@binary1702/auth 0.2.4 → 0.3.0

package/dist/core/email.js

@@ -0,0 +1,213 @@
+// ─────────────────────────────────────────────────────────────
+// Email. One function, no dependency: everything goes over fetch.
+//
+//   gmail     email.gmail.user + clientEmail + privateKey (a service
+//             account; Workspace: domain-wide delegation) or
+//             clientId + clientSecret + refreshToken (OAuth)
+//   resend    email.resend.apiKey + email.from
+//   console   neither, not production: print the message
+//   none      neither, production: throw at the first send
+//
+// (b17_auth.yaml keys; the AUTH_GMAIL_* / AUTH_RESEND_* env vars map
+// onto them, see core/options.ts.)
+//
+// Gmail is two requests: a token from oauth2.googleapis.com (a signed
+// JWT assertion for a service account, a refresh grant otherwise) and
+// a POST of the raw RFC 2822 message to gmail.googleapis.com. Tokens
+// are cached in-process until a minute before they expire.
+//
+// The decision and the message building are pure; fetch is injected.
+// ─────────────────────────────────────────────────────────────
+import { SignJWT, importPKCS8 } from "jose";
+import { options } from "./options.js";
+export const RESEND_URL = "https://api.resend.com/emails";
+export const GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
+export const GMAIL_SEND_URL = "https://gmail.googleapis.com/gmail/v1/users/me/messages/send";
+export const GMAIL_SCOPE = "https://www.googleapis.com/auth/gmail.send";
+export const EMAIL_NOT_CONFIGURED = "Email is not configured. In b17_auth.yaml set email.gmail (user + clientEmail + privateKey) or email.resend (apiKey) + email.from (run: npx @binary1702/auth).";
+function current() {
+    const o = options();
+    return { ...o.email, production: o.production };
+}
+// ── decision ──────────────────────────────────────────────────
+function gmailConfigured(cfg) {
+    const g = cfg.gmail;
+    if (!g?.user)
+        return false;
+    if (g.clientEmail && g.privateKey)
+        return true;
+    return Boolean(g.clientId && g.clientSecret && g.refreshToken);
+}
+/** Which way a message goes. Gmail wins when both are configured. Pure. */
+export function emailTransport(cfg) {
+    if (gmailConfigured(cfg))
+        return "gmail";
+    if (cfg.resend?.apiKey && cfg.from)
+        return "resend";
+    return cfg.production ? "none" : "console";
+}
+// ── addresses ─────────────────────────────────────────────────
+const b64 = (s) => Buffer.from(s, "utf8").toString("base64");
+/** RFC 2047 for a header that may hold non-ASCII (a subject with an accent) */
+export function encodeHeader(value) {
+    return /^[\x20-\x7e]*$/.test(value) ? value : `=?UTF-8?B?${b64(value)}?=`;
+}
+/**
+ * A From/To value as the header needs it. `Name <addr>` keeps the name
+ * quoted when it holds characters that mean something in a header
+ * (parentheses, commas, colons, …) and RFC 2047-encoded when it is not
+ * ASCII. A bare address passes through. Pure.
+ */
+export function formatAddress(value) {
+    const m = value.trim().match(/^(.*?)\s*<([^<>]+)>$/);
+    if (!m)
+        return value.trim();
+    const addr = m[2].trim();
+    let name = m[1].trim().replace(/^"(.*)"$/, "$1");
+    if (!name)
+        return addr;
+    if (!/^[\x20-\x7e]*$/.test(name))
+        name = encodeHeader(name);
+    else if (/[()<>\[\]:;@\\,."]/.test(name))
+        name = `"${name.replace(/(["\\])/g, "\\$1")}"`;
+    return `${name} <${addr}>`;
+}
+// ── resend ────────────────────────────────────────────────────
+/** The request Resend expects. Pure. */
+export function resendRequest(msg, cfg) {
+    return {
+        url: RESEND_URL,
+        init: {
+            method: "POST",
+            headers: { authorization: `Bearer ${cfg.resend?.apiKey}`, "content-type": "application/json" },
+            body: JSON.stringify({ from: cfg.from, to: [msg.to], subject: msg.subject, text: msg.text, html: msg.html, reply_to: cfg.replyTo }),
+        },
+    };
+}
+// ── gmail: the message ────────────────────────────────────────
+/** The raw RFC 2822 message Gmail wants, base64url-encoded. Pure. */
+export function gmailRaw(msg, from, replyTo) {
+    const crlf = (s) => s.replace(/\r?\n/g, "\r\n");
+    const head = [`From: ${formatAddress(from)}`, `To: ${formatAddress(msg.to)}`];
+    if (replyTo)
+        head.push(`Reply-To: ${formatAddress(replyTo)}`);
+    head.push(`Subject: ${encodeHeader(msg.subject)}`, "MIME-Version: 1.0");
+    let body;
+    if (msg.html) {
+        const boundary = `b_${Buffer.from(msg.subject + msg.to).toString("hex").slice(0, 24)}`;
+        head.push(`Content-Type: multipart/alternative; boundary="${boundary}"`);
+        body = [
+            `--${boundary}`,
+            "Content-Type: text/plain; charset=UTF-8",
+            "Content-Transfer-Encoding: base64",
+            "",
+            b64(crlf(msg.text)),
+            `--${boundary}`,
+            "Content-Type: text/html; charset=UTF-8",
+            "Content-Transfer-Encoding: base64",
+            "",
+            b64(crlf(msg.html)),
+            `--${boundary}--`,
+        ].join("\r\n");
+    }
+    else {
+        head.push("Content-Type: text/plain; charset=UTF-8", "Content-Transfer-Encoding: base64");
+        body = b64(crlf(msg.text));
+    }
+    return Buffer.from(head.join("\r\n") + "\r\n\r\n" + body, "utf8").toString("base64url");
+}
+/** The service account's email and PEM key (client_email and private_key in the JSON Google hands out) */
+export function serviceAccount(gmail) {
+    if (!gmail.clientEmail || !gmail.privateKey) {
+        throw new Error("email.gmail needs clientEmail and privateKey (the service account's client_email and private_key)");
+    }
+    // .env files tend to keep the key's newlines as the two characters \ n
+    const key = gmail.privateKey.replace(/\\n/g, "\n").trim();
+    if (!key.includes("-----BEGIN") || !key.includes("PRIVATE KEY-----")) {
+        throw new Error("email.gmail.privateKey does not look like a PEM private key (-----BEGIN PRIVATE KEY----- …)");
+    }
+    return { email: gmail.clientEmail, key };
+}
+/** The signed assertion for a service account acting as the mailbox user (domain-wide delegation). */
+export async function serviceAccountAssertion(gmail, now = new Date()) {
+    const sa = serviceAccount(gmail);
+    const iat = Math.floor(now.getTime() / 1000);
+    return new SignJWT({ scope: GMAIL_SCOPE })
+        .setProtectedHeader({ alg: "RS256", typ: "JWT" })
+        .setIssuer(sa.email)
+        .setSubject(gmail.user)
+        .setAudience(GOOGLE_TOKEN_URL)
+        .setIssuedAt(iat)
+        .setExpirationTime(iat + 3600)
+        .sign(await importPKCS8(sa.key, "RS256"));
+}
+/** The token request body, either grant. */
+export async function gmailTokenRequest(gmail) {
+    if (gmail.clientEmail && gmail.privateKey) {
+        return new URLSearchParams({
+            grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+            assertion: await serviceAccountAssertion(gmail),
+        });
+    }
+    return new URLSearchParams({
+        grant_type: "refresh_token",
+        client_id: gmail.clientId,
+        client_secret: gmail.clientSecret,
+        refresh_token: gmail.refreshToken,
+    });
+}
+const tokens = new Map();
+async function gmailToken(gmail, fetchFn) {
+    const cached = tokens.get(gmail.user);
+    if (cached && cached.expiresAt - Date.now() > 60_000)
+        return cached.token;
+    const res = await fetchFn(GOOGLE_TOKEN_URL, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: await gmailTokenRequest(gmail),
+    });
+    const data = (await res.json().catch(() => ({})));
+    if (!res.ok || !data.access_token) {
+        throw new Error(`Google would not issue a Gmail token (${res.status}): ${data.error ?? ""} ${data.error_description ?? ""}`.trim());
+    }
+    tokens.set(gmail.user, { token: data.access_token, expiresAt: Date.now() + (data.expires_in ?? 3600) * 1000 });
+    return data.access_token;
+}
+/** Forget cached tokens (tests, or after rotating credentials). */
+export function resetGmailTokens() {
+    tokens.clear();
+}
+// ── send ──────────────────────────────────────────────────────
+export async function sendEmail(msg, cfg = current(), fetchFn = fetch, log = console.log) {
+    switch (emailTransport(cfg)) {
+        case "none":
+            throw new Error(EMAIL_NOT_CONFIGURED);
+        case "console":
+            log(["", `[auth] email to ${msg.to}`, `[auth] subject: ${msg.subject}`, msg.text.replace(/^/gm, "[auth] "), ""].join("\n"));
+            return;
+        case "resend": {
+            const { url, init } = resendRequest(msg, cfg);
+            const res = await fetchFn(url, init);
+            if (!res.ok) {
+                const detail = await res.text().catch(() => "");
+                throw new Error(`Resend refused the email (${res.status}): ${detail.slice(0, 300)}`);
+            }
+            return;
+        }
+        case "gmail": {
+            const gmail = cfg.gmail;
+            const token = await gmailToken(gmail, fetchFn);
+            const res = await fetchFn(GMAIL_SEND_URL, {
+                method: "POST",
+                headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+                body: JSON.stringify({ raw: gmailRaw(msg, cfg.from || gmail.user, cfg.replyTo) }),
+            });
+            if (!res.ok) {
+                if (res.status === 401)
+                    tokens.delete(gmail.user); // stale token: next send fetches a new one
+                const detail = await res.text().catch(() => "");
+                throw new Error(`Gmail refused the email (${res.status}): ${detail.slice(0, 300)}`);
+            }
+        }
+    }
+}

package/dist/core/guard.d.ts

@@ -0,0 +1,49 @@
+/**
+ * A post-login destination, reduced to a same-origin path.
+ * Resolves the value the way the browser will (`/\evil.com` and
+ * `/\t/evil.com` both become `https://evil.com/`) and keeps it only
+ * if it stays on `base`'s origin.
+ */
+export declare function safeNext(value: string | null | undefined, base: string): string;
+/**
+ * The proxy runs on everything except Next's build output; this
+ * function decides the rest. Kept in sync with the CLI's proxy.ts.
+ */
+export declare const MATCHER: string[];
+/**
+ * Does a configured pattern cover this path?
+ *   /pricing        that path only
+ *   /blog/*         /blog, /blog/ and anything below (never /blogs)
+ */
+export declare function matchesPattern(pathname: string, pattern: string): boolean;
+export type AccessRules = {
+    public?: readonly string[];
+    protected?: readonly string[];
+};
+/**
+ * Paths reachable without a session. The auth pages and Next internals
+ * always are. Then one of two modes from b17_auth.yaml:
+ *
+ *   protected: /app/* /api/*   only these need a session; everything else is open
+ *   public: / /pricing         everything needs a session except these, static
+ *                              files by extension, and never anything under /api/
+ *                              (so /api/export.csv stays guarded unless listed)
+ *
+ * Neither set: the second mode with an empty list, i.e. everything guarded.
+ */
+export declare function isPublic(pathname: string, rules?: AccessRules | readonly string[]): boolean;
+/**
+ * Equality that takes the same time whatever the inputs, for the invite
+ * code. Hashing both sides first means a length difference leaks nothing.
+ */
+export declare function safeEqual(a: string, b: string): boolean;
+/**
+ * True unless the request provably came from another site.
+ *   Sec-Fetch-Site  sent by every modern browser: same-origin or none
+ *                   (typed URL, bookmark) pass, anything else fails
+ *   Origin          older browsers: must match the host served
+ *   neither         not a browser (curl, server code): passes
+ */
+export declare function isSameOrigin(headers: {
+    get(name: string): string | null;
+}): boolean;

package/dist/core/guard.js

@@ -0,0 +1,103 @@
+// ─────────────────────────────────────────────────────────────
+// Request guards. Pure functions over strings and headers, so the
+// security rules can be tested and read without Next or a database.
+//
+//   safeNext()      where to go after sign-in: same-origin path, or "/"
+//   isPublic()      which paths the proxy lets through without a cookie
+//   isSameOrigin()  refuse cross-site POSTs (login CSRF)
+//   safeEqual()     constant-time string compare (invite code)
+// ─────────────────────────────────────────────────────────────
+import { createHash, timingSafeEqual } from "node:crypto";
+/**
+ * A post-login destination, reduced to a same-origin path.
+ * Resolves the value the way the browser will (`/\evil.com` and
+ * `/\t/evil.com` both become `https://evil.com/`) and keeps it only
+ * if it stays on `base`'s origin.
+ */
+export function safeNext(value, base) {
+    if (!value)
+        return "/";
+    try {
+        const origin = new URL(base).origin;
+        const url = new URL(value, origin);
+        if (url.origin !== origin)
+            return "/";
+        return url.pathname + url.search + url.hash;
+    }
+    catch {
+        return "/";
+    }
+}
+/**
+ * The proxy runs on everything except Next's build output; this
+ * function decides the rest. Kept in sync with the CLI's proxy.ts.
+ */
+export const MATCHER = ["/((?!_next/static|_next/image|favicon.ico).*)"];
+const STATIC_FILE = /\.(?:png|jpe?g|gif|svg|ico|webp|avif|css|js|map|woff2?|ttf|otf|txt|xml|webmanifest)$/i;
+/**
+ * Does a configured pattern cover this path?
+ *   /pricing        that path only
+ *   /blog/*         /blog, /blog/ and anything below (never /blogs)
+ */
+export function matchesPattern(pathname, pattern) {
+    if (pattern.endsWith("/*")) {
+        const base = pattern.slice(0, -2) || "/";
+        return pathname === base || pathname === base + "/" || pathname.startsWith(base === "/" ? "/" : base + "/");
+    }
+    return pathname === pattern;
+}
+/**
+ * Paths reachable without a session. The auth pages and Next internals
+ * always are. Then one of two modes from b17_auth.yaml:
+ *
+ *   protected: /app/* /api/*   only these need a session; everything else is open
+ *   public: / /pricing         everything needs a session except these, static
+ *                              files by extension, and never anything under /api/
+ *                              (so /api/export.csv stays guarded unless listed)
+ *
+ * Neither set: the second mode with an empty list, i.e. everything guarded.
+ */
+export function isPublic(pathname, rules = {}) {
+    const r = Array.isArray(rules) ? { public: rules } : rules;
+    if (/^\/auth(\/|$)/.test(pathname))
+        return true;
+    if (pathname.startsWith("/_next/"))
+        return true;
+    if (r.protected?.length)
+        return !r.protected.some((p) => matchesPattern(pathname, p));
+    if (r.public?.some((p) => matchesPattern(pathname, p)))
+        return true;
+    if (pathname.startsWith("/api/"))
+        return false;
+    return STATIC_FILE.test(pathname);
+}
+/**
+ * Equality that takes the same time whatever the inputs, for the invite
+ * code. Hashing both sides first means a length difference leaks nothing.
+ */
+export function safeEqual(a, b) {
+    const h = (s) => createHash("sha256").update(s, "utf8").digest();
+    return timingSafeEqual(h(a), h(b));
+}
+/**
+ * True unless the request provably came from another site.
+ *   Sec-Fetch-Site  sent by every modern browser: same-origin or none
+ *                   (typed URL, bookmark) pass, anything else fails
+ *   Origin          older browsers: must match the host served
+ *   neither         not a browser (curl, server code): passes
+ */
+export function isSameOrigin(headers) {
+    const site = headers.get("sec-fetch-site");
+    if (site)
+        return site === "same-origin" || site === "none";
+    const origin = headers.get("origin");
+    if (!origin)
+        return true;
+    const host = (headers.get("x-forwarded-host") ?? headers.get("host"))?.split(",")[0].trim();
+    try {
+        return new URL(origin).host === host;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/core/html.d.ts

@@ -1,8 +1,34 @@
+export declare const escape: (s: string) => string;
+/**
+ * Headers every auth page is served with. Pure.
+ *   no-store            a sign-in form or an admin page is never cached, by a browser or a CDN
+ *   X-Frame-Options     never shown inside another site's frame (clickjacking)
+ *   CSP                 no scripts at all unless the page brings its own nonce; styles and the
+ *                       data: favicon are inline; forms post only to this origin
+ */
+export declare function securityHeaders(scriptNonce?: string): Record<string, string>;
+export declare function setSiteName(name: string | undefined): void;
+/** "Didn't get the email?" A second form, POSTing to /auth/verify/resend. */
+export declare function resendForm(email?: string): string;
 export declare function signInPage(opts?: {
     error?: string;
+    notice?: string;
     next?: string;
     title?: string;
     canSignUp?: boolean;
+    resend?: boolean;
+    email?: string;
+}): string;
+/** Ask for the email to send a reset link to. With `sent`, show the (always identical) confirmation instead. */
+export declare function forgotPage(opts?: {
+    sent?: boolean;
+    error?: string;
+    message?: string;
+}): string;
+/** The form behind the emailed link: a new password, the token hidden. */
+export declare function resetPage(opts: {
+    token: string;
+    error?: string;
 }): string;
 export declare function signUpPage(opts?: {
     error?: string;
@@ -11,3 +37,13 @@ export declare function signUpPage(opts?: {
     inviteRequired?: boolean;
     first?: boolean;
 }): string;
+/** A page with no form: a result, an error, a "check your email". */
+export declare function messagePage(opts: {
+    title: string;
+    message: string;
+    link?: {
+        href: string;
+        text: string;
+    };
+    after?: string;
+}): string;

package/dist/core/html.js

@@ -1,66 +1,142 @@
 // ─────────────────────────────────────────────────────────────
-// The sign-in and sign-up pages. Plain HTML served by the route
-// handler, so the consumer never builds a form or a page.
+// The auth pages. Plain HTML served by the route handler, so the
+// consumer never builds a form or a page. Every untrusted value goes
+// through escape().
 // ─────────────────────────────────────────────────────────────
 import { SIGN_IN_PATH, SIGN_UP_PATH } from "./config.js";
-const escape = (s) => s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+import { VERIFY_PATH } from "./verify.js";
+import { FORGOT_PATH, RESET_PATH } from "./reset.js";
+import { PASSWORD_MAX, PASSWORD_MIN } from "./signup.js";
+export const escape = (s) => s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+/**
+ * Headers every auth page is served with. Pure.
+ *   no-store            a sign-in form or an admin page is never cached, by a browser or a CDN
+ *   X-Frame-Options     never shown inside another site's frame (clickjacking)
+ *   CSP                 no scripts at all unless the page brings its own nonce; styles and the
+ *                       data: favicon are inline; forms post only to this origin
+ */
+export function securityHeaders(scriptNonce) {
+    const script = scriptNonce ? `script-src 'nonce-${scriptNonce}'` : "script-src 'none'";
+    return {
+        "cache-control": "no-store",
+        "x-frame-options": "DENY",
+        "content-security-policy": `default-src 'none'; ${script}; style-src 'unsafe-inline'; img-src data:; form-action 'self'; frame-ancestors 'none'; base-uri 'none'`,
+        "referrer-policy": "same-origin",
+    };
+}
 const STYLE = `
-  :root { color-scheme: light dark; --fg: #111; --bg: #fff; --line: #ddd; --muted: #666; --err: #c0392b; }
-  @media (prefers-color-scheme: dark) { :root { --fg: #eee; --bg: #111; --line: #333; --muted: #999; --err: #ff6b6b; } }
+  :root { color-scheme: light dark; --fg: #111; --bg: #fff; --line: #ddd; --muted: #666; --err: #c0392b; --ok: #1e8449; }
+  @media (prefers-color-scheme: dark) { :root { --fg: #eee; --bg: #111; --line: #333; --muted: #999; --err: #ff6b6b; --ok: #58d68d; } }
   * { box-sizing: border-box; }
   body { margin: 0; min-height: 100vh; display: grid; place-items: center; background: var(--bg); color: var(--fg);
          font: 15px/1.4 system-ui, -apple-system, sans-serif; }
-  form { width: 100%; max-width: 320px; padding: 16px; display: grid; gap: 12px; }
+  main { width: 100%; max-width: 320px; padding: 16px; display: grid; gap: 12px; }
+  form { display: grid; gap: 12px; }
   h1 { font-size: 18px; font-weight: 600; margin: 0 0 4px; }
+  p { margin: 0; }
   label { display: grid; gap: 4px; font-size: 13px; color: var(--muted); }
   input { font: inherit; padding: 8px 10px; border: 1px solid var(--line); border-radius: 6px; background: var(--bg); color: var(--fg); }
   input:focus { outline: 2px solid var(--fg); outline-offset: 1px; }
   button { font: inherit; font-weight: 500; padding: 9px; border: 0; border-radius: 6px; background: var(--fg); color: var(--bg); cursor: pointer; }
-  .error { margin: 0; font-size: 13px; color: var(--err); }
-  .alt { margin: 4px 0 0; font-size: 13px; color: var(--muted); text-align: center; }
+  .error { font-size: 13px; color: var(--err); }
+  .notice { font-size: 13px; color: var(--ok); }
+  .alt { margin-top: 4px; font-size: 13px; color: var(--muted); text-align: center; }
   .alt a { color: var(--fg); }
+  .resend { margin-top: 8px; padding-top: 12px; border-top: 1px solid var(--line); }
+  .resend button { background: none; color: var(--fg); border: 1px solid var(--line); }
 `;
-function page(opts) {
-    const title = escape(opts.title);
-    const next = escape(opts.next ?? "/");
-    const error = opts.error ? `<p class="error">${escape(opts.error)}</p>` : "";
+/** The app name for <title>, set by the handlers from b17_auth.yaml `name` */
+let siteName = "";
+export function setSiteName(name) {
+    siteName = name ?? "";
+}
+function shell(title, body) {
     return `<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${title}</title>
+<title>${escape(siteName ? `${title} · ${siteName}` : title)}</title>
 <link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>🔒</text></svg>">
 <style>${STYLE}</style>
 </head>
 <body>
-<form method="post" action="${opts.action}">
+<main>
+${body}
+</main>
+</body>
+</html>`;
+}
+function page(opts) {
+    const title = escape(opts.title);
+    const next = escape(opts.next ?? "/");
+    const error = opts.error ? `  <p class="error">${escape(opts.error)}</p>\n` : "";
+    const notice = opts.notice ? `  <p class="notice">${escape(opts.notice)}</p>\n` : "";
+    return shell(opts.title, `<form method="post" action="${opts.action}">
   <h1>${title}</h1>
-  ${error}
-  ${opts.fields}
-  <input type="hidden" name="next" value="${next}">
+${error}${notice}${opts.fields}
+  <input type="hidden" name="next" value="${next}">${opts.hidden ?? ""}
   <button type="submit">${escape(opts.button)}</button>
   ${opts.alt ?? ""}
 </form>
-</body>
-</html>`;
+${opts.after ?? ""}`);
+}
+const nextQuery = (next) => (next && next !== "/" ? `?next=${encodeURIComponent(next)}` : "");
+/** "Didn't get the email?" A second form, POSTing to /auth/verify/resend. */
+export function resendForm(email) {
+    return `<form method="post" action="${VERIFY_PATH}/resend" class="resend">
+  <label>Did not get the email? <input name="email" type="email" autocomplete="email" value="${escape(email ?? "")}" required></label>
+  <button type="submit">Send the link again</button>
+</form>`;
 }
 export function signInPage(opts = {}) {
-    const next = opts.next && opts.next !== "/" ? `?next=${encodeURIComponent(opts.next)}` : "";
     return page({
         title: opts.title ?? "Sign in",
         action: SIGN_IN_PATH,
         error: opts.error,
+        notice: opts.notice,
         next: opts.next,
         button: "Sign in",
         fields: `
-  <label>Email <input name="email" type="email" autocomplete="email" autofocus required></label>
+  <label>Email <input name="email" type="email" autocomplete="email" autofocus required value="${escape(opts.email ?? "")}"></label>
   <label>Password <input name="password" type="password" autocomplete="current-password" required></label>`,
-        alt: opts.canSignUp ? `<p class="alt">No account? <a href="${SIGN_UP_PATH}${next}">Create one</a></p>` : undefined,
+        alt: `<p class="alt"><a href="${FORGOT_PATH}">Forgot password?</a>${opts.canSignUp ? ` · No account? <a href="${SIGN_UP_PATH}${nextQuery(opts.next)}">Create one</a>` : ""}</p>`,
+        after: opts.resend ? resendForm(opts.email) : undefined,
+    });
+}
+/** Ask for the email to send a reset link to. With `sent`, show the (always identical) confirmation instead. */
+export function forgotPage(opts = {}) {
+    if (opts.sent) {
+        return messagePage({
+            title: "Check your email",
+            message: opts.message ?? "",
+            link: { href: SIGN_IN_PATH, text: "Back to sign in" },
+        });
+    }
+    return page({
+        title: "Reset your password",
+        action: FORGOT_PATH,
+        error: opts.error,
+        button: "Send reset link",
+        fields: `
+  <label>Email <input name="email" type="email" autocomplete="email" autofocus required></label>`,
+        alt: `<p class="alt"><a href="${SIGN_IN_PATH}">Back to sign in</a></p>`,
+    });
+}
+/** The form behind the emailed link: a new password, the token hidden. */
+export function resetPage(opts) {
+    return page({
+        title: "Choose a new password",
+        action: RESET_PATH,
+        error: opts.error,
+        button: "Set password",
+        hidden: `\n  <input type="hidden" name="token" value="${escape(opts.token)}">`,
+        fields: `
+  <label>New password <input name="password" type="password" autocomplete="new-password" minlength="${PASSWORD_MIN}" maxlength="${PASSWORD_MAX}" autofocus required></label>`,
+        alt: `<p class="alt"><a href="${FORGOT_PATH}">Request a new link</a></p>`,
     });
 }
 export function signUpPage(opts = {}) {
-    const next = opts.next && opts.next !== "/" ? `?next=${encodeURIComponent(opts.next)}` : "";
     return page({
         title: opts.title ?? (opts.first ? "Create the first account" : "Create account"),
         action: SIGN_UP_PATH,
@@ -69,7 +145,12 @@ export function signUpPage(opts = {}) {
         button: "Create account",
         fields: `
   <label>Email <input name="email" type="email" autocomplete="email" autofocus required></label>
-  <label>Password <input name="password" type="password" autocomplete="new-password" minlength="8" required></label>${opts.inviteRequired ? `\n  <label>Invite code <input name="invite" autocomplete="off" required></label>` : ""}`,
-        alt: opts.first ? undefined : `<p class="alt">Have an account? <a href="${SIGN_IN_PATH}${next}">Sign in</a></p>`,
+  <label>Password <input name="password" type="password" autocomplete="new-password" minlength="${PASSWORD_MIN}" maxlength="${PASSWORD_MAX}" required></label>${opts.inviteRequired ? `\n  <label>Invite code <input name="invite" autocomplete="off" required></label>` : ""}`,
+        alt: opts.first ? undefined : `<p class="alt">Have an account? <a href="${SIGN_IN_PATH}${nextQuery(opts.next)}">Sign in</a></p>`,
     });
 }
+/** A page with no form: a result, an error, a "check your email". */
+export function messagePage(opts) {
+    const link = opts.link ? `\n<p class="alt"><a href="${escape(opts.link.href)}">${escape(opts.link.text)}</a></p>` : "";
+    return shell(opts.title, `<h1>${escape(opts.title)}</h1>\n<p>${escape(opts.message)}</p>${link}\n${opts.after ?? ""}`);
+}