prehistoric-systems/bewcloud
1
0
Fork 0
mirror of https://github.com/bewcloud/bewcloud.git synced 2026-03-11 08:54:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

chore: apply suggestions from code review

Browse source 
Co-authored-by: BrunoBernardino <me@brunobernardino.com>

Co-authored-by: Bruno Bernardino <hey@bruno.eu>
This commit is contained in:
Piotr Łoboda 2026-02-26 09:44:09 +01:00 committed by GitHub
parent 436d919ead
commit cc5d6e724a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 9 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
bewcloud.config.sample.ts
View file

@ -11,7 +11,7 @@ const config: PartialDeep<Config> = {
// allowedCookieDomains: ['example.com', 'example.net'], // Can be set to allow more than the baseUrl's domain for session cookies
// skipCookieDomainSecurity: true, // If true, the cookie domain will not be strictly set and checked against. This skipping slightly reduces security, but is usually necessary for reverse proxies like Cloudflare Tunnel
// enableSingleSignOn: false, // If true, single sign-on will be enabled
// allowSingleSignOnSignups: false, // If true, single sign-on signups will be allowed overriding allowSignups
// allowSignupsViaSingleSignOn: false, // If true, signups via single sign-on will be allowed, overriding allowSignups
// singleSignOnUrl: '', // The Discovery URL (AKA Issuer) of the identity/single sign-on provider
// singleSignOnEmailAttribute: 'email', // The attribute to prefer as email of the identity/single sign-on provider
// singleSignOnScopes: ['openid', 'email'], // The scopes to request from the identity/single sign-on provider

6
lib/config.ts
View file

@ -16,7 +16,7 @@ export class AppConfig {
allowedCookieDomains: [],
skipCookieDomainSecurity: false,
enableSingleSignOn: false,
allowSingleSignOnSignups: false,
allowSignupsViaSingleSignOn: false,
singleSignOnUrl: '',
singleSignOnEmailAttribute: 'email',
singleSignOnScopes: ['openid', 'email'],
@ -118,10 +118,10 @@ export class AppConfig {
return this.config;
}
static async isSignupAllowed(sso: boolean = false): Promise<boolean> {
static async isSignupAllowed({ viaSingleSignOn = false }: { viaSingleSignOn?: boolean } = {}): Promise<boolean> {
await this.loadConfig();
const areSignupsAllowed = sso ? this.config.auth.allowSingleSignOnSignups : this.config.auth.allowSignups;
const areSignupsAllowed = viaSingleSignOn && !this.config.auth.allowSignups ? this.config.auth.allowSingleSignOnSignups : this.config.auth.allowSignups;
const areThereAdmins = await UserModel.isThereAnAdmin();
return areSignupsAllowed || !areThereAdmins;

7
lib/models/oidc.ts
View file

@ -169,7 +169,7 @@ export class OidcModel {
throw new Error(`Missing user/${emailAttribute}`);
}
const isSignupAllowed = await AppConfig.isSignupAllowed(true);
const isSignupAllowed = await AppConfig.isSignupAllowed({ viaSingleSignOn: true });
const isThereAnAdmin = await UserModel.isThereAnAdmin();
// Confirm the user exists (or signup if allowed)
@ -181,9 +181,8 @@ export class OidcModel {
}
if (!user) {
// this will allow admin account creation even if SSO signups are disabled following the foregoing logic
if (!config.auth.allowSingleSignOnSignups) {
throw new Error('Sign up via SSO is not allowed');
if (!config.auth.allowSignupsViaSingleSignOn) {
throw new Error('Sign up via SSO is not allowed!');
}
throw new Error('There was a problem signing up or logging in!');

4
lib/types.ts
View file

@ -159,8 +159,8 @@ export interface Config {
skipCookieDomainSecurity: boolean;
/** If true, single sign-on will be enabled */
enableSingleSignOn: boolean;
/** If true, single sign-on signups will be allowed overriding allowSignups */
allowSingleSignOnSignups: boolean;
/** If true, signups via single sign-on will be allowed, overriding allowSignups */
allowSignupsViaSingleSignOn: boolean;
/** The Discovery URL (AKA Issuer) of the identity/single sign-on provider */
singleSignOnUrl: string;
/** The attribute to prefer as email of the identity/single sign-on provider */