Whitelabel: Authorization + Verce fix (#11086)

* feat: add redirection-based Authorization to white-label domains

* refact: request original website from white-label domains

* fix: self.crypto bug

* test: set-up basic white-label tests

* chore: update langs

* fix: fail explicitly when requested login is from an untrusted domain

* refact: consistent variables

* fix: getDomain header access

* test: update tests

Author: kewitz

components/FeedbackModal.tsx

@@ -45,7 +45,7 @@ export function FeedbackModal({
     variables: {
       score: -1, // the sendSurveyResponse mutation requires a score, but we don't use it here
       surveyKey: feedbackKey,
-      responseId: typeof self !== 'undefined' ? self.crypto.randomUUID() : null, // the Survey component uses this to send multiple responses and have it update the same row in Coda, but here we only send one response
+      responseId: typeof self !== 'undefined' ? self.crypto?.randomUUID?.() : null, // the Survey component uses this to send multiple responses and have it update the same row in Coda, but here we only send one response
     },
   });
 

cypress.config.js

@@ -24,6 +24,10 @@ module.exports = defineConfig({
   screenshotsFolder: 'test/cypress/screenshots',
   videosFolder: 'test/cypress/videos',
   downloadsFolder: 'test/cypress/downloads',
+  hosts: {
+    'local.opencollective': '127.0.0.1',
+    'local.crooked': '127.0.0.1',
+  },
   e2e: {
     setupNodeEvents(on, config) {
       // eslint-disable-next-line n/no-unpublished-require

env.js

@@ -29,6 +29,7 @@ const defaults = {
   PDF_SERVICE_URL: 'https://pdf-staging.opencollective.com',
   NEXT_PDF_SERVICE_URL: 'https://next-pdf.opencollective.com',
   ML_SERVICE_URL: 'https://ml.opencollective.com',
+  WHITELABEL_DOMAINS: 'http://local.opencollective:3000',
   DISABLE_MOCK_UPLOADS: false,
   PAYPAL_ENVIRONMENT: 'sandbox',
   STRIPE_KEY: 'pk_test_VgSB4VSg2wb5LdAkz7p38Gw8',

lang/ca.json

@@ -1174,6 +1174,7 @@
   "dM+p3/": "From",
   "dMaivT": "Unfreezing the collective means they will regain full access to the platform.",
   "Dnbu8Y": "{accountName} (@{accountSlug}) has been frozen",
+  "domain.notAuthorized": "This page is not available on this domain.",
   "Donation": "Donation",
   "Download": "Download",
   "DownloadInvoice": "Baixa la factura",
@@ -3342,6 +3343,7 @@
   "SignIn.LinkSent": "Your magic link is on its way!",
   "SignIn.SentTo": "We've sent it to {email}.",
   "SignIn.SuccessDetails": "You’ll be redirected from the link in the email, you can safely close this tab.",
+  "signin.untrustedDomain": "You've been requested to log-in to Open Collective by an untrusted domain: {domain}",
   "signinLinkSent.": "<Link>Learn more</Link> about our login system.",
   "Sioe6W": "The person you are inviting to submit this expense will be asked to provide an invoice. Do you have one?",
   "Siv4wU": "Contribution #{id}",

lang/cs.json

@@ -1174,6 +1174,7 @@
   "dM+p3/": "From",
   "dMaivT": "Unfreezing the collective means they will regain full access to the platform.",
   "Dnbu8Y": "{accountName} (@{accountSlug}) has been frozen",
+  "domain.notAuthorized": "This page is not available on this domain.",
   "Donation": "Příspěvek",
   "Download": "Stáhnout",
   "DownloadInvoice": "Stáhnout fakturu",
@@ -3342,6 +3343,7 @@
   "SignIn.LinkSent": "Tvůj magický odkaz je na cestě!",
   "SignIn.SentTo": "We've sent it to {email}.",
   "SignIn.SuccessDetails": "You’ll be redirected from the link in the email, you can safely close this tab.",
+  "signin.untrustedDomain": "You've been requested to log-in to Open Collective by an untrusted domain: {domain}",
   "signinLinkSent.": "<Link>Learn more</Link> about our login system.",
   "Sioe6W": "The person you are inviting to submit this expense will be asked to provide an invoice. Do you have one?",
   "Siv4wU": "Contribution #{id}",

lang/de.json

@@ -1174,6 +1174,7 @@
   "dM+p3/": "Von",
   "dMaivT": "Unfreezing the collective means they will regain full access to the platform.",
   "Dnbu8Y": "{accountName} (@{accountSlug}) wurde eingefroren",
+  "domain.notAuthorized": "This page is not available on this domain.",
   "Donation": "Spende",
   "Download": "Herunterladen",
   "DownloadInvoice": "Rechnung herunterladen",
@@ -3342,6 +3343,7 @@
   "SignIn.LinkSent": "Ihr magischer Link ist zu Ihnen unterwegs!",
   "SignIn.SentTo": "Wir haben es an {email} gesendet.",
   "SignIn.SuccessDetails": "Sie werden von dem Link in der E-Mail weitergeleitet, Sie können diesen Tab schließen.",
+  "signin.untrustedDomain": "You've been requested to log-in to Open Collective by an untrusted domain: {domain}",
   "signinLinkSent.": "<Link>Learn more</Link> about our login system.",
   "Sioe6W": "The person you are inviting to submit this expense will be asked to provide an invoice. Do you have one?",
   "Siv4wU": "Contribution #{id}",

lang/en.json

@@ -1174,6 +1174,7 @@
   "dM+p3/": "From",
   "dMaivT": "Unfreezing the collective means they will regain full access to the platform.",
   "Dnbu8Y": "{accountName} (@{accountSlug}) has been frozen",
+  "domain.notAuthorized": "This page is not available on this domain.",
   "Donation": "Donation",
   "Download": "Download",
   "DownloadInvoice": "Download invoice",
@@ -3342,6 +3343,7 @@
   "SignIn.LinkSent": "Your magic link is on its way!",
   "SignIn.SentTo": "We've sent it to {email}.",
   "SignIn.SuccessDetails": "You’ll be redirected from the link in the email, you can safely close this tab.",
+  "signin.untrustedDomain": "You've been requested to log-in to Open Collective by an untrusted domain: {domain}",
   "signinLinkSent.": "<Link>Learn more</Link> about our login system.",
   "Sioe6W": "The person you are inviting to submit this expense will be asked to provide an invoice. Do you have one?",
   "Siv4wU": "Contribution #{id}",

lang/es.json

@@ -1174,6 +1174,7 @@
   "dM+p3/": "Desde",
   "dMaivT": "Descongelar el colectivo significa que recuperarán el acceso completo a la plataforma.",
   "Dnbu8Y": "{accountName} (@{accountSlug}) ha sido congelado",
+  "domain.notAuthorized": "This page is not available on this domain.",
   "Donation": "Donación",
   "Download": "Descargar",
   "DownloadInvoice": "Descargar factura",
@@ -3342,6 +3343,7 @@
   "SignIn.LinkSent": "¡Su enlace mágico está en camino!",
   "SignIn.SentTo": "Lo hemos enviado al {email}.",
   "SignIn.SuccessDetails": "Serás redirigido desde el enlace del correo electrónico, así que puedes cerrar esta pestaña sin problemas.",
+  "signin.untrustedDomain": "You've been requested to log-in to Open Collective by an untrusted domain: {domain}",
   "signinLinkSent.": "<Link>Más información</Link> sobre nuestro sistema de inicio de sesión.",
   "Sioe6W": "The person you are inviting to submit this expense will be asked to provide an invoice. Do you have one?",
   "Siv4wU": "Colaboración #{id}",

lang/fr.json

@@ -1174,6 +1174,7 @@
   "dM+p3/": "De",
   "dMaivT": "Dégeler le Collectif signifie qu'il aura désormais un accès complet à la plate-forme.",
   "Dnbu8Y": "{accountName} (@{accountSlug}) a été gelé",
+  "domain.notAuthorized": "This page is not available on this domain.",
   "Donation": "Don",
   "Download": "Télécharger",
   "DownloadInvoice": "Télécharger la facture",
@@ -3342,6 +3343,7 @@
   "SignIn.LinkSent": "Votre lien magique est en route !",
   "SignIn.SentTo": "Il a été envoyé à {email}.",
   "SignIn.SuccessDetails": "Vous serez redirigé depuis le lien dans l'email, vous pouvez fermer cet onglet.",
+  "signin.untrustedDomain": "You've been requested to log-in to Open Collective by an untrusted domain: {domain}",
   "signinLinkSent.": "<Link>En savoir plus</Link> sur notre système de connexion.",
   "Sioe6W": "La personne que vous invitez à soumettre cette dépense sera invitée à fournir une facture. En avez-vous une ?",
   "Siv4wU": "Contribution #{id}",

lang/he.json

@@ -1174,6 +1174,7 @@
   "dM+p3/": "From",
   "dMaivT": "Unfreezing the collective means they will regain full access to the platform.",
   "Dnbu8Y": "{accountName} (@{accountSlug}) הוקפא",
+  "domain.notAuthorized": "This page is not available on this domain.",
   "Donation": "תרומה",
   "Download": "הורדה",
   "DownloadInvoice": "הורדת דרישת תשלום",
@@ -3342,6 +3343,7 @@
   "SignIn.LinkSent": "הקישור הקסום שלך בדרך!",
   "SignIn.SentTo": "שלחנו אותו אל {email}.",
   "SignIn.SuccessDetails": "תישלח הפנייה במייל, אפשר לסגור את החלון הזה.",
+  "signin.untrustedDomain": "You've been requested to log-in to Open Collective by an untrusted domain: {domain}",
   "signinLinkSent.": "<Link>Learn more</Link> about our login system.",
   "Sioe6W": "The person you are inviting to submit this expense will be asked to provide an invoice. Do you have one?",
   "Siv4wU": "Contribution #{id}",

lang/it.json

@@ -1174,6 +1174,7 @@
   "dM+p3/": "Da",
   "dMaivT": "Unfreezing the collective means they will regain full access to the platform.",
   "Dnbu8Y": "{accountName} (@{accountSlug}) has been frozen",
+  "domain.notAuthorized": "This page is not available on this domain.",
   "Donation": "Donazione",
   "Download": "Scarica",
   "DownloadInvoice": "Scarica fattura",
@@ -3342,6 +3343,7 @@
   "SignIn.LinkSent": "Your magic link is on its way!",
   "SignIn.SentTo": "We've sent it to {email}.",
   "SignIn.SuccessDetails": "You’ll be redirected from the link in the email, you can safely close this tab.",
+  "signin.untrustedDomain": "You've been requested to log-in to Open Collective by an untrusted domain: {domain}",
   "signinLinkSent.": "<Link>Learn more</Link> about our login system.",
   "Sioe6W": "The person you are inviting to submit this expense will be asked to provide an invoice. Do you have one?",
   "Siv4wU": "Contribution #{id}",

lang/ja.json

@@ -1174,6 +1174,7 @@
   "dM+p3/": "From",
   "dMaivT": "Unfreezing the collective means they will regain full access to the platform.",
   "Dnbu8Y": "{accountName} (@{accountSlug}) は凍結されています",
+  "domain.notAuthorized": "This page is not available on this domain.",
   "Donation": "寄付",
   "Download": "ダウンロード",
   "DownloadInvoice": "請求書ダウンロード",
@@ -3342,6 +3343,7 @@
   "SignIn.LinkSent": "ログイン用リンクを送信しました！",
   "SignIn.SentTo": "{email} にメールを送信しました。",
   "SignIn.SuccessDetails": "メール内のリンクからリダイレクトされるので、このタブを安全に閉じることができます。",
+  "signin.untrustedDomain": "You've been requested to log-in to Open Collective by an untrusted domain: {domain}",
   "signinLinkSent.": "ログインシステムについての<Link>詳細</Link>",
   "Sioe6W": "The person you are inviting to submit this expense will be asked to provide an invoice. Do you have one?",
   "Siv4wU": "Contribution #{id}",

lang/ko.json

@@ -1174,6 +1174,7 @@
   "dM+p3/": "From",
   "dMaivT": "Unfreezing the collective means they will regain full access to the platform.",
   "Dnbu8Y": "{accountName} (@{accountSlug}) has been frozen",
+  "domain.notAuthorized": "This page is not available on this domain.",
   "Donation": "기부",
   "Download": "Download",
   "DownloadInvoice": "청구서 다운로드",
@@ -3342,6 +3343,7 @@
   "SignIn.LinkSent": "로그인 이메일을",
   "SignIn.SentTo": "{email}로 보냈어요",
   "SignIn.SuccessDetails": "이메일로 발송된 링크를 클릭하면 로그인할 수 있어요.",
+  "signin.untrustedDomain": "You've been requested to log-in to Open Collective by an untrusted domain: {domain}",
   "signinLinkSent.": "<Link>Learn more</Link> about our login system.",
   "Sioe6W": "The person you are inviting to submit this expense will be asked to provide an invoice. Do you have one?",
   "Siv4wU": "Contribution #{id}",

lang/nl.json

@@ -1174,6 +1174,7 @@
   "dM+p3/": "Van",
   "dMaivT": "Unfreezing the collective means they will regain full access to the platform.",
   "Dnbu8Y": "{accountName} (@{accountSlug}) has been frozen",
+  "domain.notAuthorized": "This page is not available on this domain.",
   "Donation": "Donatie",
   "Download": "Download",
   "DownloadInvoice": "Download invoice",
@@ -3342,6 +3343,7 @@
   "SignIn.LinkSent": "Jouw magische link is onderweg!",
   "SignIn.SentTo": "We hebben het naar {email} gestuurd.",
   "SignIn.SuccessDetails": "You’ll be redirected from the link in the email, you can safely close this tab.",
+  "signin.untrustedDomain": "You've been requested to log-in to Open Collective by an untrusted domain: {domain}",
   "signinLinkSent.": "<Link>Learn more</Link> about our login system.",
   "Sioe6W": "The person you are inviting to submit this expense will be asked to provide an invoice. Do you have one?",
   "Siv4wU": "Contribution #{id}",

lang/pl.json

@@ -1174,6 +1174,7 @@
   "dM+p3/": "Od",
   "dMaivT": "Unfreezing the collective means they will regain full access to the platform.",
   "Dnbu8Y": "{accountName} (@{accountSlug}) zostało zawieszone",
+  "domain.notAuthorized": "This page is not available on this domain.",
   "Donation": "Darowizna",
   "Download": "Pobierz",
   "DownloadInvoice": "Pobierz fakturę",
@@ -3342,6 +3343,7 @@
   "SignIn.LinkSent": "Twój magiczny link jest w drodze!",
   "SignIn.SentTo": "Wysłaliśmy na adres {email}.",
   "SignIn.SuccessDetails": "Zostaniesz przekierowany z linku w wiadomości e-mail, możesz bezpiecznie zamknąć tę kartę.",
+  "signin.untrustedDomain": "You've been requested to log-in to Open Collective by an untrusted domain: {domain}",
   "signinLinkSent.": "<Link>Dowiedz się więcej</Link> o naszym systemie logowania.",
   "Sioe6W": "The person you are inviting to submit this expense will be asked to provide an invoice. Do you have one?",
   "Siv4wU": "Contribution #{id}",

lang/pt-BR.json

@@ -1174,6 +1174,7 @@
   "dM+p3/": "De",
   "dMaivT": "Desbloquear os colectivos que recuperarão o pleno acesso à plataforma.",
   "Dnbu8Y": "{accountName} (@{accountSlug}) foi congelado",
+  "domain.notAuthorized": "This page is not available on this domain.",
   "Donation": "Doação",
   "Download": "Baixar",
   "DownloadInvoice": "Baixar fatura",
@@ -3342,6 +3343,7 @@
   "SignIn.LinkSent": "Seu link mágico está a caminho!",
   "SignIn.SentTo": "Nós enviamos para {email}.",
   "SignIn.SuccessDetails": "Você será redirecionado a partir do link no e-mail e já pode fechar essa aba.",
+  "signin.untrustedDomain": "You've been requested to log-in to Open Collective by an untrusted domain: {domain}",
   "signinLinkSent.": "<Link>Learn more</Link> about our login system.",
   "Sioe6W": "The person you are inviting to submit this expense will be asked to provide an invoice. Do you have one?",
   "Siv4wU": "Contribution #{id}",

lang/pt.json

@@ -1174,6 +1174,7 @@
   "dM+p3/": "From",
   "dMaivT": "Unfreezing the collective means they will regain full access to the platform.",
   "Dnbu8Y": "{accountName} (@{accountSlug}) has been frozen",
+  "domain.notAuthorized": "This page is not available on this domain.",
   "Donation": "Doação",
   "Download": "Transferir",
   "DownloadInvoice": "Baixar fatura",
@@ -3342,6 +3343,7 @@
   "SignIn.LinkSent": "Seu link mágico está a caminho!",
   "SignIn.SentTo": "Enviamos para {email}.",
   "SignIn.SuccessDetails": "Você será redirecionado pelo link no email, pode fechar esta aba tranquilamente.",
+  "signin.untrustedDomain": "You've been requested to log-in to Open Collective by an untrusted domain: {domain}",
   "signinLinkSent.": "<Link>Learn more</Link> about our login system.",
   "Sioe6W": "The person you are inviting to submit this expense will be asked to provide an invoice. Do you have one?",
   "Siv4wU": "Contribution #{id}",

lang/ru.json

@@ -1174,6 +1174,7 @@
   "dM+p3/": "From",
   "dMaivT": "Unfreezing the collective means they will regain full access to the platform.",
   "Dnbu8Y": "{accountName} (@{accountSlug}) has been frozen",
+  "domain.notAuthorized": "This page is not available on this domain.",
   "Donation": "Пожертвование",
   "Download": "Скачать",
   "DownloadInvoice": "Скачать счет",
@@ -3342,6 +3343,7 @@
   "SignIn.LinkSent": "Ваша волшебная ссылка уже в пути!",
   "SignIn.SentTo": "Мы отправили его на {email}.",
   "SignIn.SuccessDetails": "Вы будете перенаправлены по ссылке в письме. Вы можете закрыть эту вкладку.",
+  "signin.untrustedDomain": "You've been requested to log-in to Open Collective by an untrusted domain: {domain}",
   "signinLinkSent.": "<Link>Learn more</Link> about our login system.",
   "Sioe6W": "The person you are inviting to submit this expense will be asked to provide an invoice. Do you have one?",
   "Siv4wU": "Contribution #{id}",

lang/sk-SK.json

@@ -1174,6 +1174,7 @@
   "dM+p3/": "Od",
   "dMaivT": "Odblokovanie kolektívu znamená, že znova získajú plný prístup k platforme.",
   "Dnbu8Y": "Účet {accountName} (@{accountSlug}) bol zablokovaný",
+  "domain.notAuthorized": "This page is not available on this domain.",
   "Donation": "Príspevok",
   "Download": "Stiahnuť",
   "DownloadInvoice": "Stiahnuť faktúru",
@@ -3342,6 +3343,7 @@
   "SignIn.LinkSent": "Váš magický odkaz je na ceste!",
   "SignIn.SentTo": "Poslali sme to na adresu {email}.",
   "SignIn.SuccessDetails": "Budete presmerovaní z odkazu v e-maile, túto záložku môžete bez obáv zavrieť.",
+  "signin.untrustedDomain": "You've been requested to log-in to Open Collective by an untrusted domain: {domain}",
   "signinLinkSent.": "<Link>Learn more</Link> about our login system.",
   "Sioe6W": "The person you are inviting to submit this expense will be asked to provide an invoice. Do you have one?",
   "Siv4wU": "Contribution #{id}",

lang/sv-SE.json

@@ -1174,6 +1174,7 @@
   "dM+p3/": "Från",
   "dMaivT": "Unfreezing the collective means they will regain full access to the platform.",
   "Dnbu8Y": "{accountName} (@{accountSlug}) har frysts",
+  "domain.notAuthorized": "This page is not available on this domain.",
   "Donation": "Donation",
   "Download": "Ladda ned",
   "DownloadInvoice": "Ladda ner faktura",
@@ -3342,6 +3343,7 @@
   "SignIn.LinkSent": "Inloggningslänken är på väg!",
   "SignIn.SentTo": "Vi har skickat det till {email}.",
   "SignIn.SuccessDetails": "Du kommer att omdirigeras från länken i e-postmeddelandet, du kan stänga den här fliken.",
+  "signin.untrustedDomain": "You've been requested to log-in to Open Collective by an untrusted domain: {domain}",
   "signinLinkSent.": "<Link>Learn more</Link> about our login system.",
   "Sioe6W": "The person you are inviting to submit this expense will be asked to provide an invoice. Do you have one?",
   "Siv4wU": "Contribution #{id}",

lang/uk.json

@@ -1174,6 +1174,7 @@
   "dM+p3/": "From",
   "dMaivT": "Unfreezing the collective means they will regain full access to the platform.",
   "Dnbu8Y": "{accountName} (@{accountSlug}) заблоковано",
+  "domain.notAuthorized": "This page is not available on this domain.",
   "Donation": "Внесок",
   "Download": "Завантажити",
   "DownloadInvoice": "Завантажити рахунок",
@@ -3342,6 +3343,7 @@
   "SignIn.LinkSent": "Ваше чарівне посилання вже в дорозі!",
   "SignIn.SentTo": "Ми надіслали його на {email}.",
   "SignIn.SuccessDetails": "You’ll be redirected from the link in the email, you can safely close this tab.",
+  "signin.untrustedDomain": "You've been requested to log-in to Open Collective by an untrusted domain: {domain}",
   "signinLinkSent.": "<Link>Learn more</Link> about our login system.",
   "Sioe6W": "The person you are inviting to submit this expense will be asked to provide an invoice. Do you have one?",
   "Siv4wU": "Contribution #{id}",

lang/zh.json

@@ -1174,6 +1174,7 @@
   "dM+p3/": "来自",
   "dMaivT": "Unfreezing the collective means they will regain full access to the platform.",
   "Dnbu8Y": "{accountName} (@{accountSlug}) 已被冻结。",
+  "domain.notAuthorized": "This page is not available on this domain.",
   "Donation": "捐款",
   "Download": "下载",
   "DownloadInvoice": "下载收据",
@@ -3342,6 +3343,7 @@
   "SignIn.LinkSent": "魔法链接正在路上！",
   "SignIn.SentTo": "我们已发送至 {email}。",
   "SignIn.SuccessDetails": "邮件中的链接将会把你带回这里，你可以安全地关闭此标签。",
+  "signin.untrustedDomain": "You've been requested to log-in to Open Collective by an untrusted domain: {domain}",
   "signinLinkSent.": "<Link>了解更多</Link>关于登录系统的信息。",
   "Sioe6W": "The person you are inviting to submit this expense will be asked to provide an invoice. Do you have one?",
   "Siv4wU": "Contribution #{id}",