@antelopejs/dms 0.8.3 → 0.9.0

package/frontend-vue/layers/dms-auth/app/custom-pages/auth/signup.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { onMounted, useTemplateRef } from "vue";
+import { useTemplateRef } from "vue";
 import * as z from "zod";
 import type { FormSubmitEvent } from "@nuxt/ui";
 import StageCard from "../../../../dms-layout/app/build/components/layout/StageCard.vue";
@@ -78,7 +78,6 @@ const config = useDmsRuntimeConfig();
 const homepage = useHomepage();
 const dmsApp = useDmsApp();
 const { formError, clearFormError, showError } = useAuthFormError();
-const { $authFetch } = useAuthFetch();
 const form = useTemplateRef<AuthFormHandle>("form");
 
 const route = useDmsRoute();
@@ -91,34 +90,32 @@ const hasInvitationToken = computed(
   () => typeof queryToken.value === "string" && queryToken.value !== "",
 );
 
-const invitationState = ref<InvitationState>(
-  hasInvitationToken.value ? "checking" : "invalid",
+// A revoked, replaced or expired link says so as the page opens, rather than
+// after the whole form was filled: checked with the page, so the server
+// renders the notice. The server answers with the very check the signup
+// runs; any other failure leaves the form to the signup to settle.
+const invitationCheck = useApiData(
+  () => (hasInvitationToken.value ? "/api/auth/validate-invite-token" : null),
+  {
+    method: "POST",
+    body: () => ({ token: queryToken.value, email: queryEmail.value }),
+  },
 );
+// The invitation can be retired while the form is open: the signup says so.
+const closedOnSignup = ref<ClosedInvitation>();
+const invitationState = computed<InvitationState>(() => {
+  if (!hasInvitationToken.value) return "invalid";
+  if (closedOnSignup.value) return closedOnSignup.value;
+  const { status, error } = invitationCheck;
+  if (status.value === "idle" || status.value === "pending") return "checking";
+  return error.value ? (closedInvitationOf(error.value) ?? "open") : "open";
+});
 const closedInvitation = computed(() =>
   invitationState.value in CLOSED_INVITATION_NOTICES
     ? CLOSED_INVITATION_NOTICES[invitationState.value as ClosedInvitation]
     : undefined,
 );
 
-// A revoked, replaced or expired link says so as the page opens, rather than
-// after the whole form was filled. The server answers with the very check the
-// signup runs; any other failure leaves the form to the signup to settle.
-async function checkInvitation(): Promise<void> {
-  try {
-    await $authFetch("/api/auth/validate-invite-token", {
-      method: "POST",
-      body: { token: queryToken.value, email: queryEmail.value },
-    });
-    invitationState.value = "open";
-  } catch (error: unknown) {
-    invitationState.value = closedInvitationOf(error) ?? "open";
-  }
-}
-
-onMounted(() => {
-  if (invitationState.value === "checking") void checkInvitation();
-});
-
 // The invitation link carries the language the invitee was invited in: the
 // page opens in it, and the footer switcher still lets them pick another one
 // before the account is created with whichever is current.
@@ -149,7 +146,7 @@ async function onSubmit(payload: FormSubmitEvent<Schema>) {
     isLoading.value = true;
     clearFormError();
 
-    await $fetch("/auth/signup", {
+    await $fetch("/auth/register", {
       method: "POST",
       body: {
         ...payload.data,
@@ -167,7 +164,7 @@ async function onSubmit(payload: FormSubmitEvent<Schema>) {
     // The invitation can be retired while the form is open.
     const closed = closedInvitationOf(error);
     if (closed) {
-      invitationState.value = closed;
+      closedOnSignup.value = closed;
       return;
     }
     // A refused value (an address already used) shows under its field;

package/frontend-vue/layers/dms-auth/app/custom-pages/auth/validate.vue

@@ -19,7 +19,7 @@ const { formError, showFormError, clearFormError, showError } =
   useAuthFormError();
 
 if (!route.query.id) {
-  throw createError({
+  throw createDmsError({
     statusCode: HTTP_BAD_REQUEST,
     statusMessage: INVALID_REQUEST,
     message: "Missing required id parameter",

package/frontend-vue/layers/dms-auth/app/middleware/auth.ts

@@ -10,12 +10,10 @@ function isAuthOptions(value: MiddlewareMeta): value is AuthMiddlewareOptions {
 }
 
 async function loadPermissionsIfNeeded() {
-  const { isLoaded, fetchPermissions } = usePermissions();
-
-  if (isLoaded.value) return;
+  const { loadPermissions } = usePermissions();
 
   try {
-    await fetchPermissions();
+    await loadPermissions();
   } catch {
     /* ignore — permissions load failure is not fatal here */
   }
@@ -26,7 +24,7 @@ function handleAuthenticatedUser(
   options: MiddlewareMeta,
 ) {
   const authConfig = useDmsRuntimeConfig().public.dms;
-  const { user } = useUserSession();
+  const { user } = useDmsUserSession();
 
   if (authConfig.mustValidateEmail && !user.value?.isValidated) {
     if (to.path === "/auth/validate") return;
@@ -76,14 +74,14 @@ export default defineDmsMiddleware(async (to) => {
   // is committed and rendered with its own status. Re-throwing it here would
   // reject the pending navigation the SSR render awaits, turning that 404 into
   // a 500 fallback render.
-  if (useError().value) return abortNavigation();
+  if (useDmsError().value) return abortDmsNavigation();
 
   const options = to.meta.auth as MiddlewareMeta | undefined;
   if (!options) return;
 
   if (await isPublicAccessRoute(to)) return;
 
-  const { loggedIn } = useUserSession();
+  const { loggedIn } = useDmsUserSession();
 
   if (loggedIn.value) {
     await loadPermissionsIfNeeded();

package/frontend-vue/layers/dms-auth/app/plugins/permissions-preload.ts

@@ -0,0 +1,17 @@
+/**
+ * Loads the permission set as the app starts when the `auth` middleware will
+ * need it, rather than once the middlewares ahead of it are done: the request
+ * runs alongside the others the render makes, and the middleware joins it.
+ *
+ * Only then: a signed-in user opening a registered page that is not public,
+ * which is when the middleware loads the set. Anywhere else nothing is asked
+ * that was not asked before. A failure stays the middleware's to handle.
+ */
+export default defineDmsPlugin(() => {
+  if (!useDmsUserSession().loggedIn.value) return;
+  const page = useSiteLayout().findMatchingRoute(useDmsRoute().path);
+  if (!page || page.metadata.publicAccess === true) return;
+  usePermissions()
+    .loadPermissions()
+    .catch(() => undefined);
+});

package/frontend-vue/layers/dms-auth/server/accounts.ts

@@ -0,0 +1,135 @@
+import { randomUUID } from "node:crypto";
+import type { DmsServerEvent, DmsSession } from "#dms/server";
+
+/**
+ * The accounts this browser is signed in to: an index of their descriptors,
+ * and one sealed cookie per account holding its refresh token. The frontend
+ * server scopes and seals the cookies; their names and contents are the DMS's,
+ * unchanged from when the renderer wrote them, so stored accounts survive the
+ * move.
+ */
+
+const ACCOUNT_INDEX_COOKIE = "dms_account_index";
+const ACCOUNT_COOKIE_PREFIX = "dms_account_";
+const MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
+const UUID =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+export interface AccountDescriptor {
+  accountId: string;
+  userId?: string;
+  email?: string;
+  name?: string;
+  activeTenantId?: string;
+  persistent: boolean;
+}
+
+export interface StoredAccount extends AccountDescriptor {
+  refreshToken?: string;
+}
+
+type AccountIndex = Record<string, AccountDescriptor>;
+
+interface SessionUser {
+  _id?: string;
+  id?: string;
+  email?: string;
+  name?: string;
+}
+
+/**
+ * Whether a session, or a stored account, outlives the browser. Only a login
+ * that left "keep me signed in" unchecked says no; a cookie written before
+ * the flag existed carries none, and keeps the lifetime it was given then.
+ */
+export function isPersistent(session?: { persistent?: unknown }): boolean {
+  return session?.persistent !== false;
+}
+
+function lifetime(persistent: boolean): number | undefined {
+  return persistent ? MAX_AGE_SECONDS : undefined;
+}
+
+function accountCookieName(accountId: string): string {
+  if (!UUID.test(accountId)) throw new Error("Invalid account id");
+  return `${ACCOUNT_COOKIE_PREFIX}${accountId.replaceAll("-", "")}`;
+}
+
+function descriptor(session: DmsSession, accountId: string): AccountDescriptor {
+  const user = (session.user ?? {}) as SessionUser;
+  return {
+    accountId,
+    userId: user._id ?? user.id,
+    email: user.email,
+    name: user.name,
+    activeTenantId: session.activeTenantId,
+    persistent: isPersistent(session),
+  };
+}
+
+export function readAccounts(event: DmsServerEvent): AccountIndex {
+  return event.cookies.readSealed<AccountIndex>(ACCOUNT_INDEX_COOKIE) ?? {};
+}
+
+function writeAccountIndex(event: DmsServerEvent, accounts: AccountIndex) {
+  const persistent = Object.values(accounts).some(isPersistent);
+  event.cookies.writeSealed(ACCOUNT_INDEX_COOKIE, accounts, {
+    maxAge: lifetime(persistent),
+  });
+}
+
+export function readAccount(
+  event: DmsServerEvent,
+  accountId: unknown,
+): StoredAccount | undefined {
+  if (typeof accountId !== "string" || !UUID.test(accountId)) return undefined;
+  return event.cookies.readSealed<StoredAccount>(accountCookieName(accountId));
+}
+
+export function storeAccount(
+  event: DmsServerEvent,
+  session: DmsSession,
+  accountId?: string,
+): AccountDescriptor {
+  const id = accountId ?? randomUUID();
+  const account = descriptor(session, id);
+  writeAccountIndex(event, { ...readAccounts(event), [id]: account });
+  event.cookies.writeSealed(
+    accountCookieName(id),
+    { refreshToken: session.refreshToken, ...account },
+    { maxAge: lifetime(account.persistent) },
+  );
+  return account;
+}
+
+function assertAccountInvariant(session: DmsSession, accountId: string) {
+  if (!accountId || session.accountId !== accountId)
+    throw new Error("Account session invariant violated");
+}
+
+/**
+ * Write `session` as the current one, and as one of the stored accounts. The
+ * frontend server stamps it with `updatedAt`, which lets the browser tell a
+ * page fetched before this write, and restored from its cache, from a
+ * current one.
+ */
+export function persistAccountSession(
+  event: DmsServerEvent,
+  session: DmsSession,
+  accountId?: string,
+): AccountDescriptor {
+  const id = accountId ?? session.accountId ?? randomUUID();
+  session.accountId = id;
+  const account = storeAccount(event, session, id);
+  assertAccountInvariant(session, account.accountId);
+  event.session.write(session);
+  return account;
+}
+
+export function removeAccount(event: DmsServerEvent, accountId: unknown) {
+  const accounts = { ...readAccounts(event) };
+  if (typeof accountId === "string") delete accounts[accountId];
+  writeAccountIndex(event, accounts);
+  if (typeof accountId === "string" && UUID.test(accountId))
+    event.cookies.clear(accountCookieName(accountId));
+}

package/frontend-vue/layers/dms-auth/server/actions.ts

@@ -0,0 +1,251 @@
+import type { DmsServerEvent } from "#dms/server";
+import {
+  isPersistent,
+  persistAccountSession,
+  readAccount,
+  removeAccount,
+  storeAccount,
+  type StoredAccount,
+} from "./accounts";
+import { isRefusal, type SessionTokens, sessionFrom } from "./session";
+
+// Carries the "keep me signed in" choice of a login across its 2FA step, whose
+// request names only the challenge. Lives as long as the challenge token.
+const PENDING_LOGIN = "dms_pending_login";
+const PENDING_LOGIN_PATH = "/auth/verify-2fa";
+const PENDING_LOGIN_LIFETIME_S = 300;
+
+// Absolute backend API paths only: no scheme, no authority, no query string,
+// and no segment that could climb out of `/api/`.
+const BACKEND_API_PATH =
+  /^\/api\/[A-Za-z0-9][A-Za-z0-9._~-]*(?:\/[A-Za-z0-9][A-Za-z0-9._~-]*)*$/;
+
+type Input = Record<string, unknown>;
+
+interface EstablishResult extends SessionTokens {
+  requires_2fa?: boolean;
+  requires_tenant_assignment?: boolean;
+  two_factor_token?: string;
+}
+
+interface PendingLogin {
+  token: string;
+  persistent: boolean;
+}
+
+/**
+ * Calls a backend endpoint that opens a session and, unless it asks for a
+ * second step, writes the session and stores the account.
+ */
+async function establishWith(
+  event: DmsServerEvent,
+  endpoint: string,
+  payload: unknown,
+  persistent = true,
+) {
+  const result = await event.backend<EstablishResult>(endpoint, {
+    method: "POST",
+    body: payload,
+  });
+  if (result.requires_2fa && typeof result.two_factor_token === "string")
+    event.cookies.writeSealed(
+      PENDING_LOGIN,
+      { token: result.two_factor_token, persistent },
+      { maxAge: PENDING_LOGIN_LIFETIME_S, path: PENDING_LOGIN_PATH },
+    );
+  if (result.requires_2fa || result.requires_tenant_assignment) return result;
+  if (event.cookies.readSealed(PENDING_LOGIN))
+    event.cookies.clear(PENDING_LOGIN, { path: PENDING_LOGIN_PATH });
+  const account = persistAccountSession(event, sessionFrom(result, persistent));
+  return { user: result.user, account };
+}
+
+/**
+ * `POST /auth/login`: signs in with a password. Only a login that asked to be
+ * kept signed in outlives the browser; any other ends when the browser closes.
+ */
+export async function login(event: DmsServerEvent) {
+  const input = await event.readJson<Input>();
+  return establishWith(
+    event,
+    "/api/auth/login",
+    input,
+    input.keep_login === true,
+  );
+}
+
+/** `POST /auth/register`: the signup page itself is `/auth/signup`. */
+export async function signup(event: DmsServerEvent) {
+  return establishWith(event, "/api/auth/signup", await event.readJson());
+}
+
+/**
+ * `POST /auth/verify-2fa`: finishes a login on its 2FA step, with the lifetime
+ * the login chose. A challenge that no login of this browser left a choice
+ * for, such as the one an OAuth sign-in hands over, keeps the default.
+ */
+export async function verifyTwoFactor(event: DmsServerEvent) {
+  const input = await event.readJson<Input>();
+  const pending = event.cookies.readSealed<PendingLogin>(PENDING_LOGIN);
+  const persistent =
+    typeof input.token === "string" && pending?.token === input.token
+      ? isPersistent(pending)
+      : true;
+  return establishWith(event, "/api/auth/verify-2fa", input, persistent);
+}
+
+/** `POST /auth/request-2fa-email`: relayed to the backend as is. */
+export async function requestTwoFactorEmail(event: DmsServerEvent) {
+  return event.backend("/api/auth/request-2fa-email", {
+    method: "POST",
+    body: await event.readJson(),
+  });
+}
+
+/**
+ * Whether a caller-named endpoint is one of the declared ones. The grammar is
+ * checked on the caller's value too, so a declaration that was never meant to
+ * be a prefix cannot be widened by a traversal or a query string smuggled
+ * into the request.
+ */
+export function isAllowedEstablishEndpoint(
+  endpoint: unknown,
+  allowed: readonly string[],
+): endpoint is string {
+  return (
+    typeof endpoint === "string" &&
+    BACKEND_API_PATH.test(endpoint) &&
+    allowed.includes(endpoint)
+  );
+}
+
+/**
+ * `POST /auth/establish`: opens a session from a backend endpoint that mints a
+ * token pair, the generic half of `/auth/login`. A module whose own flow ends
+ * in an authenticated user (a registration completing, an invitation being
+ * redeemed) declares the backend route that finishes it
+ * (`authEstablishEndpoints`, or `DMS_AUTH_ESTABLISH_ENDPOINTS`); the browser
+ * names it and a payload, and never carries a token.
+ */
+export async function establish(event: DmsServerEvent) {
+  const input = await event.readJson<Input>();
+  if (
+    !isAllowedEstablishEndpoint(
+      input.endpoint,
+      event.app.authEstablishEndpoints,
+    )
+  )
+    return Response.json({ error: "Forbidden" }, { status: 403 });
+  return establishWith(event, input.endpoint, input.payload ?? {});
+}
+
+/** `POST /auth/remove-account`: forgets a stored account. */
+export async function removeStoredAccount(event: DmsServerEvent) {
+  const input = await event.readJson<Input>();
+  removeAccount(event, input.accountId);
+  return { success: true };
+}
+
+/** `POST /auth/switch-tenant`: the same account, in another tenant. */
+export async function switchTenant(event: DmsServerEvent) {
+  const session = event.session.read();
+  const input = await event.readJson<Input>();
+  if (!session)
+    return Response.json({ message: "Not authenticated" }, { status: 401 });
+  if (!input.tenantId)
+    return Response.json({ message: "tenantId required" }, { status: 400 });
+  const tokens = await event.backend<SessionTokens>("/api/auth/switch-tenant", {
+    method: "POST",
+    token: session.accessToken,
+    body: { refreshToken: session.refreshToken, tenantId: input.tenantId },
+  });
+  const user = await event.backend<SessionTokens["user"]>("/api/auth/me", {
+    token: tokens.access_token,
+  });
+  const switched = sessionFrom({ ...tokens, user }, isPersistent(session));
+  persistAccountSession(event, switched, session.accountId);
+  return { success: true, user };
+}
+
+/** `POST /auth/switch-account`: signs in as another stored account. */
+export async function switchAccount(event: DmsServerEvent) {
+  const input = await event.readJson<Input>();
+  const account = readAccount(event, input.accountId);
+  if (!account)
+    return Response.json({ message: "Account expired" }, { status: 401 });
+  try {
+    const tokens = await event.backend<SessionTokens>("/api/auth/refresh", {
+      method: "POST",
+      body: { token: account.refreshToken },
+    });
+    const user = await event.backend<SessionTokens["user"]>("/api/auth/me", {
+      token: tokens.access_token,
+    });
+    const session = sessionFrom({ ...tokens, user }, isPersistent(account));
+    const descriptor = persistAccountSession(
+      event,
+      session,
+      input.accountId as string,
+    );
+    return { success: true, user, account: descriptor };
+  } catch (error) {
+    if (isRefusal(error)) removeAccount(event, input.accountId);
+    throw error;
+  }
+}
+
+/**
+ * Keep the tokens a validation refreshed, without changing which account is
+ * signed in. Another account only has its own cookie updated. The current one
+ * also has the session updated, since a refresh may have rotated the token the
+ * session holds; it keeps its user as the backend gave it.
+ */
+function storeValidatedAccount(
+  event: DmsServerEvent,
+  account: StoredAccount,
+  accountId: string,
+  tokens: SessionTokens,
+) {
+  const current = event.session.read();
+  if (current?.accountId === accountId) {
+    persistAccountSession(
+      event,
+      sessionFrom({ ...tokens, user: current.user }, isPersistent(current)),
+      accountId,
+    );
+    return;
+  }
+  const user = {
+    _id: account.userId,
+    email: account.email,
+    name: account.name,
+  };
+  storeAccount(
+    event,
+    sessionFrom({ ...tokens, user }, isPersistent(account)),
+    accountId,
+  );
+}
+
+/**
+ * `POST /auth/validate-account`: whether a stored account can still sign in,
+ * keeping the tokens the check refreshed. `null` when the backend could not
+ * tell.
+ */
+export async function validateAccount(event: DmsServerEvent) {
+  const input = await event.readJson<Input>();
+  const account = readAccount(event, input.accountId);
+  if (!account) return { valid: false };
+  try {
+    const tokens = await event.backend<SessionTokens>("/api/auth/refresh", {
+      method: "POST",
+      body: { token: account.refreshToken },
+    });
+    storeValidatedAccount(event, account, input.accountId as string, tokens);
+    return { valid: true };
+  } catch (error) {
+    const rejected = isRefusal(error);
+    if (rejected) removeAccount(event, input.accountId);
+    return { valid: rejected ? false : null };
+  }
+}