diff --git a/client/src/i18n/translations/de.ts b/client/src/i18n/translations/de.ts index 2bec291..0421e1f 100644 --- a/client/src/i18n/translations/de.ts +++ b/client/src/i18n/translations/de.ts @@ -206,6 +206,7 @@ const de: Record = { 'login.oidc.invalidState': 'Ungültige Sitzung. Bitte erneut versuchen.', 'login.demoFailed': 'Demo-Login fehlgeschlagen', 'login.oidcSignIn': 'Anmelden mit {name}', + 'login.oidcOnly': 'Passwort-Authentifizierung ist deaktiviert. Bitte melde dich über deinen SSO-Anbieter an.', 'login.demoHint': 'Demo ausprobieren — ohne Registrierung', // Register @@ -285,6 +286,8 @@ const de: Record = { 'admin.oidcIssuer': 'Issuer URL', 'admin.oidcIssuerHint': 'Die OpenID Connect Issuer URL des Anbieters. z.B. https://accounts.google.com', 'admin.oidcSaved': 'OIDC-Konfiguration gespeichert', + 'admin.oidcOnlyMode': 'Passwort-Authentifizierung deaktivieren', + 'admin.oidcOnlyModeHint': 'Wenn aktiviert, ist nur SSO-Login erlaubt. Passwort-Login und Registrierung werden blockiert.', // File Types 'admin.fileTypes': 'Erlaubte Dateitypen', diff --git a/client/src/i18n/translations/en.ts b/client/src/i18n/translations/en.ts index 73c42a2..33c828a 100644 --- a/client/src/i18n/translations/en.ts +++ b/client/src/i18n/translations/en.ts @@ -206,6 +206,7 @@ const en: Record = { 'login.oidc.invalidState': 'Invalid session. Please try again.', 'login.demoFailed': 'Demo login failed', 'login.oidcSignIn': 'Sign in with {name}', + 'login.oidcOnly': 'Password authentication is disabled. Please sign in using your SSO provider.', 'login.demoHint': 'Try the demo — no registration needed', // Register @@ -285,6 +286,8 @@ const en: Record = { 'admin.oidcIssuer': 'Issuer URL', 'admin.oidcIssuerHint': 'The OpenID Connect Issuer URL of the provider. e.g. https://accounts.google.com', 'admin.oidcSaved': 'OIDC configuration saved', + 'admin.oidcOnlyMode': 'Disable password authentication', + 'admin.oidcOnlyModeHint': 'When enabled, only SSO login is permitted. Password-based login and registration are blocked.', // File Types 'admin.fileTypes': 'Allowed File Types', diff --git a/client/src/pages/AdminPage.tsx b/client/src/pages/AdminPage.tsx index 8f72c83..23369ef 100644 --- a/client/src/pages/AdminPage.tsx +++ b/client/src/pages/AdminPage.tsx @@ -39,6 +39,7 @@ interface OidcConfig { client_secret: string client_secret_set: boolean display_name: string + oidc_only: boolean } interface UpdateInfo { @@ -72,7 +73,7 @@ export default function AdminPage(): React.ReactElement { const [createForm, setCreateForm] = useState<{ username: string; email: string; password: string; role: string }>({ username: '', email: '', password: '', role: 'user' }) // OIDC config - const [oidcConfig, setOidcConfig] = useState({ issuer: '', client_id: '', client_secret: '', client_secret_set: false, display_name: '' }) + const [oidcConfig, setOidcConfig] = useState({ issuer: '', client_id: '', client_secret: '', client_secret_set: false, display_name: '', oidc_only: false }) const [savingOidc, setSavingOidc] = useState(false) // Registration toggle @@ -715,11 +716,31 @@ export default function AdminPage(): React.ReactElement { className="w-full px-3 py-2 border border-slate-300 rounded-lg text-sm focus:ring-2 focus:ring-slate-400 focus:border-transparent" /> + {/* OIDC-only mode toggle */} +
+
+

{t('admin.oidcOnlyMode')}

+

{t('admin.oidcOnlyModeHint')}

+
+ +
+

)} + )} - {/* OIDC / SSO login button */} - {appConfig?.oidc_configured && ( + {/* OIDC / SSO login button (only when OIDC is configured but not in oidc-only mode) */} + {appConfig?.oidc_configured && !oidcOnly && ( <>
diff --git a/client/src/pages/SettingsPage.tsx b/client/src/pages/SettingsPage.tsx index bf19952..1d13881 100644 --- a/client/src/pages/SettingsPage.tsx +++ b/client/src/pages/SettingsPage.tsx @@ -71,6 +71,13 @@ export default function SettingsPage(): React.ReactElement { const [currentPassword, setCurrentPassword] = useState('') const [newPassword, setNewPassword] = useState('') const [confirmPassword, setConfirmPassword] = useState('') + const [oidcOnlyMode, setOidcOnlyMode] = useState(false) + + useEffect(() => { + authApi.getAppConfig?.().then((config) => { + if (config?.oidc_only_mode) setOidcOnlyMode(true) + }).catch(() => {}) + }, []) useEffect(() => { setMapTileUrl(settings.map_tile_url || '') @@ -398,6 +405,7 @@ export default function SettingsPage(): React.ReactElement {
{/* Change Password */} + {!oidcOnlyMode && (
@@ -446,6 +454,7 @@ export default function SettingsPage(): React.ReactElement {
+ )}
diff --git a/server/src/routes/admin.ts b/server/src/routes/admin.ts index 53e538b..f6d0afd 100644 --- a/server/src/routes/admin.ts +++ b/server/src/routes/admin.ts @@ -122,16 +122,18 @@ router.get('/oidc', (_req: Request, res: Response) => { client_id: get('oidc_client_id'), client_secret_set: !!secret, display_name: get('oidc_display_name'), + oidc_only: get('oidc_only') === 'true', }); }); router.put('/oidc', (req: Request, res: Response) => { - const { issuer, client_id, client_secret, display_name } = req.body; + const { issuer, client_id, client_secret, display_name, oidc_only } = req.body; const set = (key: string, val: string) => db.prepare("INSERT OR REPLACE INTO app_settings (key, value) VALUES (?, ?)").run(key, val || ''); set('oidc_issuer', issuer); set('oidc_client_id', client_id); if (client_secret !== undefined) set('oidc_client_secret', client_secret); set('oidc_display_name', display_name); + set('oidc_only', oidc_only ? 'true' : 'false'); res.json({ success: true }); }); diff --git a/server/src/routes/auth.ts b/server/src/routes/auth.ts index 2996128..7516d3a 100644 --- a/server/src/routes/auth.ts +++ b/server/src/routes/auth.ts @@ -59,6 +59,17 @@ function rateLimiter(maxAttempts: number, windowMs: number) { } const authLimiter = rateLimiter(10, RATE_LIMIT_WINDOW); +function isOidcOnlyMode(): boolean { + const get = (key: string) => (db.prepare("SELECT value FROM app_settings WHERE key = ?").get(key) as { value: string } | undefined)?.value || null; + const enabled = get('oidc_only') === 'true'; + if (!enabled) return false; + const oidcConfigured = !!( + (process.env.OIDC_ISSUER || get('oidc_issuer')) && + (process.env.OIDC_CLIENT_ID || get('oidc_client_id')) + ); + return oidcConfigured; +} + function maskKey(key: string | null | undefined): string | null { if (!key) return null; if (key.length <= 8) return '--------'; @@ -89,6 +100,8 @@ router.get('/app-config', (_req: Request, res: Response) => { (process.env.OIDC_ISSUER || (db.prepare("SELECT value FROM app_settings WHERE key = 'oidc_issuer'").get() as { value: string } | undefined)?.value) && (process.env.OIDC_CLIENT_ID || (db.prepare("SELECT value FROM app_settings WHERE key = 'oidc_client_id'").get() as { value: string } | undefined)?.value) ); + const oidcOnlySetting = (db.prepare("SELECT value FROM app_settings WHERE key = 'oidc_only'").get() as { value: string } | undefined)?.value; + const oidcOnlyMode = oidcConfigured && oidcOnlySetting === 'true'; res.json({ allow_registration: isDemo ? false : allowRegistration, has_users: userCount > 0, @@ -96,6 +109,7 @@ router.get('/app-config', (_req: Request, res: Response) => { has_maps_key: hasGoogleKey, oidc_configured: oidcConfigured, oidc_display_name: oidcConfigured ? (oidcDisplayName || 'SSO') : undefined, + oidc_only_mode: oidcOnlyMode, allowed_file_types: (db.prepare("SELECT value FROM app_settings WHERE key = 'allowed_file_types'").get() as { value: string } | undefined)?.value || 'jpg,jpeg,png,gif,webp,heic,pdf,doc,docx,xls,xlsx,txt,csv', demo_mode: isDemo, demo_email: isDemo ? 'demo@trek.app' : undefined, @@ -118,6 +132,9 @@ router.post('/register', authLimiter, (req: Request, res: Response) => { const { username, email, password } = req.body; const userCount = (db.prepare('SELECT COUNT(*) as count FROM users').get() as { count: number }).count; + if (userCount > 0 && isOidcOnlyMode()) { + return res.status(403).json({ error: 'Password authentication is disabled. Please sign in with SSO.' }); + } if (userCount > 0) { const setting = db.prepare("SELECT value FROM app_settings WHERE key = 'allow_registration'").get() as { value: string } | undefined; if (setting?.value === 'false') { @@ -167,6 +184,10 @@ router.post('/register', authLimiter, (req: Request, res: Response) => { }); router.post('/login', authLimiter, (req: Request, res: Response) => { + if (isOidcOnlyMode()) { + return res.status(403).json({ error: 'Password authentication is disabled. Please sign in with SSO.' }); + } + const { email, password } = req.body; if (!email || !password) { @@ -205,6 +226,9 @@ router.get('/me', authenticate, (req: Request, res: Response) => { router.put('/me/password', authenticate, rateLimiter(5, RATE_LIMIT_WINDOW), (req: Request, res: Response) => { const authReq = req as AuthRequest; + if (isOidcOnlyMode()) { + return res.status(403).json({ error: 'Password authentication is disabled.' }); + } if (process.env.DEMO_MODE === 'true' && authReq.user.email === 'demo@trek.app') { return res.status(403).json({ error: 'Password change is disabled in demo mode.' }); }