@antelopejs/dms 0.6.1 → 0.7.0

package/dist/utils/notification-tones.d.ts

@@ -1,4 +1,5 @@
 import type { NotificationTone } from "@antelopejs/interface-dms/notifications/types";
-export declare const LOW_BACKUP_CODES = 2;
+export declare const LOW_BACKUP_CODES = 3;
 export declare function backupCodeUsedTone(left: number): NotificationTone;
 export declare function rolesChangedTone(roleCount: number): NotificationTone;
+export declare function resolveNotificationTone(tone: NotificationTone | null | undefined, isRead: boolean): NotificationTone;

package/dist/utils/notification-tones.js

@@ -3,11 +3,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.LOW_BACKUP_CODES = void 0;
 exports.backupCodeUsedTone = backupCodeUsedTone;
 exports.rolesChangedTone = rolesChangedTone;
-exports.LOW_BACKUP_CODES = 2;
+exports.resolveNotificationTone = resolveNotificationTone;
+exports.LOW_BACKUP_CODES = 3;
 function backupCodeUsedTone(left) {
     return left <= exports.LOW_BACKUP_CODES ? "error" : "warning";
 }
 function rolesChangedTone(roleCount) {
     return roleCount === 0 ? "warning" : "neutral";
 }
+function resolveNotificationTone(tone, isRead) {
+    return tone ?? (isRead ? "neutral" : "primary");
+}
 //# sourceMappingURL=notification-tones.js.map

package/dist/utils/notification-tones.js.map

@@ -1 +1 @@
-{"version":3,"file":"notification-tones.js","sourceRoot":"","sources":["../../src/utils/notification-tones.ts"],"names":[],"mappings":";;;AAsBA,gDAEC;AAQD,4CAEC;AApBY,QAAA,gBAAgB,GAAG,CAAC,CAAC;AAQlC,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI,IAAI,wBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAQD,SAAgB,gBAAgB,CAAC,SAAiB;IAChD,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC"}
+{"version":3,"file":"notification-tones.js","sourceRoot":"","sources":["../../src/utils/notification-tones.ts"],"names":[],"mappings":";;;AAyBA,gDAEC;AAQD,4CAEC;AAWD,0DAKC;AApCY,QAAA,gBAAgB,GAAG,CAAC,CAAC;AAQlC,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI,IAAI,wBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAQD,SAAgB,gBAAgB,CAAC,SAAiB;IAChD,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAWD,SAAgB,uBAAuB,CACrC,IAAyC,EACzC,MAAe;IAEf,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAClD,CAAC"}

package/dist/utils/one-time-code.d.ts

@@ -0,0 +1,3 @@
+export declare function generateCode(): string;
+export declare function hashCode(userId: string, code: string): string;
+export declare function hashesMatch(left: string, right: string): boolean;

package/dist/utils/one-time-code.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateCode = generateCode;
+exports.hashCode = hashCode;
+exports.hashesMatch = hashesMatch;
+const node_crypto_1 = require("node:crypto");
+const CODE_DIGITS = 6;
+const CODE_RANGE = 10 ** CODE_DIGITS;
+function generateCode() {
+    return (0, node_crypto_1.randomInt)(0, CODE_RANGE).toString().padStart(CODE_DIGITS, "0");
+}
+function hashCode(userId, code) {
+    return (0, node_crypto_1.createHash)("sha256")
+        .update(JSON.stringify([userId, code]))
+        .digest("hex");
+}
+function hashesMatch(left, right) {
+    const [a, b] = [Buffer.from(left), Buffer.from(right)];
+    return a.length === b.length && (0, node_crypto_1.timingSafeEqual)(a, b);
+}
+//# sourceMappingURL=one-time-code.js.map

package/dist/utils/one-time-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"one-time-code.js","sourceRoot":"","sources":["../../src/utils/one-time-code.ts"],"names":[],"mappings":";;AAQA,oCAEC;AAMD,4BAIC;AAGD,kCAGC;AAxBD,6CAAqE;AAErE,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,UAAU,GAAG,EAAE,IAAI,WAAW,CAAC;AAGrC,SAAgB,YAAY;IAC1B,OAAO,IAAA,uBAAS,EAAC,CAAC,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AACxE,CAAC;AAMD,SAAgB,QAAQ,CAAC,MAAc,EAAE,IAAY;IACnD,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;SACtC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAGD,SAAgB,WAAW,CAAC,IAAY,EAAE,KAAa;IACrD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/utils/sign-in-monitor.d.ts

@@ -1,5 +1,6 @@
 import { type User } from "@antelopejs/interface-dms/auth/db";
 import { type ClientOrigin } from "./sign-in-country";
+export declare const ATTEMPT_RETENTION_MS: number;
 export declare function recordSignIn(user: User, userAgent: string, origin: ClientOrigin): Promise<void>;
 export declare function rememberSignInDevice(userId: string, userAgent: string, origin: ClientOrigin): Promise<void>;
 export declare function recordFailedPassword(user: User): Promise<void>;

package/dist/utils/sign-in-monitor.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ATTEMPT_RETENTION_MS = void 0;
 exports.recordSignIn = recordSignIn;
 exports.rememberSignInDevice = rememberSignInDevice;
 exports.recordFailedPassword = recordFailedPassword;
@@ -16,7 +17,7 @@ const sign_in_devices_1 = require("./sign-in-devices");
 const user_agent_1 = require("./user-agent");
 const fire_and_forget_1 = require("@antelopejs/interface-dms/utils/fire-and-forget");
 const MS_PER_MINUTE = 60 * 1000;
-const ATTEMPT_RETENTION_MS = 24 * 60 * MS_PER_MINUTE;
+exports.ATTEMPT_RETENTION_MS = 24 * 60 * MS_PER_MINUTE;
 function logFailure(what, userId, error) {
     logging_1.Logging.Error(`[DMS] Could not ${what} for "${userId}": ${String(error)}`);
 }
@@ -72,7 +73,7 @@ async function recordFailedPassword(user) {
         const now = new Date();
         const attempts = (0, interface_database_decorators_1.GetModel)(signInAttempts_model_1.SignInAttemptsModel);
         await attempts.recordFailure(user._id, now);
-        await attempts.pruneBefore(user._id, new Date(now.getTime() - ATTEMPT_RETENTION_MS));
+        await attempts.pruneBefore(user._id, new Date(now.getTime() - exports.ATTEMPT_RETENTION_MS));
         await alertOnBurst(user, now);
     }
     catch (error) {

package/dist/utils/sign-in-monitor.js.map

@@ -1 +1 @@
-{"version":3,"file":"sign-in-monitor.js","sourceRoot":"","sources":["../../src/utils/sign-in-monitor.ts"],"names":[],"mappings":";;AA6CA,oCA6BC;AAGD,oDAkBC;AAyBD,oDAaC;AAGD,oDAMC;AA9ID,gEAA6D;AAC7D,6FAAqE;AACrE,0DAA4E;AAC5E,4EAAwE;AACxE,gFAA4E;AAC5E,mEAA8E;AAC9E,uDAI2B;AAC3B,uDAAqE;AACrE,uDAAyE;AACzE,6CAA8C;AAC9C,qFAAgF;AAEhF,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC;AAErD,SAAS,UAAU,CAAC,IAAY,EAAE,MAAc,EAAE,KAAc;IAC9D,iBAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,SAAS,MAAM,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,MAAc;IACnD,MAAM,QAAQ,GAAG,MAAM,IAAA,wCAAQ,EAAC,iBAAY,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClE,OAAO,QAAQ,CAAC,GAAG,CACjB,CAAC,OAAO,EAAE,EAAE,CACV,IAAA,sCAAoB,EAClB,IAAA,2BAAc,EAAC,OAAO,CAAC,SAAS,CAAC,EACjC,IAAA,+BAAa,EAAC,OAAO,CAAC,EAAE,CAAC,CAC1B,CAAC,WAAW,CAChB,CAAC;AACJ,CAAC;AAYM,KAAK,UAAU,YAAY,CAChC,IAAU,EACV,SAAiB,EACjB,MAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,sCAAoB,EACjC,IAAA,2BAAc,EAAC,SAAS,CAAC,EACzB,MAAM,CAAC,OAAO,CACf,CAAC;QACF,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjE,IAAA,wCAAQ,EAAC,8CAAqB,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;YAC1D,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;SAClC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAA,gCAAc,EAAC,MAAM,CAAC,WAAW,EAAE;YAC9C,iBAAiB;YACjB,mBAAmB;YACnB,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,IAAA,wCAAQ,EAAC,8CAAqB,CAAC,CAAC,QAAQ,CAC5C,IAAI,CAAC,GAAG,EACR,MAAM,CAAC,WAAW,EAClB,IAAI,IAAI,EAAE,CACX,CAAC;QACF,IAAI,IAAI,KAAK,KAAK;YAChB,IAAA,+BAAa,EAAC,IAAA,sCAAc,EAAC,IAAI,EAAE,MAAM,CAAC,EAAE,0BAA0B,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,UAAU,CAAC,2BAA2B,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAGM,KAAK,UAAU,oBAAoB,CACxC,MAAc,EACd,SAAiB,EACjB,MAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,sCAAoB,EACjC,IAAA,2BAAc,EAAC,SAAS,CAAC,EACzB,MAAM,CAAC,OAAO,CACf,CAAC;QACF,MAAM,IAAA,wCAAQ,EAAC,8CAAqB,CAAC,CAAC,QAAQ,CAC5C,MAAM,EACN,MAAM,CAAC,WAAW,EAClB,IAAI,IAAI,EAAE,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,UAAU,CAAC,6BAA6B,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAU,EAAE,GAAS;IAC/C,MAAM,QAAQ,GAAG,IAAA,wCAAQ,EAAC,0CAAmB,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,CACtC,IAAI,CAAC,GAAG,EACR,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,0CAAwB,CAAC,EAClD,0CAAwB,CACzB,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAA,uCAAqB,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACnE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO;IACnC,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO;IAClE,MAAM,IAAA,2CAAmB,EAAC,IAAI,CAAC,GAAG,EAAE;QAClC,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,0CAAwB,GAAG,aAAa;QACvD,YAAY,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;KACvD,CAAC,CAAC;AACL,CAAC;AAQM,KAAK,UAAU,oBAAoB,CAAC,IAAU;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAA,wCAAQ,EAAC,0CAAmB,CAAC,CAAC;QAC/C,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5C,MAAM,QAAQ,CAAC,WAAW,CACxB,IAAI,CAAC,GAAG,EACR,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,oBAAoB,CAAC,CAC/C,CAAC;QACF,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,UAAU,CAAC,2BAA2B,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAGM,KAAK,UAAU,oBAAoB,CAAC,MAAc;IACvD,IAAI,CAAC;QACH,MAAM,IAAA,wCAAQ,EAAC,0CAAmB,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,UAAU,CAAC,2BAA2B,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;AACH,CAAC"}
+{"version":3,"file":"sign-in-monitor.js","sourceRoot":"","sources":["../../src/utils/sign-in-monitor.ts"],"names":[],"mappings":";;;AA6CA,oCA6BC;AAGD,oDAkBC;AAyBD,oDAaC;AAGD,oDAMC;AA9ID,gEAA6D;AAC7D,6FAAqE;AACrE,0DAA4E;AAC5E,4EAAwE;AACxE,gFAA4E;AAC5E,mEAA8E;AAC9E,uDAI2B;AAC3B,uDAAqE;AACrE,uDAAyE;AACzE,6CAA8C;AAC9C,qFAAgF;AAEhF,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnB,QAAA,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC;AAE5D,SAAS,UAAU,CAAC,IAAY,EAAE,MAAc,EAAE,KAAc;IAC9D,iBAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,SAAS,MAAM,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,MAAc;IACnD,MAAM,QAAQ,GAAG,MAAM,IAAA,wCAAQ,EAAC,iBAAY,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClE,OAAO,QAAQ,CAAC,GAAG,CACjB,CAAC,OAAO,EAAE,EAAE,CACV,IAAA,sCAAoB,EAClB,IAAA,2BAAc,EAAC,OAAO,CAAC,SAAS,CAAC,EACjC,IAAA,+BAAa,EAAC,OAAO,CAAC,EAAE,CAAC,CAC1B,CAAC,WAAW,CAChB,CAAC;AACJ,CAAC;AAYM,KAAK,UAAU,YAAY,CAChC,IAAU,EACV,SAAiB,EACjB,MAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,sCAAoB,EACjC,IAAA,2BAAc,EAAC,SAAS,CAAC,EACzB,MAAM,CAAC,OAAO,CACf,CAAC;QACF,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjE,IAAA,wCAAQ,EAAC,8CAAqB,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;YAC1D,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;SAClC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAA,gCAAc,EAAC,MAAM,CAAC,WAAW,EAAE;YAC9C,iBAAiB;YACjB,mBAAmB;YACnB,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,IAAA,wCAAQ,EAAC,8CAAqB,CAAC,CAAC,QAAQ,CAC5C,IAAI,CAAC,GAAG,EACR,MAAM,CAAC,WAAW,EAClB,IAAI,IAAI,EAAE,CACX,CAAC;QACF,IAAI,IAAI,KAAK,KAAK;YAChB,IAAA,+BAAa,EAAC,IAAA,sCAAc,EAAC,IAAI,EAAE,MAAM,CAAC,EAAE,0BAA0B,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,UAAU,CAAC,2BAA2B,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAGM,KAAK,UAAU,oBAAoB,CACxC,MAAc,EACd,SAAiB,EACjB,MAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,sCAAoB,EACjC,IAAA,2BAAc,EAAC,SAAS,CAAC,EACzB,MAAM,CAAC,OAAO,CACf,CAAC;QACF,MAAM,IAAA,wCAAQ,EAAC,8CAAqB,CAAC,CAAC,QAAQ,CAC5C,MAAM,EACN,MAAM,CAAC,WAAW,EAClB,IAAI,IAAI,EAAE,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,UAAU,CAAC,6BAA6B,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAU,EAAE,GAAS;IAC/C,MAAM,QAAQ,GAAG,IAAA,wCAAQ,EAAC,0CAAmB,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,CACtC,IAAI,CAAC,GAAG,EACR,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,0CAAwB,CAAC,EAClD,0CAAwB,CACzB,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAA,uCAAqB,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACnE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO;IACnC,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO;IAClE,MAAM,IAAA,2CAAmB,EAAC,IAAI,CAAC,GAAG,EAAE;QAClC,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,0CAAwB,GAAG,aAAa;QACvD,YAAY,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;KACvD,CAAC,CAAC;AACL,CAAC;AAQM,KAAK,UAAU,oBAAoB,CAAC,IAAU;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAA,wCAAQ,EAAC,0CAAmB,CAAC,CAAC;QAC/C,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5C,MAAM,QAAQ,CAAC,WAAW,CACxB,IAAI,CAAC,GAAG,EACR,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,4BAAoB,CAAC,CAC/C,CAAC;QACF,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,UAAU,CAAC,2BAA2B,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAGM,KAAK,UAAU,oBAAoB,CAAC,MAAc;IACvD,IAAI,CAAC;QACH,MAAM,IAAA,wCAAQ,EAAC,0CAAmB,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,UAAU,CAAC,2BAA2B,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;AACH,CAAC"}

package/dist/utils/two-factor-codes.d.ts

@@ -0,0 +1,10 @@
+import type { User, UserModel } from "@antelopejs/interface-dms/auth/db";
+export type TwoFactorMethod = "totp" | "email";
+export declare function assertEmailCodeNotRateLimited(user: User, now?: number): void;
+export declare function sendNewEmailCode(userModel: UserModel, user: User, now?: number): Promise<void>;
+export declare function isEmailCodeExpired(user: User, now?: number): boolean;
+export declare function emailCodeMatches(user: User, code: string): boolean;
+export declare function consumeEmailCode(user: User): void;
+export declare function totpStepAt(now: number): number;
+export declare function acceptTotpCode(userModel: UserModel, user: User, secret: string, code: string, now?: number): Promise<boolean>;
+export declare function verifyTwoFactorCode(userModel: UserModel, user: User, method: TwoFactorMethod, code: string): Promise<boolean>;

package/dist/utils/two-factor-codes.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertEmailCodeNotRateLimited = assertEmailCodeNotRateLimited;
+exports.sendNewEmailCode = sendNewEmailCode;
+exports.isEmailCodeExpired = isEmailCodeExpired;
+exports.emailCodeMatches = emailCodeMatches;
+exports.consumeEmailCode = consumeEmailCode;
+exports.totpStepAt = totpStepAt;
+exports.acceptTotpCode = acceptTotpCode;
+exports.verifyTwoFactorCode = verifyTwoFactorCode;
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const auth_1 = require("@antelopejs/interface-dms/auth");
+const _2fa_1 = require("2fa");
+const constants_1 = require("../routes/auth/constants");
+const one_time_code_1 = require("./one-time-code");
+const HTTP_TOO_MANY_REQUESTS = 429;
+const MS_PER_SECOND = 1000;
+const TOTP_STEP_SECONDS = 30;
+const NO_ACCEPTED_STEP = -1;
+const msSince = (date, now) => date ? now - new Date(date).getTime() : Number.POSITIVE_INFINITY;
+function assertEmailCodeNotRateLimited(user, now = Date.now()) {
+    const isRateLimited = msSince(user.twoFactorEmailCodeRequestedAt, now) < constants_1.TWO_FACTOR_RATE_LIMIT_MS;
+    (0, interface_api_util_1.assert)(!isRateLimited, HTTP_TOO_MANY_REQUESTS, "error.rate_limited");
+}
+async function sendNewEmailCode(userModel, user, now = Date.now()) {
+    assertEmailCodeNotRateLimited(user, now);
+    const code = (0, one_time_code_1.generateCode)();
+    await (0, auth_1.send2FAEmail)(user, code);
+    user.twoFactorEmailCode = (0, one_time_code_1.hashCode)(user._id, code);
+    user.twoFactorEmailCodeRequestedAt = new Date(now);
+    await userModel.update(user);
+}
+function isEmailCodeExpired(user, now = Date.now()) {
+    return (msSince(user.twoFactorEmailCodeRequestedAt, now) >
+        constants_1.TWO_FACTOR_EMAIL_CODE_LIFETIME_MS);
+}
+function emailCodeMatches(user, code) {
+    return (!!user.twoFactorEmailCode &&
+        (0, one_time_code_1.hashesMatch)(user.twoFactorEmailCode, (0, one_time_code_1.hashCode)(user._id, code)));
+}
+function consumeEmailCode(user) {
+    user.twoFactorEmailCode = null;
+    user.twoFactorEmailCodeRequestedAt = null;
+}
+function totpStepAt(now) {
+    return Math.floor(now / MS_PER_SECOND / TOTP_STEP_SECONDS);
+}
+async function acceptTotpCode(userModel, user, secret, code, now = Date.now()) {
+    const step = totpStepAt(now);
+    if ((0, _2fa_1.generateCode)(secret, step) !== code)
+        return false;
+    const claimed = await userModel.table
+        .getAll(user._id)
+        .filter((row) => row.key("twoFactorTotpLastStep").default(NO_ACCEPTED_STEP).lt(step))
+        .update({ twoFactorTotpLastStep: step })
+        .run();
+    if (claimed === 0)
+        return false;
+    user.twoFactorTotpLastStep = step;
+    return true;
+}
+const CODE_VERIFIERS = {
+    totp: async (userModel, user, code) => !!user.twoFactorSecret &&
+        (await acceptTotpCode(userModel, user, user.twoFactorSecret, code)),
+    email: async (_userModel, user, code) => {
+        if (isEmailCodeExpired(user) || !emailCodeMatches(user, code)) {
+            return false;
+        }
+        consumeEmailCode(user);
+        return true;
+    },
+};
+function verifyTwoFactorCode(userModel, user, method, code) {
+    return CODE_VERIFIERS[method](userModel, user, code);
+}
+//# sourceMappingURL=two-factor-codes.js.map

package/dist/utils/two-factor-codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-codes.js","sourceRoot":"","sources":["../../src/utils/two-factor-codes.ts"],"names":[],"mappings":";;AA2BA,sEAOC;AAOD,4CAWC;AAED,gDAKC;AAGD,4CAKC;AAGD,4CAGC;AAGD,gCAEC;AAYD,wCAoBC;AAuBD,kDAOC;AAxID,uEAAwD;AACxD,yDAA8D;AAE9D,8BAAuD;AACvD,wDAGkC;AAClC,mDAAsE;AAItE,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,MAAM,gBAAgB,GAAG,CAAC,CAAC,CAAC;AAE5B,MAAM,OAAO,GAAG,CAAC,IAA6B,EAAE,GAAW,EAAU,EAAE,CACrE,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC;AAGnE,SAAgB,6BAA6B,CAC3C,IAAU,EACV,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,aAAa,GACjB,OAAO,CAAC,IAAI,CAAC,6BAA6B,EAAE,GAAG,CAAC,GAAG,oCAAwB,CAAC;IAC9E,IAAA,2BAAM,EAAC,CAAC,aAAa,EAAE,sBAAsB,EAAE,oBAAoB,CAAC,CAAC;AACvE,CAAC;AAOM,KAAK,UAAU,gBAAgB,CACpC,SAAoB,EACpB,IAAU,EACV,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,6BAA6B,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAA,4BAAY,GAAE,CAAC;IAC5B,MAAM,IAAA,mBAAY,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,kBAAkB,GAAG,IAAA,wBAAQ,EAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,6BAA6B,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,SAAgB,kBAAkB,CAAC,IAAU,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC7D,OAAO,CACL,OAAO,CAAC,IAAI,CAAC,6BAA6B,EAAE,GAAG,CAAC;QAChD,6CAAiC,CAClC,CAAC;AACJ,CAAC;AAGD,SAAgB,gBAAgB,CAAC,IAAU,EAAE,IAAY;IACvD,OAAO,CACL,CAAC,CAAC,IAAI,CAAC,kBAAkB;QACzB,IAAA,2BAAW,EAAC,IAAI,CAAC,kBAAkB,EAAE,IAAA,wBAAQ,EAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAC/D,CAAC;AACJ,CAAC;AAGD,SAAgB,gBAAgB,CAAC,IAAU;IACzC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAC/B,IAAI,CAAC,6BAA6B,GAAG,IAAI,CAAC;AAC5C,CAAC;AAGD,SAAgB,UAAU,CAAC,GAAW;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,aAAa,GAAG,iBAAiB,CAAC,CAAC;AAC7D,CAAC;AAYM,KAAK,UAAU,cAAc,CAClC,SAAoB,EACpB,IAAU,EACV,MAAc,EACd,IAAY,EACZ,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAGhB,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,IAAA,mBAAgB,EAAC,MAAM,EAAE,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK;SAClC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SAChB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CACd,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CACpE;SACA,MAAM,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;SACvC,GAAG,EAAE,CAAC;IACT,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,cAAc,GAGhB;IACF,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CACpC,CAAC,CAAC,IAAI,CAAC,eAAe;QACtB,CAAC,MAAM,cAAc,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACrE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACtC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC;AAOF,SAAgB,mBAAmB,CACjC,SAAoB,EACpB,IAAU,EACV,MAAuB,EACvB,IAAY;IAEZ,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC"}

package/dist/validation/auth.schema.d.ts

@@ -86,6 +86,16 @@ export declare const authSchema: {
     }, {
         email: string;
     }>;
+    validateInviteToken: z.ZodObject<{
+        token: z.ZodString;
+        email: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        token: string;
+        email: string;
+    }, {
+        token: string;
+        email: string;
+    }>;
     validateForgotPasswordToken: z.ZodObject<{
         token: z.ZodString;
         email: z.ZodString;
@@ -136,6 +146,13 @@ export declare const authSchema: {
     }, {
         code: string;
     }>;
+    confirmEmailMethod: z.ZodObject<{
+        code: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        code: string;
+    }, {
+        code: string;
+    }>;
     disableTwoFactor: z.ZodObject<{
         method: z.ZodEnum<["totp", "email"]>;
         code: z.ZodString;

package/dist/validation/auth.schema.js

@@ -39,6 +39,10 @@ const password_1 = require("./password");
 const MAX_OAUTH_EXCHANGE_VALUE_LENGTH = 2048;
 const MAX_LANGUAGE_TAG_LENGTH = 35;
 const MAX_INVITE_TOKEN_LENGTH = 256;
+const INVALID_2FA_TOKEN = "error.invalid_2fa_token";
+const twoFactorToken = z
+    .string({ message: INVALID_2FA_TOKEN })
+    .min(1, INVALID_2FA_TOKEN);
 exports.authSchema = {
     signup: z.object({
         name: z.string(),
@@ -74,6 +78,10 @@ exports.authSchema = {
     forgot: z.object({
         email: z.string().email(),
     }),
+    validateInviteToken: z.object({
+        token: z.string().max(MAX_INVITE_TOKEN_LENGTH),
+        email: z.string().email(),
+    }),
     validateForgotPasswordToken: z.object({
         token: z.string(),
         email: z.string().email(),
@@ -84,14 +92,17 @@ exports.authSchema = {
         password: password_1.passwordSchema,
     }),
     verify2FA: z.object({
-        token: z.string(),
+        token: twoFactorToken,
+        code: z.string({ message: "error.invalid_2fa_code" }),
+        method: z.enum(["totp", "email", "backup"], {
+            message: "error.invalid_2fa_method",
+        }),
+    }, { message: INVALID_2FA_TOKEN }),
+    request2FAEmail: z.object({ token: twoFactorToken }, { message: INVALID_2FA_TOKEN }),
+    confirmTotp: z.object({
         code: z.string(),
-        method: z.enum(["totp", "email", "backup"]),
     }),
-    request2FAEmail: z.object({
-        token: z.string(),
-    }),
-    confirmTotp: z.object({
+    confirmEmailMethod: z.object({
         code: z.string(),
     }),
     disableTwoFactor: z.object({

package/dist/validation/auth.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.schema.js","sourceRoot":"","sources":["../../src/validation/auth.schema.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AAEzB,yCAA4C;AAE5C,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAC7C,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEvB,QAAA,UAAU,GAAG;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,yBAAc;QACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KAClB,CAAC;IACF,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IACF,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC;QAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC;QAC7D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC;QACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;QAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;KAC3D,CAAC;IACF,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KAClB,CAAC;IACF,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACzB,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KAClB,CAAC;IACF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KAClB,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;KAC1B,CAAC;IACF,2BAA2B,EAAE,CAAC,CAAC,MAAM,CAAC;QACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;KAC1B,CAAC;IACF,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,yBAAc;KACzB,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;KAC5C,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KAClB,CAAC;IACF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;IACF,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;QACzB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;IACF,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;CACH,CAAC"}
+{"version":3,"file":"auth.schema.js","sourceRoot":"","sources":["../../src/validation/auth.schema.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AAEzB,yCAA4C;AAE5C,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAC7C,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAIpD,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;KACtC,GAAG,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;AAEhB,QAAA,UAAU,GAAG;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,yBAAc;QACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KAClB,CAAC;IACF,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IACF,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC;QAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC;QAC7D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC;QACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;QAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;KAC3D,CAAC;IACF,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KAClB,CAAC;IACF,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACzB,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KAClB,CAAC;IACF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KAClB,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;KAC1B,CAAC;IACF,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC;QAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;KAC1B,CAAC;IACF,2BAA2B,EAAE,CAAC,CAAC,MAAM,CAAC;QACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;KAC1B,CAAC;IACF,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,yBAAc;KACzB,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,CACjB;QACE,KAAK,EAAE,cAAc;QACrB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;QACrD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;YAC1C,OAAO,EAAE,0BAA0B;SACpC,CAAC;KACH,EACD,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAC/B;IACD,eAAe,EAAE,CAAC,CAAC,MAAM,CACvB,EAAE,KAAK,EAAE,cAAc,EAAE,EACzB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAC/B;IACD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;IACF,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;IACF,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;QACzB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;IACF,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;CACH,CAAC"}

package/dist/validation/issue-message.d.ts

@@ -0,0 +1 @@
+export declare function firstIssueMessage(error: unknown): string;

package/dist/validation/issue-message.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.firstIssueMessage = firstIssueMessage;
+const zod_1 = require("zod");
+function firstIssueMessage(error) {
+    const [issue] = error instanceof zod_1.ZodError ? error.issues : [];
+    return issue ? issue.message : String(error);
+}
+//# sourceMappingURL=issue-message.js.map

package/dist/validation/issue-message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue-message.js","sourceRoot":"","sources":["../../src/validation/issue-message.ts"],"names":[],"mappings":";;AAOA,8CAGC;AAVD,6BAA+B;AAO/B,SAAgB,iBAAiB,CAAC,KAAc;IAC9C,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,cAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC"}

package/dist/validation/member-invite.schema.d.ts

@@ -2,7 +2,7 @@ import { z } from "zod";
 export declare const INVITE_NAME_MAX_LENGTH = 100;
 export declare const INVITE_FULL_NAME_MAX_LENGTH: number;
 export declare const INVITE_EMAILS_MAX = 50;
-export declare const memberInviteSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
+export declare const memberInviteSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
     emails: z.ZodArray<z.ZodString, "many">;
     name: z.ZodOptional<z.ZodString>;
     firstname: z.ZodOptional<z.ZodString>;
@@ -10,11 +10,9 @@ export declare const memberInviteSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<
     roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     language: z.ZodString;
     asTenantOwner: z.ZodBoolean;
-    skipEmailValidation: z.ZodDefault<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     language: string;
     asTenantOwner: boolean;
-    skipEmailValidation: boolean;
     emails: string[];
     name?: string | undefined;
     roles?: string[] | undefined;
@@ -28,11 +26,9 @@ export declare const memberInviteSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<
     roles?: string[] | undefined;
     firstname?: string | undefined;
     lastname?: string | undefined;
-    skipEmailValidation?: boolean | undefined;
 }>, {
     language: string;
     asTenantOwner: boolean;
-    skipEmailValidation: boolean;
     emails: string[];
     name?: string | undefined;
     roles?: string[] | undefined;
@@ -46,29 +42,9 @@ export declare const memberInviteSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<
     roles?: string[] | undefined;
     firstname?: string | undefined;
     lastname?: string | undefined;
-    skipEmailValidation?: boolean | undefined;
 }>, {
     language: string;
     asTenantOwner: boolean;
-    skipEmailValidation: boolean;
-    emails: string[];
-    name?: string | undefined;
-    roles?: string[] | undefined;
-    firstname?: string | undefined;
-    lastname?: string | undefined;
-}, {
-    language: string;
-    asTenantOwner: boolean;
-    emails: string[];
-    name?: string | undefined;
-    roles?: string[] | undefined;
-    firstname?: string | undefined;
-    lastname?: string | undefined;
-    skipEmailValidation?: boolean | undefined;
-}>, {
-    language: string;
-    asTenantOwner: boolean;
-    skipEmailValidation: boolean;
     emails: string[];
     name?: string | undefined;
     roles?: string[] | undefined;

package/dist/validation/member-invite.schema.js

@@ -33,32 +33,11 @@ const memberInviteObjectSchema = zod_1.z.object({
     roles: zod_1.z.array(zod_1.z.string()).optional(),
     language: zod_1.z.string(),
     asTenantOwner: zod_1.z.boolean(),
-    skipEmailValidation: zod_1.z.boolean().default(false),
 });
-function addIssue(ctx, path, message) {
-    ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, message, path: [path] });
-}
-function requireNamesWhenValidationSkipped(data, ctx) {
-    if (!data.skipEmailValidation)
-        return;
-    if (data.emails.length > 1) {
-        addIssue(ctx, EMAILS_KEY, "$page.settings.members.invite.skip_validation_single_email");
-    }
-    if (data.name)
-        return;
-    if (!data.firstname) {
-        addIssue(ctx, "firstname", "$page.settings.members.invite.firstname_required");
-    }
-    if (!data.lastname) {
-        addIssue(ctx, "lastname", "$page.settings.members.invite.lastname_required");
-    }
-}
-exports.memberInviteSchema = zod_1.z.preprocess(acceptLegacySingleEmail, memberInviteObjectSchema
-    .refine((data) => data.asTenantOwner || (data.roles && data.roles.length > 0), {
+exports.memberInviteSchema = zod_1.z.preprocess(acceptLegacySingleEmail, memberInviteObjectSchema.refine((data) => data.asTenantOwner || (data.roles && data.roles.length > 0), {
     message: "$page.settings.members.invite.roles_required",
     path: ["roles"],
-})
-    .superRefine(requireNamesWhenValidationSkipped));
+}));
 function resolveInviteeNameParts(payload) {
     if (payload.firstname || payload.lastname || !payload.name) {
         return { firstname: payload.firstname, lastname: payload.lastname };

package/dist/validation/member-invite.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"member-invite.schema.js","sourceRoot":"","sources":["../../src/validation/member-invite.schema.ts"],"names":[],"mappings":";;;AAyHA,0DAQC;AAMD,gDAEC;AAzID,6BAAwB;AAOX,QAAA,sBAAsB,GAAG,GAAG,CAAC;AAG7B,QAAA,2BAA2B,GAAG,8BAAsB,GAAG,CAAC,CAAC;AAMzD,QAAA,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACjC,MAAM,UAAU,GAAG,QAAQ,CAAC;AAC5B,MAAM,cAAc,GAAG,KAAK,CAAC;AAM7B,SAAS,uBAAuB,CAAC,OAAgB;IAC/C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACpE,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9C,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;AAC9C,CAAC;AAOD,MAAM,cAAc,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,8BAAsB,CAAC,CAAC;AAErE,MAAM,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,OAAC;SACN,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,CAAC;SAC9C,GAAG,CAAC,CAAC,EAAE,+CAA+C,CAAC;SACvD,GAAG,CAAC,yBAAiB,EAAE,+CAA+C,CAAC;IAC1E,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,mCAA2B,CAAC,CAAC,QAAQ,EAAE;IACnE,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE;IACpB,aAAa,EAAE,OAAC,CAAC,OAAO,EAAE;IAC1B,mBAAmB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAChD,CAAC,CAAC;AAIH,SAAS,QAAQ,CAAC,GAAoB,EAAE,IAAY,EAAE,OAAe;IACnE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACvE,CAAC;AAMD,SAAS,iCAAiC,CACxC,IAAwB,EACxB,GAAoB;IAEpB,IAAI,CAAC,IAAI,CAAC,mBAAmB;QAAE,OAAO;IACtC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,CACN,GAAG,EACH,UAAU,EACV,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO;IACtB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,QAAQ,CACN,GAAG,EACH,WAAW,EACX,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,QAAQ,CACN,GAAG,EACH,UAAU,EACV,iDAAiD,CAClD,CAAC;IACJ,CAAC;AACH,CAAC;AAEY,QAAA,kBAAkB,GAAG,OAAC,CAAC,UAAU,CAC5C,uBAAuB,EACvB,wBAAwB;KACrB,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EACrE;IACE,OAAO,EAAE,8CAA8C;IACvD,IAAI,EAAE,CAAC,OAAO,CAAC;CAChB,CACF;KACA,WAAW,CAAC,iCAAiC,CAAC,CAClD,CAAC;AAeF,SAAgB,uBAAuB,CACrC,OAAqE;IAErE,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC3D,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAChE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;AAC9D,CAAC;AAMD,SAAgB,kBAAkB,CAAC,MAAyB;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"member-invite.schema.js","sourceRoot":"","sources":["../../src/validation/member-invite.schema.ts"],"names":[],"mappings":";;;AA+EA,0DAQC;AAMD,gDAEC;AA/FD,6BAAwB;AAOX,QAAA,sBAAsB,GAAG,GAAG,CAAC;AAG7B,QAAA,2BAA2B,GAAG,8BAAsB,GAAG,CAAC,CAAC;AAMzD,QAAA,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACjC,MAAM,UAAU,GAAG,QAAQ,CAAC;AAC5B,MAAM,cAAc,GAAG,KAAK,CAAC;AAM7B,SAAS,uBAAuB,CAAC,OAAgB;IAC/C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACpE,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9C,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;AAC9C,CAAC;AAOD,MAAM,cAAc,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,8BAAsB,CAAC,CAAC;AAErE,MAAM,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,OAAC;SACN,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,CAAC;SAC9C,GAAG,CAAC,CAAC,EAAE,+CAA+C,CAAC;SACvD,GAAG,CAAC,yBAAiB,EAAE,+CAA+C,CAAC;IAC1E,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,mCAA2B,CAAC,CAAC,QAAQ,EAAE;IACnE,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE;IACpB,aAAa,EAAE,OAAC,CAAC,OAAO,EAAE;CAC3B,CAAC,CAAC;AAEU,QAAA,kBAAkB,GAAG,OAAC,CAAC,UAAU,CAC5C,uBAAuB,EACvB,wBAAwB,CAAC,MAAM,CAC7B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EACrE;IACE,OAAO,EAAE,8CAA8C;IACvD,IAAI,EAAE,CAAC,OAAO,CAAC;CAChB,CACF,CACF,CAAC;AAeF,SAAgB,uBAAuB,CACrC,OAAqE;IAErE,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC3D,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAChE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;AAC9D,CAAC;AAMD,SAAgB,kBAAkB,CAAC,MAAyB;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC"}

package/frontend-vue/dms.frontend.ts

@@ -17,6 +17,7 @@ import fontPreloadPlugin from "./layers/dms-layout/app/plugins/font-preload";
 import permissionPreviewPrepaintPlugin from "./layers/dms-layout/app/plugins/permission-preview-prepaint";
 import regionalPreferencesPlugin from "./layers/dms-layout/app/plugins/regional-preferences";
 import seoPlugin from "./layers/dms-layout/app/plugins/seo";
+import sidePanelHostPlugin from "./layers/dms-layout/app/plugins/side-panel-host";
 import onboardingMiddleware from "./layers/dms-onboarding/app/middleware/onboarding.global";
 import registerPlugin from "./layers/dms-ui/app/plugins/register";
 import shortcutsPlugin from "./layers/dms-ui/app/plugins/shortcuts";
@@ -170,6 +171,7 @@ function registerPlugins(sdk: Parameters<DmsFrontendModule["setup"]>[0]): void {
   sdk.registerPlugin(accessibilityPlugin);
   sdk.registerPlugin(regionalPreferencesPlugin);
   sdk.registerPlugin(seoPlugin);
+  sdk.registerPlugin(sidePanelHostPlugin);
   sdk.registerPlugin(registerPlugin);
   sdk.registerPlugin(shortcutsPlugin);
   sdk.registerPlugin(tableViewDisplaysPlugin);

package/frontend-vue/layers/dms-auth/app/custom-pages/auth/forgot-validation.vue

@@ -124,6 +124,9 @@ async function requestForgotPassword() {
     });
 
     startCooldown();
+    // The refusal was about the previous code: the new one starts clean.
+    clearFormError();
+    codeError.value = undefined;
 
     toast.add({
       title: t("page.validate.request_sended"),

package/frontend-vue/layers/dms-auth/app/custom-pages/auth/signup.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { useTemplateRef } from "vue";
+import { onMounted, useTemplateRef } from "vue";
 import * as z from "zod";
 import type { FormSubmitEvent } from "@nuxt/ui";
 import StageCard from "../../../../dms-layout/app/build/components/layout/StageCard.vue";
@@ -15,14 +15,70 @@ import {
   useLiveFormErrors,
   useLocalizedSchema,
 } from "#dms-core/app/composables/useFormValidation";
+import { resolveApiErrorMessage } from "#dms-core/app/composables/useApiError";
 
 const MIN_NAME_LENGTH = 2;
 
+/** Why an invitation link cannot open the signup form. */
+type ClosedInvitation = "invalid" | "expired" | "revoked" | "replaced" | "used";
+type InvitationState = "checking" | "open" | ClosedInvitation;
+
+interface ClosedInvitationNotice {
+  icon: string;
+  title: string;
+  description: string;
+}
+
+// The refusals the server gives a link it would not sign up with.
+const CLOSED_INVITATION_CODES: Record<string, ClosedInvitation> = {
+  "error.invalid_token": "invalid",
+  "error.invite_expired": "expired",
+  "error.invite_revoked": "revoked",
+  "error.invite_replaced": "replaced",
+  "error.invite_used": "used",
+};
+
+const CLOSED_INVITATION_NOTICES: Record<
+  ClosedInvitation,
+  ClosedInvitationNotice
+> = {
+  invalid: {
+    icon: "i-ph-link-break",
+    title: "page.signup.invalid_invitation_title",
+    description: "page.signup.invalid_invitation_description",
+  },
+  expired: {
+    icon: "i-ph-hourglass",
+    title: "page.signup.invitation_expired_title",
+    description: "page.signup.invitation_expired_description",
+  },
+  revoked: {
+    icon: "i-ph-prohibit",
+    title: "page.signup.invitation_revoked_title",
+    description: "page.signup.invitation_revoked_description",
+  },
+  replaced: {
+    icon: "i-ph-envelope-simple",
+    title: "page.signup.invitation_replaced_title",
+    description: "page.signup.invitation_replaced_description",
+  },
+  used: {
+    icon: "i-ph-user-check",
+    title: "page.signup.invitation_used_title",
+    description: "page.signup.invitation_used_description",
+  },
+};
+
+function closedInvitationOf(error: unknown): ClosedInvitation | undefined {
+  return CLOSED_INVITATION_CODES[resolveApiErrorMessage(error)];
+}
+
 const { locale, locales, setLocale } = useI18n();
 const config = useDmsRuntimeConfig();
 const homepage = useHomepage();
 const dmsApp = useDmsApp();
 const { formError, clearFormError, showError } = useAuthFormError();
+const { $authFetch } = useAuthFetch();
 const form = useTemplateRef<AuthFormHandle>("form");
 
 const route = useDmsRoute();
@@ -35,6 +91,34 @@ const hasInvitationToken = computed(
   () => typeof queryToken.value === "string" && queryToken.value !== "",
 );
 
+const invitationState = ref<InvitationState>(
+  hasInvitationToken.value ? "checking" : "invalid",
+);
+const closedInvitation = computed(() =>
+  invitationState.value in CLOSED_INVITATION_NOTICES
+    ? CLOSED_INVITATION_NOTICES[invitationState.value as ClosedInvitation]
+    : undefined,
+);
+
+// A revoked, replaced or expired link says so as the page opens, rather than
+// after the whole form was filled. The server answers with the very check the
+// signup runs; any other failure leaves the form to the signup to settle.
+async function checkInvitation(): Promise<void> {
+  try {
+    await $authFetch("/api/auth/validate-invite-token", {
+      method: "POST",
+      body: { token: queryToken.value, email: queryEmail.value },
+    });
+    invitationState.value = "open";
+  } catch (error: unknown) {
+    invitationState.value = closedInvitationOf(error) ?? "open";
+  }
+}
+
+onMounted(() => {
+  if (invitationState.value === "checking") void checkInvitation();
+});
+
 // The invitation link carries the language the invitee was invited in: the
 // page opens in it, and the footer switcher still lets them pick another one
 // before the account is created with whichever is current.
@@ -80,6 +164,12 @@ async function onSubmit(payload: FormSubmitEvent<Schema>) {
       ),
     );
   } catch (error: unknown) {
+    // The invitation can be retired while the form is open.
+    const closed = closedInvitationOf(error);
+    if (closed) {
+      invitationState.value = closed;
+      return;
+    }
     // A refused value (an address already used) shows under its field;
     // anything else above the form.
     await showError(error, "page.signup.error_title", {
@@ -95,11 +185,11 @@ async function onSubmit(payload: FormSubmitEvent<Schema>) {
 
 <template>
   <StageCard
-    v-if="!hasInvitationToken"
-    icon="i-ph-link-break"
+    v-if="closedInvitation"
+    :icon="closedInvitation.icon"
     tone="warning"
-    :title="$t('page.signup.invalid_invitation_title')"
-    :description="$t('page.signup.invalid_invitation_description')"
+    :title="$t(closedInvitation.title)"
+    :description="$t(closedInvitation.description)"
     data-testid="signup-invalid-invitation"
   >
     <UButton
@@ -111,6 +201,16 @@ async function onSubmit(payload: FormSubmitEvent<Schema>) {
     />
   </StageCard>
 
+  <StageCard
+    v-else-if="invitationState === 'checking'"
+    icon="i-ph-spinner"
+    icon-class="animate-spin"
+    tone="neutral"
+    :title="$t('page.signup.create_account_title')"
+    :description="$t('page.signup.checking_invitation')"
+    data-testid="signup-checking-invitation"
+  />
+
   <StageCard
     v-else
     :title="$t('page.signup.create_account_title')"