feat: SSO-Login per OpenID Connect (Authentik u.a.)
Dritte Login-Methode neben Passwort und Passkey, konfiguriert über OIDC_ISSUER/OIDC_CLIENT_ID/OIDC_CLIENT_SECRET (optional, Button bleibt ohne diese Vars ausgeblendet). Authorization-Code-Flow mit PKCE, ID-Token-Signaturprüfung gegen das JWKS des Providers via neuer Abhängigkeit "jose" (RS256 fest gepinnt gegen Algorithm-Confusion), State/Nonce kurzlebig und einmalig verwendbar in neuer Tabelle oidc_states (Migration 0003, analog zu webauthn_challenges). Funktioniert ausschließlich für bereits angelegte Benutzer (Abgleich per E-Mail) – kein Auto-Provisioning, keine Rollenübernahme aus Claims, beides bleibt exklusiv über die bestehende Benutzerverwaltung steuerbar. app/login/page.tsx zu Server-Component-Wrapper reduziert (prüft isConfigured(), liest ?error= aus searchParams), bisheriger Inhalt nach components/LoginForm.tsx verschoben. Version 1.9.0. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Claude Sonnet 5
@@ -0,0 +1,162 @@
|
||||
"use client";
|
||||
|
||||
import { useState } from "react";
|
||||
import { useRouter } from "next/navigation";
|
||||
import Link from "next/link";
|
||||
import { startAuthentication } from "@simplewebauthn/browser";
|
||||
import { formatMessage } from "@/lib/i18n/shared";
|
||||
import { useDict } from "@/components/i18n/LocaleProvider";
|
||||
import LanguageSwitcher from "@/components/i18n/LanguageSwitcher";
|
||||
import type { Dict } from "@/lib/i18n/shared";
|
||||
|
||||
function authErrorMessage(dict: Dict, code: string): string {
|
||||
if (code === "invalid_credentials") return dict.login.errorInvalidCredentials;
|
||||
if (code === "password_disabled") return dict.login.errorPasswordDisabled;
|
||||
if (code === "oidc_invalid_state") return dict.login.errorOidcInvalidState;
|
||||
if (code === "oidc_unknown_user") return dict.login.errorOidcUnknownUser;
|
||||
if (code === "oidc_failed") return dict.login.errorOidcFailed;
|
||||
if (/cancelled|aborted|NotAllowedError/i.test(code))
|
||||
return dict.login.errorPasskeyCancelled;
|
||||
return formatMessage(dict.login.errorGeneric, { message: code });
|
||||
}
|
||||
|
||||
function redirectPath(role: string): string {
|
||||
return role === "admin" ? "/admin" : "/intern";
|
||||
}
|
||||
|
||||
export default function LoginForm({
|
||||
oidcEnabled,
|
||||
initialError,
|
||||
}: {
|
||||
oidcEnabled: boolean;
|
||||
initialError: string | null;
|
||||
}) {
|
||||
const router = useRouter();
|
||||
const dict = useDict();
|
||||
const [email, setEmail] = useState("");
|
||||
const [password, setPassword] = useState("");
|
||||
const [error, setError] = useState<string | null>(() =>
|
||||
initialError ? authErrorMessage(dict, initialError) : null
|
||||
);
|
||||
const [busy, setBusy] = useState(false);
|
||||
|
||||
async function signInWithPassword(e: React.FormEvent) {
|
||||
e.preventDefault();
|
||||
setError(null);
|
||||
setBusy(true);
|
||||
const res = await fetch("/api/auth/login", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ email, password }),
|
||||
});
|
||||
const data = await res.json().catch(() => ({}));
|
||||
if (!res.ok) {
|
||||
setError(authErrorMessage(dict, data.error ?? "unknown"));
|
||||
setBusy(false);
|
||||
return;
|
||||
}
|
||||
router.replace(redirectPath(data.role));
|
||||
router.refresh();
|
||||
}
|
||||
|
||||
async function signInWithPasskey() {
|
||||
setError(null);
|
||||
setBusy(true);
|
||||
try {
|
||||
const optionsRes = await fetch("/api/auth/passkeys/login-options", { method: "POST" });
|
||||
const options = await optionsRes.json();
|
||||
const response = await startAuthentication({ optionsJSON: options });
|
||||
|
||||
const verifyRes = await fetch("/api/auth/passkeys/login-verify", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ response }),
|
||||
});
|
||||
const data = await verifyRes.json().catch(() => ({}));
|
||||
if (!verifyRes.ok) {
|
||||
setError(authErrorMessage(dict, data.error ?? "unknown"));
|
||||
setBusy(false);
|
||||
return;
|
||||
}
|
||||
router.replace(redirectPath(data.role));
|
||||
router.refresh();
|
||||
} catch (err) {
|
||||
setError(authErrorMessage(dict, err instanceof Error ? err.message : String(err)));
|
||||
setBusy(false);
|
||||
}
|
||||
}
|
||||
|
||||
return (
|
||||
<div className="flex-1 flex items-center justify-center p-4">
|
||||
<div className="card w-full max-w-sm">
|
||||
<div className="flex justify-between items-center mb-4">
|
||||
<h1 className="text-xl font-bold text-[var(--c-primary)]">
|
||||
{dict.login.title}
|
||||
</h1>
|
||||
<LanguageSwitcher variant="light" />
|
||||
</div>
|
||||
<form onSubmit={signInWithPassword} className="space-y-3">
|
||||
<div>
|
||||
<label className="label" htmlFor="email">
|
||||
{dict.common.email}
|
||||
</label>
|
||||
<input
|
||||
id="email"
|
||||
type="email"
|
||||
className="input"
|
||||
value={email}
|
||||
onChange={(e) => setEmail(e.target.value)}
|
||||
autoComplete="username webauthn"
|
||||
required
|
||||
/>
|
||||
</div>
|
||||
<div>
|
||||
<label className="label" htmlFor="password">
|
||||
{dict.common.password}
|
||||
</label>
|
||||
<input
|
||||
id="password"
|
||||
type="password"
|
||||
className="input"
|
||||
value={password}
|
||||
onChange={(e) => setPassword(e.target.value)}
|
||||
autoComplete="current-password"
|
||||
required
|
||||
/>
|
||||
</div>
|
||||
{error && <p className="text-sm text-[var(--c-del)]">{error}</p>}
|
||||
<button type="submit" className="btn btn-primary w-full" disabled={busy}>
|
||||
{dict.login.submit}
|
||||
</button>
|
||||
</form>
|
||||
|
||||
<div className="my-4 flex items-center gap-3 text-xs text-gray-400">
|
||||
<span className="h-px flex-1 bg-gray-200" />
|
||||
{dict.login.or}
|
||||
<span className="h-px flex-1 bg-gray-200" />
|
||||
</div>
|
||||
|
||||
<button
|
||||
type="button"
|
||||
onClick={signInWithPasskey}
|
||||
className="btn btn-neutral w-full"
|
||||
disabled={busy}
|
||||
>
|
||||
{dict.login.passkeyButton}
|
||||
</button>
|
||||
|
||||
{oidcEnabled && (
|
||||
<a href="/api/auth/oidc/login" className="btn btn-neutral w-full mt-2">
|
||||
{dict.login.ssoButton}
|
||||
</a>
|
||||
)}
|
||||
|
||||
<p className="mt-4 text-center text-sm">
|
||||
<Link href="/" className="text-gray-500 hover:text-[var(--c-primary)]">
|
||||
{dict.login.backToMenu}
|
||||
</Link>
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
Reference in New Issue
Block a user