@arcblock/did-connect-service 4.1.36 → 4.1.38

package/dist/handlers/team-handler.js

@@ -21,15 +21,17 @@
  *   GET /.well-known/service/admin/team  → admin SPA
  *   GET /.well-known/service/invite      → invite page
  */
+import { AsyncLocalStorage } from "node:async_hooks";
 import { changeMembershipRole } from "../access/change-role.js";
 import { PermissionError, requirePermission } from "../access/rbac.js";
+import { handlerError, localizeKnownHandlerError } from "../handler-errors.js";
 import { resolveInstanceRole } from "../identity/instance-role.js";
-import { detectLocale, detectTheme } from "../locale.js";
+import { detectLocale, detectTheme, languageRowsForCodes, loadEnabledLocales, reconciledArcLangCookie } from "../locale.js";
 import { consoleLogger } from "../logger.js";
 import { buildLoginUrl } from "../login-url.js";
 import { LOGO_PREVIEW_BASE } from "../logo-paths.js";
 import { buildAdminPageHTML } from "../pages/admin/index.js";
-import { buildErrorPageHTML } from "../pages/error-page.js";
+import { buildErrorPageHTML, errorPageCopy } from "../pages/error-page.js";
 import { buildInvitePageHTML } from "../pages/invite-page.js";
 import { parseBase64Image, sniffImageType } from "./avatar-handler.js";
 import { resolveAccessKeyCaller } from "./passkey-handler.js";
@@ -41,6 +43,8 @@ function escapeEmailHtml(value) {
         .replaceAll('"', """)
         .replaceAll("'", "'");
 }
+/** Request-scoped so concurrent team fetches do not share a locale. */
+const handlerLocale = new AsyncLocalStorage();
 const API_BASE = "/.well-known/service/api/team";
 const ADMIN_PAGE = "/.well-known/service/admin";
 const INVITE_PAGE = "/.well-known/service/invite";
@@ -124,6 +128,7 @@ function shapeConnectedAccounts(rows, userSourceProvider, userDid) {
             provider: a.provider,
             id: a.id,
             userInfo,
+            createdAt: a.createdAt ?? a.firstLoginAt ?? null,
             lastLoginAt: a.lastLoginAt ?? null,
             isMain: a.provider === userSourceProvider && a.did === userDid,
             ...(extra !== undefined ? { extra } : {}),
@@ -153,6 +158,9 @@ export class TeamHandler {
         this.rpName = options.rpName;
         this.logger = options.logger ?? consoleLogger;
     }
+    async localeFor(request, instanceDid) {
+        return detectLocale(request, await loadEnabledLocales(this.store, instanceDid ?? this.instanceDid));
+    }
     /** Resolve the portal base URL for building invitation links. */
     resolvePortalUrl(request) {
         if (this.portalUrl)
@@ -186,6 +194,11 @@ export class TeamHandler {
     }
     // ─── API Router ──────────────────────────────────────────────────────
     async handleAPI(request, path, url, instanceDid, context) {
+        const enabled = await loadEnabledLocales(this.store, instanceDid ?? this.instanceDid);
+        const locale = detectLocale(request, enabled);
+        return handlerLocale.run(locale, () => this.dispatchAPI(request, path, url, instanceDid, context));
+    }
+    async dispatchAPI(request, path, url, instanceDid, context) {
         const method = request.method;
         try {
             // Public endpoint: invitation info (no auth required)
@@ -215,7 +228,7 @@ export class TeamHandler {
                 return await this.handleEmailUpdate(caller, request, instanceDid);
             }
             if (method === "POST" && path === "/profile/email/verify") {
-                return await this.handleEmailVerifySend(caller, request);
+                return await this.handleEmailVerifySend(caller, request, instanceDid);
             }
             if (method === "PUT" && path === "/profile/email/verify") {
                 return await this.handleEmailVerifyConfirm(caller, request, instanceDid);
@@ -537,10 +550,11 @@ export class TeamHandler {
     }
     /** PUT /profile/email — update email directly (marks as unverified). */
     async handleEmailUpdate(caller, request, instanceDid) {
+        const locale = await this.localeFor(request, instanceDid);
         const body = await this.parseJSON(request);
         const email = body.email?.toLowerCase().trim();
         if (!email?.includes("@")) {
-            return this.jsonResponse({ error: "Invalid email address" }, 400);
+            return this.jsonResponse({ error: handlerError("invalidEmailAddress", locale) }, 400);
         }
         await this.store.updateUserProfile(caller.did, { email, emailVerified: 0 }, caller.did);
         // Record only the domain (after the final `@`) to avoid PII leakage.
@@ -557,19 +571,20 @@ export class TeamHandler {
         return this.jsonResponse({ ok: true, user });
     }
     /** POST /profile/email/verify — send verification code to current email. */
-    async handleEmailVerifySend(caller, _request) {
+    async handleEmailVerifySend(caller, request, instanceDid) {
+        const locale = await this.localeFor(request, instanceDid);
         const emailConfig = await this.resolveEmailConfig();
         if (!emailConfig) {
-            return this.jsonResponse({ error: "Email service is not configured" }, 503);
+            return this.jsonResponse({ error: handlerError("emailServiceNotConfigured", locale) }, 503);
         }
         const userInfo = await this.store.getMemberInfo(caller.did);
         const email = userInfo?.email;
         if (!email) {
-            return this.jsonResponse({ error: "No email set on profile" }, 400);
+            return this.jsonResponse({ error: handlerError("noEmailOnProfile", locale) }, 400);
         }
         // Rate limit
         if (await this.store.isVerifyCodeSent(email)) {
-            return this.jsonResponse({ error: "Code already sent, please wait" }, 429);
+            return this.jsonResponse({ error: handlerError("codeAlreadySent", locale) }, 429);
         }
         const code = Array.from({ length: 6 }, () => Math.floor(Math.random() * 10)).join("");
         await this.store.createVerifyCode(code, email, "email-verify");
@@ -596,32 +611,33 @@ export class TeamHandler {
             if (!res.ok) {
                 const text = await res.text();
                 this.logger.warn({ message: "resend api rejected email-change verification", mod: "team", status: res.status, body: text.slice(0, 200) });
-                return this.jsonResponse({ error: `Failed to send email: ${text}` }, 500);
+                return this.jsonResponse({ error: handlerError("emailSendFailed", locale) }, 500);
             }
         }
         catch (err) {
             const message = err instanceof Error ? err.message : "Email send failed";
             this.logger.error({ message: "resend network error sending email-change verification", mod: "team", err: message });
-            return this.jsonResponse({ error: message }, 500);
+            return this.jsonResponse({ error: handlerError("emailSendFailed", locale) }, 500);
         }
         await this.store.markVerifyCodeSent(code);
         return this.jsonResponse({ ok: true });
     }
     /** PUT /profile/email/verify — confirm verification code, mark email as verified. */
     async handleEmailVerifyConfirm(caller, request, instanceDid) {
+        const locale = await this.localeFor(request, instanceDid);
         const body = await this.parseJSON(request);
         const code = body.code?.trim();
         if (!code) {
-            return this.jsonResponse({ error: "Verification code is required" }, 400);
+            return this.jsonResponse({ error: handlerError("verificationCodeRequired", locale) }, 400);
         }
         const userInfo = await this.store.getMemberInfo(caller.did);
         const email = userInfo?.email;
         if (!email) {
-            return this.jsonResponse({ error: "No email set on profile" }, 400);
+            return this.jsonResponse({ error: handlerError("noEmailOnProfile", locale) }, 400);
         }
         const verified = await this.store.consumeVerifyCode(code);
         if (!verified || verified.subject !== email) {
-            return this.jsonResponse({ error: "Invalid or expired verification code" }, 400);
+            return this.jsonResponse({ error: handlerError("invalidOrExpiredVerificationCode", locale) }, 400);
         }
         await this.store.updateUserProfile(caller.did, { emailVerified: 1 }, caller.did);
         await this.store.createAuditLog({
@@ -1495,7 +1511,8 @@ export class TeamHandler {
     async handleSaveOAuthProvider(caller, provider, request) {
         requirePermission(caller.role, "settings.edit_auth");
         if (!TeamHandler.VALID_OAUTH_PROVIDERS.includes(provider)) {
-            return this.errorResponse(`Invalid provider: ${provider}`, 400, "VALIDATION_ERROR");
+            const locale = handlerLocale.getStore() ?? "en";
+            return this.errorResponse(handlerError("invalidSettingsProvider", locale, { provider }), 400, "VALIDATION_ERROR");
         }
         const body = this.sanitizeKeys(await this.parseJSON(request));
         // Validate required fields based on provider
@@ -1567,7 +1584,8 @@ export class TeamHandler {
         for (const key of ["passkey", "email", "wallet"]) {
             const entry = body[key];
             if (entry && typeof entry.enabled !== "boolean") {
-                return this.errorResponse(`${key}.enabled must be a boolean`, 400, "VALIDATION_ERROR");
+                const locale = handlerLocale.getStore() ?? "en";
+                return this.errorResponse(handlerError("builtinEnabledMustBeBoolean", locale, { key }), 400, "VALIDATION_ERROR");
             }
         }
         const did = this.settingsInstanceDid;
@@ -1647,19 +1665,25 @@ export class TeamHandler {
         if (!user) {
             return new Response(null, { status: 302, headers: { Location: loginUrl } });
         }
+        const brandingDid = instanceDid || this.instanceDid;
+        const enabled = await loadEnabledLocales(this.store, brandingDid);
         if (!user.approved) {
-            return this.errorPage(403, "Account Blocked", "Your account has been blocked. Please contact the administrator.", url);
+            const locale = detectLocale(request, enabled);
+            const copy = errorPageCopy(locale);
+            return this.errorPage(403, copy.accountBlockedTitle, copy.accountBlockedMessage, url, locale);
         }
         // Resolve effective role for instance context
         let effectiveRole = user.role ?? "guest";
         if (instanceDid) {
             const resolved = await resolveInstanceRole(this.store, caller.did, instanceDid, user.role ?? undefined);
             if (!resolved && !opts?.isUserPage) {
-                return this.errorPage(403, "Access Denied", "You are not a member of this team.", url);
+                const locale = detectLocale(request, enabled);
+                const copy = errorPageCopy(locale);
+                return this.errorPage(403, copy.notTeamMemberTitle, copy.notTeamMemberMessage, url, locale);
             }
             effectiveRole = resolved ?? effectiveRole;
         }
-        const locale = detectLocale(request);
+        const locale = detectLocale(request, enabled);
         const theme = detectTheme(request);
         // Read app branding + languages for admin header.
         //
@@ -1673,22 +1697,15 @@ export class TeamHandler {
         // pick between the two URLs is no longer needed.
         let appName = this.rpName || "App";
         const appLogo = `${LOGO_PREVIEW_BASE}/square`;
-        let languages;
-        const brandingDid = instanceDid || this.instanceDid;
+        const languages = languageRowsForCodes(enabled);
         if (brandingDid) {
             try {
-                const [brandingRaw, langsRaw] = await Promise.all([
-                    this.store.getSetting(brandingDid, "app:branding"),
-                    this.store.getSetting(brandingDid, "app:languages"),
-                ]);
+                const brandingRaw = await this.store.getSetting(brandingDid, "app:branding");
                 if (brandingRaw) {
                     const branding = JSON.parse(brandingRaw);
                     if (branding.name)
                         appName = branding.name;
                 }
-                if (langsRaw) {
-                    languages = JSON.parse(langsRaw);
-                }
             }
             catch { /* use defaults */ }
         }
@@ -1747,12 +1764,14 @@ export class TeamHandler {
             passkeyLoginEnabled,
             emailLoginEnabled,
         });
-        return new Response(html, {
-            headers: {
-                "Content-Type": "text/html; charset=utf-8",
-                "Cache-Control": "private, no-store",
-            },
+        const headers = new Headers({
+            "Content-Type": "text/html; charset=utf-8",
+            "Cache-Control": "private, no-store",
         });
+        const localeCookie = reconciledArcLangCookie(request, locale);
+        if (localeCookie)
+            headers.set("Set-Cookie", localeCookie);
+        return new Response(html, { headers });
     }
     async serveInvitePage(request, ctxInstanceDid) {
         // Resolve federation config: if this instance is a federation member,
@@ -1768,7 +1787,8 @@ export class TeamHandler {
                 masterOAuthOrigin = (await this.store.getSetting(groupScope, "masterUrl")) ?? undefined;
             }
         }
-        const locale = detectLocale(request);
+        const enabled = await loadEnabledLocales(this.store, effectiveDid);
+        const locale = detectLocale(request, enabled);
         const html = buildInvitePageHTML(this.apiBase, locale, {
             masterOAuthOrigin,
             appName: this.rpName || "App",
@@ -1781,11 +1801,12 @@ export class TeamHandler {
         });
     }
     // ─── Helpers ────────────────────────────────────────────────────────
-    errorPage(status, title, message, url) {
+    errorPage(status, title, message, url, locale) {
         const html = buildErrorPageHTML({
             status,
             title,
             message,
+            locale,
             action: { label: "Go to Homepage", href: "/" },
             secondaryAction: status === 403
                 ? { label: "Sign in with another account", href: buildLoginUrl({ returnTo: url.pathname }) }
@@ -1806,7 +1827,9 @@ export class TeamHandler {
         });
     }
     errorResponse(message, status, code) {
-        return this.jsonResponse({ ok: false, error: message, code }, status);
+        const locale = handlerLocale.getStore();
+        const error = locale && status !== 401 ? localizeKnownHandlerError(message, locale) : message;
+        return this.jsonResponse({ ok: false, error, code }, status);
     }
     async parseJSON(request) {
         try {