feat: Remove OIDC and SSO support

Existing SSO accounts have no local password, so the migration
deactivates them before dropping is_sso_user and the
identity_provider_user table.

server/api/controllers/access-tokens/create.js

@@ -97,11 +97,10 @@
  *                 message:
  *                   type: string
  *                   enum:
- *                     - Use single sign-on
  *                     - Terms acceptance required
  *                     - Admin login required to initialize instance
  *                   description: Specific error message
- *                   example: Use single sign-on
+ *                   example: Terms acceptance required
  *     security: []
  */
 
@@ -120,9 +119,6 @@ const Errors = {
   INVALID_PASSWORD: {
     invalidPassword: 'Invalid password',
   },
-  USE_SINGLE_SIGN_ON: {
-    useSingleSignOn: 'Use single sign-on',
-  },
   TERMS_ACCEPTANCE_REQUIRED: {
     termsAcceptanceRequired: 'Terms acceptance required',
   },
@@ -156,9 +152,6 @@ module.exports = {
     invalidPassword: {
       responseType: 'unauthorized',
     },
-    useSingleSignOn: {
-      responseType: 'forbidden',
-    },
     termsAcceptanceRequired: {
       responseType: 'forbidden',
     },
@@ -168,10 +161,6 @@ module.exports = {
   },
 
   async fn(inputs) {
-    if (sails.config.custom.oidcEnforced) {
-      throw Errors.USE_SINGLE_SIGN_ON;
-    }
-
     const remoteAddress = getRemoteAddress(this.req);
     const user = await User.qm.getOneActiveByEmailOrUsername(inputs.emailOrUsername);
 
@@ -185,10 +174,6 @@ module.exports = {
         : Errors.INVALID_CREDENTIALS;
     }
 
-    if (user.isSsoUser) {
-      throw Errors.USE_SINGLE_SIGN_ON;
-    }
-
     const isPasswordValid = await bcrypt.compare(inputs.password, user.password);
 
     if (!isPasswordValid) {

server/api/controllers/access-tokens/debug-oidc.js

@@ -1,223 +0,0 @@
-/*!
- * Copyright (c) 2024 PLANKA Software GmbH
- * Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
- */
-
-const Errors = {
-  NOT_ENOUGH_RIGHTS: {
-    notEnoughRights: 'Not enough rights',
-  },
-};
-
-module.exports = {
-  inputs: {
-    code: {
-      type: 'string',
-      maxLength: 2048,
-      required: true,
-    },
-    nonce: {
-      type: 'string',
-      maxLength: 1024,
-      required: true,
-    },
-  },
-
-  exits: {
-    notEnoughRights: {
-      responseType: 'forbidden',
-    },
-  },
-
-  async fn(inputs) {
-    if (!sails.config.custom.oidcDebug) {
-      throw Errors.NOT_ENOUGH_RIGHTS;
-    }
-
-    const logs = ['🔐 Starting OIDC debug flow...', ''];
-    const client = await sails.hooks.oidc.getClient();
-
-    if (!client) {
-      logs.push('❌ OIDC client is not initialized.');
-      logs.push('💡 Hint: Check your OIDC issuer and client configuration.');
-
-      return {
-        item: null,
-        included: {
-          logs,
-        },
-      };
-    }
-
-    let tokenSet;
-    try {
-      logs.push('🔄 Exchanging authorization code...');
-
-      if (sails.config.custom.oidcUseOauthCallback) {
-        tokenSet = await client.oauthCallback(
-          sails.config.custom.oidcRedirectUri,
-          {
-            iss: sails.config.custom.oidcIssuer,
-            code: inputs.code,
-          },
-          { nonce: inputs.nonce },
-        );
-      } else {
-        tokenSet = await client.callback(
-          sails.config.custom.oidcRedirectUri,
-          {
-            iss: sails.config.custom.oidcIssuer,
-            code: inputs.code,
-          },
-          { nonce: inputs.nonce },
-        );
-      }
-
-      logs.push('✅ Authorization code exchanged successfully.', '');
-    } catch (error) {
-      logs.push('❌ Failed to exchange authorization code.');
-      logs.push(`💬 Reason: ${error.message || error.toString()}`);
-      logs.push('💡 Hint: Check redirect URI, client secret, and nonce handling.');
-
-      return {
-        item: null,
-        included: {
-          logs,
-        },
-      };
-    }
-
-    if (sails.config.custom.oidcClaimsSource === 'id_token') {
-      logs.push('📥 Extracting claims from ID token...');
-
-      try {
-        claims = tokenSet.claims();
-        logs.push('✅ Claims extracted successfully.', '');
-      } catch (error) {
-        logs.push('❌ Failed to extract user claims.');
-        logs.push(`💬 Reason: ${error.message || error.toString()}`);
-
-        return {
-          item: null,
-          included: {
-            logs,
-          },
-        };
-      }
-    } else {
-      logs.push('📥 Fetching claims from userinfo endpoint...');
-
-      try {
-        claims = await client.userinfo(tokenSet);
-        logs.push('✅ Claims fetched successfully.', '');
-      } catch (error) {
-        logs.push('❌ Failed to fetch user claims.');
-
-        if (error instanceof SyntaxError && error.message.includes('Unexpected token e in JSON')) {
-          logs.push('💬 Reason: Userinfo response is signed or not JSON.');
-          logs.push(
-            '💡 Hint: Try configuring userinfo signed response algorithm or switch to ID token claims.',
-          );
-        } else {
-          logs.push(`💬 Reason: ${error.message || error.toString()}`);
-        }
-
-        return {
-          item: null,
-          included: {
-            logs,
-          },
-        };
-      }
-    }
-
-    logs.push('📦 Raw claims received:', JSON.stringify(claims, null, 2), '');
-    logs.push('🧩 Evaluating claim mappings...', '');
-
-    const mappings = {
-      email: {
-        attribute: sails.config.custom.oidcEmailAttribute,
-        value: _.get(claims, sails.config.custom.oidcEmailAttribute),
-      },
-      name: {
-        attribute: sails.config.custom.oidcNameAttribute,
-        value: _.get(claims, sails.config.custom.oidcNameAttribute),
-      },
-      username: sails.config.custom.oidcIgnoreUsername
-        ? undefined
-        : {
-            attribute: sails.config.custom.oidcUsernameAttribute,
-            value: _.get(claims, sails.config.custom.oidcUsernameAttribute),
-          },
-      roles: sails.config.custom.oidcIgnoreRoles
-        ? undefined
-        : {
-            attribute: sails.config.custom.oidcRolesAttribute,
-            value: _.get(claims, sails.config.custom.oidcRolesAttribute),
-          },
-    };
-
-    logs.push('📋 Mapping result:', JSON.stringify(mappings, null, 2), '');
-
-    if (!mappings.email.value) {
-      logs.push('❌ Email not resolved.');
-      logs.push('💡 Hint: Check email attribute mapping.', '');
-    }
-
-    if (!mappings.name.value) {
-      logs.push('❌ Name not resolved.');
-      logs.push('💡 Hint: Check name attribute mapping.', '');
-    }
-
-    if (!sails.config.custom.oidcIgnoreUsername) {
-      if (!mappings.username.value) {
-        logs.push('⚠️ Username not resolved.');
-        logs.push('💡 Hint: Check username attribute mapping.', '');
-      }
-    }
-
-    if (!sails.config.custom.oidcIgnoreRoles) {
-      if (!Array.isArray(mappings.roles.value) || mappings.roles.value.length === 0) {
-        logs.push('⚠️ Roles not resolved or empty.');
-        logs.push('💡 Hint: Check roles attribute mapping or IdP role configuration.', '');
-      } else {
-        logs.push('🎭 Resolving user role from OIDC roles...');
-
-        // Use a Set here to avoid quadratic time complexity
-        const claimsRolesSet = new Set(mappings.roles.value);
-
-        const foundRole = [User.Roles.ADMIN, User.Roles.PROJECT_OWNER, User.Roles.BOARD_USER].find(
-          (roleItem) => {
-            const configRoles = sails.config.custom[`oidc${_.upperFirst(roleItem)}Roles`];
-
-            if (configRoles.includes('*')) {
-              return true;
-            }
-
-            return configRoles.some((configRole) => claimsRolesSet.has(configRole));
-          },
-        );
-
-        if (foundRole) {
-          logs.push(`✅ Matched user role → ${_.lowerCase(foundRole)}`, '');
-        } else {
-          logs.push('⚠️ No user role matched configured OIDC roles.');
-          logs.push('💡 Hint: Check role matching settings.', '');
-        }
-      }
-    }
-
-    if (mappings.email.value && mappings.name.value) {
-      logs.push('🎉 OIDC debug completed successfully.');
-    } else {
-      logs.push('🛑 OIDC debug detected missing required attributes.');
-    }
-
-    return {
-      item: null,
-      included: {
-        logs,
-      },
-    };
-  },
-};

server/api/controllers/access-tokens/exchange-with-oidc.js

@@ -1,271 +0,0 @@
-/*!
- * Copyright (c) 2024 PLANKA Software GmbH
- * Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
- */
-
-/**
- * @swagger
- * /access-tokens/exchange-with-oidc:
- *   post:
- *     summary: Exchange OIDC code for access token
- *     description: Exchanges an OIDC authorization code for an access token. Creates a user if they do not exist.
- *     tags:
- *       - Access Tokens
- *     operationId: exchangeForAccessTokenWithOidc
- *     requestBody:
- *       required: true
- *       content:
- *         application/json:
- *           schema:
- *             type: object
- *             required:
- *               - code
- *               - nonce
- *             properties:
- *               code:
- *                 type: string
- *                 maxLength: 2048
- *                 description: Authorization code from OIDC provider
- *                 example: abc123def456ghi789
- *               nonce:
- *                 type: string
- *                 maxLength: 1024
- *                 description: Nonce value for OIDC security
- *                 example: random-nonce-123456
- *               withHttpOnlyToken:
- *                 type: boolean
- *                 description: Whether to include HTTP-only authentication cookie
- *                 example: true
- *     responses:
- *       200:
- *         description: OIDC exchange successful
- *         content:
- *           application/json:
- *             schema:
- *               type: object
- *               required:
- *                 - item
- *               properties:
- *                 item:
- *                   type: string
- *                   description: Access token for API authentication
- *                   example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ4...
- *         headers:
- *           Set-Cookie:
- *             description: HTTP-only authentication cookie (if `withHttpOnlyToken` is true)
- *             schema:
- *               type: string
- *               example: httpOnlyToken=29aa3e38-8d24-4029-9743-9cbcf0a0dd5c; HttpOnly; Secure; SameSite=Strict
- *       400:
- *         $ref: '#/components/responses/ValidationError'
- *       401:
- *         description: OIDC authentication error
- *         content:
- *           application/json:
- *             schema:
- *               type: object
- *               required:
- *                 - code
- *                 - message
- *               properties:
- *                 code:
- *                   type: string
- *                   description: Error code
- *                   example: E_UNAUTHORIZED
- *                 message:
- *                   type: string
- *                   enum:
- *                     - Invalid code or nonce
- *                     - Invalid userinfo configuration
- *                   description: Specific error message
- *                   example: Invalid code or nonce
- *       403:
- *         description: Authentication restriction
- *         content:
- *           application/json:
- *             schema:
- *               type: object
- *               required:
- *                 - code
- *                 - message
- *               properties:
- *                 code:
- *                   type: string
- *                   description: Error code
- *                   example: E_FORBIDDEN
- *                 message:
- *                   type: string
- *                   enum:
- *                     - Terms acceptance required
- *                     - Admin login required to initialize instance
- *                   description: Specific error message
- *                   example: Terms acceptance required
- *       409:
- *         description: Conflict error
- *         content:
- *           application/json:
- *             schema:
- *               type: object
- *               required:
- *                 - code
- *                 - message
- *               properties:
- *                 code:
- *                   type: string
- *                   description: Error code
- *                   example: E_CONFLICT
- *                 message:
- *                   type: string
- *                   enum:
- *                     - Email already in use
- *                     - Username already in use
- *                     - Active users limit reached
- *                   description: Specific error message
- *                   example: Email already in use
- *       422:
- *         description: Missing required values
- *         content:
- *           application/json:
- *             schema:
- *               type: object
- *               required:
- *                 - code
- *                 - message
- *               properties:
- *                 code:
- *                   type: string
- *                   description: Error code
- *                   example: E_UNPROCESSABLE_ENTITY
- *                 message:
- *                   type: string
- *                   description: Error message
- *                   example: Unable to retrieve required values (email, name)
- *       500:
- *         description: OIDC configuration error
- *         content:
- *           application/json:
- *             schema:
- *               type: object
- *               required:
- *                 - code
- *                 - message
- *               properties:
- *                 code:
- *                   type: string
- *                   description: Error code
- *                   example: E_INTERNAL_SERVER_ERROR
- *                 message:
- *                   type: string
- *                   description: Error message
- *                   example: Invalid OIDC configuration
- *     security: []
- */
-
-const { getRemoteAddress } = require('../../../utils/remote-address');
-
-const Errors = {
-  INVALID_OIDC_CONFIGURATION: {
-    invalidOidcConfiguration: 'Invalid OIDC configuration',
-  },
-  INVALID_CODE_OR_NONCE: {
-    invalidCodeOrNonce: 'Invalid code or nonce',
-  },
-  INVALID_USERINFO_CONFIGURATION: {
-    invalidUserinfoConfiguration: 'Invalid userinfo configuration',
-  },
-  TERMS_ACCEPTANCE_REQUIRED: {
-    termsAcceptanceRequired: 'Terms acceptance required',
-  },
-  EMAIL_ALREADY_IN_USE: {
-    emailAlreadyInUse: 'Email already in use',
-  },
-  USERNAME_ALREADY_IN_USE: {
-    usernameAlreadyInUse: 'Username already in use',
-  },
-  ACTIVE_USERS_LIMIT_REACHED: {
-    activeUsersLimitReached: 'Active users limit reached',
-  },
-  MISSING_VALUES: {
-    missingValues: 'Unable to retrieve required values (email, name)',
-  },
-};
-
-module.exports = {
-  inputs: {
-    code: {
-      type: 'string',
-      maxLength: 2048,
-      required: true,
-    },
-    nonce: {
-      type: 'string',
-      maxLength: 1024,
-      required: true,
-    },
-    withHttpOnlyToken: {
-      type: 'boolean',
-    },
-  },
-
-  exits: {
-    invalidOidcConfiguration: {
-      responseType: 'serverError',
-    },
-    invalidCodeOrNonce: {
-      responseType: 'unauthorized',
-    },
-    invalidUserinfoConfiguration: {
-      responseType: 'unauthorized',
-    },
-    termsAcceptanceRequired: {
-      responseType: 'forbidden',
-    },
-    adminLoginRequiredToInitializeInstance: {
-      responseType: 'forbidden',
-    },
-    emailAlreadyInUse: {
-      responseType: 'conflict',
-    },
-    usernameAlreadyInUse: {
-      responseType: 'conflict',
-    },
-    activeUsersLimitReached: {
-      responseType: 'conflict',
-    },
-    missingValues: {
-      responseType: 'unprocessableEntity',
-    },
-  },
-
-  async fn(inputs) {
-    const remoteAddress = getRemoteAddress(this.req);
-
-    const user = await sails.helpers.users
-      .getOrCreateOneWithOidc(inputs.code, inputs.nonce)
-      .intercept('invalidOidcConfiguration', () => Errors.INVALID_OIDC_CONFIGURATION)
-      .intercept('invalidCodeOrNonce', () => {
-        sails.log.warn(`Invalid code or nonce! (IP: ${remoteAddress})`);
-        return Errors.INVALID_CODE_OR_NONCE;
-      })
-      .intercept('invalidUserinfoConfiguration', () => Errors.INVALID_USERINFO_CONFIGURATION)
-      .intercept('emailAlreadyInUse', () => Errors.EMAIL_ALREADY_IN_USE)
-      .intercept('usernameAlreadyInUse', () => Errors.USERNAME_ALREADY_IN_USE)
-      .intercept('activeLimitReached', () => Errors.ACTIVE_USERS_LIMIT_REACHED)
-      .intercept('missingValues', () => Errors.MISSING_VALUES);
-
-    return sails.helpers.accessTokens.handleSteps
-      .with({
-        user,
-        remoteAddress,
-        request: this.req,
-        response: this.res,
-        withHttpOnlyToken: inputs.withHttpOnlyToken,
-      })
-      .intercept('adminLoginRequiredToInitializeInstance', (error) => ({
-        adminLoginRequiredToInitializeInstance: error.raw,
-      }))
-      .intercept('termsAcceptanceRequired', (error) => ({
-        termsAcceptanceRequired: error.raw,
-      }));
-  },
-};