Ryan/documenso
1
0
Fork 1
mirror of https://github.com/documenso/documenso.git synced 2025-11-13 08:13:56 +10:00
Code Issues Packages Projects Releases Wiki Activity

feat: allow oidc only signup and trust mail addresses (#1208)

Browse Source 
This change will allow for user registration when users are federated
through oidc provider even if the general signup is disabled
additionally the users email address can now be automatically set as
trusted. This will force corporate users to signin using SSO instead of
creating manual accounts.
This commit is contained in:
Rene Steen
2024-07-31 07:38:12 +02:00
committed by GitHub
parent a9025b5d97
commit 7ed0a909eb
6 changed files with 38 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
apps/web/process-env.d.ts vendored
View File

@ -16,5 +16,7 @@ declare namespace NodeJS {
NEXT_PRIVATE_OIDC_WELL_KNOWN: string;
NEXT_PRIVATE_OIDC_CLIENT_ID: string;
NEXT_PRIVATE_OIDC_CLIENT_SECRET: string;
NEXT_PRIVATE_OIDC_ALLOW_SIGNUP?: string;
NEXT_PRIVATE_OIDC_SKIP_VERIFY?: string;
}
}

14
apps/web/src/pages/api/auth/[...nextauth].ts
View File

@ -60,13 +60,23 @@ export default async function auth(req: NextApiRequest, res: NextApiResponse) {
},
});
},
linkAccount: async ({ user }) => {
linkAccount: async ({ user, account, profile }) => {
const userId = typeof user.id === 'string' ? parseInt(user.id) : user.id;
if (isNaN(userId)) {
if (Number.isNaN(userId)) {
return;
}
// If the user is linking an OIDC account and the email verified date is set then update it in the db.
if (account.provider === 'oidc' && profile.emailVerified !== null) {
await prisma.user.update({
where: { id: userId },
data: {
emailVerified: profile.emailVerified,
},
});
}
await prisma.userSecurityAuditLog.create({
data: {
userId,