ref: adopt strict mode for TS

Author: aartoni

server/src/config/index.ts

@@ -1,3 +1,5 @@
+import { Config } from "src/utils/config";
+
 export default {
   default: {
     REMEMBER_ME: false,
@@ -12,6 +14,6 @@ export default {
     OIDC_GRANT_TYPE: "authorization_code",
     OIDC_FAMILY_NAME_FIELD: "family_name",
     OIDC_GIVEN_NAME_FIELD: "given_name",
-  },
+  } as Config,
   validator() {},
 };

server/src/controllers/oidc.ts

@@ -2,8 +2,9 @@ import { Context } from "koa";
 import { getJson, postForm } from "../utils/http";
 import { randomUUID, randomBytes } from "node:crypto";
 import pkceChallenge from "pkce-challenge";
+import { Config } from "src/utils/config";
 
-const REQUIRED_OIDC_FIELDS = [
+export const REQUIRED_OIDC_FIELDS: (keyof Config)[] = [
   "OIDC_AUTHORIZATION_ENDPOINT",
   "OIDC_TOKEN_ENDPOINT",
   "OIDC_USER_INFO_ENDPOINT",
@@ -17,7 +18,7 @@ const REQUIRED_OIDC_FIELDS = [
 ];
 
 const configValidation = () => {
-  const config = strapi.config.get<object>("plugin::strapi-plugin-sso");
+  const config = strapi.config.get<Config>("plugin::strapi-plugin-sso");
   const missing = REQUIRED_OIDC_FIELDS.filter((key) => !config?.[key]);
   if (missing.length > 0) {
     throw new Error(`These are required: ${missing.join(", ")}.`);
@@ -127,11 +128,7 @@ const oidcSignInCallback = async (ctx: Context) => {
 
     // Client-side authentication persistence and redirection
     const nonce = randomUUID();
-    const html = oauthService.renderSignUpSuccess(
-      jwtToken,
-      activateUser,
-      nonce,
-    );
+    const html = oauthService.renderSignUpSuccess(jwtToken, nonce);
     ctx.set("Content-Security-Policy", `script-src 'nonce-${nonce}'`);
     ctx.body = html;
   } catch (e) {

server/src/controllers/role.ts

@@ -17,6 +17,7 @@ export default ({ strapi }: { strapi: Core.Strapi }) => ({
       await roleService.setConfig(ctx.request.body as RoleConfig);
       ctx.send({}, 204);
     } catch (e) {
+      if (!(e instanceof Error)) throw e;
       strapi.log.error(e);
       ctx.send({ error: e.message }, 400);
     }

server/src/services/__tests__/oauth.spec.js

@@ -1,6 +1,6 @@
 import { describe, test, expect, jest } from "@jest/globals";
 import accepts from "accepts";
-import oauth, { SSO_ERROR_MESSAGES } from "../oauth";
+import oauth, { SsoError } from "../oauth";
 
 const ctxFor = (acceptLanguage) => {
   const headers = { "accept-language": acceptLanguage };
@@ -28,7 +28,7 @@ describe("oauth service", () => {
   const service = oauth({ strapi: mockStrapi });
 
   describe("renderSignUpError", () => {
-    test.each(Object.entries(SSO_ERROR_MESSAGES))(
+    test.each(Object.entries(SsoError))(
       'code "%s" renders the correct message',
       (code, message) => {
         expect(service.renderSignUpError(code)).toContain(message);

server/src/services/oauth.ts

@@ -1,27 +1,26 @@
-import { Core } from "@strapi/strapi";
+import { Core, UID } from "@strapi/strapi";
 import strapiUtils from "@strapi/utils";
 import { SetOption } from "cookies";
 import generator from "generate-password";
 import { Context } from "koa";
 import { randomUUID } from "node:crypto";
+import { Config } from "src/utils/config";
+import { SsoErrorCode } from "src/utils/errors";
 import { AdminSessionsConfig } from "src/types/strapi";
 
-export const SSO_ERROR_MESSAGES = Object.freeze({
-  sso_no_code: "No authorization code was returned by the provider.",
-  sso_invalid_state:
-    "The login request could not be verified. Please try again.",
-  sso_access_denied:
-    "Your account has not been granted access. Please contact your administrator.",
-  sso_failed:
-    "Authentication failed. Please try again or contact your administrator.",
-});
+export enum SsoError {
+  sso_no_code = "No authorization code was returned by the provider.",
+  sso_invalid_state = "The login request could not be verified. Please try again.",
+  sso_access_denied = "Your account has not been granted access. Please contact your administrator.",
+  sso_failed = "Authentication failed. Please try again or contact your administrator.",
+}
 
 export default ({ strapi }: { strapi: Core.Strapi }) => ({
   async createUser(
     email: string,
     lastname: string,
     firstname: string,
-    locale,
+    locale: string,
     roles = [],
   ) {
     const userService = strapi.service("admin::user");
@@ -59,23 +58,23 @@ export default ({ strapi }: { strapi: Core.Strapi }) => ({
   localeFindByHeader(ctx: Context) {
     return ctx.acceptsLanguages("en", "fr") || "en";
   },
-  async triggerWebHook(user) {
+  async triggerWebHook(user: any) {
     const eventHub = strapi.eventHub;
     if (!eventHub) return;
 
-    const modelDef = strapi.getModel("admin::user");
+    const schema = strapi.getModel("admin::user");
     const sanitizedEntity =
       await strapiUtils.sanitize.sanitizers.defaultSanitizeOutput(
-        { schema: modelDef, getModel: strapi.getModel.bind(strapi) },
+        { schema, getModel: (uid) => strapi.getModel(uid as UID.Schema) },
         user,
       );
 
     eventHub.emit("entry.create", {
-      model: modelDef.modelName,
+      model: schema.modelName,
       entry: sanitizedEntity,
     });
   },
-  triggerSignInSuccess(user) {
+  triggerSignInSuccess(user: any) {
     const { password, ...safeUser } = user;
     const eventHub = strapi.eventHub;
     eventHub.emit("admin.auth.success", {
@@ -84,9 +83,9 @@ export default ({ strapi }: { strapi: Core.Strapi }) => ({
     });
   },
   // Sign In Success
-  renderSignUpSuccess(jwtToken, user, nonce) {
+  renderSignUpSuccess(jwtToken: string, nonce: string) {
     // get REMEMBER_ME from config
-    const config = strapi.config.get("plugin::strapi-plugin-sso");
+    const config: Config = strapi.config.get("plugin::strapi-plugin-sso");
     const REMEMBER_ME = config["REMEMBER_ME"];
     const isRememberMe = !!REMEMBER_ME;
 
@@ -113,8 +112,8 @@ export default ({ strapi }: { strapi: Core.Strapi }) => ({
 </body>
 </html>`;
   },
-  renderSignUpError(code) {
-    const message = SSO_ERROR_MESSAGES[code] ?? SSO_ERROR_MESSAGES.sso_failed;
+  renderSignUpError(code: SsoErrorCode) {
+    const message = SsoError[code] ?? SsoError.sso_failed;
     const loginUrl = `${strapi.config.admin.url}/auth/login`;
     return `
 <!doctype html>
@@ -143,7 +142,7 @@ export default ({ strapi }: { strapi: Core.Strapi }) => ({
 </body>
 </html>`;
   },
-  async generateToken(user, ctx: Context) {
+  async generateToken(user: any, ctx: Context) {
     const sessionManager = strapi.sessionManager;
     if (!sessionManager) {
       throw new Error(
@@ -163,7 +162,7 @@ export default ({ strapi }: { strapi: Core.Strapi }) => ({
       });
     }
 
-    const config = strapi.config.get("plugin::strapi-plugin-sso");
+    const config: Config = strapi.config.get("plugin::strapi-plugin-sso");
     const REMEMBER_ME = config["REMEMBER_ME"];
     const rememberMe = !!REMEMBER_ME;
 
@@ -177,7 +176,7 @@ export default ({ strapi }: { strapi: Core.Strapi }) => ({
       "admin.auth.sessions",
       {},
     );
-    const maxRefresh = sessions.maxRefreshTokenLifespan;
+    const maxRefresh = sessions.maxRefreshTokenLifespan ?? 0;
     const cookieOptions: SetOption = {
       sameSite: "lax",
       ...strapi.config.get("admin.auth.cookie", {}),

server/src/services/role.ts

@@ -24,7 +24,7 @@ const roleService = ({ strapi }: { strapi: Core.Strapi }) => ({
       .query("plugin::strapi-plugin-sso.roles")
       .create({ data: { expression } });
   },
-  async resolveRole(userInfo) {
+  async resolveRole(userInfo: any) {
     const config = await this.getConfig();
     if (!config?.expression) {
       return null;

server/src/utils/config.ts

@@ -0,0 +1,14 @@
+export type Config = {
+  OIDC_AUTHORIZATION_ENDPOINT: string;
+  OIDC_TOKEN_ENDPOINT: string;
+  OIDC_USER_INFO_ENDPOINT: string;
+  OIDC_CLIENT_ID: string;
+  OIDC_CLIENT_SECRET: string;
+  OIDC_REDIRECT_URI: string;
+  OIDC_SCOPES: string;
+  OIDC_GRANT_TYPE: string;
+  OIDC_FAMILY_NAME_FIELD: string;
+  OIDC_GIVEN_NAME_FIELD: string;
+
+  REMEMBER_ME?: boolean;
+};

server/src/utils/errors.ts

@@ -0,0 +1,3 @@
+import { SsoError } from "src/services/oauth";
+
+export type SsoErrorCode = keyof typeof SsoError;

server/tsconfig.json

@@ -4,5 +4,6 @@
   "compilerOptions": {
     "rootDir": "../",
     "baseUrl": ".",
+    "strict": true
   }
 }