54137122a7
First Microsoft logins failed with 400 "email: Cannot be blank": Graph's
/oidc/userinfo endpoint omits the email claim for accounts without a
mail attribute, and team_members requires an e-mail (it also drives the
ENTRA_ADMIN_EMAILS role mapping). Reproduced against a mock Entra with
PocketBase v0.30.4; the user-supplied response body matched the
missing-email fingerprint exactly.
- provider config (reconciler + migration fast-path): userInfoURL is now
empty, so PocketBase reads the claims from the Entra id_token, which
always carries preferred_username (UPN) and email when available. The
#18 reconciler flips the already-deployed Labs provider automatically
on the next boot — no migration needed.
- pb_hooks/entra_oidc.pb.js: onRecordAuthWithOAuth2Request hook falls
back to the lowercased UPN when the email claim is absent. Guest UPNs
(ext_user#EXT#@tenant...) are excluded explicitly — "#" is RFC-valid
in an e-mail local part, so both a naive regex AND PocketBase's own
validation would accept them (caught by test V5). The hook also logs
every failed OAuth2 attempt with the underlying error to the container
log, which PocketBase otherwise only writes to its internal logs db.
Verified with a switchable mock-Entra matrix (8/8): no-email→UPN e-mail
+ allow-list role, email claim wins when present, no duplicate on
re-login, guest UPN yields a clean validation error, anonymous REST
create stays rejected, both log lines present. Regression: issue-22
matrix 9/9 (baseline pinned to 1a1351d now that #23 is merged), DoD
harness 15/15, npm test 112/112.
Closes #24
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
63 lines
2.8 KiB
JavaScript
63 lines
2.8 KiB
JavaScript
/// <reference path="../pb_data/types.d.ts" />
|
|
//
|
|
// Issue #18 — Reconcile the Entra (Azure) OIDC provider from the environment.
|
|
//
|
|
// The team_members→auth migration (pb_migrations/1781000000) is structure-only
|
|
// and runs exactly once. Provider CONFIGURATION lives here instead, so that:
|
|
//
|
|
// * an environment whose migration applied while the ENTRA_* secrets were
|
|
// absent gets its provider enabled on the next startup (no re-apply),
|
|
// * rotating ENTRA_CLIENT_SECRET / changing the tenant only requires new env
|
|
// values and a container restart,
|
|
// * a fresh database gets its provider on the first cron tick right after
|
|
// the migrations created the collection (onBootstrap fires BEFORE the
|
|
// migrations run — there is no post-migration lifecycle hook in the JSVM,
|
|
// hence the cron fallback).
|
|
//
|
|
// The reconciler compares before saving, so both hooks are cheap no-ops when
|
|
// everything is already in sync.
|
|
|
|
onBootstrap((e) => {
|
|
e.next();
|
|
const { reconcileEntraOidc } = require(`${__hooks}/utils.js`);
|
|
// reconcileEntraOidc logs a warn-once itself when the ENTRA_* env is absent.
|
|
console.log("entra_oidc reconcile (bootstrap): " + reconcileEntraOidc(e.app));
|
|
});
|
|
|
|
cronAdd("entraOidcReconcile", "* * * * *", () => {
|
|
const { reconcileEntraOidc } = require(`${__hooks}/utils.js`);
|
|
const result = reconcileEntraOidc($app);
|
|
// Only log state changes — this tick runs every minute.
|
|
if (result === "updated") {
|
|
console.log("entra_oidc reconcile (cron): OIDC provider (re)configured from ENTRA_* env");
|
|
}
|
|
});
|
|
|
|
// Entra does not always supply an `email` claim: the id_token only carries it
|
|
// when the account has a mail attribute (issue #24). The UPN in
|
|
// `preferred_username` is always present and equals the primary e-mail for
|
|
// Respellion organisation accounts, so fall back to it when it looks like a
|
|
// real address. Guest UPNs ("user_ext#EXT#@tenant...") fail the regex on
|
|
// purpose — those still get a clear validation error instead of a bogus email.
|
|
// The catch also surfaces the underlying OAuth2 failure in the container log,
|
|
// which PocketBase otherwise only writes to its internal logs database.
|
|
onRecordAuthWithOAuth2Request((e) => {
|
|
const u = e.oAuth2User;
|
|
if (u && !u.email) {
|
|
const upn = String((u.rawUser && u.rawUser.preferred_username) || u.username || "").trim().toLowerCase();
|
|
// `#` is RFC-valid in an e-mail local part, so guest UPNs
|
|
// ("ext_user#EXT#@tenant.onmicrosoft.com") pass a naive e-mail check AND
|
|
// PocketBase's own validation — exclude them explicitly.
|
|
if (/^[^@\s#]+@[^@\s#]+\.[^@\s#]+$/.test(upn)) {
|
|
u.email = upn;
|
|
console.log("entra_oidc: email claim absent — falling back to UPN " + upn);
|
|
}
|
|
}
|
|
try {
|
|
e.next();
|
|
} catch (err) {
|
|
console.log("entra_oidc auth-with-oauth2 FAILED:", String(err));
|
|
throw err;
|
|
}
|
|
}, "team_members");
|