Merge pull request #578 from EdouardVanbelle/feat/user-regisration-with-allow-list
feat(registration): add a domain allow list
This commit is contained in:
Dionisio Pozo
@@ -56,7 +56,8 @@ The frontend's "Username or email" field submits whatever the user typed; the JS
|
||||
```
|
||||
1. has_oidc() → reject "oidc_user" (unconditional)
|
||||
2. has_password() → reject "has_password" by default
|
||||
allow when OXICLOUD_MAGIC_LINK_OPEN_TO_PASSWORD_USERS=true
|
||||
allow when OXICLOUD_AUTH_POLICIES contains
|
||||
`permit_magic_link_for_password_users`
|
||||
3. neither → allow
|
||||
```
|
||||
|
||||
@@ -133,7 +134,7 @@ In all four cases the real reason is recorded in the `audit` channel — operato
|
||||
|
||||
| Concern | Current treatment |
|
||||
|---|---|
|
||||
| **Mailbox compromise = account compromise (lenient mode)** | When `OXICLOUD_MAGIC_LINK_OPEN_TO_PASSWORD_USERS=true`, a user's mailbox is as strong as their password — flip the password by mail. Operator opt-in only; off by default. Aligns with modern SaaS norms (Slack, Notion, Substack). |
|
||||
| **Mailbox compromise = account compromise (lenient mode)** | When `OXICLOUD_AUTH_POLICIES` contains `permit_magic_link_for_password_users`, a user's mailbox is as strong as their password — flip the password by mail. Operator opt-in only; off by default. Aligns with modern SaaS norms (Slack, Notion, Substack). |
|
||||
| **Mailbox compromise = account compromise (strict mode)** | Only applies to magic-link-eligible users (no other credential). Their mailbox **is** their credential by design. Password-secured accounts are unaffected. |
|
||||
| **No native MFA** | Today OIDC delegation is the only path to MFA — the IdP (Keycloak, Authentik, Okta) enforces TOTP/WebAuthn/etc., OxiCloud sees only the resulting ID token. This is why OIDC users are unconditionally excluded from magic-link. Native TOTP / WebAuthn enrolment is a future feature. |
|
||||
| **Magic-link as bearer token (login-via-email)** | Closed (PR 22). Login tokens carry a per-request challenge mirrored into the originating browser's `oxicloud_magic_request` cookie. Redemption from a different browser shows a confirmation page rather than auto-signing. Asymmetric TTL: login tokens expire in 10 min, invitations in 24 h. |
|
||||
|
||||
+146
-25
@@ -1,16 +1,18 @@
|
||||
# Authentication
|
||||
|
||||
OxiCloud ships with JWT-based authentication and Argon2id password hashing for local accounts. It also exposes status and OIDC-related auth endpoints under the same `/api/auth` namespace.
|
||||
OxiCloud ships with JWT-based authentication and Argon2id password hashing for local accounts. It also exposes status and OIDC-related auth endpoints under the same `/api/auth` namespace, plus a magic-link (email link) sign-in flow for accounts that don't use a password.
|
||||
|
||||
## Core Endpoints
|
||||
|
||||
| Method | Endpoint | Description |
|
||||
| --- | --- | --- |
|
||||
| `POST` | `/api/auth/register` | Create a local user account |
|
||||
| `POST` | `/api/auth/login` | Exchange username and password for access and refresh tokens |
|
||||
| `POST` | `/api/auth/register` | Create a local user account. `email` is required; `username` and `password` are both optional. |
|
||||
| `POST` | `/api/auth/login` | Exchange an identifier (username **or** email — dispatches on `@`) and password for access and refresh tokens |
|
||||
| `POST` | `/api/auth/magic-link/send` | Send a one-click sign-in link to the account's email. Accepts either a username or an email in the request body |
|
||||
| `GET` | `/magic/v1/{token}` | Redeem a magic-link — creates a session and stamps `email_verified_at` on the account |
|
||||
| `POST` | `/api/auth/refresh` | Refresh the session tokens |
|
||||
| `GET` | `/api/auth/me` | Return the current authenticated user |
|
||||
| `PUT` | `/api/auth/change-password` | Change the current user's password |
|
||||
| `PUT` | `/api/auth/change-password` | Change the current user's password (requires the current password) |
|
||||
| `POST` | `/api/auth/logout` | Invalidate the current session |
|
||||
| `GET` | `/api/auth/status` | Return auth system state, including OIDC availability |
|
||||
|
||||
@@ -18,55 +20,174 @@ OxiCloud ships with JWT-based authentication and Argon2id password hashing for l
|
||||
|
||||
| Method | Endpoint | Description |
|
||||
| --- | --- | --- |
|
||||
| `GET` | `/api/auth/oidc/providers` | List configured OIDC provider info |
|
||||
| `GET` | `/api/auth/oidc/providers` | Report which self-service auth methods this deployment offers (see fields below) |
|
||||
| `GET` | `/api/auth/oidc/authorize` | Build the authorization redirect URL |
|
||||
| `GET` | `/api/auth/oidc/callback` | Handle provider redirect callback |
|
||||
| `POST` | `/api/auth/oidc/exchange` | Exchange the auth code for OxiCloud session tokens |
|
||||
|
||||
`GET /api/auth/oidc/providers` fields:
|
||||
|
||||
| Field | Meaning |
|
||||
| --- | --- |
|
||||
| `enabled` | OIDC is configured on this deployment |
|
||||
| `provider_name` | Display name for the IdP (shown on the SSO button) |
|
||||
| `authorize_endpoint` | Where the SPA should start the OIDC round-trip |
|
||||
| `password_login_enabled` | `POST /api/auth/login` will accept credentials |
|
||||
| `magic_link_login_enabled` | `POST /api/auth/magic-link/send` will mint tokens (SMTP wired + allowlist + no OIDC — see rules below) |
|
||||
| `require_verified_email` | `OXICLOUD_REQUIRE_VERIFIED_EMAIL` is set — the SPA uses this hint to explain `EmailNotVerified` responses |
|
||||
|
||||
## Configuring which methods are offered
|
||||
|
||||
Two environment variables control the self-service surface (OIDC is orthogonal — see `OXICLOUD_OIDC_ENABLED`).
|
||||
|
||||
### `OXICLOUD_AUTH_METHODS`
|
||||
|
||||
Comma-separated allowlist of `password` and/or `magic_link`. Default `password,magic_link`.
|
||||
|
||||
| Configuration | Effect |
|
||||
| --- | --- |
|
||||
| Unset or `password,magic_link` | Both methods allowed (default) |
|
||||
| `password` | Password login OK. Magic-link send / redeem → 403 `MagicLinkLoginDisabled` |
|
||||
| `magic_link` | Password login → 403 `PasswordLoginDisabled`. Password-based `register` → 403 `PasswordRegistrationDisabled`. Email-only signup still works |
|
||||
|
||||
**Startup gate.** If `magic_link` is the only method allowed AND no SMTP transport is configured (`OXICLOUD_SMTP_HOST` empty), the server refuses to start with a fatal message. A magic-link-only policy without a working mailer silently locks every user out.
|
||||
|
||||
**OIDC master rule.** When `OXICLOUD_OIDC_ENABLED=true`, magic-link login is **hard-disabled** regardless of this list. The IdP is the identity boundary; magic-link would bypass any 2FA / step-up policy the IdP enforces. The startup gate above does **not** trigger in this case — OIDC provides the login path.
|
||||
|
||||
Legacy alias: `OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN=true` still removes `password` from the effective allowlist.
|
||||
|
||||
### `OXICLOUD_REQUIRE_VERIFIED_EMAIL`
|
||||
|
||||
Default `false`. When `true`, `POST /api/auth/login` returns 403 `EmailNotVerified` for any account whose `email_verified_at IS NULL`.
|
||||
|
||||
**Order matters:** the verified-email check runs **after** password validation. An attacker without the password sees only the generic `Invalid credentials` shape — they can't probe whether an account's email is verified.
|
||||
|
||||
**Verification piggyback.** When the branch fires (password OK, email unverified), the server auto-sends a verification magic-link to the account's registered address using the same login request. The user sees `EmailNotVerified` in the response and a "check your inbox" hint on the login page; resubmitting the form re-sends the link. This is why there is no separate "resend verification" endpoint — offering an unauthenticated one would leak `has_password` state.
|
||||
|
||||
**Admin exemption.** Admin accounts (role `admin`) are exempt from this gate at login, regardless of `email_verified_at`. Rationale: an operator who flips the flag on an existing deployment must not lock the admin(s) out of their own instance. Fresh admin accounts created via `POST /api/setup` or `POST /api/admin/users` are stamped verified at creation; the exemption covers pre-existing accounts that predate the flag.
|
||||
|
||||
**Auto-verified on creation:** OIDC-JIT users, admin-created users (`POST /api/admin/users`), and the first-run setup admin (`POST /api/setup`). Verification is only ever missing on regular users who signed up before the flag was turned on.
|
||||
|
||||
## Login identifier dispatch
|
||||
|
||||
`POST /api/auth/login` accepts either a username (no `@`) or an email (contains `@`) in the `username` field. The two namespaces are provably disjoint — usernames forbid `@` — so the dispatch is unambiguous and both paths return the same session shape.
|
||||
|
||||
`POST /api/auth/magic-link/send` mirrors this convention. The `email` field can be either an email or a username; the server resolves username → registered email before rate-limiting so both shapes share one budget (no bypass).
|
||||
|
||||
## Registration flow
|
||||
|
||||
Since PR 18, both `username` and `password` are optional on `POST /api/auth/register`. The only required field is `email`.
|
||||
|
||||
| Combination | Result |
|
||||
| --- | --- |
|
||||
| `email + password` | Classic signup — account gets a password hash; user can log in immediately |
|
||||
| `email + password + username` | Same, plus the username is claimed at creation |
|
||||
| `email` only | Email-only signup — no password stored; server sends a welcome magic-link. Clicking it creates a session and stamps `email_verified_at`. The user can later claim a handle via `PATCH /api/auth/me/profile` and set a password via `PUT /api/auth/change-password` |
|
||||
|
||||
The response body is uniform across success, email collision, and username collision — the SPA does not learn whether an address is already taken. The real reason lands in the audit log.
|
||||
|
||||
### `OXICLOUD_DISABLE_REGISTRATION`
|
||||
|
||||
Turns the endpoint off entirely (returns 403 `RegistrationDisabled`).
|
||||
|
||||
### `OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS`
|
||||
|
||||
Comma-separated allowlist. Rejected registrations return 403 `RegistrationDomainNotAllowed`. Distinct from `OXICLOUD_EXTERNAL_EMAIL_DOMAINS`, which gates external-user **invitations**; self-registration and invitations have independent policies.
|
||||
|
||||
## Magic-link eligibility
|
||||
|
||||
`POST /api/auth/magic-link/send` looks up the resolved email → user, then applies the eligibility ladder:
|
||||
|
||||
1. **OIDC-linked user** → refused with `reason="oidc_user"`. Unconditional; the IdP is the security boundary and may enforce MFA that magic-link would sidestep.
|
||||
2. **Has a password configured** → refused with `reason="has_password"` (default). Set `OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users` to allow — this weakens the password to mailbox-strength for affected accounts; opt-in only.
|
||||
3. **No credential** (typical external user or fresh email-only signup) → allow.
|
||||
|
||||
The verification-piggyback flow above deliberately **bypasses the `has_password` gate** — that path is only reachable after the user has already proven identity via password on the same login request, so mailbox-only trust is not being extended beyond what the password already established.
|
||||
|
||||
## Auth policy vector
|
||||
|
||||
`OXICLOUD_AUTH_POLICIES` is a comma-separated list of additive policy switches. Distinct from `OXICLOUD_AUTH_METHODS` (which enables/disables a method wholesale), each entry here grants a specific exception or restriction to default auth behaviour. Vector shape so future policies can be added by appending a token instead of introducing a new env var per behaviour. Variant names carry their own polarity (`Permit...`, future `Require...` / `Deny...`).
|
||||
|
||||
| Token | Effect |
|
||||
| --- | --- |
|
||||
| `permit_magic_link_for_password_users` | Allow magic-link login for accounts that also have a password. OIDC-linked users are still refused. |
|
||||
|
||||
Unknown tokens are logged-and-skipped at startup so a typo doesn't silently zero the vector.
|
||||
|
||||
## Example Flows
|
||||
|
||||
### Register
|
||||
### Register — classic
|
||||
|
||||
```json
|
||||
{
|
||||
"username": "testuser",
|
||||
"email": "test@example.com",
|
||||
"password": "SecurePassword123"
|
||||
}
|
||||
{ "username": "testuser", "email": "test@example.com", "password": "SecurePassword123" }
|
||||
```
|
||||
|
||||
### Register — email-only
|
||||
|
||||
```json
|
||||
{ "email": "test@example.com" }
|
||||
```
|
||||
|
||||
### Login
|
||||
|
||||
```json
|
||||
{
|
||||
"username": "testuser",
|
||||
"password": "SecurePassword123"
|
||||
}
|
||||
{ "username": "testuser", "password": "SecurePassword123" }
|
||||
```
|
||||
|
||||
Or equivalently:
|
||||
|
||||
```json
|
||||
{ "username": "test@example.com", "password": "SecurePassword123" }
|
||||
```
|
||||
|
||||
Typical successful login response:
|
||||
|
||||
```json
|
||||
{
|
||||
"accessToken": "...",
|
||||
"refreshToken": "...",
|
||||
"expiresIn": 3600
|
||||
}
|
||||
{ "accessToken": "...", "refreshToken": "...", "expiresIn": 3600 }
|
||||
```
|
||||
|
||||
### Send a sign-in link (magic-link)
|
||||
|
||||
```json
|
||||
{ "email": "testuser" }
|
||||
```
|
||||
|
||||
Uniform response regardless of whether the account exists / is eligible:
|
||||
|
||||
```json
|
||||
{ "message": "If an account exists for that email, a sign-in link will be sent." }
|
||||
```
|
||||
|
||||
### Current User
|
||||
|
||||
`GET /api/auth/me` returns the authenticated user's identity, role, and storage information.
|
||||
`GET /api/auth/me` returns the authenticated user's identity, role, `email_verified_at`, and storage information.
|
||||
|
||||
## Distinguished error codes
|
||||
|
||||
The `error_type` field on 4xx responses lets frontends render specific UX. Codes surfaced by this subsystem:
|
||||
|
||||
| `error_type` | HTTP | Meaning |
|
||||
| --- | --- | --- |
|
||||
| `PasswordLoginDisabled` | 403 | `OXICLOUD_AUTH_METHODS` doesn't include `password` |
|
||||
| `PasswordRegistrationDisabled` | 403 | Same, on `register` with a password field |
|
||||
| `MagicLinkLoginDisabled` | 403 | `OXICLOUD_AUTH_METHODS` doesn't include `magic_link`, OIDC is enabled, or email-only signup is attempted on a password-only deployment |
|
||||
| `EmailNotVerified` | 403 | Password validated, but `email_verified_at IS NULL` and `OXICLOUD_REQUIRE_VERIFIED_EMAIL=true`. Server has already sent a verification link |
|
||||
| `RegistrationDisabled` | 403 | Global registration off |
|
||||
| `RegistrationDomainNotAllowed` | 403 | Email domain outside `OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS` |
|
||||
| `AccountLocked` | 429 | Too many failed login attempts for (account, IP) — see rate-limit config |
|
||||
|
||||
## Security Model
|
||||
|
||||
- local passwords are hashed with Argon2id
|
||||
- access control is role-based (`admin` and `user`)
|
||||
- refresh tokens support session renewal without forcing frequent re-login
|
||||
- Local passwords hashed with Argon2id
|
||||
- Access control is role-based (`admin` and `user`)
|
||||
- Refresh tokens support session renewal without forcing frequent re-login
|
||||
- Login endpoint uses anti-enumeration response shapes — bad-username and bad-password return the same 403
|
||||
- Magic-link `send` returns a uniform 200 whether the account exists or not; the truth lands in the `audit` log target
|
||||
- OIDC can coexist with local auth or disable password login entirely
|
||||
- OIDC-enabled deployments have magic-link login hard-disabled to prevent IdP-MFA bypass
|
||||
|
||||
## Related Pages
|
||||
|
||||
- [OIDC / SSO](/config/oidc)
|
||||
- [Admin Settings](/config/admin-settings)
|
||||
- [Environment Variables](/config/env)
|
||||
- [Environment Variables](/config/env)
|
||||
|
||||
@@ -44,6 +44,10 @@ Most runtime variables use the `OXICLOUD_` prefix. A few build-time or allocator
|
||||
| `OXICLOUD_HASH_TIME_COST` | `3` | Argon2id iteration count |
|
||||
| `OXICLOUD_HASH_PARALLELISM` | `2` | Argon2id parallelism lanes |
|
||||
| `OXICLOUD_DISABLE_REGISTRATION` | false | Disable registration of new user accounts |
|
||||
| `OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS` | — | Comma-separated allowlist of email domains accepted on `POST /api/auth/register` (case-insensitive, exact match on the post-`@` part). Empty = any domain is allowed. **Distinct from `OXICLOUD_EXTERNAL_EMAIL_DOMAINS`**: this one gates SELF-registration (public sign-up), the external list gates INVITATIONS (grants + magic-link to third parties). An operator can lock sign-up to their company domain while leaving invitations open. Subdomains must be listed explicitly. Rejected registrations return 403 `RegistrationDomainNotAllowed` and emit an `audit` line. Example: `mycompany.com,mycompany-eu.com`. |
|
||||
| `OXICLOUD_AUTH_METHODS` | `password,magic_link` | Comma-separated allowlist of self-service auth methods (`password`, `magic_link`). OIDC is orthogonal (see `OXICLOUD_OIDC_ENABLED`). Removing `password` disables `POST /api/auth/login` (returns 403 `PasswordLoginDisabled`) and password-based `register` (returns 403 `PasswordRegistrationDisabled`). Removing `magic_link` disables `POST /api/auth/magic-link/send` (returns 403 `MagicLinkLoginDisabled`) and the redemption path for login-purpose tokens. **Startup gate**: if `magic_link` is the only method allowed AND no SMTP transport is configured (`OXICLOUD_SMTP_HOST` empty), the server refuses to start. **OIDC master rule**: when `OXICLOUD_OIDC_ENABLED=true`, magic-link login is hard-disabled regardless of this list (would otherwise bypass IdP-enforced MFA / step-up). Legacy alias: `OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN=true` still removes `password` from the list. |
|
||||
| `OXICLOUD_AUTH_POLICIES` | — | Comma-separated additive policy switches. Each token grants an exception or restriction to the default auth behaviour; empty (unset) = pure defaults. Recognised tokens: `permit_magic_link_for_password_users` (allow magic-link login for accounts that also have a password — off by default because magic-link would weaken the password to mailbox-strength; OIDC-linked users are still refused regardless). |
|
||||
| `OXICLOUD_REQUIRE_VERIFIED_EMAIL` | `false` | When `true`, `POST /api/auth/login` returns 403 `EmailNotVerified` for any account whose `email_verified_at` is NULL. Users can prove control by requesting a magic-link (whose redemption stamps `email_verified_at`), so this composes with `magic_link` in `OXICLOUD_AUTH_METHODS` to give users a self-service verification path. Admin-created (`POST /api/admin/users`) and setup-admin (`POST /api/setup`) users are auto-verified. OIDC-JIT users are also stamped verified at creation. |
|
||||
|
||||
### Rate Limiting & Account Lockout
|
||||
|
||||
|
||||
+95
-13
@@ -597,6 +597,81 @@ OXICLOUD_WOPI_ENABLED=false
|
||||
# Example (only addresses on these two domains can be invited):
|
||||
#OXICLOUD_EXTERNAL_EMAIL_DOMAINS=partner-a.com,partner-b.io
|
||||
|
||||
# Allowlist of email domains accepted on the public POST /api/auth/register
|
||||
# endpoint. Comma-separated, case-insensitive, exact-match on the post-`@`
|
||||
# part of the address. Empty (the default) = any domain is allowed.
|
||||
#
|
||||
# DISTINCT from OXICLOUD_EXTERNAL_EMAIL_DOMAINS above: this one gates
|
||||
# SELF-registration (a stranger signing up), while the external list
|
||||
# gates INVITATIONS (an admin/user sharing to an outside address).
|
||||
# An operator can, for example, keep public sign-up locked to their
|
||||
# own company domain while allowing invitations to any customer:
|
||||
# OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS=mycompany.com
|
||||
# OXICLOUD_EXTERNAL_EMAIL_DOMAINS= (empty)
|
||||
#
|
||||
# Wildcards / subdomain semantics are intentionally NOT supported:
|
||||
# `mycompany.com` does not match `eng.mycompany.com`. List every subdomain
|
||||
# explicitly when needed.
|
||||
#
|
||||
# Rejected registrations return HTTP 403 with error code
|
||||
# `RegistrationDomainNotAllowed` and log an `audit` line with
|
||||
# reason=domain_not_allowed for operator visibility.
|
||||
#
|
||||
# Example (only staff at these two domains can self-register):
|
||||
#OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS=mycompany.com,mycompany-eu.com
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# OXICLOUD_AUTH_METHODS — self-service authentication method allowlist.
|
||||
# ---------------------------------------------------------------------------
|
||||
# Comma-separated list of `password` and/or `magic_link`. Controls which
|
||||
# self-service authentication methods this deployment offers on the login
|
||||
# page and accepts at the corresponding endpoints. OIDC is orthogonal —
|
||||
# use `OXICLOUD_OIDC_ENABLED` for that.
|
||||
#
|
||||
# Semantics per configuration:
|
||||
# * Empty (unset) or `password,magic_link` — both methods allowed
|
||||
# (default). Matches pre-flag behaviour.
|
||||
# * `password` — `POST /api/auth/login` OK,
|
||||
# magic-link send / redeem
|
||||
# return 403 `MagicLinkLoginDisabled`.
|
||||
# * `magic_link` — `POST /api/auth/login`
|
||||
# returns 403 `PasswordLoginDisabled`;
|
||||
# password-based `register`
|
||||
# returns 403 `PasswordRegistrationDisabled`.
|
||||
#
|
||||
# SECURITY — startup gate. When `magic_link` is the ONLY method allowed
|
||||
# but no SMTP transport is configured, the server refuses to start with a
|
||||
# fatal message. A magic-link-only policy without a mail sender silently
|
||||
# locks every user out of the deployment.
|
||||
#
|
||||
# SECURITY — OIDC master rule. When `OXICLOUD_OIDC_ENABLED=true`, magic-
|
||||
# link login is HARD-disabled regardless of what this list says. OIDC is
|
||||
# the master identity provider; magic-link would sidestep any 2FA / step-
|
||||
# up the IdP enforces. The startup gate above does NOT trigger in this
|
||||
# case (OIDC provides a login path).
|
||||
#
|
||||
# Legacy alias: `OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN=true` still removes
|
||||
# `password` from this list. New deployments should prefer this env var.
|
||||
#
|
||||
# Default: password,magic_link
|
||||
#OXICLOUD_AUTH_METHODS=password,magic_link
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# OXICLOUD_REQUIRE_VERIFIED_EMAIL — gate login on email verification.
|
||||
# ---------------------------------------------------------------------------
|
||||
# When `true`, `POST /api/auth/login` returns 403 `EmailNotVerified` for
|
||||
# any account whose `email_verified_at` is NULL. Users can prove control
|
||||
# by requesting a magic-link (whose redemption stamps
|
||||
# `email_verified_at`) — so this composes naturally with `magic_link` in
|
||||
# the allowlist above to give users a self-service verification path.
|
||||
#
|
||||
# Admin-created (`POST /api/admin/users`) and first-run setup-admin
|
||||
# (`POST /api/setup`) users are auto-verified — admin fiat counts as
|
||||
# verification. OIDC-JIT users are also stamped verified at creation.
|
||||
#
|
||||
# Default: false
|
||||
#OXICLOUD_REQUIRE_VERIFIED_EMAIL=false
|
||||
|
||||
# Per-sharer rate limit on email-type grants from POST /api/grants. Keyed on
|
||||
# the authenticated caller's user_id. Hitting the cap returns 429 with
|
||||
# Retry-After. Default 50/hour — generous for legitimate admin invites,
|
||||
@@ -617,19 +692,26 @@ OXICLOUD_WOPI_ENABLED=false
|
||||
# for client IP resolution. Default 200/hour.
|
||||
#OXICLOUD_MAGIC_LINK_SEND_PER_IP_PER_HOUR=200
|
||||
|
||||
# Policy switch: should magic-link sign-in be offered to users who already
|
||||
# have a password configured?
|
||||
# false (default, strict) — users with a password are audit-logged
|
||||
# `has_password` and receive no mail. Their password is the only
|
||||
# authentication path; magic-link would weaken it to "mailbox
|
||||
# compromise = account compromise".
|
||||
# true (lenient) — users with a password can also request a
|
||||
# magic-link as a sign-in path. Aligns with modern SaaS UX
|
||||
# (Slack, Notion, etc.). Operators who already treat email as the
|
||||
# canonical password-reset channel pick this.
|
||||
# OIDC-linked users are ALWAYS rejected regardless of this flag — the
|
||||
# IdP is the security boundary and may enforce MFA we shouldn't bypass.
|
||||
#OXICLOUD_MAGIC_LINK_OPEN_TO_PASSWORD_USERS=false
|
||||
# ---------------------------------------------------------------------------
|
||||
# OXICLOUD_AUTH_POLICIES — additive auth-policy switches (comma-separated).
|
||||
# ---------------------------------------------------------------------------
|
||||
# Each recognised token grants an exception or restriction to the default
|
||||
# auth behaviour. Empty (unset) = pure defaults. Vector shape so future
|
||||
# policies can be added without new env vars.
|
||||
#
|
||||
# Recognised tokens:
|
||||
#
|
||||
# permit_magic_link_for_password_users
|
||||
# Allow magic-link sign-in for accounts that ALSO have a password.
|
||||
# Off by default — magic-link would otherwise weaken the password to
|
||||
# mailbox-strength. Aligns with modern SaaS UX (Slack, Notion, etc.)
|
||||
# when set. OIDC-linked users are ALWAYS rejected regardless of this
|
||||
# policy — the IdP is the security boundary and may enforce MFA we
|
||||
# shouldn't bypass.
|
||||
#
|
||||
# Example:
|
||||
#OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users
|
||||
|
||||
|
||||
# Operator-level kill switch for share-notification emails to internal
|
||||
# users (the "Alice shared 'Project Alpha' with you" mail that fires when
|
||||
|
||||
@@ -142,12 +142,26 @@ export async function apiJson<T>(input: RequestInfo | URL, init?: RequestInit):
|
||||
}
|
||||
|
||||
export class ApiError extends Error {
|
||||
/**
|
||||
* `error_type` field from the backend's `ErrorResponse` body, when
|
||||
* present. Callers switch on this to render specific UX for
|
||||
* distinguished failures (e.g. `EmailNotVerified` → "resend
|
||||
* verification link" prompt). Falls back to `undefined` when the
|
||||
* response body isn't parseable or the endpoint doesn't emit one.
|
||||
*/
|
||||
readonly errorType?: string;
|
||||
|
||||
constructor(
|
||||
readonly status: number,
|
||||
readonly statusText: string,
|
||||
readonly resource: RequestInfo | URL
|
||||
readonly resource: RequestInfo | URL,
|
||||
errorType?: string,
|
||||
serverMessage?: string
|
||||
) {
|
||||
super(`API ${status} ${statusText} for ${urlString(resource as RequestInfo | URL)}`);
|
||||
super(
|
||||
serverMessage ?? `API ${status} ${statusText} for ${urlString(resource as RequestInfo | URL)}`
|
||||
);
|
||||
this.name = 'ApiError';
|
||||
this.errorType = errorType;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -22,7 +22,7 @@ it('exercises the auth endpoints (success paths)', async () => {
|
||||
await auth.getAuthStatus().catch(() => {});
|
||||
await auth.setupAdmin('e@x.test', 'p').catch(() => {});
|
||||
await auth.exchangeOidcCode('code').catch(() => {});
|
||||
await auth.register('u', 'e@x.test', 'p').catch(() => {});
|
||||
await auth.register('e@x.test', 'p', 'u').catch(() => {});
|
||||
await auth.sendMagicLink('e@x.test').catch(() => {});
|
||||
await auth.logout().catch(() => {});
|
||||
const fc = (globalThis.fetch as unknown as ReturnType<typeof vi.fn>).mock.calls.length;
|
||||
|
||||
@@ -3,10 +3,32 @@
|
||||
* primitives here intentionally bypass it (see client.ts) so a 401 surfaces as
|
||||
* a genuine failure to the caller.
|
||||
*/
|
||||
import { apiFetch } from '$lib/api/client';
|
||||
import { ApiError, apiFetch } from '$lib/api/client';
|
||||
import { getCsrfHeaders } from '$lib/api/csrf';
|
||||
import type { AuthResponse, User } from '$lib/api/types';
|
||||
|
||||
/**
|
||||
* Best-effort parse of the backend `ErrorResponse` shape
|
||||
* (`{ status, error, message, error_type }`). Returns whatever it could
|
||||
* extract; never throws — a malformed body just yields undefineds.
|
||||
*/
|
||||
async function parseErrorBody(res: Response): Promise<{ errorType?: string; message?: string }> {
|
||||
try {
|
||||
const body = (await res.clone().json()) as {
|
||||
error_type?: unknown;
|
||||
message?: unknown;
|
||||
error?: unknown;
|
||||
};
|
||||
const errorType = typeof body.error_type === 'string' ? body.error_type : undefined;
|
||||
const rawMessage =
|
||||
(typeof body.message === 'string' ? body.message : undefined) ??
|
||||
(typeof body.error === 'string' ? body.error : undefined);
|
||||
return { errorType, message: rawMessage };
|
||||
} catch {
|
||||
return {};
|
||||
}
|
||||
}
|
||||
|
||||
const JSON_HEADERS = { 'Content-Type': 'application/json' };
|
||||
|
||||
/**
|
||||
@@ -48,7 +70,13 @@ export async function login(emailOrUsername: string, password: string): Promise<
|
||||
headers: { ...JSON_HEADERS, ...getCsrfHeaders() },
|
||||
body: JSON.stringify({ username: emailOrUsername, password })
|
||||
});
|
||||
if (!res.ok) throw new Error(`login failed: ${res.status}`);
|
||||
if (!res.ok) {
|
||||
// Surface the backend `error_type` so the login page can offer
|
||||
// specific UX: `EmailNotVerified` → "resend verification link",
|
||||
// `PasswordLoginDisabled` → nudge toward magic-link / SSO, etc.
|
||||
const { errorType, message } = await parseErrorBody(res);
|
||||
throw new ApiError(res.status, res.statusText, '/api/auth/login', errorType, message);
|
||||
}
|
||||
return (await res.json()) as AuthResponse;
|
||||
}
|
||||
|
||||
@@ -56,6 +84,20 @@ export interface OidcProviders {
|
||||
enabled: boolean;
|
||||
provider_name?: string;
|
||||
password_login_enabled?: boolean;
|
||||
/**
|
||||
* True when the server accepts magic-link login requests. The backend
|
||||
* composes three factors: SMTP wired, `OXICLOUD_AUTH_METHODS` allowlist
|
||||
* includes `magic_link`, and OIDC is NOT enabled at the deployment
|
||||
* (OIDC-enabled deployments must not offer magic-link — it would bypass
|
||||
* any 2FA / step-up the IdP enforces).
|
||||
*/
|
||||
magic_link_login_enabled?: boolean;
|
||||
/**
|
||||
* True when `OXICLOUD_REQUIRE_VERIFIED_EMAIL` is set. The login page
|
||||
* uses this to explain the `EmailNotVerified` login response and
|
||||
* surface a "resend verification link" affordance.
|
||||
*/
|
||||
require_verified_email?: boolean;
|
||||
authorize_endpoint?: string;
|
||||
}
|
||||
|
||||
@@ -135,16 +177,21 @@ export async function exchangeOidcCode(code: string): Promise<User | null> {
|
||||
}
|
||||
|
||||
/**
|
||||
* Register a new user. Raw `fetch` (NOT apiFetch) so a 401/validation failure
|
||||
* surfaces to the caller instead of tripping the global refresh-and-redirect
|
||||
* interceptor — mirrors the login primitive.
|
||||
* Register a new user. Since PR 18 both `username` and `password` are optional
|
||||
* on the backend: an email-only signup is valid and mints a welcome magic-link.
|
||||
* Raw `fetch` (NOT apiFetch) so a 401/validation failure surfaces to the caller
|
||||
* instead of tripping the global refresh-and-redirect interceptor — mirrors
|
||||
* the login primitive.
|
||||
*/
|
||||
export async function register(username: string, email: string, password: string): Promise<void> {
|
||||
export async function register(email: string, password?: string, username?: string): Promise<void> {
|
||||
const body: Record<string, unknown> = { email, role: 'user' };
|
||||
if (password) body.password = password;
|
||||
if (username) body.username = username;
|
||||
const res = await fetch('/api/auth/register', {
|
||||
method: 'POST',
|
||||
credentials: 'same-origin',
|
||||
headers: { ...JSON_HEADERS, ...getCsrfHeaders() },
|
||||
body: JSON.stringify({ username, email, password, role: 'user' })
|
||||
body: JSON.stringify(body)
|
||||
});
|
||||
if (!res.ok) {
|
||||
const e = (await res.json().catch(() => ({}))) as { error?: string; message?: string };
|
||||
|
||||
@@ -307,10 +307,15 @@
|
||||
}
|
||||
|
||||
.auth-toggle-link {
|
||||
background: transparent;
|
||||
border: 0;
|
||||
padding: 0;
|
||||
color: var(--color-accent-text);
|
||||
cursor: pointer;
|
||||
text-decoration: none;
|
||||
font-weight: var(--weight-medium);
|
||||
font-family: inherit;
|
||||
font-size: inherit;
|
||||
}
|
||||
|
||||
.auth-toggle-link:hover {
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -41,7 +41,15 @@ beforeEach(() => {
|
||||
pageState.url = new URL('http://localhost/login');
|
||||
session.user = null;
|
||||
m(auth.fetchMe).mockResolvedValue(null);
|
||||
m(auth.getOidcProviders).mockResolvedValue({ providers: [] });
|
||||
// Default provider info: both password + magic-link enabled, OIDC off.
|
||||
// The unified login form's magic-link submit path is only reachable
|
||||
// when `magic_link_login_enabled === true` — without this pin the
|
||||
// "sends a magic link" test can't reach `sendMagicLink()`.
|
||||
m(auth.getOidcProviders).mockResolvedValue({
|
||||
enabled: false,
|
||||
password_login_enabled: true,
|
||||
magic_link_login_enabled: true
|
||||
});
|
||||
m(auth.getAuthStatus).mockResolvedValue({ initialized: true });
|
||||
});
|
||||
|
||||
@@ -75,16 +83,21 @@ it('enters setup mode on a fresh install', async () => {
|
||||
await screen.findByTestId('login-setup-form');
|
||||
});
|
||||
|
||||
it('sends a magic link', async () => {
|
||||
it('sends a magic link when the password field is left empty', async () => {
|
||||
// Unified form: the same identifier input drives both flows. Filling
|
||||
// the identifier and leaving password empty makes `submitAsMagicLink`
|
||||
// derived resolve to true — the single submit button then dispatches
|
||||
// to `sendMagicLink` instead of `login`.
|
||||
m(auth.sendMagicLink).mockResolvedValue('sent');
|
||||
render(LoginPage);
|
||||
await screen.findByTestId('login-form');
|
||||
await fireEvent.click(screen.getByTestId('login-magic-toggle-btn'));
|
||||
await fireEvent.input(screen.getByTestId('login-magic-email-input'), {
|
||||
await fireEvent.input(screen.getByTestId('login-username-input'), {
|
||||
target: { value: 'a@b.test' }
|
||||
});
|
||||
await fireEvent.click(screen.getByTestId('login-magic-send-btn'));
|
||||
// Password intentionally NOT filled.
|
||||
await fireEvent.click(screen.getByTestId('login-submit-btn'));
|
||||
await waitFor(() => expect(auth.sendMagicLink).toHaveBeenCalledWith('a@b.test'));
|
||||
expect(auth.login).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('registers a new account', async () => {
|
||||
|
||||
@@ -622,6 +622,7 @@
|
||||
"login_identifier_placeholder": "Enter your username or email",
|
||||
"password": "Password",
|
||||
"password_placeholder": "Enter your password",
|
||||
"password_or_link_hint": "Password (leave blank for a sign-in link)",
|
||||
"login_button": "Sign in",
|
||||
"no_account": "Don't have an account?",
|
||||
"register": "Sign up",
|
||||
@@ -676,6 +677,7 @@
|
||||
"session_expired": "Your session expired. Please sign in again.",
|
||||
"sign_in": "Sign in",
|
||||
"signing_in": "Signing in…",
|
||||
"sending": "Sending…",
|
||||
"toggle_password": "Show password"
|
||||
},
|
||||
"storage": {
|
||||
|
||||
@@ -264,13 +264,26 @@ pub struct OidcExchangeDto {
|
||||
pub code: String,
|
||||
}
|
||||
|
||||
/// Information about available OIDC providers
|
||||
/// Information about available OIDC providers + self-service auth
|
||||
/// methods enabled on the deployment. Consumed by the login page to
|
||||
/// decide which forms/buttons to render.
|
||||
#[derive(Debug, Serialize, Deserialize, ToSchema)]
|
||||
pub struct OidcProviderInfoDto {
|
||||
pub enabled: bool,
|
||||
pub provider_name: String,
|
||||
pub authorize_endpoint: String,
|
||||
pub password_login_enabled: bool,
|
||||
/// True iff the server accepts magic-link login requests
|
||||
/// (`OXICLOUD_AUTH_METHODS` includes `magic_link` AND SMTP is
|
||||
/// configured). Frontend renders the magic-link form when true.
|
||||
#[serde(default)]
|
||||
pub magic_link_login_enabled: bool,
|
||||
/// True iff `OXICLOUD_REQUIRE_VERIFIED_EMAIL` is set. Frontend uses
|
||||
/// this hint to explain the `EmailNotVerified` login response and
|
||||
/// to nudge new users toward the magic-link verification path
|
||||
/// straight after signup.
|
||||
#[serde(default)]
|
||||
pub require_verified_email: bool,
|
||||
}
|
||||
|
||||
/// Claims extracted from the validated OIDC ID token
|
||||
|
||||
@@ -7,7 +7,7 @@ use crate::application::ports::auth_ports::{
|
||||
};
|
||||
use crate::application::ports::user_lifecycle::{DeletionMode, LogoutReason};
|
||||
use crate::application::services::user_lifecycle_service::UserLifecycleService;
|
||||
use crate::common::config::OidcConfig;
|
||||
use crate::common::config::{AuthMethod, OidcConfig};
|
||||
use crate::common::errors::{DomainError, ErrorKind};
|
||||
use crate::domain::entities::magic_link_token::{MagicLinkResourceKind, MagicLinkStatus};
|
||||
use crate::domain::entities::session::Session;
|
||||
@@ -148,6 +148,16 @@ pub struct AuthApplicationService {
|
||||
/// per request; the known mutation paths (`change_user_role`,
|
||||
/// `set_user_active`) also invalidate eagerly.
|
||||
user_flags_cache: Cache<Uuid, UserFlags>,
|
||||
/// Self-service auth-method allowlist (mirrors
|
||||
/// `AuthConfig::allowed_auth_methods`). Empty = both methods
|
||||
/// allowed. Consulted by login / register / magic-link handlers via
|
||||
/// `is_password_login_allowed()` / `is_magic_link_login_allowed()`
|
||||
/// so callers don't have to reach for the app config.
|
||||
allowed_auth_methods: Vec<AuthMethod>,
|
||||
/// Whether `POST /api/auth/login` refuses accounts whose
|
||||
/// `email_verified_at IS NULL`. Mirrors
|
||||
/// `AuthConfig::require_verified_email`.
|
||||
require_verified_email: bool,
|
||||
}
|
||||
|
||||
/// TTL for [`AuthApplicationService::user_flags_cache`]. Upper bound on how
|
||||
@@ -191,9 +201,95 @@ impl AuthApplicationService {
|
||||
.max_capacity(10_000)
|
||||
.time_to_live(USER_FLAGS_CACHE_TTL)
|
||||
.build(),
|
||||
allowed_auth_methods: vec![AuthMethod::Password, AuthMethod::MagicLink],
|
||||
require_verified_email: false,
|
||||
}
|
||||
}
|
||||
|
||||
/// Populates the auth-method allowlist + `require_verified_email`
|
||||
/// snapshot from the loaded config. Called by the DI factory. If
|
||||
/// left uncalled (test builds), defaults are permissive: both
|
||||
/// methods enabled, verified-email not required.
|
||||
pub fn with_auth_policy(
|
||||
mut self,
|
||||
allowed_methods: Vec<AuthMethod>,
|
||||
require_verified_email: bool,
|
||||
) -> Self {
|
||||
self.allowed_auth_methods = allowed_methods;
|
||||
self.require_verified_email = require_verified_email;
|
||||
self
|
||||
}
|
||||
|
||||
/// True iff `POST /api/auth/login` is a supported endpoint on this
|
||||
/// deployment. Composes the OIDC `disable_password_login` legacy
|
||||
/// flag with the newer `OXICLOUD_AUTH_METHODS` allowlist.
|
||||
pub fn is_password_login_allowed(&self) -> bool {
|
||||
!self.password_login_disabled()
|
||||
&& (self.allowed_auth_methods.is_empty()
|
||||
|| self.allowed_auth_methods.contains(&AuthMethod::Password))
|
||||
}
|
||||
|
||||
/// True iff `POST /api/auth/magic-link/send` should mint tokens for
|
||||
/// end-user login on this deployment.
|
||||
///
|
||||
/// Requires ALL of:
|
||||
/// * repo wired (SMTP configured, tokens can actually be minted);
|
||||
/// * allowlist permits `MagicLink` (or is empty = permissive);
|
||||
/// * OIDC is NOT enabled at the deployment level.
|
||||
///
|
||||
/// The OIDC guard is a hard rule: when OIDC is enabled it is the
|
||||
/// master identity provider — magic-link would bypass any 2FA / step-up
|
||||
/// policy that the IdP enforces. An operator running OIDC + local
|
||||
/// accounts hybrid must NOT expose magic-link login for the local
|
||||
/// accounts either, because a user provisioned via OIDC-JIT could
|
||||
/// receive a magic-link on the same mailbox and sidestep MFA. Admin-
|
||||
/// mediated invites use OIDC or password bootstrap instead.
|
||||
pub fn is_magic_link_login_allowed(&self) -> bool {
|
||||
self.magic_link_enabled()
|
||||
&& !self.oidc_enabled()
|
||||
&& (self.allowed_auth_methods.is_empty()
|
||||
|| self.allowed_auth_methods.contains(&AuthMethod::MagicLink))
|
||||
}
|
||||
|
||||
/// True iff login should reject accounts with `email_verified_at IS
|
||||
/// NULL`. Backed by `OXICLOUD_REQUIRE_VERIFIED_EMAIL`.
|
||||
pub fn require_verified_email(&self) -> bool {
|
||||
self.require_verified_email
|
||||
}
|
||||
|
||||
/// Resolve a login-identifier (username OR email) to the account's
|
||||
/// registered email address. Mirrors the `POST /api/auth/login`
|
||||
/// dispatcher (`@` presence → email lookup, else → username
|
||||
/// lookup). Returns `None` when the identifier doesn't match any
|
||||
/// account — callers that need anti-enumeration semantics MUST
|
||||
/// still return their uniform response after logging the reason.
|
||||
///
|
||||
/// The username namespace forbids `@` (PR 16), so the two paths
|
||||
/// are disjoint — no ambiguity.
|
||||
pub async fn resolve_login_identifier_to_email(&self, identifier: &str) -> Option<String> {
|
||||
if identifier.contains('@') {
|
||||
Some(identifier.to_string())
|
||||
} else {
|
||||
self.user_storage
|
||||
.get_user_by_username(identifier)
|
||||
.await
|
||||
.ok()
|
||||
.map(|u| u.email().to_string())
|
||||
}
|
||||
}
|
||||
|
||||
/// Direct lookup helpers used by handlers that need the full `User`
|
||||
/// entity (not just the email). Mirrors the internal `user_storage`
|
||||
/// calls the service already makes in `login`. Currently used by
|
||||
/// the login handler to auto-mint a verification magic-link after
|
||||
/// a successful password check.
|
||||
pub async fn find_user_by_email(&self, email: &str) -> Result<User, DomainError> {
|
||||
self.user_storage.get_user_by_email(email).await
|
||||
}
|
||||
pub async fn find_user_by_username(&self, username: &str) -> Result<User, DomainError> {
|
||||
self.user_storage.get_user_by_username(username).await
|
||||
}
|
||||
|
||||
/// Wire the magic-link token repository. Called from the DI factory
|
||||
/// when the magic-link feature is configured. Mirrors the
|
||||
/// `with_oidc` / `with_user_lifecycle` builder pattern.
|
||||
@@ -508,6 +604,13 @@ impl AuthApplicationService {
|
||||
)
|
||||
})?;
|
||||
|
||||
// First-run admin is authoritative by definition — they set the
|
||||
// password themselves, at the console, on a fresh install. Mark
|
||||
// verified so `OXICLOUD_REQUIRE_VERIFIED_EMAIL` never locks the
|
||||
// sole account with root-level power out of their own instance.
|
||||
let mut user = user;
|
||||
user.mark_email_verified();
|
||||
|
||||
let created_user = self.user_storage.create_user(user).await?;
|
||||
|
||||
// Lifecycle: notify hooks. PR 3 moves home-folder creation into
|
||||
@@ -527,6 +630,26 @@ impl AuthApplicationService {
|
||||
}
|
||||
|
||||
pub async fn login(&self, dto: LoginDto) -> Result<AuthResponseDto, DomainError> {
|
||||
// Gate: policy may forbid password logins entirely (either the
|
||||
// legacy OIDC-only mode or the newer `OXICLOUD_AUTH_METHODS`
|
||||
// allowlist without `password`). Refuse BEFORE the user lookup
|
||||
// so we don't leak account existence via timing on a disabled
|
||||
// endpoint.
|
||||
if !self.is_password_login_allowed() {
|
||||
tracing::info!(
|
||||
target: "audit",
|
||||
event = "auth.login_rejected",
|
||||
reason = "password_login_disabled",
|
||||
attempted_username = %dto.username,
|
||||
"🔐 login rejected: password login disabled by policy",
|
||||
);
|
||||
return Err(DomainError::new(
|
||||
ErrorKind::AccessDenied,
|
||||
"Auth",
|
||||
"Password login is disabled",
|
||||
));
|
||||
}
|
||||
|
||||
// Dispatch on `@` in the input: presence of `@` means an email
|
||||
// was typed, absence means a username. The two namespaces are
|
||||
// provably disjoint (PR 16 forbids `@` in usernames), so this
|
||||
@@ -612,6 +735,45 @@ impl AuthApplicationService {
|
||||
));
|
||||
}
|
||||
|
||||
// Gate: `OXICLOUD_REQUIRE_VERIFIED_EMAIL`. Checked AFTER password
|
||||
// validation so an attacker with only a username cannot probe
|
||||
// account verification state (the response shape is
|
||||
// `Invalid credentials` for bad passwords regardless of whether
|
||||
// the email is verified — a wrong-password observer learns
|
||||
// nothing).
|
||||
//
|
||||
// ADMIN EXEMPTION: admins are trusted by fiat and predate this
|
||||
// gate. Fresh admin accounts (admin_create_user /
|
||||
// setup_create_admin) are stamped verified at creation; the
|
||||
// exemption covers pre-existing admin accounts installed before
|
||||
// the flag shipped.
|
||||
//
|
||||
// The auto-send of a verification magic-link when this branch
|
||||
// fires is done at the handler layer (login handler triggers
|
||||
// `send_verification_link_authenticated`) rather than here —
|
||||
// the service returns the distinguished error and the handler
|
||||
// orchestrates the side effect. Keeps this method side-effect-
|
||||
// free on the audit path.
|
||||
if self.require_verified_email
|
||||
&& !matches!(user.role(), UserRole::Admin)
|
||||
&& !user.is_email_verified()
|
||||
{
|
||||
tracing::info!(
|
||||
target: "audit",
|
||||
event = "auth.login_rejected",
|
||||
reason = "email_not_verified",
|
||||
user_id = %user.id(),
|
||||
username = %user.display_for_audit(),
|
||||
"🔐 login rejected: email not verified for '{}' (password OK)",
|
||||
user.display_for_audit(),
|
||||
);
|
||||
return Err(DomainError::new(
|
||||
ErrorKind::AccessDenied,
|
||||
"Auth",
|
||||
"Email not verified",
|
||||
));
|
||||
}
|
||||
|
||||
// Lifecycle: dispatch login BEFORE register_login() so hooks
|
||||
// observing `last_login_at().is_none()` see "first ever login"
|
||||
// correctly. See tip #1 in user_lifecycle.rs.
|
||||
@@ -689,6 +851,17 @@ impl AuthApplicationService {
|
||||
)
|
||||
})?;
|
||||
|
||||
// Defense-in-depth: if magic-link login was minted under an older
|
||||
// policy and the operator has since flipped OIDC on (or dropped
|
||||
// `MagicLink` from `OXICLOUD_AUTH_METHODS`), we must not honour
|
||||
// pre-existing login tokens. Invitation tokens (resource_kind =
|
||||
// File / Folder) are checked separately below — they represent
|
||||
// an admin-mediated invite, which is a distinct policy question
|
||||
// from "self-service login via email".
|
||||
//
|
||||
// We do the token lookup FIRST so we can classify by
|
||||
// `resource_kind()` before applying the gate — invitations
|
||||
// survive, plain logins do not.
|
||||
let mlt = repo.find_by_token(token).await?.ok_or_else(|| {
|
||||
// Audit: unknown / forged magic-link redemption. The first
|
||||
// 8 chars of the bogus token are logged so a recurring
|
||||
@@ -710,6 +883,27 @@ impl AuthApplicationService {
|
||||
)
|
||||
})?;
|
||||
|
||||
// Enforce the login-magic-link policy on stale tokens.
|
||||
// resource_kind = None means "plain login-via-email"; anything
|
||||
// else is an invite (which follows its own admin-mediated
|
||||
// trust chain). Refuse the login case if the current policy
|
||||
// forbids magic-link login.
|
||||
if mlt.resource_kind().is_none() && !self.is_magic_link_login_allowed() {
|
||||
tracing::info!(
|
||||
target: "audit",
|
||||
event = "magic_link.redemption_rejected",
|
||||
reason = "login_disabled_by_policy",
|
||||
token_id = %mlt.id(),
|
||||
user_id = %mlt.user_id(),
|
||||
"🔗 magic-link rejected: login-via-email disabled by policy (OIDC-master or allowlist)",
|
||||
);
|
||||
return Err(DomainError::new(
|
||||
ErrorKind::AccessDenied,
|
||||
"MagicLink",
|
||||
"magic-link login is disabled",
|
||||
));
|
||||
}
|
||||
|
||||
// Friendly early-rejection messages. The atomic `mark_used`
|
||||
// below is the canonical single-use guard.
|
||||
if mlt.status() == MagicLinkStatus::Used {
|
||||
@@ -1717,6 +1911,16 @@ impl AuthApplicationService {
|
||||
)
|
||||
})?;
|
||||
|
||||
// Admin fiat counts as verification. When
|
||||
// `OXICLOUD_REQUIRE_VERIFIED_EMAIL` is set, admin-created users
|
||||
// still get to log in without a magic-link round-trip — the
|
||||
// operator explicitly vouched for the address at creation. This
|
||||
// mirrors the OIDC-JIT convention (see `redeem_pending_oidc_token`
|
||||
// and `login_oidc_callback` which also stamp
|
||||
// `email_verified_at` on first sight).
|
||||
let mut user = user;
|
||||
user.mark_email_verified();
|
||||
|
||||
// Persist
|
||||
let created = self.user_storage.create_user(user).await?;
|
||||
|
||||
|
||||
@@ -449,7 +449,8 @@ impl MagicLinkInviteService {
|
||||
/// is reserved for `resolve_or_create_recipient` — and if the
|
||||
/// matched user has no other login credential, mint a NULL-resource
|
||||
/// magic-link token and email a sign-in link. The redemption
|
||||
/// endpoint lands a NULL-resource token on `/#/sharedwithme`.
|
||||
/// endpoint lands a NULL-resource token on `/shared-with-me`
|
||||
/// (external users) or `/files` (internal users).
|
||||
///
|
||||
/// Always returns `Ok(())` so the caller can emit a uniform
|
||||
/// response shape (`"If an account exists, a link will be sent."`)
|
||||
@@ -615,6 +616,123 @@ impl MagicLinkInviteService {
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Mint + email a magic-link for **email verification**, called
|
||||
/// only after another authentication factor has already proven the
|
||||
/// caller's identity (currently: the login handler after a
|
||||
/// successful password check).
|
||||
///
|
||||
/// Contract: the caller MUST have validated the user's identity via
|
||||
/// an independent factor before invoking this. The method does NOT
|
||||
/// re-verify credentials — it exists specifically to bypass the
|
||||
/// `has_password` eligibility gate, which would otherwise deadlock
|
||||
/// the `OXICLOUD_REQUIRE_VERIFIED_EMAIL` flow (login rejected as
|
||||
/// unverified → user asks for a verification link → refused
|
||||
/// because they have a password).
|
||||
///
|
||||
/// Rejected: OIDC-linked users, deactivated users. Everything else
|
||||
/// gets a token — including the "has password" case that
|
||||
/// `send_login_link` refuses.
|
||||
pub async fn send_verification_link_authenticated(
|
||||
&self,
|
||||
user: &User,
|
||||
request_challenge: &str,
|
||||
) -> Result<(), DomainError> {
|
||||
// OIDC boundary is unconditional even here — the IdP owns the
|
||||
// identity contract and we must not mint a session-primitive
|
||||
// for a user it manages.
|
||||
if user.is_oidc_user() {
|
||||
tracing::info!(
|
||||
target: "audit",
|
||||
event = "auth.magic_link_send",
|
||||
reason = "oidc_user",
|
||||
user_id = %user.id(),
|
||||
username = %user.display_for_audit(),
|
||||
"🔗 verify-link suppressed: OIDC user",
|
||||
);
|
||||
return Ok(());
|
||||
}
|
||||
if !user.is_active() {
|
||||
tracing::info!(
|
||||
target: "audit",
|
||||
event = "auth.magic_link_send",
|
||||
reason = "account_deactivated",
|
||||
user_id = %user.id(),
|
||||
username = %user.display_for_audit(),
|
||||
"🔗 verify-link suppressed: account deactivated",
|
||||
);
|
||||
return Ok(());
|
||||
}
|
||||
|
||||
let token = MagicLinkToken::new(
|
||||
user.id(),
|
||||
chrono::Duration::minutes(self.magic_link_cfg.login_ttl_minutes as i64),
|
||||
None,
|
||||
Some(request_challenge.to_string()),
|
||||
);
|
||||
self.magic_link_repo.create(&token).await?;
|
||||
|
||||
let link = format!(
|
||||
"{}/magic/v1/{}",
|
||||
self.public_base_url.trim_end_matches('/'),
|
||||
token.token(),
|
||||
);
|
||||
// Reuses the login email template for now — same call to
|
||||
// action (click the link), same TTL, same challenge binding.
|
||||
// A dedicated "verify your email" template can land later
|
||||
// without wire changes.
|
||||
let locale = self.locale_for(user);
|
||||
let ttl_minutes = self.magic_link_cfg.login_ttl_minutes.to_string();
|
||||
let login_args: Vec<(&str, &str)> = vec![("link", &link), ("ttl_minutes", &ttl_minutes)];
|
||||
|
||||
let subject = self
|
||||
.i18n_or(
|
||||
"server.magic_link.email.login.subject",
|
||||
&locale,
|
||||
&login_args,
|
||||
)
|
||||
.await;
|
||||
let text_body = self
|
||||
.render_bilingual("server.magic_link.email.login.body", &locale, &login_args)
|
||||
.await;
|
||||
|
||||
let message = EmailMessage {
|
||||
to: user.email().to_string(),
|
||||
subject,
|
||||
text_body,
|
||||
html_body: None,
|
||||
};
|
||||
|
||||
match self.email_sender.send(message).await {
|
||||
Ok(outcome) => {
|
||||
tracing::info!(
|
||||
target: "audit",
|
||||
event = "auth.magic_link_send",
|
||||
reason = "sent_verification",
|
||||
user_id = %user.id(),
|
||||
username = %user.display_for_audit(),
|
||||
email = %user.email(),
|
||||
smtp_code = outcome.code,
|
||||
smtp_message = %outcome.message,
|
||||
"🔗 verify-link sent to '{}'",
|
||||
user.email(),
|
||||
);
|
||||
}
|
||||
Err(e) => {
|
||||
tracing::warn!(
|
||||
target: "audit",
|
||||
event = "auth.magic_link_send_failed",
|
||||
user_id = %user.id(),
|
||||
email = %user.email(),
|
||||
error = %e.message,
|
||||
"🔗 verify-link SMTP send failed for '{}'",
|
||||
user.email(),
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Resolve a translation, falling back to the literal key on any
|
||||
/// lookup error. Identical to the handler-side helper — kept inline
|
||||
/// here because the service layer can't pull in a UI util module
|
||||
|
||||
@@ -486,7 +486,7 @@ impl RecipientNotificationService {
|
||||
// body — same pattern as `MagicLinkInviteService::issue_invitation`.
|
||||
let inviter_short = granter.display_full(false);
|
||||
let inviter_full = granter.display_full(true);
|
||||
let login_link = format!("{}/#/login", self.public_base_url.trim_end_matches('/'),);
|
||||
let login_link = format!("{}/login", self.public_base_url.trim_end_matches('/'),);
|
||||
|
||||
let args: Vec<(&str, &str)> = vec![
|
||||
("inviter", inviter_short.as_str()),
|
||||
|
||||
+288
-1
@@ -470,6 +470,148 @@ pub struct AuthConfig {
|
||||
pub hash_parallelism: u32,
|
||||
/// Rate limiting / account lockout configuration
|
||||
pub rate_limit: RateLimitConfig,
|
||||
/// Allowlist of email domains accepted on the public `POST
|
||||
/// /api/auth/register` endpoint. Empty = no restriction (any
|
||||
/// domain is allowed). Entries are lowercased and trimmed at
|
||||
/// load time; matching is case-insensitive exact-match on the
|
||||
/// post-`@` part of the address.
|
||||
///
|
||||
/// This is DISTINCT from
|
||||
/// [`MagicLinkConfig::allowed_email_domains`], which gates who
|
||||
/// can be INVITED (email-typed grants + magic-link login for
|
||||
/// existing recipients). This list gates SELF-registration
|
||||
/// only. An operator can, for example, keep public registration
|
||||
/// open to `partner-a.com` and `partner-b.io` while allowing
|
||||
/// invitations to any domain — the two lists are independent.
|
||||
///
|
||||
/// Example: `["partner-a.com", "partner-b.io"]` — only
|
||||
/// addresses `<anything>@partner-a.com` or
|
||||
/// `<anything>@partner-b.io` can self-register; everything else
|
||||
/// is rejected with 403 `RegistrationDomainNotAllowed`.
|
||||
///
|
||||
/// Wildcards / subdomain semantics are intentionally out of
|
||||
/// scope (mirroring `MagicLinkConfig::allowed_email_domains`):
|
||||
/// `partner.com` does NOT match `eng.partner.com`. List every
|
||||
/// subdomain explicitly.
|
||||
///
|
||||
/// Env: `OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS` (comma-
|
||||
/// separated).
|
||||
pub registration_allowed_email_domains: Vec<String>,
|
||||
/// Additive auth-policy toggles the operator has opted into.
|
||||
/// Distinct from `allowed_auth_methods` (which enables/disables a
|
||||
/// method wholesale) — this vector composes policy switches that
|
||||
/// tweak the default auth behaviour. Empty = pure defaults in
|
||||
/// effect, matching legacy behaviour.
|
||||
///
|
||||
/// Vector shape (rather than one boolean per policy) so future
|
||||
/// switches can be added by appending a variant instead of
|
||||
/// growing the env-var surface — `OXICLOUD_AUTH_POLICIES=policy_a,policy_b`.
|
||||
/// Each variant's name carries its own polarity (`Permit...`,
|
||||
/// future `Require...` / `Deny...`); the field name stays neutral
|
||||
/// so a future deny-style policy reads correctly at the call site.
|
||||
///
|
||||
/// Env: `OXICLOUD_AUTH_POLICIES` (comma-separated).
|
||||
///
|
||||
/// Deprecated legacy alias: `OXICLOUD_MAGIC_LINK_OPEN_TO_PASSWORD_USERS=true`
|
||||
/// still adds `PermitMagicLinkForPasswordUsers` to the vector for
|
||||
/// backwards compatibility; emits a startup warning encouraging
|
||||
/// migration to the vector form.
|
||||
pub auth_policies: Vec<AuthPolicy>,
|
||||
/// Allowlist of self-service auth methods offered on the login
|
||||
/// page and accepted by their respective endpoints. Empty (the
|
||||
/// default) = both methods allowed, matching legacy behaviour.
|
||||
/// OIDC is orthogonal — controlled via `OxidcConfig::enabled`.
|
||||
///
|
||||
/// Semantics:
|
||||
/// * `AuthMethod::Password` allowed → `POST /api/auth/login`
|
||||
/// accepts credentials; password-based `register` works.
|
||||
/// * `AuthMethod::MagicLink` allowed → `POST /api/auth/magic-
|
||||
/// link/send` mints tokens; email-only `register` works.
|
||||
///
|
||||
/// A method NOT in the list returns 403 with a specific
|
||||
/// `error_type` (`PasswordLoginDisabled`,
|
||||
/// `MagicLinkLoginDisabled`) so frontends can render a
|
||||
/// contextual message rather than a generic auth error.
|
||||
///
|
||||
/// Startup guard: when `MagicLink` is in the list but
|
||||
/// `SmtpConfig::is_enabled()` is false, the server refuses to
|
||||
/// start. A magic-link policy without a mail sender is a
|
||||
/// misconfiguration that silently locks users out.
|
||||
///
|
||||
/// Env: `OXICLOUD_AUTH_METHODS` (comma-separated:
|
||||
/// `password,magic_link`). Alias: the older
|
||||
/// `OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN=true` still removes
|
||||
/// Password from this list when set (backwards-compat).
|
||||
pub allowed_auth_methods: Vec<AuthMethod>,
|
||||
/// Require the user's email to be verified before login is
|
||||
/// permitted. When `true`, `POST /api/auth/login` returns 403
|
||||
/// `EmailNotVerified` for any account whose `email_verified_at`
|
||||
/// is NULL. Users can prove control by clicking a magic-link
|
||||
/// (which stamps `email_verified_at`) — so this composes with
|
||||
/// `AuthMethod::MagicLink` in the allowlist above to provide a
|
||||
/// verification path.
|
||||
///
|
||||
/// Admin-created users (`POST /api/admin/users`) and the
|
||||
/// first-run setup admin (`POST /api/setup`) get
|
||||
/// `email_verified_at = NOW()` at creation — admin fiat counts
|
||||
/// as verification, matching the OIDC-JIT convention.
|
||||
///
|
||||
/// Env: `OXICLOUD_REQUIRE_VERIFIED_EMAIL` (default `false`).
|
||||
pub require_verified_email: bool,
|
||||
}
|
||||
|
||||
/// Self-service auth method. Exposed as `AuthConfig::allowed_auth_methods`
|
||||
/// and parsed from `OXICLOUD_AUTH_METHODS` (comma-separated). OIDC is
|
||||
/// deliberately excluded — it lives in `OidcConfig` with its own gate.
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum AuthMethod {
|
||||
Password,
|
||||
MagicLink,
|
||||
}
|
||||
|
||||
impl AuthMethod {
|
||||
/// Case-insensitive parse: accepts `password`, `magic_link`, and the
|
||||
/// dash form `magic-link` (some operators habitually use dashes).
|
||||
/// Unknown token returns `None` so the caller can log-and-skip.
|
||||
pub fn parse(s: &str) -> Option<Self> {
|
||||
match s.trim().to_ascii_lowercase().as_str() {
|
||||
"password" => Some(Self::Password),
|
||||
"magic_link" | "magic-link" | "magiclink" => Some(Self::MagicLink),
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Additive auth-policy switches. Exposed as `AuthConfig::auth_policies`
|
||||
/// and parsed from `OXICLOUD_AUTH_POLICIES` (comma-separated). Each
|
||||
/// variant's name states its own polarity — `Permit...` grants an
|
||||
/// exception, future `Require...` / `Deny...` variants restrict.
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum AuthPolicy {
|
||||
/// Allow magic-link login for accounts that ALSO have a password
|
||||
/// configured. Off by default — magic-link is otherwise gated by
|
||||
/// `magic_link_eligibility()` to users without a password
|
||||
/// (mailbox-strength should not shadow a stronger credential).
|
||||
/// Enabling this weakens the password to mailbox-strength for
|
||||
/// affected accounts; opt-in only.
|
||||
///
|
||||
/// Deprecated legacy alias: `OXICLOUD_MAGIC_LINK_OPEN_TO_PASSWORD_USERS=true`
|
||||
/// adds this variant to the vector with a startup warning.
|
||||
PermitMagicLinkForPasswordUsers,
|
||||
}
|
||||
|
||||
impl AuthPolicy {
|
||||
/// Case-insensitive parse: accepts `permit_magic_link_for_password_users`
|
||||
/// (canonical) and the dash form. Unknown token returns `None` so
|
||||
/// the caller can log-and-skip.
|
||||
pub fn parse(s: &str) -> Option<Self> {
|
||||
match s.trim().to_ascii_lowercase().as_str() {
|
||||
"permit_magic_link_for_password_users" | "permit-magic-link-for-password-users" => {
|
||||
Some(Self::PermitMagicLinkForPasswordUsers)
|
||||
}
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Rate limiting and brute-force protection configuration.
|
||||
@@ -521,10 +663,30 @@ impl Default for AuthConfig {
|
||||
hash_time_cost: 3,
|
||||
hash_parallelism: 2,
|
||||
rate_limit: RateLimitConfig::default(),
|
||||
registration_allowed_email_domains: Vec::new(),
|
||||
auth_policies: Vec::new(),
|
||||
allowed_auth_methods: vec![AuthMethod::Password, AuthMethod::MagicLink],
|
||||
require_verified_email: false,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl AuthConfig {
|
||||
/// True iff `method` is enabled (or the allowlist is empty — meaning
|
||||
/// "all methods allowed", matching pre-`OXICLOUD_AUTH_METHODS`
|
||||
/// behaviour when the operator hasn't opted in yet).
|
||||
pub fn is_method_allowed(&self, method: AuthMethod) -> bool {
|
||||
self.allowed_auth_methods.is_empty() || self.allowed_auth_methods.contains(&method)
|
||||
}
|
||||
|
||||
/// True iff `policy` has been opted into via `OXICLOUD_AUTH_POLICIES`
|
||||
/// (or its legacy alias). Default policies are OFF — the vector is
|
||||
/// additive only, no invert / defaults.
|
||||
pub fn has_policy(&self, policy: AuthPolicy) -> bool {
|
||||
self.auth_policies.contains(&policy)
|
||||
}
|
||||
}
|
||||
|
||||
/// OpenID Connect (OIDC) configuration
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct OidcConfig {
|
||||
@@ -1508,6 +1670,110 @@ impl AppConfig {
|
||||
config.auth.rate_limit.lockout_duration_secs = val;
|
||||
}
|
||||
|
||||
// Registration email-domain allowlist. Distinct from
|
||||
// `OXICLOUD_EXTERNAL_EMAIL_DOMAINS` (which gates who can be
|
||||
// INVITED via grants + magic link) — this one gates who can
|
||||
// SELF-register via `POST /api/auth/register`. Empty = no
|
||||
// restriction. Same parse shape as the external-domains list:
|
||||
// comma-separated, lowercased, trimmed, empties dropped.
|
||||
if let Ok(v) = env::var("OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS") {
|
||||
config.auth.registration_allowed_email_domains = v
|
||||
.split(',')
|
||||
.map(|d| d.trim().to_ascii_lowercase())
|
||||
.filter(|d| !d.is_empty())
|
||||
.collect();
|
||||
}
|
||||
|
||||
// Self-service auth-method allowlist. Empty (unset) = both methods
|
||||
// allowed. Unknown tokens are logged-and-skipped; a completely
|
||||
// unparseable value falls back to the default rather than locking
|
||||
// the operator out. If the resulting list is empty (e.g. the
|
||||
// operator wrote `OXICLOUD_AUTH_METHODS=nope`), we restore the
|
||||
// default — a zero-method allowlist would refuse every login.
|
||||
if let Ok(v) = env::var("OXICLOUD_AUTH_METHODS") {
|
||||
let methods: Vec<AuthMethod> = v
|
||||
.split(',')
|
||||
.filter_map(|s| {
|
||||
let parsed = AuthMethod::parse(s);
|
||||
if parsed.is_none() && !s.trim().is_empty() {
|
||||
eprintln!(
|
||||
"⚠️ OXICLOUD_AUTH_METHODS: ignoring unknown token '{}' \
|
||||
(expected: password, magic_link)",
|
||||
s.trim()
|
||||
);
|
||||
}
|
||||
parsed
|
||||
})
|
||||
.collect();
|
||||
if methods.is_empty() {
|
||||
eprintln!(
|
||||
"⚠️ OXICLOUD_AUTH_METHODS parsed to an empty allowlist; \
|
||||
falling back to default (password, magic_link)"
|
||||
);
|
||||
} else {
|
||||
config.auth.allowed_auth_methods = methods;
|
||||
}
|
||||
}
|
||||
|
||||
// Legacy alias: OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN=true still
|
||||
// removes Password from the allowlist. Its main handling in the
|
||||
// OIDC config block below is preserved for the `login_options`
|
||||
// response; this line makes the effect apply uniformly through
|
||||
// `is_method_allowed(Password)` so services don't need to check
|
||||
// both flags.
|
||||
if let Ok(v) = env::var("OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN")
|
||||
&& v.parse::<bool>().unwrap_or(false)
|
||||
{
|
||||
config
|
||||
.auth
|
||||
.allowed_auth_methods
|
||||
.retain(|m| *m != AuthMethod::Password);
|
||||
}
|
||||
|
||||
if let Ok(v) = env::var("OXICLOUD_REQUIRE_VERIFIED_EMAIL") {
|
||||
config.auth.require_verified_email = v.parse::<bool>().unwrap_or(false);
|
||||
}
|
||||
|
||||
// Auth-policy vector. Additive — each recognised token adds a
|
||||
// variant; unknown tokens are logged-and-skipped so a typo
|
||||
// doesn't silently zero the whole vector (an operator wanting
|
||||
// "no policies" simply doesn't set the env var).
|
||||
//
|
||||
// The legacy alias
|
||||
// `OXICLOUD_MAGIC_LINK_OPEN_TO_PASSWORD_USERS=true` is applied
|
||||
// AFTER this block (see the MagicLinkConfig section below) so a
|
||||
// deployment setting BOTH env vars ends up with a single copy
|
||||
// of `PermitMagicLinkForPasswordUsers` regardless of order.
|
||||
if let Ok(v) = env::var("OXICLOUD_AUTH_POLICIES") {
|
||||
for token in v.split(',') {
|
||||
match AuthPolicy::parse(token) {
|
||||
Some(policy) => {
|
||||
if !config.auth.auth_policies.contains(&policy) {
|
||||
config.auth.auth_policies.push(policy);
|
||||
}
|
||||
}
|
||||
None if !token.trim().is_empty() => {
|
||||
eprintln!(
|
||||
"⚠️ OXICLOUD_AUTH_POLICIES: ignoring unknown token '{}' \
|
||||
(known: permit_magic_link_for_password_users)",
|
||||
token.trim()
|
||||
);
|
||||
}
|
||||
None => {}
|
||||
}
|
||||
}
|
||||
// Reflect the vector into the legacy magic_link config field
|
||||
// so `magic_link_eligibility()` (the site that reads the
|
||||
// boolean today) doesn't need to know about the new form.
|
||||
if config
|
||||
.auth
|
||||
.auth_policies
|
||||
.contains(&AuthPolicy::PermitMagicLinkForPasswordUsers)
|
||||
{
|
||||
config.magic_link.open_to_password_users = true;
|
||||
}
|
||||
}
|
||||
|
||||
// Feature flags
|
||||
if let Ok(enable_auth) = env::var("OXICLOUD_ENABLE_AUTH").map(|v| v.parse::<bool>())
|
||||
&& let Ok(val) = enable_auth
|
||||
@@ -2072,8 +2338,29 @@ impl AppConfig {
|
||||
{
|
||||
config.magic_link.send_per_ip_per_hour = n;
|
||||
}
|
||||
// Legacy alias — writes the same effect as
|
||||
// `OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users`.
|
||||
// Warn once at boot so operators know to migrate before we drop
|
||||
// the old var. Kept indefinitely for compat, but the encouraged
|
||||
// form is the vector.
|
||||
if let Ok(v) = env::var("OXICLOUD_MAGIC_LINK_OPEN_TO_PASSWORD_USERS") {
|
||||
config.magic_link.open_to_password_users = v == "true" || v == "1";
|
||||
let enabled = v == "true" || v == "1";
|
||||
config.magic_link.open_to_password_users = enabled;
|
||||
if enabled
|
||||
&& !config
|
||||
.auth
|
||||
.auth_policies
|
||||
.contains(&AuthPolicy::PermitMagicLinkForPasswordUsers)
|
||||
{
|
||||
config
|
||||
.auth
|
||||
.auth_policies
|
||||
.push(AuthPolicy::PermitMagicLinkForPasswordUsers);
|
||||
}
|
||||
eprintln!(
|
||||
"⚠️ OXICLOUD_MAGIC_LINK_OPEN_TO_PASSWORD_USERS is deprecated. \
|
||||
Use `OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users` instead."
|
||||
);
|
||||
}
|
||||
if let Ok(v) = env::var("OXICLOUD_NOTIFY_INTERNAL_USERS_ON_SHARE") {
|
||||
config.magic_link.notify_internal_users_on_share = v == "true" || v == "1";
|
||||
|
||||
@@ -52,6 +52,14 @@ pub async fn create_auth_services(
|
||||
// direct FolderService dependency for that path.
|
||||
auth_app_service = auth_app_service.with_user_lifecycle(user_lifecycle);
|
||||
|
||||
// Wire the auth-method allowlist + email-verification requirement so
|
||||
// login / magic-link / register handlers consult a single snapshot
|
||||
// rather than reaching into the app config on every call.
|
||||
auth_app_service = auth_app_service.with_auth_policy(
|
||||
config.auth.allowed_auth_methods.clone(),
|
||||
config.auth.require_verified_email,
|
||||
);
|
||||
|
||||
// Wire the magic-link token repo. Enables `GET /magic/v1/{token}`
|
||||
// and the future `POST /api/auth/magic-link/send` endpoint to mint
|
||||
// and consume tokens. The repo is unconditional (it's just SQL on
|
||||
|
||||
@@ -127,21 +127,37 @@ pub async fn register(
|
||||
}
|
||||
};
|
||||
|
||||
// Block password registration when OIDC-only mode is active.
|
||||
// Email-only signup still works in OIDC-only mode (no password
|
||||
// stored; the user authenticates via magic-link).
|
||||
// Block password registration when the policy forbids password
|
||||
// logins (OIDC-only mode OR `OXICLOUD_AUTH_METHODS` allowlist
|
||||
// without `password`). Email-only signup still works — the user
|
||||
// authenticates via magic-link or SSO on their first visit.
|
||||
if dto.password.is_some()
|
||||
&& auth_service
|
||||
&& !auth_service
|
||||
.auth_application_service
|
||||
.password_login_disabled()
|
||||
.is_password_login_allowed()
|
||||
{
|
||||
return Err(AppError::new(
|
||||
StatusCode::FORBIDDEN,
|
||||
"Password registration is disabled. Please use SSO/OIDC to sign in.",
|
||||
"Password registration is disabled by policy.",
|
||||
"PasswordRegistrationDisabled",
|
||||
));
|
||||
}
|
||||
|
||||
// Symmetric guard: when magic-link is off, an email-only signup has
|
||||
// no path to a session (there's no token to click). Refuse rather
|
||||
// than silently succeed and leave the user with an unusable account.
|
||||
if dto.password.is_none()
|
||||
&& !auth_service
|
||||
.auth_application_service
|
||||
.is_magic_link_login_allowed()
|
||||
{
|
||||
return Err(AppError::new(
|
||||
StatusCode::FORBIDDEN,
|
||||
"Email-only registration requires magic-link login, which is disabled.",
|
||||
"MagicLinkLoginDisabled",
|
||||
));
|
||||
}
|
||||
|
||||
// Admin disabled public registration globally — surface 403.
|
||||
if let Some(admin_svc) = state.admin_settings_service.as_ref()
|
||||
&& !admin_svc.get_registration_enabled().await
|
||||
@@ -153,6 +169,47 @@ pub async fn register(
|
||||
));
|
||||
}
|
||||
|
||||
// Operator-configured allowlist of email domains that can
|
||||
// self-register. Empty list = no restriction (any domain accepted).
|
||||
// Distinct from `OXICLOUD_EXTERNAL_EMAIL_DOMAINS`, which gates
|
||||
// magic-link / grant invitations — an operator can leave that
|
||||
// permissive while locking self-registration down, or vice versa.
|
||||
//
|
||||
// Matching mirrors the magic-link list:
|
||||
// * post-`@` part of the address is extracted and lowercased
|
||||
// * case-insensitive exact match against the allowlist
|
||||
// * no wildcard / subdomain expansion (list every domain
|
||||
// explicitly, per the config docstring)
|
||||
//
|
||||
// Audit-log denials at the `audit` target so operators can spot
|
||||
// enumeration / probe attempts — mirrors the shape used by the
|
||||
// magic-link domain rejection at
|
||||
// `magic_link_invite_service.rs`.
|
||||
let allow_list = &state.core.config.auth.registration_allowed_email_domains;
|
||||
if !allow_list.is_empty() {
|
||||
let domain = dto
|
||||
.email
|
||||
.split('@')
|
||||
.nth(1)
|
||||
.map(|d| d.trim().to_ascii_lowercase())
|
||||
.unwrap_or_default();
|
||||
if domain.is_empty() || !allow_list.iter().any(|d| d == &domain) {
|
||||
tracing::info!(
|
||||
target: "audit",
|
||||
event = "auth.register_rejected",
|
||||
reason = "domain_not_allowed",
|
||||
domain = %domain,
|
||||
"👮🏻♂️ Public registration refused: email domain not in \
|
||||
OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS"
|
||||
);
|
||||
return Err(AppError::new(
|
||||
StatusCode::FORBIDDEN,
|
||||
"Registration is not open to this email domain.",
|
||||
"RegistrationDomainNotAllowed",
|
||||
));
|
||||
}
|
||||
}
|
||||
|
||||
// Email-only signup requires SMTP. Without it the welcome mail
|
||||
// can't be dispatched and the user is stranded with no way to log
|
||||
// in. 503 is the right response: instance-wide policy, no per-user
|
||||
@@ -310,13 +367,19 @@ pub async fn login(
|
||||
));
|
||||
}
|
||||
|
||||
// Check if password login is disabled (OIDC-only mode)
|
||||
if auth_service
|
||||
// Check if password login is allowed (composes the legacy OIDC-only
|
||||
// flag with the newer `OXICLOUD_AUTH_METHODS` allowlist). When
|
||||
// disabled, return `PasswordLoginDisabled` so the SPA can hide the
|
||||
// password field and surface the available fallback (magic-link or
|
||||
// SSO) instead of showing a generic "invalid credentials".
|
||||
if !auth_service
|
||||
.auth_application_service
|
||||
.password_login_disabled()
|
||||
.is_password_login_allowed()
|
||||
{
|
||||
return Err(AppError::unauthorized(
|
||||
"Password login is disabled. Please use SSO/OIDC to sign in.",
|
||||
return Err(AppError::new(
|
||||
StatusCode::FORBIDDEN,
|
||||
"Password login is disabled by policy.",
|
||||
"PasswordLoginDisabled",
|
||||
));
|
||||
}
|
||||
|
||||
@@ -384,6 +447,55 @@ pub async fn login(
|
||||
.login_lockout
|
||||
.record_failure(&dto.username, &client_ip);
|
||||
tracing::error!("Login failed for user {}: {}", dto.username, err);
|
||||
// Remap the `require_verified_email` refusal (message
|
||||
// string comes from AuthApplicationService::login) into a
|
||||
// distinguished error_type and, critically, PIGGYBACK a
|
||||
// verification link on the successful-password proof: the
|
||||
// caller just showed they know the password, so we can
|
||||
// safely mint a verification magic-link for their address
|
||||
// without going through the anti-enum-fronted
|
||||
// `magic-link/send` (which would refuse `has_password`).
|
||||
//
|
||||
// This branch is reached ONLY when the password validated
|
||||
// successfully — the service checks `require_verified_email`
|
||||
// AFTER the password check specifically so an attacker
|
||||
// without the password can't discover an account's
|
||||
// verification state from the response shape.
|
||||
if err.message == "Email not verified" {
|
||||
// Best-effort auto-send. We swallow any error and still
|
||||
// return the same EmailNotVerified response — the
|
||||
// frontend hint ("check your inbox") doubles as the
|
||||
// resend affordance if delivery didn't land.
|
||||
if let Some(invite_svc) = state.magic_link_invite_service.as_ref() {
|
||||
// Re-look up the user by identifier (mirrors the
|
||||
// service's login dispatch) to get the User entity
|
||||
// that the verification helper needs. On any
|
||||
// lookup failure we skip the send — attacker never
|
||||
// sees the difference.
|
||||
let lookup = if dto.username.contains('@') {
|
||||
auth_service
|
||||
.auth_application_service
|
||||
.find_user_by_email(&dto.username)
|
||||
.await
|
||||
} else {
|
||||
auth_service
|
||||
.auth_application_service
|
||||
.find_user_by_username(&dto.username)
|
||||
.await
|
||||
};
|
||||
if let Ok(user) = lookup {
|
||||
let challenge = cookie_auth::generate_magic_request_challenge();
|
||||
let _ = invite_svc
|
||||
.send_verification_link_authenticated(&user, &challenge)
|
||||
.await;
|
||||
}
|
||||
}
|
||||
return Err(AppError::new(
|
||||
StatusCode::FORBIDDEN,
|
||||
"Your email is not verified. We sent a verification link to your inbox.",
|
||||
"EmailNotVerified",
|
||||
));
|
||||
}
|
||||
Err(err.into())
|
||||
}
|
||||
}
|
||||
@@ -829,12 +941,22 @@ pub async fn oidc_providers(
|
||||
|
||||
let auth_app = &auth_service.auth_application_service;
|
||||
|
||||
// Policy questions the SPA needs to decide which forms to render.
|
||||
// `is_magic_link_login_allowed()` composes SMTP wiring + allowlist +
|
||||
// the "OIDC master → no magic-link login" hard rule; the login page
|
||||
// shows the magic-link tab iff this is true.
|
||||
let password_login_enabled = auth_app.is_password_login_allowed();
|
||||
let magic_link_login_enabled = auth_app.is_magic_link_login_allowed();
|
||||
let require_verified_email = auth_app.require_verified_email();
|
||||
|
||||
if !auth_app.oidc_enabled() {
|
||||
return Ok(Json(OidcProviderInfoDto {
|
||||
enabled: false,
|
||||
provider_name: String::new(),
|
||||
authorize_endpoint: String::new(),
|
||||
password_login_enabled: true,
|
||||
password_login_enabled,
|
||||
magic_link_login_enabled,
|
||||
require_verified_email,
|
||||
}));
|
||||
}
|
||||
|
||||
@@ -844,7 +966,9 @@ pub async fn oidc_providers(
|
||||
enabled: true,
|
||||
provider_name: config.provider_name.clone(),
|
||||
authorize_endpoint: "/api/auth/oidc/authorize".to_string(),
|
||||
password_login_enabled: !config.disable_password_login,
|
||||
password_login_enabled,
|
||||
magic_link_login_enabled,
|
||||
require_verified_email,
|
||||
}))
|
||||
}
|
||||
|
||||
@@ -1086,6 +1210,21 @@ pub async fn send_magic_link(
|
||||
));
|
||||
};
|
||||
|
||||
// Policy: `OXICLOUD_AUTH_METHODS` may forbid magic-link login even
|
||||
// when SMTP is wired (an operator might want the invite path — used
|
||||
// by admins to seed accounts — without offering it as a login
|
||||
// fallback). Refuse with the same anti-enum shape as any other
|
||||
// policy-gated endpoint.
|
||||
if let Some(auth) = state.auth_service.as_ref()
|
||||
&& !auth.auth_application_service.is_magic_link_login_allowed()
|
||||
{
|
||||
return Err(AppError::new(
|
||||
StatusCode::FORBIDDEN,
|
||||
"Magic-link login is disabled by policy.",
|
||||
"MagicLinkLoginDisabled",
|
||||
));
|
||||
}
|
||||
|
||||
// Authentication signal — presence (not validity) of Bearer header
|
||||
// OR access cookie. We deliberately don't decode the JWT here: a
|
||||
// stale-cookie holder gets a 401 from any other endpoint they
|
||||
@@ -1123,6 +1262,26 @@ pub async fn send_magic_link(
|
||||
)
|
||||
})?;
|
||||
|
||||
// Login-identifier resolution. The DTO field is named `email` for
|
||||
// backwards-compat, but the value may be either an email address or
|
||||
// a username — dispatch matches the `POST /api/auth/login`
|
||||
// convention (`@` present → email, else → username). Username
|
||||
// lookups happen BEFORE rate-limiting so `alice` and
|
||||
// `alice@example.com` bucket on the same key; without this,
|
||||
// alternating shapes would double the effective per-email budget.
|
||||
//
|
||||
// Anti-enum: username misses fall through to `body.email` unchanged
|
||||
// and land in the malformed_email / no_account branches downstream,
|
||||
// both of which return the uniform 200 with an audit line.
|
||||
let resolved_email = if let Some(auth) = state.auth_service.as_ref() {
|
||||
auth.auth_application_service
|
||||
.resolve_login_identifier_to_email(&body.email)
|
||||
.await
|
||||
.unwrap_or_else(|| body.email.clone())
|
||||
} else {
|
||||
body.email.clone()
|
||||
};
|
||||
|
||||
// Per-request browser-binding challenge (PR 22). Generated for
|
||||
// every request and set as a cookie on every 200 response —
|
||||
// including the silent-rate-limit paths — so the cookie's
|
||||
@@ -1170,8 +1329,11 @@ pub async fn send_magic_link(
|
||||
// casing/IDN-host tricks don't multiply the budget. Malformed
|
||||
// addresses skip this check and fall through to the service,
|
||||
// which records its own audit entry under reason="malformed_email".
|
||||
// Buckets on the RESOLVED email (post-username lookup) so
|
||||
// username and email inputs for the same account share one
|
||||
// budget — see resolve_login_identifier_to_email() above.
|
||||
if let Ok(normalised) =
|
||||
crate::domain::services::email_normalize::normalize_email(&body.email)
|
||||
crate::domain::services::email_normalize::normalize_email(&resolved_email)
|
||||
&& state
|
||||
.magic_link_send_per_email_rate_limiter
|
||||
.check_and_increment(&normalised)
|
||||
@@ -1191,8 +1353,12 @@ pub async fn send_magic_link(
|
||||
// The service swallows every operational outcome and logs the truth
|
||||
// via the audit channel; we surface only an internal error (DB down,
|
||||
// etc.). Anti-enumeration means we always return the same body.
|
||||
// We pass the resolved email — if the caller sent a username, the
|
||||
// service sees the corresponding address; if the caller sent a
|
||||
// bare unknown identifier, the service still audits it as
|
||||
// malformed_email / no_account.
|
||||
invite_svc
|
||||
.send_login_link(&body.email, &challenge)
|
||||
.send_login_link(&resolved_email, &challenge)
|
||||
.await
|
||||
.map_err(AppError::from)?;
|
||||
|
||||
|
||||
@@ -8,10 +8,10 @@
|
||||
//! 2. Issues access + refresh JWT for the token's owning user.
|
||||
//! 3. Sets the standard `oxicloud_access` / `oxicloud_refresh` /
|
||||
//! `oxicloud_csrf` cookies (same as `POST /api/auth/login`).
|
||||
//! 4. 302-redirects to a frontend hash-route based on the token's
|
||||
//! resource target:
|
||||
//! - Folder → `/#/files/folder/{id}`
|
||||
//! - File or NULL → `/#/sharedwithme`
|
||||
//! 4. 302-redirects to a SPA route based on the token's resource
|
||||
//! target:
|
||||
//! - Folder → `/files/{id}`
|
||||
//! - File or NULL → `/shared-with-me`
|
||||
//!
|
||||
//! Files don't have a deep-link route today; v1 lands file invitations
|
||||
//! on Shared With Me where the file shows up.
|
||||
@@ -140,7 +140,7 @@ struct RedeemQuery {
|
||||
params(("token" = String, Path, description = "Opaque magic-link token")),
|
||||
responses(
|
||||
(status = 200, description = "Cross-browser confirmation prompt (HTML page)"),
|
||||
(status = 302, description = "Redemption succeeded — redirects to the resource or to /#/sharedwithme"),
|
||||
(status = 302, description = "Redemption succeeded — redirects to the resource or to /shared-with-me"),
|
||||
(status = 410, description = "Token is unknown, expired, or already used"),
|
||||
(status = 503, description = "Magic-link feature is not configured on this server"),
|
||||
),
|
||||
@@ -574,24 +574,32 @@ fn build_success_response(state: &Arc<AppState>, redemption: MagicLinkRedemption
|
||||
response
|
||||
}
|
||||
|
||||
/// Build the SPA hash-route the redemption should land on. Mirrors the
|
||||
/// front-end's `deserializeHash()` parser at `static/js/app/main.js`.
|
||||
/// Build the SPA route the redemption should land on.
|
||||
///
|
||||
/// - **Resource token** (folder invitation): deep-link to the resource.
|
||||
/// - **NULL-resource token + external user**: land on `/#/sharedwithme`
|
||||
/// - **Resource token** (folder invitation): deep-link into the folder
|
||||
/// view. SvelteKit `files/[...path]` accepts folder IDs as path
|
||||
/// segments (see `frontend/src/routes/files/[...path]/+page.svelte`
|
||||
/// — `goto(resolve(`/files/${folder.id}`))`).
|
||||
/// - **NULL-resource token + external user**: land on `/shared-with-me`
|
||||
/// (their entry point — they own no folders themselves).
|
||||
/// - **NULL-resource token + internal user**: land on `/#/files` (the
|
||||
/// - **NULL-resource token + internal user**: land on `/files` (the
|
||||
/// user has a home folder; the "shared with me" view would be empty
|
||||
/// on first signup, so home is the better welcome). Internal users
|
||||
/// on NULL-resource tokens come from the email-only-signup welcome
|
||||
/// path (PR 18) or from a magic-link they requested themselves
|
||||
/// while password-eligible-and-lenient-mode (PR 19).
|
||||
///
|
||||
/// Historical: pre-SvelteKit these were hash routes
|
||||
/// (`/#/files`, `/#/sharedwithme`, `/#/files/folder/{id}`) served by the
|
||||
/// legacy vanilla frontend. Landing on those now serves the legacy
|
||||
/// shell (with old meta-CSP + inline scripts) instead of the SPA and
|
||||
/// triggers a CSP violation on modern deployments.
|
||||
fn redirect_target(redemption: &MagicLinkRedemption) -> String {
|
||||
match (redemption.resource_kind, redemption.resource_id) {
|
||||
(Some(MagicLinkResourceKind::Folder), Some(folder_id)) => {
|
||||
format!("/#/files/folder/{}", folder_id)
|
||||
format!("/files/{}", folder_id)
|
||||
}
|
||||
_ if redemption.auth.user.is_external => "/#/sharedwithme".to_string(),
|
||||
_ => "/#/files".to_string(),
|
||||
_ if redemption.auth.user.is_external => "/shared-with-me".to_string(),
|
||||
_ => "/files".to_string(),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -169,10 +169,43 @@ fn csp_hash(script: &str) -> String {
|
||||
|
||||
/// Text content of every inline `<script>` (no `src`) in `html`, returned as
|
||||
/// byte-exact slices suitable for CSP hashing.
|
||||
///
|
||||
/// Skips HTML comments (`<!-- ... -->`) before matching `<script`. Without this,
|
||||
/// a comment containing the literal string `<script>` (e.g. the theme-init
|
||||
/// explanatory block in the SvelteKit shell) causes the scanner to match the
|
||||
/// comment first, consume through the real script's `</script>`, and emit the
|
||||
/// wrong hash — the real inline script then fails CSP with `script-src 'self'`.
|
||||
fn inline_scripts(html: &str) -> Vec<&str> {
|
||||
let mut scripts = Vec::new();
|
||||
let mut cursor = 0;
|
||||
while let Some(rel) = find_ci(&html[cursor..], "<script") {
|
||||
while cursor < html.len() {
|
||||
let tail = &html[cursor..];
|
||||
// Skip past HTML comments — they may contain the literal
|
||||
// string `<script>` in prose and would otherwise poison the
|
||||
// scanner. Comment-nesting is not a spec concern.
|
||||
let next_comment = find_ci(tail, "<!--");
|
||||
let next_script = find_ci(tail, "<script");
|
||||
match (next_comment, next_script) {
|
||||
(Some(c), Some(s)) if c < s => {
|
||||
let end_rel = find_ci(&tail[c + 4..], "-->").map(|r| c + 4 + r + 3);
|
||||
cursor = match end_rel {
|
||||
Some(e) => cursor + e,
|
||||
None => break, // unterminated comment; give up
|
||||
};
|
||||
continue;
|
||||
}
|
||||
(Some(c), None) => {
|
||||
let end_rel = find_ci(&tail[c + 4..], "-->").map(|r| c + 4 + r + 3);
|
||||
cursor = match end_rel {
|
||||
Some(e) => cursor + e,
|
||||
None => break,
|
||||
};
|
||||
continue;
|
||||
}
|
||||
(None, None) => break,
|
||||
_ => {} // next thing is a real <script
|
||||
}
|
||||
let rel = next_script.unwrap();
|
||||
let tag_start = cursor + rel;
|
||||
// End of the opening tag.
|
||||
let Some(gt) = html[tag_start..].find('>') else {
|
||||
@@ -263,6 +296,31 @@ mod tests {
|
||||
assert_eq!(set.len(), 1);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn html_comment_mentioning_script_does_not_poison_scanner() {
|
||||
// The SvelteKit shell has an explanatory comment referring to
|
||||
// `<script>` in its prose (see static-dist/index.html theme-init
|
||||
// block). Without comment skipping the scanner matches the
|
||||
// comment's substring first, consumes through the real script's
|
||||
// close tag, and emits the wrong hash — the real script then
|
||||
// fails CSP with `script-src 'self'`.
|
||||
let html = concat!(
|
||||
"<!-- svelte.config.js finds this <script> by id and adds its hash -->\n",
|
||||
"<script id=\"theme-init\">alert(1);</script>\n",
|
||||
"<script>boot();</script>\n",
|
||||
);
|
||||
let scripts = inline_scripts(html);
|
||||
assert_eq!(scripts, vec!["alert(1);", "boot();"]);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn unterminated_comment_bails_out_gracefully() {
|
||||
// Malformed input: `<!--` never closed. Must not loop forever
|
||||
// and must not falsely capture anything downstream.
|
||||
let html = "<!-- unterminated <script>evil()</script>";
|
||||
assert!(inline_scripts(html).is_empty());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn distinct_scripts_produce_distinct_hashes() {
|
||||
assert_ne!(csp_hash("a()"), csp_hash("b()"));
|
||||
|
||||
+39
-1
@@ -174,7 +174,18 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
|
||||
// Explicit file → hard error on a missing/unreadable path.
|
||||
// Silent fallback would defeat the purpose of pinning the
|
||||
// config source.
|
||||
if let Err(e) = dotenvy::from_filename(path) {
|
||||
//
|
||||
// `from_filename_override` (not `from_filename`) so the
|
||||
// config file wins over the shell's process env. Without
|
||||
// this, an operator's leftover `export OXICLOUD_*` from a
|
||||
// dev session leaks into a `--config` invocation and
|
||||
// silently corrupts test/CI runs — a rejected shell var
|
||||
// stays in effect despite the "explicit config" contract.
|
||||
// For the default (no `--config`) path we KEEP the
|
||||
// non-overriding `dotenvy::dotenv()` — that path is dev
|
||||
// convenience where a live shell export is the expected
|
||||
// ad-hoc override.
|
||||
if let Err(e) = dotenvy::from_filename_override(path) {
|
||||
eprintln!("failed to load --config {path}: {e}");
|
||||
std::process::exit(2);
|
||||
}
|
||||
@@ -285,6 +296,33 @@ async fn run() -> Result<(), Box<dyn std::error::Error>> {
|
||||
// Load configuration from environment variables
|
||||
let config = common::config::AppConfig::from_env();
|
||||
|
||||
// SECURITY: fail-closed on incoherent auth-method configuration. A
|
||||
// magic-link-only policy without a working SMTP sender locks every
|
||||
// user out — nothing can mint tokens, so nobody can log in. Refuse
|
||||
// to start rather than boot into a bricked auth surface.
|
||||
//
|
||||
// The SMTP-mock (`OXICLOUD_SMTP_MOCK=true` in `tests/common/server.env`)
|
||||
// sets `OXICLOUD_SMTP_HOST=localhost`, so `is_enabled()` returns
|
||||
// true and the Hurl test harness satisfies this gate without a real
|
||||
// mail server.
|
||||
if config
|
||||
.auth
|
||||
.allowed_auth_methods
|
||||
.contains(&common::config::AuthMethod::MagicLink)
|
||||
&& !config
|
||||
.auth
|
||||
.allowed_auth_methods
|
||||
.contains(&common::config::AuthMethod::Password)
|
||||
&& !config.smtp.is_enabled()
|
||||
{
|
||||
panic!(
|
||||
"FATAL: OXICLOUD_AUTH_METHODS enables `magic_link` as the ONLY \
|
||||
self-service auth method, but no SMTP transport is configured. \
|
||||
Set OXICLOUD_SMTP_HOST (and matching OXICLOUD_SMTP_* settings) \
|
||||
or add `password` to OXICLOUD_AUTH_METHODS. Refusing to start."
|
||||
);
|
||||
}
|
||||
|
||||
// Surface the upload-size limits at startup. Operators (and the
|
||||
// CI runner) need to see what's actually in effect — a silent
|
||||
// fallback to the 100 MB default when `OXICLOUD_CHUNK_MAX_BYTES`
|
||||
|
||||
@@ -82,3 +82,26 @@ Content-Type: application/json
|
||||
{ "username": "ghost@nowhere.invalid", "password": "{{password}}" }
|
||||
|
||||
HTTP 403
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
# Case 7 — /api/auth/oidc/providers advertises the auth-method
|
||||
# policy the SPA needs to render the correct forms.
|
||||
#
|
||||
# tests/common/server.env has OXICLOUD_OIDC_ENABLED=false,
|
||||
# OXICLOUD_SMTP_MOCK=true (so SMTP is "wired"), and the default
|
||||
# OXICLOUD_AUTH_METHODS (both methods allowed). Expected shape:
|
||||
# enabled: false — no OIDC IdP configured
|
||||
# password_login_enabled: true — default allowlist includes it
|
||||
# magic_link_login_enabled: true — SMTP wired + allowlist + no OIDC
|
||||
# require_verified_email: false — default
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
GET {{base_url}}/api/auth/oidc/providers
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.enabled" == false
|
||||
jsonpath "$.password_login_enabled" == true
|
||||
jsonpath "$.magic_link_login_enabled" == true
|
||||
jsonpath "$.require_verified_email" == false
|
||||
|
||||
|
||||
@@ -0,0 +1,162 @@
|
||||
# =============================================================
|
||||
# OxiCloud — magic-link login for password users
|
||||
# =============================================================
|
||||
# Regression pin for the `OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users`
|
||||
# switch. Default eligibility ladder refuses `has_password` accounts
|
||||
# (the strict argument: mailbox-strength shouldn't shadow the stronger
|
||||
# credential). Operators who prefer modern-SaaS UX opt-in via this
|
||||
# policy; when set, `POST /api/auth/magic-link/send` mints a login token
|
||||
# for accounts that also have a password.
|
||||
#
|
||||
# Cross-file coupling: `tests/common/server.env` sets
|
||||
# `OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users`. Without
|
||||
# it, Step 2 below would land on `reason="has_password"` and mail nothing
|
||||
# — Step 3's SMTP capture would fail with an empty inbox.
|
||||
#
|
||||
# What is NOT exercised here:
|
||||
# * OIDC-master rule: covered separately in tests/oidc/oidc.hurl
|
||||
# step 2b (magic-link SEND refused when OIDC is enabled).
|
||||
# * `has_password` rejection under the strict default: can't be
|
||||
# exercised in the same run — the env is global. Rust unit test
|
||||
# on `magic_link_eligibility()` covers it directly.
|
||||
# =============================================================
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
# Step 1 — Admin login. Needed to reach the mock-SMTP capture
|
||||
# endpoint (admin-scoped: /api/admin/smtp/test/captured).
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
POST {{base_url}}/api/auth/login
|
||||
Content-Type: application/json
|
||||
{ "username": "{{username}}", "password": "{{password}}" }
|
||||
|
||||
HTTP 200
|
||||
[Captures]
|
||||
alice_token: jsonpath "$.access_token"
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
# Step 2 — Baseline: admin logs in normally with a password.
|
||||
# Confirms nothing about the policy has broken the
|
||||
# classic path. Same call as Step 1, kept as a
|
||||
# named baseline for readers of the test log.
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
POST {{base_url}}/api/auth/login
|
||||
Content-Type: application/json
|
||||
{ "username": "{{username}}", "password": "{{password}}" }
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.access_token" exists
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
# Step 3 — Request a magic-link for the SAME user via email.
|
||||
# Anti-enum uniform 200 regardless of eligibility, so
|
||||
# the real proof of "policy fired, mail actually sent"
|
||||
# is the SMTP capture in Step 5. Without the policy
|
||||
# in server.env, this same request would be refused
|
||||
# under `reason="has_password"` and no mail would be
|
||||
# captured.
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
POST {{base_url}}/api/auth/magic-link/send
|
||||
Content-Type: application/json
|
||||
{ "email": "{{email}}" }
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.message" contains "sign-in link"
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
# Step 4 — Same request, but with the LOGIN-IDENTIFIER passed
|
||||
# as a username (no `@`). Server dispatches on `@` and
|
||||
# resolves the username to the registered email BEFORE
|
||||
# rate-limiting, so `admin` and `admin@example.com`
|
||||
# bucket on one budget. Uniform 200 either way.
|
||||
#
|
||||
# The browser-binding challenge cookie is captured HERE
|
||||
# (not on Step 3): each `/send` request mints a fresh
|
||||
# challenge, and Step 5 will fetch the MOST RECENT mail —
|
||||
# which was minted by this very request. Capturing from
|
||||
# Step 3 instead would pair a stale cookie with Step 4's
|
||||
# token, and Step 6's redemption would land on PR 22's
|
||||
# cross-browser confirmation page (200 HTML) instead of
|
||||
# the direct 302.
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
POST {{base_url}}/api/auth/magic-link/send
|
||||
Content-Type: application/json
|
||||
{ "email": "{{username}}" }
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.message" contains "sign-in link"
|
||||
[Captures]
|
||||
alice_magic_cookie: header "set-cookie" regex "oxicloud_magic_request=([^;]+)"
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
# Step 5 — Capture the mail. The mock SMTP records every
|
||||
# outbound message keyed on the recipient. Two magic-
|
||||
# link mails should have landed (steps 3 and 4), both
|
||||
# addressed to the admin's registered email. The
|
||||
# captured endpoint returns the MOST RECENT one — we
|
||||
# extract its link.
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
GET {{base_url}}/api/admin/smtp/test/captured?to={{email}}
|
||||
Authorization: Bearer {{alice_token}}
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.to" == "{{email}}"
|
||||
jsonpath "$.text_body" matches "/magic/v1/[A-Za-z0-9_-]+"
|
||||
[Captures]
|
||||
alice_magic_url: jsonpath "$.text_body" regex "(https?://[^\\s]+/magic/v1/[A-Za-z0-9_-]+)"
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
# Step 6 — Redeem the link with the matching browser-binding
|
||||
# cookie. Internal user, no resource target → lands
|
||||
# on `/files` (SPA route). Access-token cookie is set
|
||||
# on the redirect response.
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
GET {{alice_magic_url}}
|
||||
Cookie: oxicloud_magic_request={{alice_magic_cookie}}
|
||||
|
||||
HTTP 302
|
||||
[Asserts]
|
||||
header "Location" == "/files"
|
||||
[Captures]
|
||||
alice_magic_access_token: cookie "oxicloud_access"
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
# Step 7 — The cookie session works: /api/auth/me returns the
|
||||
# admin's own profile. Proves the magic-link redemption
|
||||
# created a real session for the password-holding user
|
||||
# — the point of the whole `permit_magic_link_for_password_users`
|
||||
# policy.
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
GET {{base_url}}/api/auth/me
|
||||
Authorization: Bearer {{alice_magic_access_token}}
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.email" == "{{email}}"
|
||||
jsonpath "$.username" == "{{username}}"
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
# Step 8 — Anti-enum sanity: magic-link for a non-existent
|
||||
# identifier. Same uniform 200 shape, no mail sent.
|
||||
# The audit log records reason="no_account" — not
|
||||
# observable from the client, but the response shape
|
||||
# is IDENTICAL to Step 3, which is the whole point.
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
POST {{base_url}}/api/auth/magic-link/send
|
||||
Content-Type: application/json
|
||||
{ "email": "ghost-user-that-doesnt-exist" }
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.message" contains "sign-in link"
|
||||
@@ -159,7 +159,11 @@ GET {{magic_url}}
|
||||
|
||||
HTTP 302
|
||||
[Asserts]
|
||||
header "Location" == "/#/files/folder/{{ext_folder_id}}"
|
||||
# SvelteKit `files/[...path]` accepts a folder ID as a path segment.
|
||||
# Historical value pre-migration was `/#/files/folder/{id}` (legacy
|
||||
# vanilla-frontend hash-routing). Kept in sync with the redemption
|
||||
# handler in src/interfaces/api/handlers/magic_link_handler.rs.
|
||||
header "Location" == "/files/{{ext_folder_id}}"
|
||||
[Captures]
|
||||
bob_access_token: cookie "oxicloud_access"
|
||||
|
||||
@@ -240,9 +244,15 @@ HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.id" == "{{alice_user_id}}"
|
||||
jsonpath "$.is_external" == false
|
||||
# PR 23 — alice is the admin set up via classic password registration
|
||||
# and has never clicked a magic-link, so her email is unverified.
|
||||
jsonpath "$.email_verified_at" not exists
|
||||
# Setup admin is auto-verified at creation. `setup_create_admin` stamps
|
||||
# `email_verified_at = NOW()` — admin fiat counts as verification,
|
||||
# matching the OIDC-JIT convention. Rationale: an operator running the
|
||||
# first-run wizard is authoritative by construction (they set the
|
||||
# password at the console on a fresh install). Without this, flipping
|
||||
# `OXICLOUD_REQUIRE_VERIFIED_EMAIL=true` on an existing deployment
|
||||
# would lock the sole admin out of their own instance. The admin login
|
||||
# exemption is a second layer of defense; this stamp is the primary.
|
||||
jsonpath "$.email_verified_at" exists
|
||||
|
||||
# 11e — bob CANNOT enumerate unrelated users. A random UUID returns 404
|
||||
# (anti-enumeration; same response as "user doesn't exist").
|
||||
@@ -350,7 +360,7 @@ jsonpath "$.message" contains "sign-in link"
|
||||
|
||||
# 15b — Capture the fresh email; extract the NEW magic-link URL.
|
||||
# This is a NULL-resource token (login flow), so redemption
|
||||
# will land on /#/sharedwithme rather than a deep-link.
|
||||
# will land on /shared-with-me rather than a deep-link.
|
||||
GET {{base_url}}/api/admin/smtp/test/captured?to=bob@externalcompany.com
|
||||
Authorization: Bearer {{alice_token}}
|
||||
|
||||
@@ -376,13 +386,17 @@ body contains "different browser"
|
||||
# 15c-ii — Same token, with `?confirm=1` to acknowledge the
|
||||
# cross-browser redemption. PR 22 audit-logs
|
||||
# `cross_browser_confirmed=true` on the success line.
|
||||
# Lands on /#/sharedwithme since the token has no
|
||||
# resource target.
|
||||
# Lands on /shared-with-me since the token has no
|
||||
# resource target (external user, NULL resource_kind).
|
||||
GET {{login_magic_url}}?confirm=1
|
||||
|
||||
HTTP 302
|
||||
[Asserts]
|
||||
header "Location" == "/#/sharedwithme"
|
||||
# SvelteKit route (path-based). Historical value pre-migration was
|
||||
# `/#/sharedwithme` (legacy vanilla-frontend hash-routing). Kept in
|
||||
# sync with `redirect_target()` in
|
||||
# src/interfaces/api/handlers/magic_link_handler.rs.
|
||||
header "Location" == "/shared-with-me"
|
||||
[Captures]
|
||||
bob_relogin_token: cookie "oxicloud_access"
|
||||
|
||||
@@ -408,10 +422,15 @@ Authorization: Bearer {{alice_token}}
|
||||
HTTP 404
|
||||
|
||||
# 15f — Email maps to an existing internal user with a password
|
||||
# (Alice the admin) → uniform 200 but the magic link is NOT
|
||||
# actually sent. has_login_credential() short-circuits the
|
||||
# service so password/OIDC accounts cannot be bypassed via
|
||||
# mailbox ownership at the moment of request.
|
||||
# (Alice the admin). The test env has
|
||||
# `OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users`
|
||||
# set globally in `tests/common/server.env`, so the `has_password`
|
||||
# eligibility check is bypassed and the link IS minted. Under
|
||||
# the STRICT default (policy absent), the eligibility ladder
|
||||
# would refuse with `reason="has_password"` and no mail would
|
||||
# ship — that path is covered by a Rust unit test on
|
||||
# `magic_link_eligibility()` because it needs the opposite env
|
||||
# which we can't hot-swap mid-run.
|
||||
POST {{base_url}}/api/auth/magic-link/send
|
||||
Content-Type: application/json
|
||||
{ "email": "{{email}}" }
|
||||
@@ -420,10 +439,15 @@ HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.message" contains "sign-in link"
|
||||
|
||||
# With the permit policy, a mail WAS captured. Rate-limit slot burned
|
||||
# either way (increment fires before eligibility) — Step 16's math
|
||||
# still holds.
|
||||
GET {{base_url}}/api/admin/smtp/test/captured?to={{email}}
|
||||
Authorization: Bearer {{alice_token}}
|
||||
|
||||
HTTP 404
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.to" == "{{email}}"
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
|
||||
@@ -5,8 +5,8 @@
|
||||
# `POST /api/auth/register`. Email-only signup:
|
||||
# - returns a uniform 200 message (no JWT, no UserDto)
|
||||
# - mints a welcome magic-link mailed to `email`
|
||||
# - redemption lands the new internal user on `/#/files`
|
||||
# (not `/#/sharedwithme`, which is for externals)
|
||||
# - redemption lands the new internal user on `/files`
|
||||
# (not `/shared-with-me`, which is for externals)
|
||||
#
|
||||
# Requires `OXICLOUD_SMTP_MOCK=true` (set in tests/common/server.env).
|
||||
# =============================================================
|
||||
@@ -111,14 +111,19 @@ body contains "different browser"
|
||||
# Step 5b — Same link, this time with the matching cookie.
|
||||
# PR 22 binds the magic-link to the requesting browser;
|
||||
# a matching cookie redeems instantly. Internal user
|
||||
# with no resource target → lands on `/#/files`.
|
||||
# with no resource target → lands on `/files`.
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
GET {{pr18_magic_url}}
|
||||
Cookie: oxicloud_magic_request={{pr18_magic_cookie}}
|
||||
|
||||
HTTP 302
|
||||
[Asserts]
|
||||
header "Location" == "/#/files"
|
||||
# SPA route (SvelteKit path-based). Historical value pre-migration was
|
||||
# `/#/files` (legacy vanilla frontend hash-routing). Changed alongside
|
||||
# the migration off the legacy shell — landing on the hash route now
|
||||
# serves the legacy `static/index.html` with its meta-CSP inline
|
||||
# scripts, which the SPA CSP blocks.
|
||||
header "Location" == "/files"
|
||||
[Captures]
|
||||
pr18_access_token: cookie "oxicloud_access"
|
||||
|
||||
@@ -350,6 +355,61 @@ HTTP 200
|
||||
jsonpath "$.message" contains "request received"
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
# Step 12 — OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS gate.
|
||||
#
|
||||
# `tests/common/server.env` pins the allowlist to
|
||||
# `example.com,example.test`. Every legitimate signup above stayed
|
||||
# inside that set. Now attempt an off-domain address and assert:
|
||||
#
|
||||
# * HTTP 403 (NOT the anti-enumeration 200 — instance-wide policy
|
||||
# is not a per-user oracle; a rejected domain hasn't
|
||||
# established whether a specific address exists).
|
||||
# * `RegistrationDomainNotAllowed` error code so operators and
|
||||
# frontends can distinguish this from other 403 shapes
|
||||
# (`RegistrationDisabled`, `PasswordRegistrationDisabled`).
|
||||
#
|
||||
# The gate is CASE-INSENSITIVE on the post-`@` part — extra
|
||||
# request with mixed case pins that behaviour so a future refactor
|
||||
# can't silently regress a lowercase-only match.
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
POST {{base_url}}/api/auth/register
|
||||
Content-Type: application/json
|
||||
{
|
||||
"username": "off-domain",
|
||||
"email": "someone@nowhere.invalid",
|
||||
"password": "TestPassword1!"
|
||||
}
|
||||
|
||||
HTTP 403
|
||||
[Asserts]
|
||||
# `$.error` carries the human-readable message; the stable
|
||||
# machine-readable code lives at `$.error_type` (see
|
||||
# `interfaces/errors.rs::ErrorResponse`). Pin `error_type` so a
|
||||
# future copy-edit of the message doesn't break the test.
|
||||
jsonpath "$.error_type" == "RegistrationDomainNotAllowed"
|
||||
|
||||
|
||||
# Case-insensitive matching regression pin: `EXAMPLE.COM` in the
|
||||
# post-`@` part is normalised to `example.com` and accepted. Reuse
|
||||
# charlie's already-taken email so the request lands on the
|
||||
# anti-enum-200 collision path — this way we exercise the domain
|
||||
# gate (must pass) without creating a new user that would need
|
||||
# cleanup, and pin the "case-insensitive normalization" invariant
|
||||
# in one step.
|
||||
POST {{base_url}}/api/auth/register
|
||||
Content-Type: application/json
|
||||
{
|
||||
"username": "case-check",
|
||||
"email": "charlie@EXAMPLE.COM",
|
||||
"password": "TestPassword1!"
|
||||
}
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.message" contains "request received"
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
# Cleanup — admin deletes both test users.
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
|
||||
@@ -147,6 +147,7 @@ hurl --variables-file "$API_DIR/test.env" --file-root "$REPO_ROOT/tests" --test
|
||||
"$API_DIR/setup.hurl" \
|
||||
"$API_DIR/auth_login.hurl" \
|
||||
"$API_DIR/auth_session_lifecycle.hurl" \
|
||||
"$API_DIR/auth_magic_link_login.hurl" \
|
||||
"$API_DIR/registration.hurl" \
|
||||
"$API_DIR/nc_status_capabilities.hurl" \
|
||||
"$API_DIR/nc_login_flow_v2.hurl" \
|
||||
|
||||
@@ -39,6 +39,19 @@ OXICLOUD_RATE_LIMIT_LOGIN_MAX=3600
|
||||
OXICLOUD_RATE_LIMIT_REGISTER_MAX=3600
|
||||
OXICLOUD_TRUST_PROXY_CIDR=0.0.0.0/0
|
||||
|
||||
# Mock SMTP — same block as server.env. Required so `magic-link/send`
|
||||
# reaches the policy gate (returns 403 MagicLinkLoginDisabled under the
|
||||
# OIDC-master rule) instead of short-circuiting to 503 ServiceUnavailable
|
||||
# because the invite service is unconfigured. The captured-mail endpoint
|
||||
# is still available even when magic-link login is refused — invitations
|
||||
# to non-OIDC recipients still route through this transport.
|
||||
OXICLOUD_SMTP_MOCK=true
|
||||
OXICLOUD_SMTP_HOST=localhost
|
||||
OXICLOUD_SMTP_PORT=25
|
||||
OXICLOUD_SMTP_FROM='OxiCloud Tests <test@oxicloud.local>'
|
||||
OXICLOUD_SMTP_TLS=none
|
||||
OXICLOUD_ALLOW_EXTERNAL_USERS=true
|
||||
|
||||
# ── OIDC client wired at the fake-idp sidecar ──────────────────────────────
|
||||
# tests/oidc/fake_idp/server.js (panva/node-oidc-provider) publishes the
|
||||
# issuer at the root URL; discovery is at /.well-known/openid-configuration
|
||||
@@ -66,3 +79,6 @@ OXICLOUD_OIDC_PROVIDER_NAME=MockSSO
|
||||
# match. This is the standard Authentik/Keycloak/Entra pattern: an
|
||||
# IdP group becomes an OxiCloud role.
|
||||
OXICLOUD_OIDC_ADMIN_GROUPS=admin-users
|
||||
|
||||
OXICLOUD_AUTH_METHODS=password,magic_link
|
||||
OXICLOUD_REQUIRE_VERIFIED_EMAIL=false
|
||||
|
||||
@@ -69,6 +69,31 @@ OXICLOUD_SMTP_FROM='OxiCloud Tests <test@oxicloud.local>'
|
||||
OXICLOUD_SMTP_TLS=none
|
||||
OXICLOUD_ALLOW_EXTERNAL_USERS=true
|
||||
|
||||
# Public-registration email-domain allowlist. Exercised by
|
||||
# `registration.hurl` step "off-domain rejection" (attempts to
|
||||
# register with @nowhere.invalid and asserts 403
|
||||
# `RegistrationDomainNotAllowed`). Contains BOTH `example.com` (Hurl
|
||||
# fixtures use it — charlie@example.com etc.) AND `example.test` (E2E
|
||||
# login.spec uses it — reg-*@example.test). Every legitimate test
|
||||
# path stays inside the allowlist; the rejection test picks a domain
|
||||
# outside it deliberately.
|
||||
OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS=example.com,example.test
|
||||
|
||||
# Auth-policy vector. Enables the "magic-link login is allowed for
|
||||
# accounts that also have a password" branch — required by
|
||||
# auth_magic_link_login.hurl (alice has a password AND requests a
|
||||
# magic-link login). Inert for every other test: `has_password`
|
||||
# refusal only fires when the endpoint is called, and no other file
|
||||
# calls `magic-link/send` for a password-holding account.
|
||||
OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users
|
||||
OXICLOUD_AUTH_METHODS=password,magic_link
|
||||
# Explicit pin — `--config` now overrides shell env (main.rs uses
|
||||
# `from_filename_override`), but pinning here documents the intended
|
||||
# test-env state. Flip to true for the deferred `tests/verify_email/`
|
||||
# suite; leaving false here keeps every other suite on the "verified
|
||||
# email not required" path (charlie's classic register+login etc.).
|
||||
OXICLOUD_REQUIRE_VERIFIED_EMAIL=false
|
||||
|
||||
# PR 12 — magic-link rate-limit caps lowered so external_users.hurl can
|
||||
# exercise the cap behaviour with a small, deterministic request count.
|
||||
# Production defaults are 50 / 5 / 200 respectively (see example.env).
|
||||
|
||||
@@ -29,11 +29,22 @@ test.describe('SPA · authentication', () => {
|
||||
await expect(page.getByTestId('login-form')).toBeVisible();
|
||||
});
|
||||
|
||||
test('magic-link panel toggles open', async ({ page }) => {
|
||||
test('submit button dispatches to magic-link when password is empty', async ({ page }) => {
|
||||
// Unified login form: one identifier + one optional password + one
|
||||
// adaptive submit button. Filling the identifier and leaving the
|
||||
// password blank flips the button label to "Send sign-in link" and
|
||||
// routes to /api/auth/magic-link/send on click. The old two-form
|
||||
// UX with `login-magic-toggle-btn` was retired 2026-07-14.
|
||||
await page.goto('/login');
|
||||
await page.getByTestId('login-magic-toggle-btn').click();
|
||||
await expect(page.getByTestId('login-magic-form')).toBeVisible();
|
||||
await expect(page.getByTestId('login-magic-email-input')).toBeVisible();
|
||||
await expect(page.getByTestId('login-form')).toBeVisible();
|
||||
await page.getByTestId('login-username-input').fill('someone@example.test');
|
||||
// Password intentionally NOT filled — this drives the label swap.
|
||||
const submit = page.getByTestId('login-submit-btn');
|
||||
await expect(submit).toBeVisible();
|
||||
// Label content differs per mode: password-empty → magic-link copy;
|
||||
// password-filled → "Sign in". Assert the magic-link copy is what's
|
||||
// shown so the dispatch is provably in the magic-link branch.
|
||||
await expect(submit).toHaveText(/link|Link|Send/);
|
||||
});
|
||||
|
||||
test('successful login reaches the files app shell', async ({ page }) => {
|
||||
|
||||
@@ -58,13 +58,21 @@ test('an oidc callback code is exchanged on load', async ({ page }) => {
|
||||
});
|
||||
|
||||
test('request a magic link from the login page', async ({ page }) => {
|
||||
// Unified form: leave the password field empty and submit — the
|
||||
// adaptive submit routes to /api/auth/magic-link/send with the
|
||||
// identifier as-is (backend accepts email OR username via `@`
|
||||
// dispatch). Old separate `login-magic-*` testids retired in the
|
||||
// single-form refactor.
|
||||
await page.goto('/login');
|
||||
await page.getByTestId('login-magic-toggle-btn').click();
|
||||
await expect(page.getByTestId('login-magic-form')).toBeVisible();
|
||||
await expect(page.getByTestId('login-form')).toBeVisible();
|
||||
|
||||
await page.getByTestId('login-magic-email-input').fill('someone@example.test');
|
||||
await page.getByTestId('login-magic-send-btn').click();
|
||||
// A status message resolves (success or error); give the request time to run.
|
||||
await page.getByTestId('login-username-input').fill('someone@example.test');
|
||||
// Password intentionally NOT filled.
|
||||
await page.getByTestId('login-submit-btn').click();
|
||||
|
||||
// A status message resolves (uniform 200 anti-enum success or error);
|
||||
// give the request time to run.
|
||||
await page.waitForTimeout(1_000);
|
||||
await expect(page.getByTestId('login-magic-form').or(page.getByTestId('login-form')).first()).toBeVisible();
|
||||
// Still on the login page either way — anti-enum success doesn't redirect.
|
||||
await expect(page.getByTestId('login-form')).toBeVisible();
|
||||
});
|
||||
|
||||
@@ -69,6 +69,31 @@ jsonpath "$.enabled" == true
|
||||
jsonpath "$.provider_name" == "MockSSO"
|
||||
jsonpath "$.authorize_endpoint" == "/api/auth/oidc/authorize"
|
||||
jsonpath "$.password_login_enabled" == true
|
||||
# OIDC-master rule: magic-link login must be reported as OFF when OIDC
|
||||
# is enabled, regardless of `OXICLOUD_AUTH_METHODS` or SMTP wiring.
|
||||
# Magic-link would bypass any 2FA / step-up the IdP enforces; refusing
|
||||
# it at the deployment level is a hard invariant. The SPA reads this
|
||||
# to hide the "Send sign-in link" affordance.
|
||||
jsonpath "$.magic_link_login_enabled" == false
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
# Step 2b — OIDC-master rule regression at the endpoint layer.
|
||||
# `POST /api/auth/magic-link/send` is refused with 403
|
||||
# `MagicLinkLoginDisabled` when OIDC is enabled. The
|
||||
# mock SMTP is configured (server-with-oidc.env has the
|
||||
# full SMTP block) so this proves the policy gate fires
|
||||
# BEFORE the "SMTP not wired" 503, which would otherwise
|
||||
# mask the real reason. The 403 error_type is the machine-
|
||||
# readable contract the SPA switches on.
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
POST {{base_url}}/api/auth/magic-link/send
|
||||
Content-Type: application/json
|
||||
{ "email": "someone@example.com" }
|
||||
|
||||
HTTP 403
|
||||
[Asserts]
|
||||
jsonpath "$.error_type" == "MagicLinkLoginDisabled"
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
|
||||
Reference in New Issue
Block a user