },
-    "@types/body-parser": {
-      "version": "1.19.2",
-      "resolved": "https://registry.npmjs.org/@types/body-parser/-/body-parser-1.19.2.tgz",
-      "integrity": "sha512-ALYone6pm6QmwZoAgeyNksccT9Q4AWZQ6PvfwR37GT6r6FWUPguq6sUmNGSMV2Wr761oQoBxwGGa6DR5o1DC9g==",
-      "requires": {
-        "@types/connect": "*",
-        "@types/node": "*"
-      }
-    },
-    "@types/connect": {
-      "version": "3.4.35",
-      "resolved": "https://registry.npmjs.org/@types/connect/-/connect-3.4.35.tgz",
-      "integrity": "sha512-cdeYyv4KWoEgpBISTxWvqYsVy444DOqehiF3fM3ne10AmJ62RSyNkUnxMJXHQWRQQX2eR94m5y1IZyDwBjV9FQ==",
-      "requires": {
-        "@types/node": "*"
-      }
-    },
-    "@types/express": {
-      "version": "4.17.17",
-      "resolved": "https://registry.npmjs.org/@types/express/-/express-4.17.17.tgz",
-      "integrity": "sha512-Q4FmmuLGBG58btUnfS1c1r/NQdlp3DMfGDGig8WhfpA2YRUtEkxAjkZb0yvplJGYdF1fsQ81iMDcH24sSCNC/Q==",
-      "requires": {
-        "@types/body-parser": "*",
-        "@types/express-serve-static-core": "^4.17.33",
-        "@types/qs": "*",
-        "@types/serve-static": "*"
-      }
-    },
-    "@types/express-serve-static-core": {
-      "version": "4.17.35",
-      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-4.17.35.tgz",
-      "integrity": "sha512-wALWQwrgiB2AWTT91CB62b6Yt0sNHpznUXeZEcnPU3DRdlDIz74x8Qg1UUYKSVFi+va5vKOLYRBI1bRKiLLKIg==",
-      "requires": {
-        "@types/node": "*",
-        "@types/qs": "*",
-        "@types/range-parser": "*",
-        "@types/send": "*"
-      }
-    },
-    "@types/http-errors": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@types/http-errors/-/http-errors-2.0.1.tgz",
-      "integrity": "sha512-/K3ds8TRAfBvi5vfjuz8y6+GiAYBZ0x4tXv1Av6CWBWn0IlADc+ZX9pMq7oU0fNQPnBwIZl3rmeLp6SBApbxSQ=="
-    },
     "@types/json5": {
       "version": "0.0.29",
       "resolved": "https://registry.npmjs.org/@types/json5/-/json5-0.0.29.tgz",
       "integrity": "sha512-dRLjCWHYg4oaA77cxO64oO+7JwCwnIzkZPdrrC71jQmQtlhM556pwKo5bUzqvZndkVbeFLIIi+9TC40JNF5hNQ==",
       "dev": true
     },
-    "@types/jsonwebtoken": {
-      "version": "9.0.2",
-      "resolved": "https://registry.npmjs.org/@types/jsonwebtoken/-/jsonwebtoken-9.0.2.tgz",
-      "integrity": "sha512-drE6uz7QBKq1fYqqoFKTDRdFCPHd5TCub75BM+D+cMx7NU9hUz7SESLfC2fSCXVFMO5Yj8sOWHuGqPgjc+fz0Q==",
-      "requires": {
-        "@types/node": "*"
-      }
-    },
-    "@types/mime": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@types/mime/-/mime-1.3.2.tgz",
-      "integrity": "sha512-YATxVxgRqNH6nHEIsvg6k2Boc1JHI9ZbH5iWFFv/MTkchz3b1ieGDa5T0a9RznNdI0KhVbdbWSN+KWWrQZRxTw=="
-    },
-    "@types/node": {
-      "version": "20.4.5",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.4.5.tgz",
-      "integrity": "sha512-rt40Nk13II9JwQBdeYqmbn2Q6IVTA5uPhvSO+JVqdXw/6/4glI6oR9ezty/A9Hg5u7JH4OmYmuQ+XvjKm0Datg=="
-    },
-    "@types/qs": {
-      "version": "6.9.7",
-      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.9.7.tgz",
-      "integrity": "sha512-FGa1F62FT09qcrueBA6qYTrJPVDzah9a+493+o2PCXsesWHIn27G98TsSMs3WPNbZIEj4+VJf6saSFpvD+3Zsw=="
-    },
-    "@types/range-parser": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@types/range-parser/-/range-parser-1.2.4.tgz",
-      "integrity": "sha512-EEhsLsD6UsDM1yFhAvy0Cjr6VwmpMWqFBCb9w07wVugF7w9nfajxLuVmngTIpgS6svCnm6Vaw+MZhoDCKnOfsw=="
-    },
-    "@types/send": {
-      "version": "0.17.1",
-      "resolved": "https://registry.npmjs.org/@types/send/-/send-0.17.1.tgz",
-      "integrity": "sha512-Cwo8LE/0rnvX7kIIa3QHCkcuF21c05Ayb0ZfxPiv0W8VRiZiNW/WuRupHKpqqGVGf7SUA44QSOUKaEd9lIrd/Q==",
-      "requires": {
-        "@types/mime": "^1",
-        "@types/node": "*"
-      }
-    },
-    "@types/serve-static": {
-      "version": "1.15.2",
-      "resolved": "https://registry.npmjs.org/@types/serve-static/-/serve-static-1.15.2.tgz",
-      "integrity": "sha512-J2LqtvFYCzaj8pVYKw8klQXrLLk7TBZmQ4ShlcdkELFKGwGMfevMLneMMRkMgZxotOD9wg497LpC7O8PcvAmfw==",
-      "requires": {
-        "@types/http-errors": "*",
-        "@types/mime": "*",
-        "@types/node": "*"
-      }
-    },
     "abbrev": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-1.1.1.tgz",
@@ -11092,19 +10860,6 @@
         "safe-buffer": "^5.0.1"
       }
     },
-    "jwks-rsa": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/jwks-rsa/-/jwks-rsa-3.0.1.tgz",
-      "integrity": "sha512-UUOZ0CVReK1QVU3rbi9bC7N5/le8ziUj0A2ef1Q0M7OPD2KvjEYizptqIxGIo6fSLYDkqBrazILS18tYuRc8gw==",
-      "requires": {
-        "@types/express": "^4.17.14",
-        "@types/jsonwebtoken": "^9.0.0",
-        "debug": "^4.3.4",
-        "jose": "^4.10.4",
-        "limiter": "^1.1.5",
-        "lru-memoizer": "^2.1.4"
-      }
-    },
     "jws": {
       "version": "3.2.2",
       "resolved": "https://registry.npmjs.org/jws/-/jws-3.2.2.tgz",
@@ -11195,11 +10950,6 @@
         }
       }
     },
-    "limiter": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/limiter/-/limiter-1.1.5.tgz",
-      "integrity": "sha512-FWWMIEOxz3GwUI4Ts/IvgVy6LPvoMPgjMdQ185nN6psJyBJ4yOpzqm695/h5umdLJg2vW3GR5iG11MAkR2AzJA=="
-    },
     "localforage": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/localforage/-/localforage-1.3.0.tgz",
@@ -11222,11 +10972,6 @@
       "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
       "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg=="
     },
-    "lodash.clonedeep": {
-      "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/lodash.clonedeep/-/lodash.clonedeep-4.5.0.tgz",
-      "integrity": "sha512-H5ZhCF25riFd9uB5UCkVKo61m3S/xZk1x4wA6yp/L3RFP6Z/eHH1ymQcGLo7J3GMPfm0V/7m1tryHuGVxpqEBQ=="
-    },
     "lodash.issafeinteger": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/lodash.issafeinteger/-/lodash.issafeinteger-4.0.4.tgz",
@@ -11277,31 +11022,6 @@
         "yallist": "^4.0.0"
       }
     },
-    "lru-memoizer": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/lru-memoizer/-/lru-memoizer-2.2.0.tgz",
-      "integrity": "sha512-QfOZ6jNkxCcM/BkIPnFsqDhtrazLRsghi9mBwFAzol5GCvj4EkFT899Za3+QwikCg5sRX8JstioBDwOxEyzaNw==",
-      "requires": {
-        "lodash.clonedeep": "^4.5.0",
-        "lru-cache": "~4.0.0"
-      },
-      "dependencies": {
-        "lru-cache": {
-          "version": "4.0.2",
-          "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-4.0.2.tgz",
-          "integrity": "sha512-uQw9OqphAGiZhkuPlpFGmdTU2tEuhxTourM/19qGJrxBPHAr/f8BT1a0i/lOclESnGatdJG/UCkP9kZB/Lh1iw==",
-          "requires": {
-            "pseudomap": "^1.0.1",
-            "yallist": "^2.0.0"
-          }
-        },
-        "yallist": {
-          "version": "2.1.2",
-          "resolved": "https://registry.npmjs.org/yallist/-/yallist-2.1.2.tgz",
-          "integrity": "sha512-ncTzHV7NvsQZkYe1DW7cbDLm0YpzHmZF5r/iyP3ZnQtMiJ+pjzisCiMNI+Sj+xQF5pXhSHxSB3uDbsBTzY/c2A=="
-        }
-      }
-    },
     "machine": {
       "version": "15.2.2",
       "resolved": "https://registry.npmjs.org/machine/-/machine-15.2.2.tgz",

server/package.json

@@ -32,7 +32,6 @@
     "dotenv-cli": "^6.0.0",
     "filenamify": "^4.3.0",
     "jsonwebtoken": "^9.0.0",
-    "jwks-rsa": "^3.0.1",
     "knex": "^2.3.0",
     "lodash": "^4.17.21",
     "moment": "^2.29.4",