@binary1702/auth 0.2.5 → 0.4.0

package/dist/next/index.js

@@ -5,104 +5,206 @@
 //               export { GET, POST } from "@binary1702/auth/next"
 //
 // Serves:
-//   GET  /auth/sign-in    the sign-in page
-//   POST /auth/sign-in    verify, set cookie, redirect to ?next or /
-//   GET  /auth/sign-up    the sign-up page (see core/signup.ts for when)
-//   POST /auth/sign-up    create user, set cookie, redirect
-//   GET  /auth/sign-out   clear cookie, redirect to sign-in
-//   POST /auth/sign-out   same (for fetch callers)
-//   GET  /auth/session    { user } or { user: null }
+//   GET  /auth/sign-in          the sign-in page
+//   POST /auth/sign-in          verify, set cookie, redirect to ?next or /
+//   GET  /auth/sign-up          the sign-up page (see core/signup.ts for when)
+//   POST /auth/sign-up          create user, email a verify link, set cookie, redirect
+//   GET  /auth/sign-out         clear cookie, redirect to ?next (same origin) or the sign-in page
+//   POST /auth/sign-out         same (JSON for fetch callers)
+//   GET  /auth/session          the session contract (core/org.ts), or 401
+//   POST /auth/session          switch the active organization { organization: id }
+//   GET  /auth/policy           { signup, pages, name } for an app's own sign-in / sign-up page
+//
+// With `pages:` in b17_auth.yaml the app serves sign-in / sign-up itself:
+// GET /auth/sign-in and /auth/sign-up redirect there (core/pages.ts),
+// every redirect above lands there, and the POSTs stay the protocol.
+//   GET  /auth/verify?token=    consume the link, mark the email verified
+//   POST /auth/verify/resend    email a fresh link (body: email)
+//   GET  /auth/forgot           "send me a reset link" form
+//   POST /auth/forgot           email a reset link if the address exists; same answer either way
+//   GET  /auth/reset?token=     "choose a new password" form
+//   POST /auth/reset            consume the token, set the password, sign in
+//   GET  /auth/invite?token=    the welcome form an added user gets (choose a password)
+//   POST /auth/invite           consume the invite token, set the password (verified), sign in
 //
 // Use anywhere on the server:
-//   const user = await requireUser()   // { id, email } or throws AuthError(401)
-//   const user = await getUser()       // { id, email } or null
-// Both check the database: a deleted user or a revoked session is null.
+//   const session = await getSession()         // { user, organization, authorization } or null
+//   const session = await requireSession()     // same, or throws AuthError(401)
+//   const session = await requirePermission("invoices.create")   // or throws AuthError(403)
+//   const user = await getUser() / requireUser()                 // just the user part
+// All of them run the same check: signature, user still exists with
+// the epoch the token was signed under, email verified when required.
 // ─────────────────────────────────────────────────────────────
 import { cookies } from "next/headers.js";
 import { NextResponse } from "next/server.js";
-import { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_UP_PATH, getSecret } from "../core/config.js";
+import { randomBytes } from "node:crypto";
+import { COOKIE_NAME, cookieName, getSecret } from "../core/config.js";
+import { options } from "../core/options.js";
+import { landing, movedTo, pageOverride, pagePath } from "../core/pages.js";
 import { isCurrent, signSession, verifySession } from "../core/session.js";
-import { hashPassword, verifyPassword } from "../core/password.js";
-import { countUsers, createUser, findUser, sessionEpoch } from "../core/db.js";
-import { signInPage, signUpPage } from "../core/html.js";
-import { signupPolicy, validateCredentials } from "../core/signup.js";
+import { hashPassword, needsRehash, verifyPassword } from "../core/password.js";
+import { addMember, adminOrgs, adminUsers, countUsers, createOrg, createUser, db, DuplicateUserError, rehashPassword, findOrg, findUser, markVerified, memberRole, removeMember, removeOrg, removeUser, resetRole, seedRoles, revokeSessions, sessionRow, setActiveOrg, setPassword, setPasswordById, setRolePermissions, storedRoles, } from "../core/db.js";
+import { forgotPage, messagePage, resendForm, resetPage, securityHeaders, setPages, setSiteName, signInPage, signUpPage } from "../core/html.js";
+import { adminPage } from "../core/admin-html.js";
+import { ADMIN_PATH, ROLE_NAME, backTo as adminBackTo, grantedFromFields, isAdmin, isOrgAction, isRoleAction, isUserAction, mayEditRoles, refusedOnSelf, roleChoices } from "../core/admin.js";
+import { emailTransport } from "../core/email.js";
+import { clientIp, rateLimit, retryMessage } from "../core/rate.js";
+import { signupPolicy, validateCredentials, validateEmail, validatePassword } from "../core/signup.js";
+import { INVITE_LINK_INVALID, INVITE_TTL_SECONDS, inviteEmail, inviteLink } from "../core/invite.js";
+import { isSameOrigin, safeEqual, safeNext } from "../core/guard.js";
+import { consumeToken, issueToken } from "../core/tokens.js";
+import { sendEmail } from "../core/email.js";
+import { VERIFY_TTL_SECONDS, mayAccess, verifyEmail, verifyLink } from "../core/verify.js";
+import { FORGOT_PATH, FORGOT_SENT, RESET_LINK_INVALID, RESET_TTL_SECONDS, resetEmail, resetLink } from "../core/reset.js";
+import { OWNER, buildSession, hasPermission } from "../core/org.js";
 export class AuthError extends Error {
-    status = 401;
-    constructor(message = "Unauthorized") {
+    status;
+    constructor(message = "Unauthorized", status = 401) {
         super(message);
         this.name = "AuthError";
+        this.status = status;
     }
 }
 /**
- * The full check, for anything that hands out data: a valid signature,
- * AND the user still exists with the epoch the token was signed under.
- * One indexed lookup by primary key. (The proxy skips the lookup; see
- * core/session.ts for why that is safe.)
+ * The one session check, for anything that hands out data: a valid
+ * signature, AND the user still exists with the epoch the token was
+ * signed under, AND (when required) a verified email. One query, which
+ * also brings the active organization and role. (The proxy skips the
+ * lookup; see core/session.ts for why that is safe.)
  */
-async function userFromToken(token) {
+async function sessionFromToken(token) {
     if (!token)
         return null;
     const claim = await verifySession(token, getSecret());
-    if (!claim || !isCurrent(claim, await sessionEpoch(claim.id)))
+    if (!claim)
+        return null;
+    await seeded();
+    const row = await sessionRow(claim.id);
+    const o = options();
+    if (!row || !isCurrent(claim, row.epoch) || !mayAccess(row.verified, o.requireVerified))
         return null;
-    return { id: claim.id, email: claim.email };
+    return buildSession(row, o);
+}
+/**
+ * The starting point for roles, written once per process (and then once
+ * per database: INSERT … DO NOTHING). The CLI does the same at install;
+ * this covers a database the CLI never saw, such as production's.
+ */
+let seeding = null;
+function seeded() {
+    seeding ??= seedRoles(options().roles).catch((err) => {
+        seeding = null; // retry on the next request
+        throw err;
+    });
+    return seeding;
+}
+async function cookieToken() {
+    return pickCookie(async (name) => (await cookies()).get(name)?.value);
+}
+/** The current cookie name first, then the pre-0.3.0 one, so upgrading signs nobody out. */
+async function pickCookie(get) {
+    return (await get(cookieName(options().production))) ?? (await get(COOKIE_NAME));
+}
+/** The session contract for the current request, or null if signed out, deleted or revoked. */
+export async function getSession() {
+    return sessionFromToken(await cookieToken());
+}
+/** The session, or throw AuthError (status 401). */
+export async function requireSession() {
+    const session = await getSession();
+    if (!session)
+        throw new AuthError();
+    return session;
+}
+/** The session, or throw AuthError: 401 when signed out, 403 when the role lacks the permission. */
+export async function requirePermission(permission) {
+    const session = await requireSession();
+    if (!hasPermission(session, permission))
+        throw new AuthError("Forbidden", 403);
+    return session;
 }
 /** Current user from the session cookie, or null if signed out, deleted or revoked. */
 export async function getUser() {
-    return userFromToken((await cookies()).get(COOKIE_NAME)?.value);
+    return (await getSession())?.user ?? null;
 }
 /** Current user, or throw AuthError (status 401). */
 export async function requireUser() {
-    const user = await getUser();
-    if (!user)
-        throw new AuthError();
-    return user;
+    return (await requireSession()).user;
 }
-/** A 401 JSON response for catch blocks: `catch (e) { return unauthorized(e) }` */
+/** A 401/403 JSON response for catch blocks: `catch (e) { return unauthorized(e) }` */
 export function unauthorized(err) {
     if (err && !(err instanceof AuthError))
         throw err;
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const status = err instanceof AuthError ? err.status : 401;
+    return NextResponse.json({ error: status === 403 ? "Forbidden" : "Unauthorized" }, { status });
 }
+/** The sign-in / sign-up pages: the app's own when b17_auth.yaml names them (core/pages.ts) */
+const SIGN_IN_PATH = () => pagePath(options().pages, "signIn");
+const SIGN_UP_PATH = () => pagePath(options().pages, "signUp");
 const cookieOptions = () => ({
     httpOnly: true,
     sameSite: "lax",
-    secure: process.env.NODE_ENV === "production",
+    secure: options().production,
     path: "/",
-    maxAge: SESSION_DAYS * 24 * 60 * 60,
+    maxAge: options().sessionDays * 24 * 60 * 60,
 });
-/** Only allow same-origin relative paths as a post-login destination. */
-function safeNext(value) {
-    if (!value || !value.startsWith("/") || value.startsWith("//"))
-        return "/";
-    return value;
+/** An auth page: HTML plus the headers every one of them carries (see securityHeaders) */
+function html(body, status = 200, headers = securityHeaders()) {
+    return new NextResponse(body, { status, headers: { "content-type": "text/html; charset=utf-8", ...headers } });
 }
-function html(body, status = 200) {
-    return new NextResponse(body, { status, headers: { "content-type": "text/html; charset=utf-8" } });
+/** Per-user JSON: never cached by a browser or a CDN */
+function sessionJson(session) {
+    const res = session
+        ? NextResponse.json(session)
+        : NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    res.headers.set("cache-control", "no-store");
+    return res;
 }
 async function readBody(req) {
     const type = req.headers.get("content-type") ?? "";
     const get = (b, k) => String((b instanceof FormData ? b.get(k) : b[k]) ?? "");
     const b = type.includes("application/json")
         ? (await req.json().catch(() => ({})))
-        : await req.formData();
+        : await req.formData().catch(() => new FormData());
     return {
         email: get(b, "email").trim().toLowerCase(),
         password: get(b, "password"),
         invite: get(b, "invite").trim(),
-        next: safeNext(get(b, "next")),
+        token: get(b, "token").trim(),
+        organization: get(b, "organization").trim(),
+        // Same-origin only; nothing (or the root) means the app's home
+        next: landing(safeNext(get(b, "next"), req.url), options().home),
         json: type.includes("application/json"),
     };
 }
+/** Every field of a form or JSON body as strings (the admin forms vary per action). */
+async function readFields(req) {
+    const type = req.headers.get("content-type") ?? "";
+    const out = new Proxy({}, { get: (t, k) => (typeof k === "string" ? (t[k] ?? "") : undefined) });
+    if (type.includes("application/json")) {
+        const b = (await req.json().catch(() => ({})));
+        for (const [k, v] of Object.entries(b))
+            out[k] = String(v ?? "");
+    }
+    else {
+        const fd = await req.formData().catch(() => new FormData());
+        fd.forEach((v, k) => (out[k] = String(v)));
+    }
+    return out;
+}
+async function currentSession(req) {
+    return sessionFromToken(await pickCookie((name) => req.cookies.get(name)?.value));
+}
 async function currentUser(req) {
-    return userFromToken(req.cookies.get(COOKIE_NAME)?.value);
+    return (await currentSession(req))?.user ?? null;
 }
 /** Sign the user in on a response: cookie + redirect (form) or JSON (fetch). */
 async function signedIn(req, user, next, json) {
-    const token = await signSession(user, getSecret());
-    const body = { user: { id: user.id, email: user.email } };
+    const token = await signSession(user, getSecret(), options().sessionDays);
+    // `next` is already reduced to a same-origin path: a fetch caller can follow it as is
+    const body = { user: { id: user.id, email: user.email }, next };
     const res = json ? NextResponse.json(body) : NextResponse.redirect(new URL(next, req.url), 303);
-    res.cookies.set(COOKIE_NAME, token, cookieOptions());
+    res.cookies.set(cookieName(options().production), token, cookieOptions());
     return res;
 }
 /** Back to a form with ?error=<msg>, keeping ?next. */
@@ -113,77 +215,561 @@ function backTo(req, path, error, next) {
         url.searchParams.set("next", next);
     return NextResponse.redirect(url, 303);
 }
-function signOutResponse(req, json) {
+/** The sign-in page in its "check your email" state. */
+function checkYourEmail(req, next, json, user) {
+    if (json)
+        return NextResponse.json({ user: user ?? null, verify: true }, { status: user ? 200 : 403 });
+    const url = new URL(SIGN_IN_PATH(), req.url);
+    url.searchParams.set("verify", "1");
+    if (next !== "/")
+        url.searchParams.set("next", next);
+    return NextResponse.redirect(url, 303);
+}
+/** 429 with Retry-After: JSON for fetch callers, the form again (with the message) for browsers. */
+function tooMany(d, json, page) {
+    const message = retryMessage(d.retryAfter);
+    const res = json ? NextResponse.json({ error: message, retryAfter: d.retryAfter }, { status: 429 }) : html(page(message), 429);
+    res.headers.set("retry-after", String(d.retryAfter));
+    return res;
+}
+/** Clear the cookie, then land on `next` (same origin; the app's public front, say) or the sign-in page */
+function signOutResponse(req, json, next) {
+    const to = next ? safeNext(next, req.url) : SIGN_IN_PATH();
     const res = json
         ? NextResponse.json({ ok: true })
-        : NextResponse.redirect(new URL(SIGN_IN_PATH, req.url), 303);
+        : NextResponse.redirect(new URL(to === "/" && !next ? SIGN_IN_PATH() : to, req.url), 303);
+    // Clear both names: the current one and the pre-0.3.0 one a browser may still hold
+    res.cookies.set(cookieName(options().production), "", { ...cookieOptions(), maxAge: 0 });
     res.cookies.set(COOKIE_NAME, "", { ...cookieOptions(), maxAge: 0 });
     return res;
 }
 async function policy() {
-    return signupPolicy(process.env, await countUsers());
+    return signupPolicy(options().signup, await countUsers());
+}
+/** Issue a verify token and email the link. Throws if the email cannot be sent. Returns the link, for the admin page to show. */
+async function sendVerification(req, user, next) {
+    const raw = await issueToken(user.id, "verify", VERIFY_TTL_SECONDS, { next });
+    const link = verifyLink(req.url, raw, next);
+    await sendEmail(verifyEmail(user.email, link, siteName(req)));
+    return link;
+}
+/** Issue an invite token and email the welcome link: choose a password, verified, signed in. Throws if the email cannot be sent. Returns the link, for the admin page to show. */
+async function sendInvite(req, user) {
+    const raw = await issueToken(user.id, "invite", INVITE_TTL_SECONDS);
+    const link = inviteLink(req.url, raw);
+    await sendEmail(inviteEmail(user.email, link, siteName(req)));
+    return link;
+}
+/**
+ * What to tell the admin after an email went out, honestly: in development
+ * without a transport, nothing was sent. The link itself comes along either
+ * way, so the admin can hand it over directly (it still works once).
+ */
+function emailOutcome(what, email, link) {
+    const o = options();
+    const transport = emailTransport({ ...o.email, production: o.production });
+    if (transport === "console") {
+        return { ok: false, message: `Nothing was sent: email is not set up (add email: to b17_auth.yaml). The ${what} link for ${email} is below; it works once.`, link };
+    }
+    return { ok: true, message: `${what[0].toUpperCase()}${what.slice(1)} link emailed to ${email} via ${transport}. The same link, in case it does not arrive:`, link };
+}
+/** For subjects and titles: `name` from b17_auth.yaml, else the host serving the request. Also tells the pages where sign-in / sign-up live. */
+function siteName(req) {
+    const o = options();
+    setSiteName(o.name);
+    setPages(o.pages);
+    return o.name || new URL(req.url).host;
+}
+/** GET /auth/sign-in or /auth/sign-up when the app serves that page itself: same query, the app's path */
+function movedPage(req, key) {
+    const custom = pageOverride(options().pages, key);
+    return custom ? NextResponse.redirect(new URL(movedTo(custom, req.nextUrl.search), req.url)) : null;
+}
+// ── admin ─────────────────────────────────────────────────────
+async function renderAdmin(self, nonce, view, limited, notice, error, link) {
+    const o = options();
+    await seeded();
+    const [users, orgs, stored, [tokens]] = await Promise.all([
+        adminUsers(),
+        adminOrgs(),
+        storedRoles(),
+        db().query(`SELECT COUNT(*)::int AS total, COUNT(*) FILTER (WHERE used_at IS NULL AND expires_at > now())::int AS live FROM tokens`),
+    ]);
+    const inUse = [...orgs.flatMap((org) => org.members.map((m) => m.role)), ...stored.map((s) => s.name)];
+    return adminPage({
+        self,
+        view,
+        users,
+        orgs,
+        stored,
+        roles: roleChoices(Object.keys(o.roles), inUse),
+        limited,
+        link,
+        options: o,
+        transport: emailTransport({ ...o.email, production: o.production }),
+        tokens: tokens ?? { total: 0, live: 0 },
+        notice,
+        error,
+        nonce,
+    });
+}
+/** Back to the admin page with a one-line result */
+function adminResult(req, kind, message, back, link) {
+    const url = new URL(`${ADMIN_PATH}${back ? `?${back}` : ""}`, req.url);
+    url.searchParams.set(kind, message);
+    if (link)
+        url.searchParams.set("link", link);
+    return NextResponse.redirect(url, 303);
+}
+/** A link the admin page may show: one of this site's own /auth/ links, nothing else (the query is not trusted). */
+function shownLink(req, value) {
+    if (!value)
+        return undefined;
+    const path = safeNext(value, req.url);
+    return path.startsWith("/auth/") ? new URL(path, req.url).toString() : undefined;
+}
+/** The admin POSTs: what the CLI does, from a form. Returns a notice or an error message. */
+async function adminAction(route, self, f, sendVerify, invite) {
+    const ok = (message) => ({ ok: true, message });
+    const fail = (message) => ({ ok: false, message });
+    const email = f.email.trim().toLowerCase();
+    if (route === "admin/users") {
+        const action = f.action;
+        if (!isUserAction(action))
+            return fail("Unknown action.");
+        const refused = refusedOnSelf(action, email, self);
+        if (refused)
+            return fail(refused);
+        if (action === "add") {
+            // Two flows, named by the button. Register: email + password, the account is
+            // ready and verified (the admin vouches for it). Invite: email only; the account
+            // gets a password nobody knows, and the person gets one link to choose theirs,
+            // which also verifies the address. A JSON caller without `mode` is read from the
+            // password: present means register.
+            const byInvite = f.mode ? f.mode === "invite" : !f.password;
+            if (!byInvite && !f.password)
+                return fail("Register needs a password. To send a link instead, use Invite.");
+            const invalid = byInvite ? validateEmail(email, options()) : validateCredentials(email, f.password, options());
+            if (invalid)
+                return fail(invalid);
+            if (await findUser(email))
+                return fail("That email is already registered.");
+            let created;
+            try {
+                created = await createUser(email, await hashPassword(byInvite ? randomBytes(32).toString("base64url") : f.password), { verified: !byInvite });
+            }
+            catch (err) {
+                if (err instanceof DuplicateUserError)
+                    return fail("That email is already registered.");
+                throw err;
+            }
+            if (!byInvite)
+                return ok(`Registered ${email}: ready and verified.`);
+            let link;
+            try {
+                link = await invite({ id: created.id, email: created.email });
+            }
+            catch (err) {
+                return fail(`Invited ${email}, but could not send the link: ${err instanceof Error ? err.message : String(err)}. Use "invite" to try again.`);
+            }
+            const outcome = emailOutcome("invitation", email, link);
+            return { ...outcome, message: `Invited ${email}. ${outcome.message}` };
+        }
+        const user = await findUser(email);
+        if (!user)
+            return fail(`No user ${email}.`);
+        if (action === "invite") {
+            let link;
+            try {
+                link = await invite({ id: user.id, email: user.email });
+            }
+            catch (err) {
+                return fail(`Could not send: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            return emailOutcome("invitation", email, link);
+        }
+        if (action === "set-password") {
+            const invalid = validatePassword(f.password);
+            if (invalid)
+                return fail(invalid);
+            await setPassword(email, await hashPassword(f.password));
+            return ok(`Password set for ${email}; their other sessions are ended.`);
+        }
+        if (action === "sign-out") {
+            await revokeSessions(email);
+            return ok(`Every session of ${email} is ended.`);
+        }
+        if (action === "verify") {
+            await markVerified(user.id);
+            return ok(`${email} marked verified.`);
+        }
+        if (action === "send-verify") {
+            if (user.verified_at)
+                return fail(`${email} is already verified.`);
+            let link;
+            try {
+                link = await sendVerify({ id: user.id, email: user.email });
+            }
+            catch (err) {
+                return fail(`Could not send: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            // Without a transport, development prints the email to the terminal: say so instead of claiming a send
+            return emailOutcome("verification", email, link);
+        }
+        await removeUser(email);
+        return ok(`Removed ${email}.`);
+    }
+    if (route === "admin/orgs") {
+        const action = f.action;
+        if (!isOrgAction(action))
+            return fail("Unknown action.");
+        if (action === "create") {
+            const name = f.name.trim();
+            if (!name)
+                return fail("An organization needs a name.");
+            if (await findOrg(name))
+                return fail(`There is already an organization called ${name}.`);
+            const org = await createOrg(name);
+            return ok(`Created ${org.name}.`);
+        }
+        const org = await findOrg(f.org);
+        if (!org)
+            return fail("No such organization.");
+        if (action === "remove-org") {
+            await removeOrg(org.id);
+            return ok(`Removed ${org.name} and its memberships.`);
+        }
+        const user = await findUser(email);
+        if (!user)
+            return fail(`No user ${email}. Add them first.`);
+        if (action === "remove-member") {
+            return (await removeMember(org.id, user.id)) ? ok(`${email} removed from ${org.name}.`) : fail(`${email} is not a member of ${org.name}.`);
+        }
+        const role = f.role.trim();
+        if (!ROLE_NAME.test(role))
+            return fail("A role is one word: letters, digits, - or _.");
+        await addMember(org.id, user.id, role); // add-member and set-role are the same upsert
+        return ok(`${email} is ${role} in ${org.name}.`);
+    }
+    if (route === "admin/roles") {
+        const action = f.action;
+        if (!isRoleAction(action))
+            return fail("Unknown action.");
+        const role = f.role.trim();
+        if (!ROLE_NAME.test(role))
+            return fail("A role is one word: letters, digits, - or _.");
+        if (role === OWNER)
+            return fail("The owner role always holds everything.");
+        // scope: "" = every organization; an organization's id = that one only
+        const scope = roleScope(f);
+        if (scope && !(await findOrg(scope)))
+            return fail("No such organization.");
+        if (action === "follow") {
+            if (!scope)
+                return fail("Only an organization's own rule can be dropped.");
+            return (await resetRole(scope, role)) ? ok(`${role} follows Roles again here.`) : fail(`${role} had no rule of its own here.`);
+        }
+        if (action === "defaults") {
+            if (scope)
+                return fail("Defaults apply to Roles, not to one organization.");
+            const defaults = options().roles[role];
+            if (!defaults)
+                return fail(`${role} has no default in b17_auth.yaml.`);
+            await setRolePermissions("", role, defaults);
+            return ok(`${role} is back to its default: ${defaults.join(", ") || "nothing"}.`);
+        }
+        const catalogue = Object.keys(options().permissions);
+        if (!catalogue.length)
+            return fail("Declare permissions in b17_auth.yaml first.");
+        // Only ids the app declares can be granted, whatever the form says
+        const granted = grantedFromFields(f, catalogue);
+        await setRolePermissions(scope, role, granted);
+        return ok(`${role} may now${scope ? " here" : ""}: ${granted.length ? granted.join(", ") : "nothing"}.`);
+    }
+    return fail("Unknown action.");
+}
+/** The organization a roles form is about, or "" for every organization. Never taken from the form as is. */
+function roleScope(f) {
+    const scope = f.scope || f.org || "";
+    return /^[0-9a-f-]{36}$/i.test(scope) ? scope : "";
+}
+/**
+ * Who may run an admin POST. A system admin: anything. An organization's
+ * owner: its roles grid and its members (never the organization's removal,
+ * nothing about users or other organizations).
+ */
+async function mayPost(session, route, f) {
+    const admin = isAdmin(session, options().admins);
+    if (admin)
+        return true;
+    const orgId = route === "admin/roles" ? roleScope(f) : route === "admin/orgs" ? (/^[0-9a-f-]{36}$/i.test(f.org) ? f.org : "") : "";
+    if (!orgId)
+        return false;
+    if (route === "admin/orgs" && !["add-member", "set-role", "remove-member"].includes(f.action))
+        return false;
+    return mayEditRoles(false, orgId, await memberRole(session.user.id, orgId));
 }
 // ── handlers ──────────────────────────────────────────────────
 export async function GET(req, ctx) {
     const { path } = await ctx.params;
     const route = path.join("/");
     const q = req.nextUrl.searchParams;
-    const next = safeNext(q.get("next"));
+    const next = safeNext(q.get("next"), req.url);
+    siteName(req); // so <title> carries the app name on every page below
     if (route === "sign-in") {
         if (await currentUser(req))
-            return NextResponse.redirect(new URL(next, req.url));
+            return NextResponse.redirect(new URL(landing(next, options().home), req.url));
+        // The app draws this page itself: hand over, query and all
+        const moved = movedPage(req, "signIn");
+        if (moved)
+            return moved;
         const p = await policy();
         // A fresh install has nobody to sign in: go straight to creating the first account.
         if (p.reason === "first")
-            return NextResponse.redirect(new URL(SIGN_UP_PATH, req.url));
+            return NextResponse.redirect(new URL(SIGN_UP_PATH(), req.url));
         const error = q.get("error") === "1" ? "Wrong email or password." : (q.get("error") ?? undefined);
-        return html(signInPage({ next, error, canSignUp: p.allowed }));
+        const verify = q.get("verify") === "1";
+        const notice = verify
+            ? "Check your email for a verification link, then sign in."
+            : q.get("verified") === "1"
+                ? "Email verified. Sign in to continue."
+                : undefined;
+        return html(signInPage({ next, error, notice, resend: verify, canSignUp: p.allowed }));
     }
     if (route === "sign-up") {
         if (await currentUser(req))
-            return NextResponse.redirect(new URL(next, req.url));
+            return NextResponse.redirect(new URL(landing(next, options().home), req.url));
+        const moved = movedPage(req, "signUp");
+        if (moved)
+            return moved;
         const p = await policy();
         if (!p.allowed)
             return NextResponse.json({ error: "Sign-up is closed" }, { status: 404 });
         return html(signUpPage({ next, error: q.get("error") ?? undefined, inviteRequired: p.inviteRequired, first: p.reason === "first" }));
     }
     if (route === "sign-out")
-        return signOutResponse(req, false);
+        return signOutResponse(req, false, q.get("next"));
     if (route === "session")
-        return NextResponse.json({ user: await currentUser(req) });
+        return sessionJson(await currentSession(req));
+    if (route === "policy") {
+        // What an app's own sign-in / sign-up page needs before it renders. Public, never cached.
+        const o = options();
+        const res = NextResponse.json({ signup: await policy(), pages: { signIn: SIGN_IN_PATH(), signUp: SIGN_UP_PATH() }, home: landing(null, o.home), name: o.name });
+        res.headers.set("cache-control", "no-store");
+        return res;
+    }
+    if (route === "admin") {
+        const session = await currentSession(req);
+        if (!session)
+            return NextResponse.redirect(new URL(`${SIGN_IN_PATH()}?next=${encodeURIComponent(ADMIN_PATH)}`, req.url));
+        const nonce = randomBytes(16).toString("base64");
+        const orgId = q.get("org");
+        const tab = q.get("tab");
+        const admin = isAdmin(session, options().admins);
+        if (!admin) {
+            // An organization's owner manages that organization: its roles and members, nothing else
+            const own = orgId && /^[0-9a-f-]{36}$/i.test(orgId) ? await memberRole(session.user.id, orgId) : null;
+            if (!orgId || !mayEditRoles(false, orgId, own)) {
+                const back = landing(null, options().home);
+                return html(messagePage({ title: "Not an admin", message: `This page is for emails under admins: in b17_auth.yaml, or an organization's owner (open your organization from the app).`, link: { href: back, text: "Back" } }), 403);
+            }
+            return html(await renderAdmin(session.user.email, nonce, { tab: "org", orgId }, true, q.get("notice") ?? undefined, q.get("error") ?? undefined, shownLink(req, q.get("link"))), 200, securityHeaders(nonce));
+        }
+        const view = orgId ? { tab: "org", orgId } : tab === "users" || tab === "settings" || tab === "roles" ? { tab } : { tab: "orgs" };
+        return html(await renderAdmin(session.user.email, nonce, view, false, q.get("notice") ?? undefined, q.get("error") ?? undefined, shownLink(req, q.get("link"))), 200, securityHeaders(nonce));
+    }
+    if (route === "forgot") {
+        return html(forgotPage({ sent: q.get("sent") === "1", message: FORGOT_SENT, error: q.get("error") ?? undefined }));
+    }
+    if (route === "reset") {
+        // Show the form without consuming the token: a mail scanner that
+        // prefetches the link must not burn it.
+        const token = q.get("token") ?? "";
+        if (!token)
+            return html(messagePage({ title: "Link expired", message: RESET_LINK_INVALID, link: { href: FORGOT_PATH, text: "Request a new link" } }), 400);
+        return html(resetPage({ token, error: q.get("error") ?? undefined }));
+    }
+    if (route === "invite") {
+        // The welcome link an added user gets: same rule, the form consumes nothing
+        const token = q.get("token") ?? "";
+        if (!token)
+            return html(messagePage({ title: "Link expired", message: INVITE_LINK_INVALID, link: { href: SIGN_IN_PATH(), text: "Sign in" } }), 400);
+        return html(resetPage({ token, invite: true, error: q.get("error") ?? undefined }));
+    }
+    if (route === "verify") {
+        const token = await consumeToken(q.get("token") ?? "", "verify");
+        const user = token ? await markVerified(token.userId) : null;
+        if (!user) {
+            return html(messagePage({
+                title: "Link expired",
+                message: "This verification link is invalid, already used, or older than 24 hours.",
+                after: resendForm(),
+            }), 400);
+        }
+        const dest = safeNext(typeof token.meta.next === "string" ? token.meta.next : q.get("next"), req.url);
+        // Signed in already (sign-up set the cookie)? Carry on. Otherwise sign in.
+        if (await currentUser(req))
+            return NextResponse.redirect(new URL(dest, req.url), 303);
+        const url = new URL(SIGN_IN_PATH(), req.url);
+        url.searchParams.set("verified", "1");
+        if (dest !== "/")
+            url.searchParams.set("next", dest);
+        return NextResponse.redirect(url, 303);
+    }
     return NextResponse.json({ error: "Not found" }, { status: 404 });
 }
 export async function POST(req, ctx) {
     const { path } = await ctx.params;
     const route = path.join("/");
-    if (route === "sign-out")
-        return signOutResponse(req, true);
+    siteName(req); // pages rendered from a POST (a failed reset) carry the app name too
+    // Every POST here sets or clears the session cookie, which SameSite
+    // does not protect: another site could sign the visitor in as itself.
+    if (!isSameOrigin(req.headers)) {
+        return NextResponse.json({ error: "Cross-site request refused" }, { status: 403 });
+    }
+    if (route === "sign-out") {
+        const { json } = await readBody(req);
+        return signOutResponse(req, json, req.nextUrl.searchParams.get("next"));
+    }
+    if (route === "admin/users" || route === "admin/orgs" || route === "admin/roles") {
+        const session = await currentSession(req);
+        if (!session)
+            return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+        const f = await readFields(req);
+        // Checked on the server, per organization: the form's claims mean nothing
+        if (!(await mayPost(session, route, f)))
+            return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+        const result = await adminAction(route, session.user.email, f, (user) => sendVerification(req, user, "/"), (user) => sendInvite(req, user));
+        // After removing an organization there is nothing to return to; otherwise, the view the form was on
+        const back = f.action === "remove-org" ? "" : adminBackTo(f);
+        return adminResult(req, result.ok ? "notice" : "error", result.message, back, result.link);
+    }
+    if (route === "session") {
+        // Switch the active organization. The id is the client's wish; the
+        // membership check in setActiveOrg() is what makes it true.
+        const session = await currentSession(req);
+        if (!session)
+            return sessionJson(null);
+        const { organization, json, next } = await readBody(req);
+        if (!(await setActiveOrg(session.user.id, organization))) {
+            return NextResponse.json({ error: "Not a member of that organization" }, { status: 403 });
+        }
+        return json ? sessionJson(await currentSession(req)) : NextResponse.redirect(new URL(next, req.url), 303);
+    }
     if (route === "sign-in") {
         const { email, password, next, json } = await readBody(req);
+        // Count the attempt before checking anything: wrong guesses are the ones that matter
+        const byIp = await rateLimit("signin:ip", clientIp(req.headers));
+        const byEmail = email ? await rateLimit("signin:email", email) : null;
+        const limited = !byIp.allowed ? byIp : byEmail && !byEmail.allowed ? byEmail : null;
+        if (limited) {
+            const canSignUp = (await policy()).allowed;
+            return tooMany(limited, json, (error) => signInPage({ next, error, email, canSignUp }));
+        }
         const row = email && password ? await findUser(email) : null;
         const ok = row ? await verifyPassword(password, row.password_hash) : false;
         if (!row || !ok) {
             if (json)
                 return NextResponse.json({ error: "Wrong email or password" }, { status: 401 });
-            return backTo(req, SIGN_IN_PATH, "1", next);
+            return backTo(req, SIGN_IN_PATH(), "1", next);
         }
+        if (!mayAccess(row.verified_at !== null, options().requireVerified))
+            return checkYourEmail(req, next, json);
+        // A row hashed under older, weaker parameters gets upgraded now that we hold the password
+        if (needsRehash(row.password_hash))
+            await rehashPassword(row.id, await hashPassword(password));
         return signedIn(req, { id: row.id, email: row.email, epoch: row.epoch }, next, json);
     }
     if (route === "sign-up") {
         const { email, password, invite, next, json } = await readBody(req);
         const p = await policy();
-        const fail = (msg, status = 400) => json ? NextResponse.json({ error: msg }, { status }) : backTo(req, SIGN_UP_PATH, msg, next);
+        const fail = (msg, status = 400) => json ? NextResponse.json({ error: msg }, { status }) : backTo(req, SIGN_UP_PATH(), msg, next);
         if (!p.allowed)
             return NextResponse.json({ error: "Sign-up is closed" }, { status: 404 });
-        if (p.inviteRequired && invite !== process.env.AUTH_INVITE_CODE)
+        const byIp = await rateLimit("signup:ip", clientIp(req.headers));
+        if (!byIp.allowed)
+            return tooMany(byIp, json, (error) => signUpPage({ next, error, inviteRequired: p.inviteRequired, first: p.reason === "first" }));
+        const o = options();
+        if (p.inviteRequired && !safeEqual(invite, o.inviteCode ?? ""))
             return fail("Wrong invite code.", 403);
-        const invalid = validateCredentials(email, password, process.env);
+        const invalid = validateCredentials(email, password, o);
         if (invalid)
             return fail(invalid);
         if (await findUser(email))
             return fail("That email is already registered.", 409);
-        const user = await createUser(email, await hashPassword(password));
+        let user;
+        try {
+            user = await createUser(email, await hashPassword(password));
+        }
+        catch (err) {
+            // Two sign-ups for one email at the same instant: the check above passed for both, the database let one in
+            if (err instanceof DuplicateUserError)
+                return fail("That email is already registered.", 409);
+            throw err;
+        }
+        const required = o.requireVerified;
+        try {
+            await sendVerification(req, user, next);
+        }
+        catch (err) {
+            // The account exists either way. Only when verification gates
+            // access is a lost email a failure the user must hear about.
+            console.error("[auth] could not send the verification email:", err instanceof Error ? err.message : err);
+            if (required)
+                return fail("Could not send the verification email. Try again later.", 500);
+        }
+        if (required)
+            return checkYourEmail(req, next, json, user);
         return signedIn(req, user, next, json);
     }
+    if (route === "forgot") {
+        const { email, json } = await readBody(req);
+        if (email) {
+            const d = await rateLimit("forgot:email", email);
+            if (!d.allowed)
+                return tooMany(d, json, (error) => forgotPage({ error }));
+        }
+        const row = email ? await findUser(email) : null;
+        if (row) {
+            const raw = await issueToken(row.id, "reset", RESET_TTL_SECONDS);
+            await sendEmail(resetEmail(row.email, resetLink(req.url, raw), siteName(req))).catch((err) => console.error("[auth] could not send the reset email:", err instanceof Error ? err.message : err));
+        }
+        // Same answer whether or not the address exists
+        if (json)
+            return NextResponse.json({ ok: true, message: FORGOT_SENT });
+        const url = new URL(FORGOT_PATH, req.url);
+        url.searchParams.set("sent", "1");
+        return NextResponse.redirect(url, 303);
+    }
+    if (route === "reset" || route === "invite") {
+        // One flow, two kinds of token: a reset link (1 h) or an invitation (7 days).
+        // Either way: consume, set the password (marks verified, ends old sessions), sign in.
+        const invite = route === "invite";
+        const { token, password, next, json } = await readBody(req);
+        const fail = (msg, status = 400) => json ? NextResponse.json({ error: msg }, { status }) : html(resetPage({ token, invite, error: msg }), status);
+        // Validate before consuming, so a weak password does not burn the link
+        const invalid = validatePassword(password);
+        if (invalid)
+            return fail(invalid);
+        const consumed = await consumeToken(token, invite ? "invite" : "reset");
+        const user = consumed ? await setPasswordById(consumed.userId, await hashPassword(password)) : null;
+        if (!user)
+            return fail(invite ? INVITE_LINK_INVALID : RESET_LINK_INVALID);
+        return signedIn(req, user, next, json);
+    }
+    if (route === "verify/resend") {
+        const { email, next, json } = await readBody(req);
+        if (email) {
+            const d = await rateLimit("verify:email", email);
+            if (!d.allowed)
+                return tooMany(d, json, (error) => signInPage({ next, error, email, resend: true }));
+        }
+        const row = email ? await findUser(email) : null;
+        if (row && row.verified_at === null) {
+            await sendVerification(req, { id: row.id, email: row.email }, next).catch((err) => console.error("[auth] could not resend the verification email:", err instanceof Error ? err.message : err));
+        }
+        // Same answer whether or not the address exists
+        return json ? NextResponse.json({ ok: true }) : checkYourEmail(req, next, false);
+    }
     return NextResponse.json({ error: "Not found" }, { status: 404 });
 }