mirror of https://github.com/requarks/wiki
NGPixel
1 month ago
parent
14e1efae41
commit
ff4a5bc6e6
@ -0,0 +1,137 @@
|
||||
import type { AuthFlow, AuthFlowCallback, ProviderProfile } from '../../../models/authentication.ts'
|
||||
|
||||
/**
|
||||
* GitHub
|
||||
*
|
||||
* GitHub speaks OAuth 2.0 and not OpenID Connect: there is no ID token, and therefore nothing to
|
||||
* verify signatures on — the access token is exchanged over TLS and then spent against the API, which
|
||||
* answers who it belongs to. That is the whole protocol here, so this module is written with `fetch`
|
||||
* and no dependency. The parts a library would otherwise be trusted with — `state`, and keeping the
|
||||
* client secret off the browser — are done by the flow around it (`api/authentication.ts`).
|
||||
*
|
||||
* Two GitHub-specific things are worth the code:
|
||||
*
|
||||
* - the address comes from `/user/emails` rather than `/user`, because a profile's public email is
|
||||
* often empty and always unverified. Only a verified primary address is accepted;
|
||||
* - an organization can be required, checked against the membership API with the user's own token.
|
||||
*/
|
||||
export default class GitHubAuthentication {
|
||||
strategyId: string
|
||||
conf: Record<string, any>
|
||||
/** Set by `models/authentication.ts` right after construction. */
|
||||
module?: string
|
||||
|
||||
constructor(strategyId: string, conf: Record<string, any>) {
|
||||
this.strategyId = strategyId
|
||||
this.conf = conf
|
||||
}
|
||||
|
||||
/** Where a user signs in, and where the API lives — the two differ on Enterprise Server. */
|
||||
private get hosts(): { web: string; api: string } {
|
||||
const enterprise = (this.conf.enterpriseHost || '').trim().replace(/^https?:\/\//, '')
|
||||
return enterprise
|
||||
? { web: `https://${enterprise}`, api: `https://${enterprise}/api/v3` }
|
||||
: { web: 'https://github.com', api: 'https://api.github.com' }
|
||||
}
|
||||
|
||||
/** A GitHub API call as this user, with the headers GitHub asks every client to send. */
|
||||
private async api(path: string, accessToken: string): Promise<any> {
|
||||
const resp = await fetch(`${this.hosts.api}${path}`, {
|
||||
headers: {
|
||||
Authorization: `Bearer ${accessToken}`,
|
||||
Accept: 'application/vnd.github+json',
|
||||
'X-GitHub-Api-Version': '2022-11-28',
|
||||
'User-Agent': 'Wiki.js'
|
||||
}
|
||||
})
|
||||
if (!resp.ok) {
|
||||
throw new Error(`ERR_PROVIDER_REQUEST_FAILED`)
|
||||
}
|
||||
return resp.json()
|
||||
}
|
||||
|
||||
async authorizationUrl({ redirectUri, state }: AuthFlow): Promise<string> {
|
||||
if (!this.conf.clientId || !this.conf.clientSecret) {
|
||||
throw new Error('ERR_STRATEGY_MISCONFIGURED')
|
||||
}
|
||||
const url = new URL(`${this.hosts.web}/login/oauth/authorize`)
|
||||
url.searchParams.set('client_id', this.conf.clientId)
|
||||
url.searchParams.set('redirect_uri', redirectUri)
|
||||
/*
|
||||
`user:email` is what makes the verified addresses readable; `read:org` is only asked for when an
|
||||
organization is being enforced, since a scope nobody needs is a scope nobody should be granting.
|
||||
*/
|
||||
url.searchParams.set(
|
||||
'scope',
|
||||
this.conf.allowedOrganization ? 'read:user user:email read:org' : 'read:user user:email'
|
||||
)
|
||||
url.searchParams.set('state', state)
|
||||
return url.toString()
|
||||
}
|
||||
|
||||
async profile({ code, redirectUri }: AuthFlowCallback): Promise<ProviderProfile> {
|
||||
if (!code) {
|
||||
throw new Error('ERR_NO_AUTHORIZATION_CODE')
|
||||
}
|
||||
// -> `Accept: application/json`, or GitHub answers this one in form encoding
|
||||
const tokenResp = await fetch(`${this.hosts.web}/login/oauth/access_token`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
Accept: 'application/json',
|
||||
'Content-Type': 'application/json',
|
||||
'User-Agent': 'Wiki.js'
|
||||
},
|
||||
body: JSON.stringify({
|
||||
client_id: this.conf.clientId,
|
||||
client_secret: this.conf.clientSecret,
|
||||
redirect_uri: redirectUri,
|
||||
code
|
||||
})
|
||||
})
|
||||
const token = (await tokenResp.json()) as Record<string, any>
|
||||
// -> GitHub reports a refused exchange as 200 with an `error` field, not as a status
|
||||
if (!tokenResp.ok || token.error || !token.access_token) {
|
||||
throw new Error('ERR_TOKEN_EXCHANGE_FAILED')
|
||||
}
|
||||
|
||||
const account = await this.api('/user', token.access_token)
|
||||
if (!account?.id) {
|
||||
throw new Error('ERR_NO_PROVIDER_ACCOUNT')
|
||||
}
|
||||
|
||||
/*
|
||||
The primary verified address, which is the only one that says anything: `account.email` is
|
||||
whatever the profile shows publicly, is frequently null, and is never checked by GitHub.
|
||||
*/
|
||||
const emails: any[] = await this.api('/user/emails', token.access_token)
|
||||
const email = emails?.find((entry) => entry.primary && entry.verified)?.email
|
||||
if (!email) {
|
||||
throw new Error('ERR_NO_VERIFIED_EMAIL_FROM_PROVIDER')
|
||||
}
|
||||
|
||||
if (this.conf.allowedOrganization) {
|
||||
const org = this.conf.allowedOrganization.trim()
|
||||
const resp = await fetch(
|
||||
`${this.hosts.api}/orgs/${encodeURIComponent(org)}/members/${encodeURIComponent(account.login)}`,
|
||||
{
|
||||
headers: {
|
||||
Authorization: `Bearer ${token.access_token}`,
|
||||
Accept: 'application/vnd.github+json',
|
||||
'X-GitHub-Api-Version': '2022-11-28',
|
||||
'User-Agent': 'Wiki.js'
|
||||
}
|
||||
}
|
||||
)
|
||||
// -> 204 is a member, 302 is "ask as somebody who can see", 404 is not a member
|
||||
if (resp.status !== 204) {
|
||||
throw new Error('ERR_LOGIN_RESTRICTED')
|
||||
}
|
||||
}
|
||||
|
||||
return {
|
||||
id: String(account.id),
|
||||
email,
|
||||
name: account.name || account.login
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,44 @@
|
||||
key: github
|
||||
title: GitHub
|
||||
description: Sign in with a GitHub account, on github.com or a GitHub Enterprise Server.
|
||||
author: requarks.io
|
||||
logo: https://static.requarks.io/logo/github.svg
|
||||
icon: /_assets/icons/ultraviolet-github.svg
|
||||
color: dark-4
|
||||
vendor: 'GitHub, Inc.'
|
||||
website: 'https://docs.github.com/en/apps/oauth-apps'
|
||||
isAvailable: true
|
||||
useForm: false
|
||||
usernameType: email
|
||||
props:
|
||||
clientId:
|
||||
type: String
|
||||
title: Client ID
|
||||
hint: From the OAuth app registered under Developer settings.
|
||||
icon: key
|
||||
order: 1
|
||||
clientSecret:
|
||||
type: String
|
||||
title: Client Secret
|
||||
hint: From the same OAuth app.
|
||||
icon: password
|
||||
sensitive: true
|
||||
order: 2
|
||||
enterpriseHost:
|
||||
type: String
|
||||
title: GitHub Enterprise Host
|
||||
hint: (optional) Hostname of a GitHub Enterprise Server, e.g. github.example.com. Leave empty for github.com.
|
||||
icon: server
|
||||
order: 3
|
||||
allowedOrganization:
|
||||
type: String
|
||||
title: Restrict to Organization
|
||||
hint: (optional) Login name of a GitHub organization. Only its members may sign in — which needs the account to be a public member, or the OAuth app to be approved by the organization.
|
||||
icon: user-groups
|
||||
order: 4
|
||||
refs:
|
||||
callbackUrl:
|
||||
title: Authorization Callback URL
|
||||
hint: Set this as the OAuth app's callback URL on GitHub.
|
||||
icon: back
|
||||
value: '{host}/_api/auth/{id}/callback'
|
||||
@ -0,0 +1,99 @@
|
||||
import * as client from 'openid-client'
|
||||
import type { AuthFlow, AuthFlowCallback, ProviderProfile } from '../../../models/authentication.ts'
|
||||
|
||||
/** Google's issuer, from which every endpoint and signing key is discovered. */
|
||||
const ISSUER = 'https://accounts.google.com'
|
||||
|
||||
/**
|
||||
* Google
|
||||
*
|
||||
* Google is an OpenID Connect provider, so this is the generic flow with the issuer fixed and two
|
||||
* things Google specifically needs saying about:
|
||||
*
|
||||
* - a Workspace domain can be required, and the claim is checked HERE as well as asked for — `hd`
|
||||
* on the authorization request is a hint to the account chooser, not a promise about the answer;
|
||||
* - `email_verified` is honoured, because an account on this wiki is matched by email address and
|
||||
* an unverified one says nothing about who holds the mailbox.
|
||||
*
|
||||
* Written against `openid-client` rather than by hand for the reason the generic module is: the ID
|
||||
* token has to be verified, and a token nobody verified still logs somebody in.
|
||||
*/
|
||||
export default class GoogleAuthentication {
|
||||
strategyId: string
|
||||
conf: Record<string, any>
|
||||
/** Set by `models/authentication.ts` right after construction. */
|
||||
module?: string
|
||||
|
||||
private config: client.Configuration | null = null
|
||||
|
||||
constructor(strategyId: string, conf: Record<string, any>) {
|
||||
this.strategyId = strategyId
|
||||
this.conf = conf
|
||||
}
|
||||
|
||||
private async configuration(): Promise<client.Configuration> {
|
||||
if (this.config) {
|
||||
return this.config
|
||||
}
|
||||
if (!this.conf.clientId || !this.conf.clientSecret) {
|
||||
throw new Error('ERR_STRATEGY_MISCONFIGURED')
|
||||
}
|
||||
this.config = await client.discovery(
|
||||
new URL(ISSUER),
|
||||
this.conf.clientId,
|
||||
this.conf.clientSecret
|
||||
)
|
||||
return this.config
|
||||
}
|
||||
|
||||
async authorizationUrl({ redirectUri, state, nonce, codeVerifier }: AuthFlow): Promise<string> {
|
||||
const config = await this.configuration()
|
||||
return client
|
||||
.buildAuthorizationUrl(config, {
|
||||
redirect_uri: redirectUri,
|
||||
scope: 'openid profile email',
|
||||
state,
|
||||
nonce,
|
||||
code_challenge: await client.calculatePKCECodeChallenge(codeVerifier),
|
||||
code_challenge_method: 'S256',
|
||||
// -> Which accounts the chooser offers. The answer is still checked below.
|
||||
...(this.conf.hostedDomain ? { hd: this.conf.hostedDomain } : {})
|
||||
})
|
||||
.toString()
|
||||
}
|
||||
|
||||
async profile({
|
||||
currentUrl,
|
||||
state,
|
||||
nonce,
|
||||
codeVerifier
|
||||
}: AuthFlowCallback): Promise<ProviderProfile> {
|
||||
const config = await this.configuration()
|
||||
const tokens = await client.authorizationCodeGrant(config, new URL(currentUrl), {
|
||||
expectedState: state,
|
||||
expectedNonce: nonce,
|
||||
pkceCodeVerifier: codeVerifier
|
||||
})
|
||||
const claims = tokens.claims() as Record<string, any> | undefined
|
||||
if (!claims?.sub) {
|
||||
throw new Error('ERR_NO_ID_TOKEN')
|
||||
}
|
||||
|
||||
const email = claims.email
|
||||
if (!email || typeof email !== 'string') {
|
||||
throw new Error('ERR_NO_EMAIL_FROM_PROVIDER')
|
||||
}
|
||||
if (claims.email_verified === false && this.conf.allowUnverifiedEmail !== true) {
|
||||
throw new Error('ERR_EMAIL_NOT_VERIFIED')
|
||||
}
|
||||
if (this.conf.hostedDomain && claims.hd !== this.conf.hostedDomain) {
|
||||
throw new Error('ERR_LOGIN_RESTRICTED')
|
||||
}
|
||||
|
||||
return {
|
||||
id: claims.sub,
|
||||
email,
|
||||
name: (claims.name as string) || email
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,45 @@
|
||||
key: google
|
||||
title: Google
|
||||
description: Sign in with a Google account or a Google Workspace domain.
|
||||
author: requarks.io
|
||||
logo: https://static.requarks.io/logo/google.svg
|
||||
icon: /_assets/icons/ultraviolet-google.svg
|
||||
color: red-6
|
||||
vendor: 'Google LLC'
|
||||
website: 'https://developers.google.com/identity/openid-connect/openid-connect'
|
||||
isAvailable: true
|
||||
useForm: false
|
||||
usernameType: email
|
||||
props:
|
||||
clientId:
|
||||
type: String
|
||||
title: Client ID
|
||||
hint: From the OAuth 2.0 Client ID created in the Google Cloud console.
|
||||
icon: key
|
||||
order: 1
|
||||
clientSecret:
|
||||
type: String
|
||||
title: Client Secret
|
||||
hint: From the same OAuth 2.0 Client ID.
|
||||
icon: password
|
||||
sensitive: true
|
||||
order: 2
|
||||
hostedDomain:
|
||||
type: String
|
||||
title: Restrict to Workspace Domain
|
||||
hint: (optional) A Workspace domain, e.g. example.com. Only accounts on it may sign in — checked here as well as asked for, since the parameter alone is a hint to Google rather than a guarantee.
|
||||
icon: geography
|
||||
order: 3
|
||||
allowUnverifiedEmail:
|
||||
type: Boolean
|
||||
title: Accept Unverified Addresses
|
||||
hint: Off by default. A Google account whose address is unverified proves nothing about the mailbox, and an account here is matched on the address.
|
||||
icon: received
|
||||
default: false
|
||||
order: 4
|
||||
refs:
|
||||
callbackUrl:
|
||||
title: Authorized Redirect URI
|
||||
hint: Add this to the OAuth client's authorized redirect URIs in the Google Cloud console.
|
||||
icon: back
|
||||
value: '{host}/_api/auth/{id}/callback'
|
||||
@ -0,0 +1,137 @@
|
||||
import * as client from 'openid-client'
|
||||
import type { AuthFlow, AuthFlowCallback, ProviderProfile } from '../../../models/authentication.ts'
|
||||
|
||||
/**
|
||||
* Generic OpenID Connect / OAuth2
|
||||
*
|
||||
* The authorization code flow with PKCE, against any provider that speaks OpenID Connect. What makes
|
||||
* it OIDC rather than bare OAuth2 is the ID token: a signed statement of who signed in, which is
|
||||
* verified here against the provider's published keys — issuer, audience, nonce and signature — before
|
||||
* anything is believed about the person behind it.
|
||||
*
|
||||
* That verification is why this goes through `openid-client` rather than a handful of `fetch` calls.
|
||||
* The requests themselves are trivial; the checks around them are where a mistake is silent, because
|
||||
* a token that is never verified still logs somebody in.
|
||||
*/
|
||||
export default class OidcAuthentication {
|
||||
strategyId: string
|
||||
conf: Record<string, any>
|
||||
/** Set by `models/authentication.ts` right after construction. */
|
||||
module?: string
|
||||
|
||||
/**
|
||||
* The provider as `openid-client` sees it. Built once and kept: with discovery on it is a network
|
||||
* round trip, and it is the same answer for every login until the strategy is saved again.
|
||||
*/
|
||||
private config: client.Configuration | null = null
|
||||
|
||||
constructor(strategyId: string, conf: Record<string, any>) {
|
||||
this.strategyId = strategyId
|
||||
this.conf = conf
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolve the provider's metadata.
|
||||
*
|
||||
* Discovery is the path worth taking: the endpoints AND the signing keys come from the issuer
|
||||
* itself, so a provider rotating either is followed without an administrator editing anything. The
|
||||
* manual path exists for providers that publish no discovery document, and needs the JWKS URL for
|
||||
* the same reason — without keys there is nothing to check the ID token against.
|
||||
*/
|
||||
private async configuration(): Promise<client.Configuration> {
|
||||
if (this.config) {
|
||||
return this.config
|
||||
}
|
||||
const { clientId, clientSecret, issuer } = this.conf
|
||||
if (!clientId || !clientSecret || !issuer) {
|
||||
throw new Error('ERR_STRATEGY_MISCONFIGURED')
|
||||
}
|
||||
if (this.conf.useDiscovery !== false) {
|
||||
this.config = await client.discovery(new URL(issuer), clientId, clientSecret)
|
||||
} else {
|
||||
if (!this.conf.authorizationURL || !this.conf.tokenURL || !this.conf.jwksURL) {
|
||||
throw new Error('ERR_STRATEGY_MISCONFIGURED')
|
||||
}
|
||||
this.config = new client.Configuration(
|
||||
{
|
||||
issuer,
|
||||
authorization_endpoint: this.conf.authorizationURL,
|
||||
token_endpoint: this.conf.tokenURL,
|
||||
userinfo_endpoint: this.conf.userInfoURL || undefined,
|
||||
jwks_uri: this.conf.jwksURL
|
||||
},
|
||||
clientId,
|
||||
clientSecret
|
||||
)
|
||||
}
|
||||
return this.config
|
||||
}
|
||||
|
||||
/** Where to send the browser to sign in. */
|
||||
async authorizationUrl({ redirectUri, state, nonce, codeVerifier }: AuthFlow): Promise<string> {
|
||||
const config = await this.configuration()
|
||||
return client
|
||||
.buildAuthorizationUrl(config, {
|
||||
redirect_uri: redirectUri,
|
||||
scope: this.conf.scopes || 'openid profile email',
|
||||
state,
|
||||
nonce,
|
||||
code_challenge: await client.calculatePKCECodeChallenge(codeVerifier),
|
||||
code_challenge_method: 'S256'
|
||||
})
|
||||
.toString()
|
||||
}
|
||||
|
||||
/**
|
||||
* Turn the code the provider sent back into who signed in.
|
||||
*
|
||||
* `authorizationCodeGrant` is what does the checking: it refuses a response whose state does not
|
||||
* match the one this flow started with, exchanges the code with the PKCE verifier, and validates
|
||||
* the ID token's signature, issuer, audience and nonce. Everything after it is reading claims.
|
||||
*/
|
||||
async profile({
|
||||
currentUrl,
|
||||
state,
|
||||
nonce,
|
||||
codeVerifier
|
||||
}: AuthFlowCallback): Promise<ProviderProfile> {
|
||||
const config = await this.configuration()
|
||||
const tokens = await client.authorizationCodeGrant(config, new URL(currentUrl), {
|
||||
expectedState: state,
|
||||
expectedNonce: nonce,
|
||||
pkceCodeVerifier: codeVerifier
|
||||
})
|
||||
const claims = tokens.claims()
|
||||
if (!claims?.sub) {
|
||||
throw new Error('ERR_NO_ID_TOKEN')
|
||||
}
|
||||
|
||||
/*
|
||||
The userinfo endpoint is consulted when the provider has one, because a provider is free to keep
|
||||
claims out of the ID token and behind it — several put the email address there only. Its answer
|
||||
is merged over the token's, and `fetchUserInfo` checks that it is about the same subject.
|
||||
*/
|
||||
let info: Record<string, any> = claims
|
||||
if (config.serverMetadata().userinfo_endpoint) {
|
||||
info = {
|
||||
...claims,
|
||||
...(await client.fetchUserInfo(config, tokens.access_token, claims.sub))
|
||||
}
|
||||
}
|
||||
|
||||
const email = info[this.conf.emailClaim || 'email']
|
||||
if (!email || typeof email !== 'string') {
|
||||
throw new Error('ERR_NO_EMAIL_FROM_PROVIDER')
|
||||
}
|
||||
return {
|
||||
id: claims.sub,
|
||||
email,
|
||||
name: (info[this.conf.displayNameClaim || 'name'] as string) || email
|
||||
}
|
||||
}
|
||||
|
||||
/** Where a logout should continue, so that the session at the provider ends too. */
|
||||
logoutUrl(): string | null {
|
||||
return this.conf.logoutURL || null
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,96 @@
|
||||
key: oidc
|
||||
title: Generic OpenID Connect / OAuth2
|
||||
description: OpenID Connect 1.0 is a simple identity layer on top of the OAuth 2.0 protocol.
|
||||
author: requarks.io
|
||||
logo: https://static.requarks.io/logo/oidc.svg
|
||||
icon: /_assets/icons/ultraviolet-openid.svg
|
||||
color: blue-grey-8
|
||||
vendor: 'OpenID Foundation'
|
||||
website: 'https://openid.net/connect/'
|
||||
isAvailable: true
|
||||
useForm: false
|
||||
usernameType: email
|
||||
props:
|
||||
clientId:
|
||||
type: String
|
||||
title: Client ID
|
||||
hint: Application Client ID, as the provider issued it.
|
||||
icon: key
|
||||
order: 1
|
||||
clientSecret:
|
||||
type: String
|
||||
title: Client Secret
|
||||
hint: Application Client Secret, as the provider issued it.
|
||||
icon: password
|
||||
sensitive: true
|
||||
order: 2
|
||||
issuer:
|
||||
type: String
|
||||
title: Issuer
|
||||
hint: The provider's issuer URL, e.g. https://id.example.com. Everything else is discovered from it.
|
||||
icon: internet
|
||||
order: 3
|
||||
useDiscovery:
|
||||
type: Boolean
|
||||
title: Use Discovery
|
||||
hint: Read the endpoints and signing keys from the issuer's /.well-known/openid-configuration. Turn off only for a provider that does not publish one, and fill in the endpoints below.
|
||||
icon: rescan-document
|
||||
default: true
|
||||
order: 4
|
||||
authorizationURL:
|
||||
type: String
|
||||
title: Authorization Endpoint URL
|
||||
hint: Ignored while discovery is on.
|
||||
icon: enter
|
||||
order: 5
|
||||
tokenURL:
|
||||
type: String
|
||||
title: Token Endpoint URL
|
||||
hint: Ignored while discovery is on.
|
||||
icon: exit
|
||||
order: 6
|
||||
userInfoURL:
|
||||
type: String
|
||||
title: User Info Endpoint URL
|
||||
hint: Ignored while discovery is on. Optional even without it — the ID token alone can carry everything needed.
|
||||
icon: contact
|
||||
order: 7
|
||||
jwksURL:
|
||||
type: String
|
||||
title: JSON Web Key Set URL
|
||||
hint: Ignored while discovery is on. Where the keys that signed the ID token are published; without it the ID token cannot be verified and logins are refused.
|
||||
icon: fingerprint-scan
|
||||
order: 8
|
||||
scopes:
|
||||
type: String
|
||||
title: Scopes
|
||||
hint: Space-separated. `openid` is required; `email` is what an account is matched on here.
|
||||
icon: rules
|
||||
default: 'openid profile email'
|
||||
order: 9
|
||||
emailClaim:
|
||||
type: String
|
||||
title: Email Claim
|
||||
hint: Which claim carries the email address.
|
||||
icon: envelope
|
||||
default: email
|
||||
order: 10
|
||||
displayNameClaim:
|
||||
type: String
|
||||
title: Display Name Claim
|
||||
hint: Which claim carries the name to show. Falls back to the email address when the claim is absent.
|
||||
icon: person
|
||||
default: name
|
||||
order: 11
|
||||
logoutURL:
|
||||
type: String
|
||||
title: Logout URL
|
||||
hint: (optional) Where to send a user after logging out, so that the session at the provider ends too.
|
||||
icon: exit
|
||||
order: 12
|
||||
refs:
|
||||
callbackUrl:
|
||||
title: Authorization Callback URL
|
||||
hint: Register this as the redirect URI at the provider. It is the same for every provider.
|
||||
icon: back
|
||||
value: '{host}/_api/auth/{id}/callback'
|
||||
@ -0,0 +1,113 @@
|
||||
<template>
|
||||
<w-dialog v-model="dialogVisible" max-width="450px" @hide="onDialogHide">
|
||||
<w-card style="min-width: 350px">
|
||||
<w-card-section class="card-header">
|
||||
<w-icon name="img:/_assets/icons/fluent-delete-bin.svg" size="sm" class="mr-2" />
|
||||
<span>{{ t(`admin.users.deleteConfirmTitle`) }}</span>
|
||||
</w-card-section>
|
||||
<w-card-section>
|
||||
<div class="text-body2">
|
||||
<i18n-t keypath="admin.users.deleteConfirmText">
|
||||
<template #username>
|
||||
<strong>{{ props.user.name }}</strong>
|
||||
</template>
|
||||
</i18n-t>
|
||||
</div>
|
||||
<!--
|
||||
Said before the attempt rather than only when it fails: a user who has written anything
|
||||
cannot be deleted at all, and finding that out from an error after confirming is finding it
|
||||
out too late to have chosen deactivation instead.
|
||||
-->
|
||||
<div class="text-body2 mt-4">{{ t(`admin.users.deleteConfirmForeignNotice`) }}</div>
|
||||
<div class="text-body2 mt-4">
|
||||
<strong class="text-negative">{{ t(`admin.users.deleteHint`) }}</strong>
|
||||
</div>
|
||||
</w-card-section>
|
||||
<w-card-actions class="card-actions">
|
||||
<w-space />
|
||||
<w-btn
|
||||
class="acrylic-btn"
|
||||
flat
|
||||
:label="t(`common.actions.cancel`)"
|
||||
color="grey"
|
||||
padding="xs md"
|
||||
@click="onDialogCancel" />
|
||||
<w-btn
|
||||
unelevated
|
||||
:label="t(`common.actions.delete`)"
|
||||
color="negative"
|
||||
padding="xs md"
|
||||
:loading="state.isDeleting"
|
||||
@click="confirm" />
|
||||
</w-card-actions>
|
||||
</w-card>
|
||||
</w-dialog>
|
||||
</template>
|
||||
|
||||
<script setup>
|
||||
import { reactive } from 'vue'
|
||||
import { useI18n } from 'vue-i18n'
|
||||
|
||||
import { dialogComponentEmits, useDialogComponent } from '@/composables/dialog'
|
||||
import { notify } from '@/composables/notify'
|
||||
|
||||
// PROPS
|
||||
|
||||
const props = defineProps({
|
||||
user: {
|
||||
type: Object,
|
||||
required: true
|
||||
}
|
||||
})
|
||||
|
||||
// EMITS
|
||||
|
||||
defineEmits([...dialogComponentEmits])
|
||||
|
||||
// DIALOG
|
||||
|
||||
const { dialogVisible, onDialogHide, onDialogOK, onDialogCancel } = useDialogComponent()
|
||||
|
||||
// I18N
|
||||
|
||||
const { t } = useI18n()
|
||||
|
||||
// DATA
|
||||
|
||||
const state = reactive({
|
||||
isDeleting: false
|
||||
})
|
||||
|
||||
// METHODS
|
||||
|
||||
async function confirm() {
|
||||
state.isDeleting = true
|
||||
try {
|
||||
const resp = await API_CLIENT.delete(`users/${props.user.id}`)
|
||||
if (!resp?.ok) {
|
||||
throw new Error((await resp.json())?.message || 'An unexpected error occured.')
|
||||
}
|
||||
notify({
|
||||
type: 'positive',
|
||||
message: t('admin.users.deleteSuccess', { username: props.user.name })
|
||||
})
|
||||
onDialogOK()
|
||||
} catch (err) {
|
||||
/*
|
||||
ky throws for statuses above 400, and this endpoint has several things to say through one: the
|
||||
account owns pages, it is the last root administrator, it is a system user, it is the caller's
|
||||
own. The reason is in the body, so the dialog stays open with it rather than closing on a
|
||||
failure it did not report.
|
||||
*/
|
||||
const apiMessage = await err.response
|
||||
?.json()
|
||||
.then((b) => b?.message)
|
||||
.catch(() => null)
|
||||
notify({
|
||||
type: 'negative',
|
||||
message: apiMessage || err.message
|
||||
})
|
||||
}
|
||||
state.isDeleting = false
|
||||
}
|
||||
</script>
|
||||
Loading…
Reference in new issue