@adminforth/email-invite 1.2.2 → 1.2.4

package/build.log

@@ -7,5 +7,5 @@ custom/
 custom/SetPassword.vue
 custom/tsconfig.json
 
-sent 14,973 bytes  received 58 bytes  30,062.00 bytes/sec
+sent 14,976 bytes  received 58 bytes  30,068.00 bytes/sec
 total size is 14,761  speedup is 0.98

package/dist/index.d.ts

@@ -10,6 +10,7 @@ export default class EmailInvitePlugin extends AdminForthPlugin {
     modifyResourceConfig(adminforth: IAdminForth, resourceConfig: AdminForthResource): Promise<void>;
     validateConfigAfterDiscover(adminforth: IAdminForth, resourceConfig: AdminForthResource): void;
     instanceUniqueRepresentation(pluginOptions: any): string;
+    passwordHashDigest(passwordHash: string | null | undefined): string;
     handleUserCreation({ resource, adminUser, record, adminforth, extra }: {
         resource: AdminForthResource;
         adminUser: AdminUser;

package/dist/index.js

@@ -9,6 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 import AdminForth, { AdminForthPlugin, suggestIfTypo, Filters, afLogger } from "adminforth";
 import { z } from "zod";
+import { createHash, randomUUID } from "crypto";
 const setPasswordBodySchema = z.object({
     token: z.string(),
     password: z.string(),
@@ -119,6 +120,9 @@ export default class EmailInvitePlugin extends AdminForthPlugin {
     instanceUniqueRepresentation(pluginOptions) {
         return `single`;
     }
+    passwordHashDigest(passwordHash) {
+        return createHash('sha256').update(passwordHash || '').digest('hex').slice(0, 16);
+    }
     handleUserCreation(_a) {
         return __awaiter(this, arguments, void 0, function* ({ resource, adminUser, record, adminforth, extra }) {
             try {
@@ -127,7 +131,7 @@ export default class EmailInvitePlugin extends AdminForthPlugin {
                     delete record.password;
                 }
                 const passwordHashFieldName = adminforth.config.auth.passwordHashField;
-                record[passwordHashFieldName] = yield AdminForth.Utils.generatePasswordHash('TEMP_INVITE_PLACEHOLDER_' + Date.now());
+                record[passwordHashFieldName] = yield AdminForth.Utils.generatePasswordHash('TEMP_INVITE_PLACEHOLDER_' + randomUUID());
                 if (this.options.emailConfirmedField && this.emailConfirmedField) {
                     record[this.emailConfirmedField.name] = false;
                 }
@@ -144,15 +148,19 @@ export default class EmailInvitePlugin extends AdminForthPlugin {
             var _b, _c;
             try {
                 const email = record[this.options.emailField];
+                const newRecordId = record[this.authResource.columns.find(col => col.primaryKey).name];
                 if (!email || !/\S+@\S+\.\S+/.test(email)) {
                     console.warn('Email invite plugin: Invalid or missing email address');
                     return { ok: true }; // Don't fail user creation for email issues
                 }
                 const brandName = adminforth.config.customization.brandName || 'Admin Panel';
-                const inviteToken = adminforth.auth.issueJWT({ email, recordId, inviteEmail: true }, 'inviteUser', '7d' // 7 days validity
+                const inviteToken = adminforth.auth.issueJWT({
+                    email,
+                    recordId: newRecordId,
+                    inviteEmail: true,
+                    ph: this.passwordHashDigest(record[this.adminforth.config.auth.passwordHashField])
+                }, 'inviteUser', '7d' // 7 days validity
                 );
-                console.log('Sending invite email to:', email);
-                console.log('Generated JWT token payload:', { email, recordId, inviteEmail: true });
                 const host = ((_b = extra === null || extra === void 0 ? void 0 : extra.headers) === null || _b === void 0 ? void 0 : _b.host) || 'localhost';
                 const protocol = ((_c = extra === null || extra === void 0 ? void 0 : extra.headers) === null || _c === void 0 ? void 0 : _c['x-forwarded-proto']) || 'http';
                 const inviteUrl = `${protocol}://${host}/set-password?token=${inviteToken}`;
@@ -219,6 +227,9 @@ export default class EmailInvitePlugin extends AdminForthPlugin {
                     if (recordId) {
                         userRecord = yield this.adminforth.resource(this.authResource.resourceId).get(Filters.EQ(this.authResource.columns.find(c => c.primaryKey).name, recordId));
                     }
+                    if (decoded.ph !== this.passwordHashDigest(userRecord[this.adminforth.config.auth.passwordHashField])) {
+                        return { error: 'Token has already been used', ok: false };
+                    }
                     if (!userRecord && email) {
                         const records = yield this.adminforth.resource(this.authResource.resourceId).list(Filters.EQ(this.options.emailField, email), 1);
                         userRecord = records.length > 0 ? records[0] : null;
@@ -226,7 +237,7 @@ export default class EmailInvitePlugin extends AdminForthPlugin {
                     if (!userRecord) {
                         return { error: 'User not found', ok: false };
                     }
-                    if (userRecord[this.options.emailConfirmedField]) {
+                    if (this.options.emailConfirmedField && userRecord[this.options.emailConfirmedField]) {
                         return { error: 'Password already set. Invitation link cannot be reused.', ok: false };
                     }
                     const userEmail = userRecord[this.options.emailField];

package/index.ts

@@ -2,6 +2,7 @@ import AdminForth, { AdminForthPlugin, suggestIfTypo, Filters, afLogger } from "
 import type { IAdminForth, IHttpServer, AdminForthResourcePages, AdminForthResourceColumn, AdminForthDataTypes, AdminForthResource, AdminUser, HttpExtra } from "adminforth";
 import type { PluginOptions } from './types.js';
 import { z } from "zod";
+import { createHash, randomUUID } from "crypto";
 
 const setPasswordBodySchema = z.object({
   token: z.string(),
@@ -137,6 +138,11 @@ export default class EmailInvitePlugin extends AdminForthPlugin {
     return `single`;
   }
 
+  passwordHashDigest(passwordHash: string | null | undefined): string {
+    return createHash('sha256').update(passwordHash || '').digest('hex').slice(0, 16);
+  }
+
+
   async handleUserCreation({ resource, adminUser, record, adminforth, extra }: {
     resource: AdminForthResource;
     adminUser: AdminUser;
@@ -151,7 +157,7 @@ export default class EmailInvitePlugin extends AdminForthPlugin {
       }
 
       const passwordHashFieldName = adminforth.config.auth!.passwordHashField;
-      record[passwordHashFieldName] = await AdminForth.Utils.generatePasswordHash('TEMP_INVITE_PLACEHOLDER_' + Date.now());
+      record[passwordHashFieldName] = await AdminForth.Utils.generatePasswordHash('TEMP_INVITE_PLACEHOLDER_' + randomUUID());
 
       if (this.options.emailConfirmedField && this.emailConfirmedField) {
         record[this.emailConfirmedField.name] = false;
@@ -174,6 +180,7 @@ export default class EmailInvitePlugin extends AdminForthPlugin {
   }): Promise<{ok: boolean, error?: string}> {
     try {
       const email = record[this.options.emailField];
+      const newRecordId = record[this.authResource.columns.find(col => col.primaryKey)!.name];
       
       if (!email || !/\S+@\S+\.\S+/.test(email)) {
         console.warn('Email invite plugin: Invalid or missing email address');
@@ -181,16 +188,18 @@ export default class EmailInvitePlugin extends AdminForthPlugin {
       }
 
       const brandName = adminforth.config.customization.brandName || 'Admin Panel';
-      
+
        const inviteToken = adminforth.auth.issueJWT(
-         { email, recordId, inviteEmail: true }, 
+         { 
+          email, 
+          recordId: newRecordId,
+          inviteEmail: true,
+          ph: this.passwordHashDigest(record[this.adminforth.config.auth.passwordHashField])
+        }, 
          'inviteUser', 
          '7d' // 7 days validity
        );
 
-       console.log('Sending invite email to:', email);
-       console.log('Generated JWT token payload:', { email, recordId, inviteEmail: true });
-
        const host = extra?.headers?.host || 'localhost';
        const protocol = extra?.headers?.['x-forwarded-proto'] || 'http';
        const inviteUrl = `${protocol}://${host}/set-password?token=${inviteToken}`;
@@ -270,6 +279,10 @@ export default class EmailInvitePlugin extends AdminForthPlugin {
             userRecord = await this.adminforth.resource(this.authResource.resourceId).get(Filters.EQ(this.authResource.columns.find(c => c.primaryKey).name, recordId));
           }
           
+          if (decoded.ph !== this.passwordHashDigest(userRecord[this.adminforth.config.auth.passwordHashField])) {
+            return { error: 'Token has already been used', ok: false };
+          }
+
           if (!userRecord && email) {
             const records = await this.adminforth.resource(this.authResource.resourceId).list(
               Filters.EQ(this.options.emailField, email),
@@ -281,7 +294,7 @@ export default class EmailInvitePlugin extends AdminForthPlugin {
             return { error: 'User not found', ok: false };
           }
 
-          if ( userRecord[this.options.emailConfirmedField] ) {
+          if ( this.options.emailConfirmedField && userRecord[this.options.emailConfirmedField] ) {
             return { error: 'Password already set. Invitation link cannot be reused.', ok: false };
           }
           const userEmail = userRecord[this.options.emailField];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/email-invite",
-  "version": "1.2.2",
+  "version": "1.2.4",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "type": "module",