@binary1702/auth 0.3.0 → 0.4.0

package/dist/next/index.js

@@ -9,16 +9,23 @@
 //   POST /auth/sign-in          verify, set cookie, redirect to ?next or /
 //   GET  /auth/sign-up          the sign-up page (see core/signup.ts for when)
 //   POST /auth/sign-up          create user, email a verify link, set cookie, redirect
-//   GET  /auth/sign-out         clear cookie, redirect to sign-in
-//   POST /auth/sign-out         same (for fetch callers)
+//   GET  /auth/sign-out         clear cookie, redirect to ?next (same origin) or the sign-in page
+//   POST /auth/sign-out         same (JSON for fetch callers)
 //   GET  /auth/session          the session contract (core/org.ts), or 401
 //   POST /auth/session          switch the active organization { organization: id }
+//   GET  /auth/policy           { signup, pages, name } for an app's own sign-in / sign-up page
+//
+// With `pages:` in b17_auth.yaml the app serves sign-in / sign-up itself:
+// GET /auth/sign-in and /auth/sign-up redirect there (core/pages.ts),
+// every redirect above lands there, and the POSTs stay the protocol.
 //   GET  /auth/verify?token=    consume the link, mark the email verified
 //   POST /auth/verify/resend    email a fresh link (body: email)
 //   GET  /auth/forgot           "send me a reset link" form
 //   POST /auth/forgot           email a reset link if the address exists; same answer either way
 //   GET  /auth/reset?token=     "choose a new password" form
 //   POST /auth/reset            consume the token, set the password, sign in
+//   GET  /auth/invite?token=    the welcome form an added user gets (choose a password)
+//   POST /auth/invite           consume the invite token, set the password (verified), sign in
 //
 // Use anywhere on the server:
 //   const session = await getSession()         // { user, organization, authorization } or null
@@ -31,23 +38,25 @@
 import { cookies } from "next/headers.js";
 import { NextResponse } from "next/server.js";
 import { randomBytes } from "node:crypto";
-import { COOKIE_NAME, SIGN_IN_PATH, SIGN_UP_PATH, cookieName, getSecret } from "../core/config.js";
+import { COOKIE_NAME, cookieName, getSecret } from "../core/config.js";
 import { options } from "../core/options.js";
+import { landing, movedTo, pageOverride, pagePath } from "../core/pages.js";
 import { isCurrent, signSession, verifySession } from "../core/session.js";
 import { hashPassword, needsRehash, verifyPassword } from "../core/password.js";
-import { addMember, adminOrgs, adminUsers, countUsers, createOrg, createUser, db, DuplicateUserError, rehashPassword, findOrg, findUser, markVerified, removeMember, removeOrg, removeUser, revokeSessions, sessionRow, setActiveOrg, setPassword, setPasswordById, } from "../core/db.js";
-import { forgotPage, messagePage, resendForm, resetPage, securityHeaders, setSiteName, signInPage, signUpPage } from "../core/html.js";
+import { addMember, adminOrgs, adminUsers, countUsers, createOrg, createUser, db, DuplicateUserError, rehashPassword, findOrg, findUser, markVerified, memberRole, removeMember, removeOrg, removeUser, resetRole, seedRoles, revokeSessions, sessionRow, setActiveOrg, setPassword, setPasswordById, setRolePermissions, storedRoles, } from "../core/db.js";
+import { forgotPage, messagePage, resendForm, resetPage, securityHeaders, setPages, setSiteName, signInPage, signUpPage } from "../core/html.js";
 import { adminPage } from "../core/admin-html.js";
-import { ADMIN_PATH, backTo as adminBackTo, isAdmin, isOrgAction, isUserAction, refusedOnSelf, roleChoices } from "../core/admin.js";
+import { ADMIN_PATH, ROLE_NAME, backTo as adminBackTo, grantedFromFields, isAdmin, isOrgAction, isRoleAction, isUserAction, mayEditRoles, refusedOnSelf, roleChoices } from "../core/admin.js";
 import { emailTransport } from "../core/email.js";
 import { clientIp, rateLimit, retryMessage } from "../core/rate.js";
-import { signupPolicy, validateCredentials, validatePassword } from "../core/signup.js";
+import { signupPolicy, validateCredentials, validateEmail, validatePassword } from "../core/signup.js";
+import { INVITE_LINK_INVALID, INVITE_TTL_SECONDS, inviteEmail, inviteLink } from "../core/invite.js";
 import { isSameOrigin, safeEqual, safeNext } from "../core/guard.js";
 import { consumeToken, issueToken } from "../core/tokens.js";
 import { sendEmail } from "../core/email.js";
 import { VERIFY_TTL_SECONDS, mayAccess, verifyEmail, verifyLink } from "../core/verify.js";
 import { FORGOT_PATH, FORGOT_SENT, RESET_LINK_INVALID, RESET_TTL_SECONDS, resetEmail, resetLink } from "../core/reset.js";
-import { buildSession, hasPermission } from "../core/org.js";
+import { OWNER, buildSession, hasPermission } from "../core/org.js";
 export class AuthError extends Error {
     status;
     constructor(message = "Unauthorized", status = 401) {
@@ -69,12 +78,26 @@ async function sessionFromToken(token) {
     const claim = await verifySession(token, getSecret());
     if (!claim)
         return null;
+    await seeded();
     const row = await sessionRow(claim.id);
     const o = options();
     if (!row || !isCurrent(claim, row.epoch) || !mayAccess(row.verified, o.requireVerified))
         return null;
     return buildSession(row, o);
 }
+/**
+ * The starting point for roles, written once per process (and then once
+ * per database: INSERT … DO NOTHING). The CLI does the same at install;
+ * this covers a database the CLI never saw, such as production's.
+ */
+let seeding = null;
+function seeded() {
+    seeding ??= seedRoles(options().roles).catch((err) => {
+        seeding = null; // retry on the next request
+        throw err;
+    });
+    return seeding;
+}
 async function cookieToken() {
     return pickCookie(async (name) => (await cookies()).get(name)?.value);
 }
@@ -115,6 +138,9 @@ export function unauthorized(err) {
     const status = err instanceof AuthError ? err.status : 401;
     return NextResponse.json({ error: status === 403 ? "Forbidden" : "Unauthorized" }, { status });
 }
+/** The sign-in / sign-up pages: the app's own when b17_auth.yaml names them (core/pages.ts) */
+const SIGN_IN_PATH = () => pagePath(options().pages, "signIn");
+const SIGN_UP_PATH = () => pagePath(options().pages, "signUp");
 const cookieOptions = () => ({
     httpOnly: true,
     sameSite: "lax",
@@ -146,7 +172,8 @@ async function readBody(req) {
         invite: get(b, "invite").trim(),
         token: get(b, "token").trim(),
         organization: get(b, "organization").trim(),
-        next: safeNext(get(b, "next"), req.url),
+        // Same-origin only; nothing (or the root) means the app's home
+        next: landing(safeNext(get(b, "next"), req.url), options().home),
         json: type.includes("application/json"),
     };
 }
@@ -174,7 +201,8 @@ async function currentUser(req) {
 /** Sign the user in on a response: cookie + redirect (form) or JSON (fetch). */
 async function signedIn(req, user, next, json) {
     const token = await signSession(user, getSecret(), options().sessionDays);
-    const body = { user: { id: user.id, email: user.email } };
+    // `next` is already reduced to a same-origin path: a fetch caller can follow it as is
+    const body = { user: { id: user.id, email: user.email }, next };
     const res = json ? NextResponse.json(body) : NextResponse.redirect(new URL(next, req.url), 303);
     res.cookies.set(cookieName(options().production), token, cookieOptions());
     return res;
@@ -191,7 +219,7 @@ function backTo(req, path, error, next) {
 function checkYourEmail(req, next, json, user) {
     if (json)
         return NextResponse.json({ user: user ?? null, verify: true }, { status: user ? 200 : 403 });
-    const url = new URL(SIGN_IN_PATH, req.url);
+    const url = new URL(SIGN_IN_PATH(), req.url);
     url.searchParams.set("verify", "1");
     if (next !== "/")
         url.searchParams.set("next", next);
@@ -204,10 +232,12 @@ function tooMany(d, json, page) {
     res.headers.set("retry-after", String(d.retryAfter));
     return res;
 }
-function signOutResponse(req, json) {
+/** Clear the cookie, then land on `next` (same origin; the app's public front, say) or the sign-in page */
+function signOutResponse(req, json, next) {
+    const to = next ? safeNext(next, req.url) : SIGN_IN_PATH();
     const res = json
         ? NextResponse.json({ ok: true })
-        : NextResponse.redirect(new URL(SIGN_IN_PATH, req.url), 303);
+        : NextResponse.redirect(new URL(to === "/" && !next ? SIGN_IN_PATH() : to, req.url), 303);
     // Clear both names: the current one and the pre-0.3.0 one a browser may still hold
     res.cookies.set(cookieName(options().production), "", { ...cookieOptions(), maxAge: 0 });
     res.cookies.set(COOKIE_NAME, "", { ...cookieOptions(), maxAge: 0 });
@@ -216,32 +246,65 @@ function signOutResponse(req, json) {
 async function policy() {
     return signupPolicy(options().signup, await countUsers());
 }
-/** Issue a verify token and email the link. Throws if the email cannot be sent. */
+/** Issue a verify token and email the link. Throws if the email cannot be sent. Returns the link, for the admin page to show. */
 async function sendVerification(req, user, next) {
     const raw = await issueToken(user.id, "verify", VERIFY_TTL_SECONDS, { next });
-    await sendEmail(verifyEmail(user.email, verifyLink(req.url, raw, next), siteName(req)));
+    const link = verifyLink(req.url, raw, next);
+    await sendEmail(verifyEmail(user.email, link, siteName(req)));
+    return link;
+}
+/** Issue an invite token and email the welcome link: choose a password, verified, signed in. Throws if the email cannot be sent. Returns the link, for the admin page to show. */
+async function sendInvite(req, user) {
+    const raw = await issueToken(user.id, "invite", INVITE_TTL_SECONDS);
+    const link = inviteLink(req.url, raw);
+    await sendEmail(inviteEmail(user.email, link, siteName(req)));
+    return link;
 }
-/** For subjects and titles: `name` from b17_auth.yaml, else the host serving the request */
+/**
+ * What to tell the admin after an email went out, honestly: in development
+ * without a transport, nothing was sent. The link itself comes along either
+ * way, so the admin can hand it over directly (it still works once).
+ */
+function emailOutcome(what, email, link) {
+    const o = options();
+    const transport = emailTransport({ ...o.email, production: o.production });
+    if (transport === "console") {
+        return { ok: false, message: `Nothing was sent: email is not set up (add email: to b17_auth.yaml). The ${what} link for ${email} is below; it works once.`, link };
+    }
+    return { ok: true, message: `${what[0].toUpperCase()}${what.slice(1)} link emailed to ${email} via ${transport}. The same link, in case it does not arrive:`, link };
+}
+/** For subjects and titles: `name` from b17_auth.yaml, else the host serving the request. Also tells the pages where sign-in / sign-up live. */
 function siteName(req) {
-    const name = options().name;
-    setSiteName(name);
-    return name || new URL(req.url).host;
+    const o = options();
+    setSiteName(o.name);
+    setPages(o.pages);
+    return o.name || new URL(req.url).host;
+}
+/** GET /auth/sign-in or /auth/sign-up when the app serves that page itself: same query, the app's path */
+function movedPage(req, key) {
+    const custom = pageOverride(options().pages, key);
+    return custom ? NextResponse.redirect(new URL(movedTo(custom, req.nextUrl.search), req.url)) : null;
 }
 // ── admin ─────────────────────────────────────────────────────
-async function renderAdmin(self, nonce, view, notice, error) {
+async function renderAdmin(self, nonce, view, limited, notice, error, link) {
     const o = options();
-    const [users, orgs, [tokens]] = await Promise.all([
+    await seeded();
+    const [users, orgs, stored, [tokens]] = await Promise.all([
         adminUsers(),
         adminOrgs(),
+        storedRoles(),
         db().query(`SELECT COUNT(*)::int AS total, COUNT(*) FILTER (WHERE used_at IS NULL AND expires_at > now())::int AS live FROM tokens`),
     ]);
-    const inUse = orgs.flatMap((org) => org.members.map((m) => m.role));
+    const inUse = [...orgs.flatMap((org) => org.members.map((m) => m.role)), ...stored.map((s) => s.name)];
     return adminPage({
         self,
         view,
         users,
         orgs,
-        roles: roleChoices(Object.keys(o.permissions), inUse),
+        stored,
+        roles: roleChoices(Object.keys(o.roles), inUse),
+        limited,
+        link,
         options: o,
         transport: emailTransport({ ...o.email, production: o.production }),
         tokens: tokens ?? { total: 0, live: 0 },
@@ -251,13 +314,22 @@ async function renderAdmin(self, nonce, view, notice, error) {
     });
 }
 /** Back to the admin page with a one-line result */
-function adminResult(req, kind, message, back) {
+function adminResult(req, kind, message, back, link) {
     const url = new URL(`${ADMIN_PATH}${back ? `?${back}` : ""}`, req.url);
     url.searchParams.set(kind, message);
+    if (link)
+        url.searchParams.set("link", link);
     return NextResponse.redirect(url, 303);
 }
+/** A link the admin page may show: one of this site's own /auth/ links, nothing else (the query is not trusted). */
+function shownLink(req, value) {
+    if (!value)
+        return undefined;
+    const path = safeNext(value, req.url);
+    return path.startsWith("/auth/") ? new URL(path, req.url).toString() : undefined;
+}
 /** The admin POSTs: what the CLI does, from a form. Returns a notice or an error message. */
-async function adminAction(route, self, f, sendVerify) {
+async function adminAction(route, self, f, sendVerify, invite) {
     const ok = (message) => ({ ok: true, message });
     const fail = (message) => ({ ok: false, message });
     const email = f.email.trim().toLowerCase();
@@ -269,24 +341,53 @@ async function adminAction(route, self, f, sendVerify) {
         if (refused)
             return fail(refused);
         if (action === "add") {
-            const invalid = validateCredentials(email, f.password, options());
+            // Two flows, named by the button. Register: email + password, the account is
+            // ready and verified (the admin vouches for it). Invite: email only; the account
+            // gets a password nobody knows, and the person gets one link to choose theirs,
+            // which also verifies the address. A JSON caller without `mode` is read from the
+            // password: present means register.
+            const byInvite = f.mode ? f.mode === "invite" : !f.password;
+            if (!byInvite && !f.password)
+                return fail("Register needs a password. To send a link instead, use Invite.");
+            const invalid = byInvite ? validateEmail(email, options()) : validateCredentials(email, f.password, options());
             if (invalid)
                 return fail(invalid);
             if (await findUser(email))
                 return fail("That email is already registered.");
+            let created;
             try {
-                await createUser(email, await hashPassword(f.password), { verified: true });
+                created = await createUser(email, await hashPassword(byInvite ? randomBytes(32).toString("base64url") : f.password), { verified: !byInvite });
             }
             catch (err) {
                 if (err instanceof DuplicateUserError)
                     return fail("That email is already registered.");
                 throw err;
             }
-            return ok(`Added ${email}.`);
+            if (!byInvite)
+                return ok(`Registered ${email}: ready and verified.`);
+            let link;
+            try {
+                link = await invite({ id: created.id, email: created.email });
+            }
+            catch (err) {
+                return fail(`Invited ${email}, but could not send the link: ${err instanceof Error ? err.message : String(err)}. Use "invite" to try again.`);
+            }
+            const outcome = emailOutcome("invitation", email, link);
+            return { ...outcome, message: `Invited ${email}. ${outcome.message}` };
         }
         const user = await findUser(email);
         if (!user)
             return fail(`No user ${email}.`);
+        if (action === "invite") {
+            let link;
+            try {
+                link = await invite({ id: user.id, email: user.email });
+            }
+            catch (err) {
+                return fail(`Could not send: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            return emailOutcome("invitation", email, link);
+        }
         if (action === "set-password") {
             const invalid = validatePassword(f.password);
             if (invalid)
@@ -305,13 +406,15 @@ async function adminAction(route, self, f, sendVerify) {
         if (action === "send-verify") {
             if (user.verified_at)
                 return fail(`${email} is already verified.`);
+            let link;
             try {
-                await sendVerify({ id: user.id, email: user.email });
+                link = await sendVerify({ id: user.id, email: user.email });
             }
             catch (err) {
                 return fail(`Could not send: ${err instanceof Error ? err.message : String(err)}`);
             }
-            return ok(`Verification email sent to ${email}.`);
+            // Without a transport, development prints the email to the terminal: say so instead of claiming a send
+            return emailOutcome("verification", email, link);
         }
         await removeUser(email);
         return ok(`Removed ${email}.`);
@@ -343,13 +446,69 @@ async function adminAction(route, self, f, sendVerify) {
             return (await removeMember(org.id, user.id)) ? ok(`${email} removed from ${org.name}.`) : fail(`${email} is not a member of ${org.name}.`);
         }
         const role = f.role.trim();
-        if (!/^[a-z0-9_-]{1,32}$/i.test(role))
+        if (!ROLE_NAME.test(role))
             return fail("A role is one word: letters, digits, - or _.");
         await addMember(org.id, user.id, role); // add-member and set-role are the same upsert
         return ok(`${email} is ${role} in ${org.name}.`);
     }
+    if (route === "admin/roles") {
+        const action = f.action;
+        if (!isRoleAction(action))
+            return fail("Unknown action.");
+        const role = f.role.trim();
+        if (!ROLE_NAME.test(role))
+            return fail("A role is one word: letters, digits, - or _.");
+        if (role === OWNER)
+            return fail("The owner role always holds everything.");
+        // scope: "" = every organization; an organization's id = that one only
+        const scope = roleScope(f);
+        if (scope && !(await findOrg(scope)))
+            return fail("No such organization.");
+        if (action === "follow") {
+            if (!scope)
+                return fail("Only an organization's own rule can be dropped.");
+            return (await resetRole(scope, role)) ? ok(`${role} follows Roles again here.`) : fail(`${role} had no rule of its own here.`);
+        }
+        if (action === "defaults") {
+            if (scope)
+                return fail("Defaults apply to Roles, not to one organization.");
+            const defaults = options().roles[role];
+            if (!defaults)
+                return fail(`${role} has no default in b17_auth.yaml.`);
+            await setRolePermissions("", role, defaults);
+            return ok(`${role} is back to its default: ${defaults.join(", ") || "nothing"}.`);
+        }
+        const catalogue = Object.keys(options().permissions);
+        if (!catalogue.length)
+            return fail("Declare permissions in b17_auth.yaml first.");
+        // Only ids the app declares can be granted, whatever the form says
+        const granted = grantedFromFields(f, catalogue);
+        await setRolePermissions(scope, role, granted);
+        return ok(`${role} may now${scope ? " here" : ""}: ${granted.length ? granted.join(", ") : "nothing"}.`);
+    }
     return fail("Unknown action.");
 }
+/** The organization a roles form is about, or "" for every organization. Never taken from the form as is. */
+function roleScope(f) {
+    const scope = f.scope || f.org || "";
+    return /^[0-9a-f-]{36}$/i.test(scope) ? scope : "";
+}
+/**
+ * Who may run an admin POST. A system admin: anything. An organization's
+ * owner: its roles grid and its members (never the organization's removal,
+ * nothing about users or other organizations).
+ */
+async function mayPost(session, route, f) {
+    const admin = isAdmin(session, options().admins);
+    if (admin)
+        return true;
+    const orgId = route === "admin/roles" ? roleScope(f) : route === "admin/orgs" ? (/^[0-9a-f-]{36}$/i.test(f.org) ? f.org : "") : "";
+    if (!orgId)
+        return false;
+    if (route === "admin/orgs" && !["add-member", "set-role", "remove-member"].includes(f.action))
+        return false;
+    return mayEditRoles(false, orgId, await memberRole(session.user.id, orgId));
+}
 // ── handlers ──────────────────────────────────────────────────
 export async function GET(req, ctx) {
     const { path } = await ctx.params;
@@ -359,11 +518,15 @@ export async function GET(req, ctx) {
     siteName(req); // so <title> carries the app name on every page below
     if (route === "sign-in") {
         if (await currentUser(req))
-            return NextResponse.redirect(new URL(next, req.url));
+            return NextResponse.redirect(new URL(landing(next, options().home), req.url));
+        // The app draws this page itself: hand over, query and all
+        const moved = movedPage(req, "signIn");
+        if (moved)
+            return moved;
         const p = await policy();
         // A fresh install has nobody to sign in: go straight to creating the first account.
         if (p.reason === "first")
-            return NextResponse.redirect(new URL(SIGN_UP_PATH, req.url));
+            return NextResponse.redirect(new URL(SIGN_UP_PATH(), req.url));
         const error = q.get("error") === "1" ? "Wrong email or password." : (q.get("error") ?? undefined);
         const verify = q.get("verify") === "1";
         const notice = verify
@@ -375,28 +538,45 @@ export async function GET(req, ctx) {
     }
     if (route === "sign-up") {
         if (await currentUser(req))
-            return NextResponse.redirect(new URL(next, req.url));
+            return NextResponse.redirect(new URL(landing(next, options().home), req.url));
+        const moved = movedPage(req, "signUp");
+        if (moved)
+            return moved;
         const p = await policy();
         if (!p.allowed)
             return NextResponse.json({ error: "Sign-up is closed" }, { status: 404 });
         return html(signUpPage({ next, error: q.get("error") ?? undefined, inviteRequired: p.inviteRequired, first: p.reason === "first" }));
     }
     if (route === "sign-out")
-        return signOutResponse(req, false);
+        return signOutResponse(req, false, q.get("next"));
     if (route === "session")
         return sessionJson(await currentSession(req));
+    if (route === "policy") {
+        // What an app's own sign-in / sign-up page needs before it renders. Public, never cached.
+        const o = options();
+        const res = NextResponse.json({ signup: await policy(), pages: { signIn: SIGN_IN_PATH(), signUp: SIGN_UP_PATH() }, home: landing(null, o.home), name: o.name });
+        res.headers.set("cache-control", "no-store");
+        return res;
+    }
     if (route === "admin") {
         const session = await currentSession(req);
         if (!session)
-            return NextResponse.redirect(new URL(`${SIGN_IN_PATH}?next=${encodeURIComponent(ADMIN_PATH)}`, req.url));
-        if (!isAdmin(session, options().admins)) {
-            return html(messagePage({ title: "Not an admin", message: `Add ${session.user.email} under admins: in b17_auth.yaml to open this page.`, link: { href: "/", text: "Back" } }), 403);
-        }
+            return NextResponse.redirect(new URL(`${SIGN_IN_PATH()}?next=${encodeURIComponent(ADMIN_PATH)}`, req.url));
         const nonce = randomBytes(16).toString("base64");
         const orgId = q.get("org");
         const tab = q.get("tab");
-        const view = orgId ? { tab: "org", orgId } : tab === "users" || tab === "settings" ? { tab } : { tab: "orgs" };
-        return html(await renderAdmin(session.user.email, nonce, view, q.get("notice") ?? undefined, q.get("error") ?? undefined), 200, securityHeaders(nonce));
+        const admin = isAdmin(session, options().admins);
+        if (!admin) {
+            // An organization's owner manages that organization: its roles and members, nothing else
+            const own = orgId && /^[0-9a-f-]{36}$/i.test(orgId) ? await memberRole(session.user.id, orgId) : null;
+            if (!orgId || !mayEditRoles(false, orgId, own)) {
+                const back = landing(null, options().home);
+                return html(messagePage({ title: "Not an admin", message: `This page is for emails under admins: in b17_auth.yaml, or an organization's owner (open your organization from the app).`, link: { href: back, text: "Back" } }), 403);
+            }
+            return html(await renderAdmin(session.user.email, nonce, { tab: "org", orgId }, true, q.get("notice") ?? undefined, q.get("error") ?? undefined, shownLink(req, q.get("link"))), 200, securityHeaders(nonce));
+        }
+        const view = orgId ? { tab: "org", orgId } : tab === "users" || tab === "settings" || tab === "roles" ? { tab } : { tab: "orgs" };
+        return html(await renderAdmin(session.user.email, nonce, view, false, q.get("notice") ?? undefined, q.get("error") ?? undefined, shownLink(req, q.get("link"))), 200, securityHeaders(nonce));
     }
     if (route === "forgot") {
         return html(forgotPage({ sent: q.get("sent") === "1", message: FORGOT_SENT, error: q.get("error") ?? undefined }));
@@ -409,6 +589,13 @@ export async function GET(req, ctx) {
             return html(messagePage({ title: "Link expired", message: RESET_LINK_INVALID, link: { href: FORGOT_PATH, text: "Request a new link" } }), 400);
         return html(resetPage({ token, error: q.get("error") ?? undefined }));
     }
+    if (route === "invite") {
+        // The welcome link an added user gets: same rule, the form consumes nothing
+        const token = q.get("token") ?? "";
+        if (!token)
+            return html(messagePage({ title: "Link expired", message: INVITE_LINK_INVALID, link: { href: SIGN_IN_PATH(), text: "Sign in" } }), 400);
+        return html(resetPage({ token, invite: true, error: q.get("error") ?? undefined }));
+    }
     if (route === "verify") {
         const token = await consumeToken(q.get("token") ?? "", "verify");
         const user = token ? await markVerified(token.userId) : null;
@@ -423,7 +610,7 @@ export async function GET(req, ctx) {
         // Signed in already (sign-up set the cookie)? Carry on. Otherwise sign in.
         if (await currentUser(req))
             return NextResponse.redirect(new URL(dest, req.url), 303);
-        const url = new URL(SIGN_IN_PATH, req.url);
+        const url = new URL(SIGN_IN_PATH(), req.url);
         url.searchParams.set("verified", "1");
         if (dest !== "/")
             url.searchParams.set("next", dest);
@@ -440,18 +627,22 @@ export async function POST(req, ctx) {
     if (!isSameOrigin(req.headers)) {
         return NextResponse.json({ error: "Cross-site request refused" }, { status: 403 });
     }
-    if (route === "sign-out")
-        return signOutResponse(req, true);
-    if (route === "admin/users" || route === "admin/orgs") {
+    if (route === "sign-out") {
+        const { json } = await readBody(req);
+        return signOutResponse(req, json, req.nextUrl.searchParams.get("next"));
+    }
+    if (route === "admin/users" || route === "admin/orgs" || route === "admin/roles") {
         const session = await currentSession(req);
-        if (!session || !isAdmin(session, options().admins)) {
-            return NextResponse.json({ error: session ? "Forbidden" : "Unauthorized" }, { status: session ? 403 : 401 });
-        }
+        if (!session)
+            return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
         const f = await readFields(req);
-        const result = await adminAction(route, session.user.email, f, (user) => sendVerification(req, user, "/"));
+        // Checked on the server, per organization: the form's claims mean nothing
+        if (!(await mayPost(session, route, f)))
+            return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+        const result = await adminAction(route, session.user.email, f, (user) => sendVerification(req, user, "/"), (user) => sendInvite(req, user));
         // After removing an organization there is nothing to return to; otherwise, the view the form was on
         const back = f.action === "remove-org" ? "" : adminBackTo(f);
-        return adminResult(req, result.ok ? "notice" : "error", result.message, back);
+        return adminResult(req, result.ok ? "notice" : "error", result.message, back, result.link);
     }
     if (route === "session") {
         // Switch the active organization. The id is the client's wish; the
@@ -480,7 +671,7 @@ export async function POST(req, ctx) {
         if (!row || !ok) {
             if (json)
                 return NextResponse.json({ error: "Wrong email or password" }, { status: 401 });
-            return backTo(req, SIGN_IN_PATH, "1", next);
+            return backTo(req, SIGN_IN_PATH(), "1", next);
         }
         if (!mayAccess(row.verified_at !== null, options().requireVerified))
             return checkYourEmail(req, next, json);
@@ -492,7 +683,7 @@ export async function POST(req, ctx) {
     if (route === "sign-up") {
         const { email, password, invite, next, json } = await readBody(req);
         const p = await policy();
-        const fail = (msg, status = 400) => json ? NextResponse.json({ error: msg }, { status }) : backTo(req, SIGN_UP_PATH, msg, next);
+        const fail = (msg, status = 400) => json ? NextResponse.json({ error: msg }, { status }) : backTo(req, SIGN_UP_PATH(), msg, next);
         if (!p.allowed)
             return NextResponse.json({ error: "Sign-up is closed" }, { status: 404 });
         const byIp = await rateLimit("signup:ip", clientIp(req.headers));
@@ -550,17 +741,20 @@ export async function POST(req, ctx) {
         url.searchParams.set("sent", "1");
         return NextResponse.redirect(url, 303);
     }
-    if (route === "reset") {
+    if (route === "reset" || route === "invite") {
+        // One flow, two kinds of token: a reset link (1 h) or an invitation (7 days).
+        // Either way: consume, set the password (marks verified, ends old sessions), sign in.
+        const invite = route === "invite";
         const { token, password, next, json } = await readBody(req);
-        const fail = (msg, status = 400) => json ? NextResponse.json({ error: msg }, { status }) : html(resetPage({ token, error: msg }), status);
+        const fail = (msg, status = 400) => json ? NextResponse.json({ error: msg }, { status }) : html(resetPage({ token, invite, error: msg }), status);
         // Validate before consuming, so a weak password does not burn the link
         const invalid = validatePassword(password);
         if (invalid)
             return fail(invalid);
-        const consumed = await consumeToken(token, "reset");
+        const consumed = await consumeToken(token, invite ? "invite" : "reset");
         const user = consumed ? await setPasswordById(consumed.userId, await hashPassword(password)) : null;
         if (!user)
-            return fail(RESET_LINK_INVALID);
+            return fail(invite ? INVITE_LINK_INVALID : RESET_LINK_INVALID);
         return signedIn(req, user, next, json);
     }
     if (route === "verify/resend") {

package/dist/next/proxy.js

@@ -2,10 +2,13 @@
 // Proxy (Next 16) / middleware (Next 15). Runs before every route.
 //
 // Verifies the cookie signature only. No database, no network.
-//   no/invalid cookie + page request  → 302 to /auth/sign-in?next=<path>
+//   no/invalid cookie + page request  → 302 to the sign-in page?next=<path>
 //   no/invalid cookie + /api request  → 401 JSON
 //   valid cookie                      → continue
 //
+// The sign-in page is /auth/sign-in, or the app's own page when
+// b17_auth.yaml names one under `pages:` (core/pages.ts).
+//
 // A cheap first gate, not the last one: a revoked session (deleted
 // user, changed password) still has a valid signature and passes here.
 // getUser()/requireUser() check the database and refuse it, so no data
@@ -17,26 +20,31 @@
 // makes every other decision, so the rule lives in one tested place.
 // ─────────────────────────────────────────────────────────────
 import { NextResponse } from "next/server.js";
-import { COOKIE_NAME, SIGN_IN_PATH, cookieName, getSecret } from "../core/config.js";
+import { COOKIE_NAME, cookieName, getSecret } from "../core/config.js";
 import { verifySession } from "../core/session.js";
 import { MATCHER, isPublic } from "../core/guard.js";
 import { options } from "../core/options.js";
+import { appPages, pagePath, sendsHome } from "../core/pages.js";
 /** Paste this into proxy.ts as `export const config = { matcher: MATCHER }` */
 export { MATCHER };
 export async function proxy(request) {
     const { pathname, search } = request.nextUrl;
     // `protected:` or `public:` from b17_auth.yaml, on top of the built-in rules (auth pages, Next internals)
     const o = options();
-    if (isPublic(pathname, { public: o.public, protected: o.protected }))
-        return NextResponse.next();
     // The current cookie name, then the pre-0.3.0 one: upgrading signs nobody out
     const token = request.cookies.get(cookieName(o.production))?.value ?? request.cookies.get(COOKIE_NAME)?.value;
-    if (token && (await verifySession(token, getSecret())))
+    const signedIn = async () => !!token && !!(await verifySession(token, getSecret()));
+    // With `home:` set, the root is the public site and the app lives elsewhere: a signed-in visitor goes there
+    if (sendsHome(pathname, o.home) && (await signedIn()))
+        return NextResponse.redirect(new URL(o.home, request.url));
+    if (isPublic(pathname, { public: o.public, protected: o.protected, pages: appPages(o.pages) }))
+        return NextResponse.next();
+    if (await signedIn())
         return NextResponse.next();
     if (pathname.startsWith("/api/")) {
         return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     }
-    const url = new URL(SIGN_IN_PATH, request.url);
+    const url = new URL(pagePath(o.pages, "signIn"), request.url);
     if (pathname !== "/")
         url.searchParams.set("next", pathname + search);
     return NextResponse.redirect(url);