Strapi Plugin OBO Auth

This plugin provides a secure On-Behalf-Of (OBO) token exchange endpoint for Strapi v5. It is designed for microservice architectures where a middle-tier service needs to perform actions on a downstream Strapi API on behalf of an authenticated user without exposing the user's original JWT.

Features

• ✅ Strapi v5 Compatible - Built specifically for Strapi v5
• ✅ Admin Panel Interface - Full admin panel integration with settings and testing
• ✅ API Endpoint - RESTful API for token exchange
• ✅ Secure Token Validation - Validates incoming JWTs using Strapi's JWT secret
• ✅ User Verification - Ensures user exists and is not blocked
• ✅ Settings Management - Configurable settings through admin panel

How it Works

1. A client authenticates with your primary Strapi instance (or any IdP) and receives a JWT.
2. The client sends this JWT to a trusted middle-tier service.
3. The middle-tier service calls the /api/obo-auth/exchange-token endpoint provided by this plugin.
4. The plugin validates the initial JWT and issues a new, short-lived JWT.
5. The middle-tier service uses this new JWT to securely communicate with the downstream Strapi API.

Installation

# Using npm
npm install strapi-plugin-obo-auth

# Using yarn
yarn add strapi-plugin-obo-auth

# Using pnpm
pnpm add strapi-plugin-obo-auth

Configuration

Ensure your Strapi application has a JWT_SECRET configured in your .env file, as this is used to validate the incoming token.

File: .env

JWT_SECRET=your-super-secret-jwt-secret

Then, enable the plugin by creating or editing the ./config/plugins.js file:

module.exports = {
  'strapi-plugin-obo-auth': {
    enabled: true,
  },
};

Admin Panel

After installation, you'll find the OBO Auth plugin in your Strapi admin panel:

1. Main Interface: Navigate to the "OBO Auth" section in the left sidebar
2. Token Testing: Use the built-in interface to test token exchange
3. Settings: Configure plugin settings in Settings → OBO Auth Settings

Admin Panel Features

• Token Exchange Interface: Test the token exchange functionality directly from the admin panel
• Settings Management: Configure plugin behavior and token expiration
• API Documentation: Built-in API documentation and examples
• Real-time Testing: Test tokens without leaving the admin interface

API Endpoint

• Method: POST
• Path: /api/obo-auth/exchange-token
• Body:

{
  "token": "<initial_strapi_jwt>"
}

• Success Response:

{
  "jwt": "<new_strapi_jwt>",
  "user": { ... }
}

Development

Version Management

This plugin includes a Makefile for easy version management and publishing:

# Show current version
make version

# Increment versions
make patch    # 1.0.0 -> 1.0.1
make minor    # 1.0.0 -> 1.1.0
make major    # 1.0.0 -> 2.0.0

# Publish to npm
make publish

# Increment and publish in one command
make publish-patch
make publish-minor
make publish-major

# Full release workflow (version + publish + git tag)
make full-release-patch
make full-release-minor
make full-release-major

# Other useful commands
make clean           # Clean build artifacts
make validate        # Validate package.json
make dry-publish     # Test what would be published
make check-published # Check if package exists in npm

Requirements

• Node.js >= 18.0.0
• Strapi v5.0.0 or higher
• npm >= 6.0.0

License

MIT