@antelopejs/dms 0.0.1

package/frontend-vue/layers/dms-auth/app/custom-pages/auth/validate.vue

@@ -0,0 +1,151 @@
+<script setup lang="ts">
+import * as z from "zod";
+import type { FormSubmitEvent } from "@nuxt/ui";
+import { useWindowSize } from "@vueuse/core";
+
+const route = useDmsRoute();
+const { t } = useI18n();
+const toast = useToast();
+const { width } = useWindowSize();
+const homepage = useHomepage();
+const { $authFetch } = useAuthFetch();
+
+if (!route.query.id) {
+  throw createError({
+    statusCode: HTTP_BAD_REQUEST,
+    statusMessage: INVALID_REQUEST,
+    message: "Missing required id parameter",
+  });
+}
+
+const MOBILE_BREAKPOINT = 375;
+const PIN_LENGTH = 6;
+const COOLDOWN_DURATION = 60;
+
+const computedSize = computed(() => {
+  return width.value < MOBILE_BREAKPOINT ? "lg" : "xl";
+});
+
+const isLoading = ref(false);
+const form = useTemplateRef("form");
+
+const schema = z.object({
+  pin: z.string().array().length(PIN_LENGTH),
+});
+type Schema = z.output<typeof schema>;
+const state = reactive<Partial<Schema>>({});
+
+const { cooldown, startCooldown } = useCooldown(COOLDOWN_DURATION);
+
+onMounted(() => {
+  startCooldown();
+});
+
+async function onSubmit(event: FormSubmitEvent<Schema>) {
+  try {
+    isLoading.value = true;
+    await $authFetch("/api/auth/verify-email", {
+      method: "POST",
+      body: {
+        token: event.data.pin.join(""),
+        user_id: route.query.id as string,
+      },
+    });
+
+    navigateDms(homepage);
+  } catch (error: unknown) {
+    useApiError(error, {
+      title: "page.validate.error_title",
+    });
+  } finally {
+    isLoading.value = false;
+  }
+}
+
+function onUpdatePin(value: string[]) {
+  if (value.length !== PIN_LENGTH) return;
+
+  form.value?.submit();
+}
+
+async function requestEmailValidation() {
+  try {
+    isLoading.value = true;
+    await $authFetch("/api/auth/request-email-verification");
+
+    startCooldown();
+
+    toast.add({
+      title: t("page.validate.request_sended"),
+      description: t("page.validate.request_sended_description"),
+      color: "success",
+    });
+  } catch (error: unknown) {
+    useApiError(error, {
+      title: "page.validate.error_title",
+    });
+  } finally {
+    isLoading.value = false;
+  }
+}
+</script>
+
+<template>
+  <div class="mx-auto max-w-md">
+    <DmsCard variant="elevated" :padded="false" class="p-6 sm:p-12">
+      <h1 class="pb-5 text-2xl font-bold">
+        {{ $t("page.validate.title") }}
+      </h1>
+
+      <p class="text-muted pb-7 text-sm font-normal">
+        {{ $t("page.validate.description") }}
+      </p>
+
+      <UForm
+        ref="form"
+        :schema="schema"
+        :state="state"
+        class="space-y-7"
+        @submit="onSubmit"
+      >
+        <div class="flex items-center justify-center">
+          <UPinInput
+            v-model="state.pin"
+            :length="PIN_LENGTH"
+            :size="computedSize"
+            type="text"
+            otp
+            @update:model-value="onUpdatePin"
+          />
+        </div>
+
+        <div class="flex justify-center">
+          <UButton
+            v-if="cooldown === 0"
+            :label="$t('page.validate.request_validation')"
+            :loading="isLoading"
+            color="primary"
+            variant="ghost"
+            size="sm"
+            type="button"
+            @click="requestEmailValidation()"
+          />
+
+          <UButton
+            v-else
+            :label="
+              $t('page.validate.request_validation_in', {
+                time: cooldown,
+              })
+            "
+            :loading="isLoading"
+            color="neutral"
+            variant="link"
+            size="sm"
+            disabled
+          />
+        </div>
+      </UForm>
+    </DmsCard>
+  </div>
+</template>

package/frontend-vue/layers/dms-auth/app/middleware/auth.ts

@@ -0,0 +1,91 @@
+interface AuthMiddlewareOptions {
+  navigateAuthenticatedTo?: string;
+  navigateUnauthenticatedTo?: string;
+}
+
+type MiddlewareMeta = boolean | AuthMiddlewareOptions;
+
+function isAuthOptions(value: MiddlewareMeta): value is AuthMiddlewareOptions {
+  return typeof value === "object" && value !== null;
+}
+
+async function loadPermissionsIfNeeded() {
+  const { isLoaded, fetchPermissions } = usePermissions();
+
+  if (isLoaded.value) return;
+
+  try {
+    await fetchPermissions();
+  } catch {
+    /* ignore — permissions load failure is not fatal here */
+  }
+}
+
+function handleAuthenticatedUser(
+  to: ReturnType<typeof useDmsRoute>,
+  options: MiddlewareMeta,
+) {
+  const authConfig = useDmsRuntimeConfig().public.dms;
+  const { user } = useUserSession();
+
+  if (authConfig.mustValidateEmail && !user.value?.isValidated) {
+    if (to.path === "/auth/validate") return;
+
+    return navigateDms({
+      path: "/auth/validate",
+      query: { redirect: to.fullPath },
+    });
+  }
+
+  if (isAuthOptions(options) && options.navigateAuthenticatedTo) {
+    return navigateDms(options.navigateAuthenticatedTo);
+  }
+}
+
+function handleUnauthenticatedUser(
+  to: ReturnType<typeof useDmsRoute>,
+  options: MiddlewareMeta,
+) {
+  if (isAuthOptions(options) && options.navigateUnauthenticatedTo) {
+    return navigateDms(options.navigateUnauthenticatedTo);
+  }
+
+  if (to.path.startsWith("/auth")) return;
+
+  return navigateDms({
+    path: "/auth",
+    query: { redirect: to.fullPath },
+  });
+}
+
+async function isPublicAccessRoute(to: ReturnType<typeof useDmsRoute>) {
+  const siteLayout = useSiteLayout();
+
+  if (!siteLayout.siteLayout.value) {
+    await siteLayout.loadSiteLayout();
+  }
+
+  const routeMatch = siteLayout.findMatchingRoute(to.path);
+  return routeMatch?.metadata?.publicAccess === true;
+}
+
+export default defineDmsMiddleware(async (to) => {
+  if (to.matched.length === 0) return;
+
+  const error = useError();
+  if (error.value) throw showError(error.value);
+
+  const options = to.meta.auth as MiddlewareMeta | undefined;
+  if (!options) return;
+
+  if (await isPublicAccessRoute(to)) return;
+
+  const { loggedIn } = useUserSession();
+
+  if (loggedIn.value) {
+    await loadPermissionsIfNeeded();
+    return handleAuthenticatedUser(to, options);
+  }
+
+  return handleUnauthenticatedUser(to, options);
+});

package/frontend-vue/layers/dms-auth/app/utils/accountsFlow.ts

@@ -0,0 +1,22 @@
+import type {
+  LocationQuery,
+  LocationQueryRaw,
+} from "#dms-inertia/frontend-module";
+
+export const ACCOUNTS_LIST_ROUTE = "/auth/accounts";
+export const FROM_ACCOUNTS_QUERY = { from: "accounts" };
+
+export function isFromAccountsList(query: LocationQuery): boolean {
+  const raw = query.from;
+  const value = Array.isArray(raw) ? raw[0] : raw;
+  return value === FROM_ACCOUNTS_QUERY.from;
+}
+
+export function withAccountsFlag(
+  currentQuery: LocationQuery,
+  targetQuery: LocationQueryRaw = {},
+): LocationQueryRaw {
+  return isFromAccountsList(currentQuery)
+    ? { ...targetQuery, ...FROM_ACCOUNTS_QUERY }
+    : targetQuery;
+}

package/frontend-vue/layers/dms-auth/i18n/locales/auth-en-GB.json

@@ -0,0 +1,174 @@
+{
+  "page": {
+    "auth": {
+      "login_title": "Connect to your account",
+      "keep_login": "Keep my active session",
+      "new_here": "New here?",
+      "already_have": "Already an account?",
+      "error_title": "Connection error",
+      "back_to_accounts": "Back to account list",
+      "oauth": {
+        "continue_with": "Continue with {provider}",
+        "separator": "or with e-mail",
+        "completing": "Signing you in…"
+      }
+    },
+    "signup": {
+      "create_account_title": "Create your account",
+      "error_title": "Account creation error"
+    },
+    "2fa": {
+      "title": "Two-factor verification",
+      "description_totp": "Enter the 6-digit code from your authenticator app.",
+      "description_email": "Enter the 6-digit code sent to your email.",
+      "send_email": "Send verification code by email",
+      "email_sent": "Verification code sent to your email",
+      "email_error": "Failed to send verification code",
+      "error_title": "Verification error",
+      "use_email": "Use email verification instead",
+      "use_totp": "Use authenticator app instead",
+      "use_backup": "Use a backup code",
+      "back_to_2fa": "Back to verification"
+    },
+    "backup": {
+      "title": "Use a backup code",
+      "description": "Enter one of your backup recovery codes to sign in.",
+      "code": "Backup code",
+      "error_title": "Verification error"
+    },
+    "forgot": {
+      "title_success": "Password reset!",
+      "title_forget": "Forgot password",
+      "description_success": "Your password has been successfully reset. You will now be connected to your account.",
+      "description_validation": "Please enter the 6-digit code you received by email to reset your password.",
+      "description_forget": "An email containing a recovery code will be sent to you to reset your password.",
+      "error_title": "Reset error"
+    },
+    "validate": {
+      "title": "Email validation",
+      "description": "In order to validate your email address, please enter the 6-digit code you received in the email sent to you.",
+      "error_title": "Validation error",
+      "request_validation_in": "Request new validation in {time} seconds",
+      "request_validation": "Request new validation",
+      "request_sended": "Validation request sent",
+      "request_sended_description": "A new validation code has been sent to you by email."
+    },
+    "recover": {
+      "title": "Reset your password",
+      "description": "Please define a new password to secure your account."
+    },
+    "accounts": {
+      "title": "Choose an account",
+      "description": "Select an account to access your platform.",
+      "active_account": "Active",
+      "expired_account": "Expired",
+      "add_account": "Add an account",
+      "account_removed": "Account removed"
+    },
+    "settings": {
+      "sessions": {
+        "title": "Sessions",
+        "description": "View and manage all active sessions on your account.",
+        "disconnect_all": "Disconnect all sessions",
+        "disconnect": "Disconnect",
+        "empty": "No active sessions",
+        "current": "Current session",
+        "revoked": "Session disconnected",
+        "revoke_error": "Failed to disconnect session",
+        "revoke_all_error": "Failed to disconnect all sessions",
+        "device_desktop": "Desktop",
+        "device_mobile": "Smartphone",
+        "device_tablet": "Tablet",
+        "sessions_on_device": "{count} Sessions on {device}",
+        "session_number": "Session #{number}",
+        "date_time": "Date and time",
+        "location": "Location",
+        "unknown_location": "Unknown",
+        "operating_system": "Operating system",
+        "browser_label": "Browser",
+        "ip_address": "IP address",
+        "just_now": "just now",
+        "minutes_ago": "{count} minutes ago",
+        "hours_ago": "{count} hours ago",
+        "days_ago": "{count} days ago"
+      },
+      "two_factor": {
+        "title": "Two-factor authentication",
+        "description": "Add an extra layer of security to your account by requiring a verification code at login.",
+        "enabled": "Enabled",
+        "disabled": "Disabled",
+        "enable_success": "Two-factor authentication enabled",
+        "disable_success": "Two-factor authentication disabled",
+        "setup_error": "Failed to set up two-factor authentication",
+        "invalid_code": "Invalid verification code",
+        "enter_code": "Verification code",
+        "confirm_disable": "Disable",
+        "send_code": "Send code by email",
+        "email_code_sent": "Verification code sent to your email",
+        "email_code_error": "Failed to send verification code",
+        "totp_title": "Authenticator app",
+        "totp_description": "Use an authenticator app like Google Authenticator or Authy to generate verification codes.",
+        "totp_enable": "Set up authenticator",
+        "totp_disable": "Disable authenticator",
+        "email_title": "Email verification",
+        "email_description": "Receive a verification code by email each time you sign in.",
+        "email_enable": "Enable email verification",
+        "email_disable": "Disable email verification",
+        "setup_qr_description": "Scan the QR code with your authenticator app, then enter the 6-digit code to verify.",
+        "setup_secret_label": "Or enter this secret manually:",
+        "setup_verify_code": "Verification code",
+        "backup_title": "Backup recovery codes",
+        "backup_section_title": "Recovery codes",
+        "backup_description": "Generate one-time-use backup codes in case you lose access to your verification methods.",
+        "backup_warning": "Save these codes in a safe place. Each code can only be used once and they will not be shown again.",
+        "backup_regenerate": "Regenerate codes",
+        "backup_regenerated": "Backup codes regenerated",
+        "backup_dismiss": "I have saved my codes",
+        "add_method": "Add an authentication method",
+        "remove": "Remove",
+        "confirm_disable_title": "Disable two-factor authentication",
+        "confirm_disable_description": "Enter your current verification code to confirm disabling this method.",
+        "regenerate_description": "Enter a verification code to generate new backup codes. Your existing codes will be invalidated."
+      },
+      "profile": {
+        "title": "Personal information",
+        "description": "Manage and update your personal information to keep your profile up-to-date and secure.",
+        "avatar": "Avatar",
+        "avatar_description": "Square picture, stored at up to 100x100 pixels.",
+        "name": "Full name",
+        "email": "Email",
+        "password": "Password",
+        "password_placeholder": "Password",
+        "password_confirm_placeholder": "Confirm password",
+        "language_title": "Application language",
+        "language_description": "Your preferred language for customizing the dashboard display."
+      },
+      "description": {
+        "profile": "Manage and update your personal information to keep your profile up-to-date and secure",
+        "sessions": "View and manage your active sessions across all devices"
+      }
+    }
+  },
+  "error": {
+    "oauth": {
+      "cancelled": "Sign-in cancelled.",
+      "invalid_state": "Sign-in session expired or invalid, please try again.",
+      "failed": "Signing in with this provider failed.",
+      "provider_disabled": "This login provider is not enabled.",
+      "provider_unreachable": "Provider unreachable, please try again shortly.",
+      "token_exchange_failed": "The provider rejected the sign-in.",
+      "email_unavailable": "Could not read your e-mail address from this provider.",
+      "email_not_verified": "This provider account has no verified e-mail address.",
+      "linking_disabled": "An account already exists with this e-mail address. Sign in with your password.",
+      "account_not_validated": "An account already exists with this e-mail address but is not validated. Validate it before linking this provider.",
+      "registration_disabled": "No account matches this identity and provider sign-up is disabled.",
+      "identity_already_linked": "This provider account is already linked to another user.",
+      "user_not_created": "Account creation failed.",
+      "jwt_secret_missing": "Provider sign-in is not configured on this instance.",
+      "resolution_mismatch": "Could not determine which account this identity belongs to.",
+      "relay_required": "Direct call refused: this endpoint only accepts the instance's frontend server.",
+      "identity_malformed": "The provider returned an unusable identity, please try again."
+    },
+    "rate_limited": "Too many attempts, please try again in a minute."
+  }
+}

package/frontend-vue/layers/dms-auth/i18n/locales/auth-fr-FR.json

@@ -0,0 +1,174 @@
+{
+  "page": {
+    "auth": {
+      "login_title": "Connectez-vous à votre compte",
+      "keep_login": "Garder ma session active",
+      "new_here": "Nouveau ici ?",
+      "already_have": "Déjà un compte ?",
+      "error_title": "Erreur de connexion",
+      "back_to_accounts": "Retour à la liste des comptes",
+      "oauth": {
+        "continue_with": "Continuer avec {provider}",
+        "separator": "ou par e-mail",
+        "completing": "Connexion en cours…"
+      }
+    },
+    "signup": {
+      "create_account_title": "Créer votre compte",
+      "error_title": "Erreur de création de compte"
+    },
+    "2fa": {
+      "title": "Vérification à deux facteurs",
+      "description_totp": "Entrez le code à 6 chiffres de votre application d'authentification.",
+      "description_email": "Entrez le code à 6 chiffres envoyé à votre adresse e-mail.",
+      "send_email": "Envoyer le code par e-mail",
+      "email_sent": "Code de vérification envoyé par e-mail",
+      "email_error": "Impossible d'envoyer le code de vérification",
+      "error_title": "Erreur de vérification",
+      "use_email": "Utiliser la vérification par e-mail",
+      "use_totp": "Utiliser l'application d'authentification",
+      "use_backup": "Utiliser un code de secours",
+      "back_to_2fa": "Retour à la vérification"
+    },
+    "backup": {
+      "title": "Utiliser un code de secours",
+      "description": "Entrez l'un de vos codes de récupération pour vous connecter.",
+      "code": "Code de secours",
+      "error_title": "Erreur de vérification"
+    },
+    "forgot": {
+      "title_success": "Mot de passe réinitialisé !",
+      "title_forget": "Mot de passe oublié",
+      "description_success": "Votre mot de passe a été réinitialisé avec succès. Vous allez maintenant être connecté à votre compte.",
+      "description_validation": "Veuillez entrer le code à 6 chiffres que vous avez reçu par e-mail pour réinitialiser votre mot de passe.",
+      "description_forget": "Un e-mail contenant un code de récupération vous sera envoyé pour réinitialiser votre mot de passe.",
+      "error_title": "Erreur de réinitialisation"
+    },
+    "validate": {
+      "title": "Validation de l'e-mail",
+      "description": "Afin de valider votre adresse e-mail, veuillez entrer le code à 6 chiffres que vous avez reçu dans le mail qui vous a été envoyé.",
+      "error_title": "Erreur de validation",
+      "request_validation_in": "Demander une nouvelle validation dans {time} secondes",
+      "request_validation": "Demander une nouvelle validation",
+      "request_sended": "Demande de validation envoyée",
+      "request_sended_description": "Un nouveau code de validation vous a été envoyé par e-mail."
+    },
+    "recover": {
+      "title": "Réinitialiser votre mot de passe",
+      "description": "Veuillez définir un nouveau mot de passe pour sécuriser votre compte."
+    },
+    "accounts": {
+      "title": "Choisir un compte",
+      "description": "Sélectionnez un compte pour accéder à votre plateforme.",
+      "active_account": "Actif",
+      "expired_account": "Expiré",
+      "add_account": "Ajouter un compte",
+      "account_removed": "Compte supprimé"
+    },
+    "settings": {
+      "sessions": {
+        "title": "Sessions",
+        "description": "Visualisez et gérez toutes les sessions actives de votre compte.",
+        "disconnect_all": "Fermer toutes les sessions",
+        "disconnect": "Déconnexion",
+        "empty": "Aucune session active",
+        "current": "Session actuelle",
+        "revoked": "Session déconnectée",
+        "revoke_error": "Impossible de déconnecter la session",
+        "revoke_all_error": "Impossible de déconnecter toutes les sessions",
+        "device_desktop": "Ordinateur",
+        "device_mobile": "Smartphone",
+        "device_tablet": "Tablette",
+        "sessions_on_device": "{count} Sessions sur {device}",
+        "session_number": "Session #{number}",
+        "date_time": "Date et heure",
+        "location": "Localisation",
+        "unknown_location": "Inconnue",
+        "operating_system": "Système d'exploitation",
+        "browser_label": "Application",
+        "ip_address": "Adresse IP",
+        "just_now": "à l'instant",
+        "minutes_ago": "il y a {count} minutes",
+        "hours_ago": "il y a {count} heures",
+        "days_ago": "il y a {count} jours"
+      },
+      "two_factor": {
+        "title": "Authentification à deux facteurs",
+        "description": "Ajoutez une couche de sécurité supplémentaire à votre compte en exigeant un code de vérification à chaque connexion.",
+        "enabled": "Activé",
+        "disabled": "Désactivé",
+        "enable_success": "Authentification à deux facteurs activée",
+        "disable_success": "Authentification à deux facteurs désactivée",
+        "setup_error": "Impossible de configurer l'authentification à deux facteurs",
+        "invalid_code": "Code de vérification invalide",
+        "enter_code": "Code de vérification",
+        "confirm_disable": "Désactiver",
+        "send_code": "Envoyer le code par e-mail",
+        "email_code_sent": "Code de vérification envoyé par e-mail",
+        "email_code_error": "Impossible d'envoyer le code de vérification",
+        "totp_title": "Application d'authentification",
+        "totp_description": "Utilisez une application comme Google Authenticator ou Authy pour générer des codes de vérification.",
+        "totp_enable": "Configurer l'authentification",
+        "totp_disable": "Désactiver l'authentification",
+        "email_title": "Vérification par e-mail",
+        "email_description": "Recevez un code de vérification par e-mail à chaque connexion.",
+        "email_enable": "Activer la vérification par e-mail",
+        "email_disable": "Désactiver la vérification par e-mail",
+        "setup_qr_description": "Scannez le QR code avec votre application d'authentification, puis entrez le code à 6 chiffres pour vérifier.",
+        "setup_secret_label": "Ou entrez ce secret manuellement :",
+        "setup_verify_code": "Code de vérification",
+        "backup_title": "Codes de récupération",
+        "backup_section_title": "Codes de récupération",
+        "backup_description": "Générez des codes de secours à usage unique en cas de perte d'accès à vos méthodes de vérification.",
+        "backup_warning": "Conservez ces codes dans un endroit sûr. Chaque code ne peut être utilisé qu'une seule fois et ils ne seront plus affichés.",
+        "backup_regenerate": "Régénérer les codes",
+        "backup_regenerated": "Codes de récupération régénérés",
+        "backup_dismiss": "J'ai sauvegardé mes codes",
+        "add_method": "Ajouter une méthode d'authentification",
+        "remove": "Supprimer",
+        "confirm_disable_title": "Désactiver l'authentification à deux facteurs",
+        "confirm_disable_description": "Entrez votre code de vérification actuel pour confirmer la désactivation de cette méthode.",
+        "regenerate_description": "Entrez un code de vérification pour générer de nouveaux codes de secours. Vos codes existants seront invalidés."
+      },
+      "profile": {
+        "title": "Informations personnelles",
+        "description": "Gérez et mettez à jour vos informations personnelles pour maintenir votre profil à jour et sécurisé.",
+        "avatar": "Avatar",
+        "avatar_description": "Image carrée, enregistrée en 100x100 pixels maximum.",
+        "name": "Nom et prénom",
+        "email": "Email",
+        "password": "Mot de passe",
+        "password_placeholder": "Mot de passe",
+        "password_confirm_placeholder": "Confirmer le mot de passe",
+        "language_title": "Langue de l'application",
+        "language_description": "Votre langue préférée pour personnaliser l'affichage du tableau de bord."
+      },
+      "description": {
+        "profile": "Gérez et mettez à jour vos informations personnelles pour maintenir votre profil à jour et sécurisé",
+        "sessions": "Consultez et gérez vos sessions actives sur tous vos appareils"
+      }
+    }
+  },
+  "error": {
+    "oauth": {
+      "cancelled": "Connexion annulée.",
+      "invalid_state": "Session de connexion expirée ou invalide, réessayez.",
+      "failed": "La connexion avec ce fournisseur a échoué.",
+      "provider_disabled": "Ce fournisseur de connexion n'est pas activé.",
+      "provider_unreachable": "Fournisseur injoignable, réessayez dans un instant.",
+      "token_exchange_failed": "Le fournisseur a refusé la connexion.",
+      "email_unavailable": "Impossible de récupérer votre adresse e-mail depuis ce fournisseur.",
+      "email_not_verified": "L'adresse e-mail de ce compte n'est pas vérifiée chez le fournisseur.",
+      "linking_disabled": "Un compte existe déjà avec cette adresse e-mail. Connectez-vous avec votre mot de passe.",
+      "account_not_validated": "Un compte existe déjà avec cette adresse e-mail mais n'est pas validé. Validez-le avant de lier ce fournisseur.",
+      "registration_disabled": "Aucun compte n'est associé à cette identité et l'inscription par fournisseur est désactivée.",
+      "identity_already_linked": "Ce compte fournisseur est déjà lié à un autre utilisateur.",
+      "user_not_created": "La création du compte a échoué.",
+      "jwt_secret_missing": "La connexion par fournisseur n'est pas configurée sur cette instance.",
+      "resolution_mismatch": "Impossible de déterminer le compte associé à cette identité.",
+      "relay_required": "Appel direct refusé : ce point d'entrée n'accepte que le serveur frontend de l'instance.",
+      "identity_malformed": "Le fournisseur a renvoyé une identité inexploitable, réessayez."
+    },
+    "rate_limited": "Trop de tentatives, réessayez dans une minute."
+  }
+}

package/frontend-vue/layers/dms-auth/shared/oauth.ts

@@ -0,0 +1,48 @@
+export interface TwoFactorHandoff {
+  kind: "2fa";
+  token: string;
+  methods: string[];
+}
+
+export interface NoWorkspaceHandoff {
+  kind: "no-workspace";
+  token: string;
+  provider: string;
+}
+
+export interface NoHandoff {
+  kind: "none";
+}
+
+/**
+ * Short-lived credential hand-over between the OAuth callback and the
+ * completion page. The tokens ride an httpOnly one-shot cookie instead of a
+ * redirect's `Location:` header, so they never reach the access logs of
+ * whatever sits in front of the app; the completion page then navigates
+ * client-side, matching the exposure of the password login path.
+ *
+ * Shared between the server routes that write the handoff and the completion
+ * page that consumes it, so the contract cannot drift silently.
+ */
+export type OAuthHandoff = TwoFactorHandoff | NoWorkspaceHandoff | NoHandoff;
+
+export const OAUTH_HANDOFF_KINDS = [
+  "2fa",
+  "no-workspace",
+  "none",
+] as const satisfies readonly OAuthHandoff["kind"][];
+
+const ABSOLUTE_PATH_PATTERN = /^\/(?!\/)[^\\]*$/;
+
+/**
+ * Keep only same-origin, non-protocol-relative paths: the redirect target
+ * travels through the provider round-trip and query strings of public pages,
+ * and must never turn the login flow into an open redirect. Shared so the
+ * server routes and the completion page apply the exact same rule.
+ */
+export function sanitizeRedirectPath(value: unknown): string {
+  if (typeof value !== "string" || !ABSOLUTE_PATH_PATTERN.test(value)) {
+    return "";
+  }
+  return value;
+}

package/frontend-vue/layers/dms-core/app/components/PermissionGate.vue

@@ -0,0 +1,13 @@
+<script setup lang="ts">
+interface Props {
+  permission: string;
+}
+
+defineProps<Props>();
+const { hasPermission, isLoaded } = usePermissions();
+</script>
+
+<template>
+  <slot v-if="isLoaded && hasPermission(permission)" />
+  <slot v-else name="fallback" />
+</template>