@byline/admin 6.7.2 → 6.8.0

package/dist/modules/admin-account/components/change-password.js

@@ -182,7 +182,7 @@ function ChangeAccountPassword({ account, onClose, onSuccess }) {
                     children: [
                         /*#__PURE__*/ jsx(Button, {
                             type: "button",
-                            intent: "secondary",
+                            intent: "noeffect",
                             size: "sm",
                             onClick: onClose,
                             className: clsx('byline-account-change-password-action', change_password_module.action),

package/dist/modules/admin-account/components/container.js

@@ -5,6 +5,7 @@ import { LocalDateTime } from "@byline/admin/react";
 import { useTranslation } from "@byline/i18n/react";
 import { CloseIcon, Drawer, EditIcon, IconButton } from "@byline/ui/react";
 import clsx from "clsx";
+import { PasskeyManager } from "../../auth/components/passkey-manager.js";
 import { ChangeAccountPassword } from "./change-password.js";
 import container_module from "./container.module.js";
 import { Preferences } from "./preferences.js";
@@ -208,6 +209,19 @@ function AccountSelfContainer({ account }) {
                                     /*#__PURE__*/ jsx("p", {
                                         className: clsx('muted', 'byline-account-status-help', container_module["status-help"]),
                                         children: t('account.preferences.help')
+                                    }),
+                                    /*#__PURE__*/ jsxs("div", {
+                                        className: clsx('byline-account-preferences-theme', container_module["preferences-theme"]),
+                                        children: [
+                                            /*#__PURE__*/ jsx("p", {
+                                                className: clsx('byline-account-line', container_module.line),
+                                                children: /*#__PURE__*/ jsx("span", {
+                                                    className: "muted",
+                                                    children: t('account.appearance.colorTheme')
+                                                })
+                                            }),
+                                            /*#__PURE__*/ jsx(ThemeSwitch, {})
+                                        ]
                                     })
                                 ]
                             })
@@ -225,9 +239,10 @@ function AccountSelfContainer({ account }) {
                                     children: t('account.password.intro')
                                 })
                             }),
-                            /*#__PURE__*/ jsx(ContainerSection, {
-                                title: t('account.sections.appearance'),
-                                children: /*#__PURE__*/ jsx(ThemeSwitch, {})
+                            /*#__PURE__*/ jsx(PasskeyManager, {
+                                targetUserId: currentAccount.id,
+                                targetIsSuperAdmin: currentAccount.is_super_admin,
+                                section: ContainerSection
                             }),
                             /*#__PURE__*/ jsxs(ContainerSection, {
                                 title: t('account.sections.status'),

package/dist/modules/admin-account/components/container.module.js

@@ -15,6 +15,8 @@ const container_module = {
     statusOff: "status-off-WJAcBy",
     "status-help": "status-help-GVOlMV",
     statusHelp: "status-help-GVOlMV",
+    "preferences-theme": "preferences-theme-SHTZmr",
+    preferencesTheme: "preferences-theme-SHTZmr",
     "not-set": "not-set-Ek2yXe",
     notSet: "not-set-Ek2yXe",
     drawer: "drawer-dDlpic",

package/dist/modules/admin-account/components/container_module.css

@@ -60,6 +60,13 @@
   margin-bottom: 0;
 }
 
+:is(.preferences-theme-SHTZmr, .byline-account-preferences-theme) {
+  gap: var(--spacing-8);
+  margin-top: var(--spacing-20);
+  flex-direction: column;
+  display: flex;
+}
+
 :is(.not-set-Ek2yXe, .byline-account-not-set) {
   font-style: italic;
 }

package/dist/modules/admin-account/components/preferences.js

@@ -124,7 +124,7 @@ function Preferences({ account, onClose, onSuccess }) {
                     children: [
                         /*#__PURE__*/ jsx(Button, {
                             type: "button",
-                            intent: "secondary",
+                            intent: "noeffect",
                             size: "sm",
                             onClick: onClose,
                             className: clsx('byline-account-preferences-action', preferences_module.action),

package/dist/modules/admin-account/components/update.js

@@ -183,7 +183,7 @@ function UpdateAccount({ account, onClose, onSuccess }) {
                     children: [
                         /*#__PURE__*/ jsx(Button, {
                             type: "button",
-                            intent: "secondary",
+                            intent: "noeffect",
                             size: "sm",
                             onClick: onClose,
                             className: clsx('byline-account-update-action', update_module.action),

package/dist/modules/admin-roles/components/create.js

@@ -144,7 +144,7 @@ function CreateAdminRole({ onClose, onSuccess }) {
                     children: [
                         /*#__PURE__*/ jsx(Button, {
                             type: "button",
-                            intent: "secondary",
+                            intent: "noeffect",
                             size: "sm",
                             onClick: onClose,
                             className: clsx('byline-role-create-action', create_module.action),

package/dist/modules/admin-roles/components/permissions.js

@@ -207,7 +207,7 @@ function RolePermissions({ role, registered, initialAbilities, onSaved }) {
                         children: [
                             /*#__PURE__*/ jsx(Button, {
                                 type: "button",
-                                intent: "secondary",
+                                intent: "noeffect",
                                 size: "xs",
                                 onClick: handleCancel,
                                 disabled: saving,

package/dist/modules/admin-roles/components/update.js

@@ -134,7 +134,7 @@ function UpdateRole({ role, onClose, onSuccess }) {
                     children: [
                         /*#__PURE__*/ jsx(Button, {
                             type: "button",
-                            intent: "secondary",
+                            intent: "noeffect",
                             size: "sm",
                             onClick: onClose,
                             className: clsx('byline-role-update-action', update_module.action),

package/dist/modules/admin-users/abilities.d.ts

@@ -30,6 +30,7 @@ export declare const ADMIN_USERS_ABILITIES: {
     readonly update: 'admin.users.update';
     readonly delete: 'admin.users.delete';
     readonly changePassword: 'admin.users.changePassword';
+    readonly managePasskeys: 'admin.users.managePasskeys';
 };
 export type AdminUsersAbilityKey = (typeof ADMIN_USERS_ABILITIES)[keyof typeof ADMIN_USERS_ABILITIES];
 /**

package/dist/modules/admin-users/abilities.js

@@ -3,9 +3,16 @@ const ADMIN_USERS_ABILITIES = {
     create: 'admin.users.create',
     update: 'admin.users.update',
     delete: 'admin.users.delete',
-    changePassword: 'admin.users.changePassword'
+    changePassword: 'admin.users.changePassword',
+    managePasskeys: 'admin.users.managePasskeys'
 };
 function registerAdminUsersAbilities(registry) {
+    registry.register({
+        key: ADMIN_USERS_ABILITIES.managePasskeys,
+        label: 'Manage admin user passkeys',
+        group: 'admin.users',
+        source: 'admin'
+    });
     registry.register({
         key: ADMIN_USERS_ABILITIES.read,
         label: 'Read admin users',

package/dist/modules/admin-users/components/create.js

@@ -239,7 +239,7 @@ function CreateAdminUser({ onClose, onSuccess }) {
                     children: [
                         /*#__PURE__*/ jsx(Button, {
                             type: "button",
-                            intent: "secondary",
+                            intent: "noeffect",
                             size: "sm",
                             onClick: onClose,
                             className: clsx('byline-user-create-action', create_module.action),

package/dist/modules/admin-users/components/roles.js

@@ -113,7 +113,7 @@ function UserRoles({ user, allRoles, initialRoleIds, onClose, onSaved }) {
                 children: [
                     /*#__PURE__*/ jsx(Button, {
                         type: "button",
-                        intent: "secondary",
+                        intent: "noeffect",
                         size: "xs",
                         onClick: onClose,
                         disabled: saving,

package/dist/modules/admin-users/components/set-password.js

@@ -130,7 +130,7 @@ function SetPassword({ user, onClose, onSuccess }) {
                     children: [
                         /*#__PURE__*/ jsx(Button, {
                             type: "button",
-                            intent: "secondary",
+                            intent: "noeffect",
                             size: "sm",
                             onClick: onClose,
                             className: clsx('byline-user-set-password-action', set_password_module.action),

package/dist/modules/admin-users/components/update.js

@@ -230,7 +230,7 @@ function UpdateUser({ user, onClose, onSuccess }) {
                     children: [
                         /*#__PURE__*/ jsx(Button, {
                             type: "button",
-                            intent: "secondary",
+                            intent: "noeffect",
                             size: "sm",
                             onClick: onClose,
                             className: clsx('byline-user-update-action', update_module.action),

package/dist/modules/auth/auth-maintenance-repository.d.ts

@@ -0,0 +1,31 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/** Bounded housekeeping; expiry and revocation remain independent authorization checks. */
+export interface AuthMaintenanceRepository {
+    /** Remove at most 100 attempts expired or consumed on/before the supplied grace cutoff. */
+    purgeAttempts(before: Date): Promise<number>;
+    /** Candidate only: eligibility must be checked again under its owning account lock. */
+    findTerminalLogin(before: Date): Promise<{
+        id: string;
+        adminUserId: string;
+    } | null>;
+    /**
+     * Requires the owning account lock. Re-read eligibility, delete at most 100 refresh
+     * children, then delete the terminal parent only if no children remain. Never cascade.
+     */
+    pruneTerminalLogin(input: {
+        id: string;
+        adminUserId: string;
+        before: Date;
+    }): Promise<{
+        refreshDeleted: number;
+        loginDeleted: boolean;
+    }>;
+    /** Remove at most 100 legacy null-sid rows expired on/before the retention cutoff. */
+    purgeLegacyRefreshTokens(before: Date): Promise<number>;
+}

package/dist/modules/auth/auth-maintenance-repository.js

@@ -0,0 +1 @@
+export { };

package/dist/modules/auth/auth-maintenance.d.ts

@@ -0,0 +1,11 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { RecurringTaskDefinition } from '@byline/core';
+import type { AdminStore } from '../../store.js';
+/** Register for native sessions even on password-only sites; configuration never runs cleanup. */
+export declare function createAuthMaintenanceTasks(store: AdminStore, now?: () => Date): RecurringTaskDefinition[];

package/dist/modules/auth/auth-maintenance.js

@@ -0,0 +1,39 @@
+const DAY = 86400000;
+function createAuthMaintenanceTasks(store, now = ()=>new Date()) {
+    const task = (name, retention, batch)=>({
+            name: `auth.maintenance.${name}`,
+            intervalMs: 60000,
+            leaseMs: 60000,
+            async run (context) {
+                const started = performance.now();
+                const cutoff = new Date(now().getTime() - retention);
+                for(let n = 0; n < 32 && performance.now() - started < 30000; n++){
+                    context.signal.throwIfAborted();
+                    await context.heartbeat();
+                    context.signal.throwIfAborted();
+                    if (!await batch(cutoff)) return {
+                        workRemaining: false
+                    };
+                }
+                return {
+                    workRemaining: true
+                };
+            }
+        });
+    return [
+        task('attempts', 300000, async (cutoff)=>await store.authMaintenance.purgeAttempts(cutoff) === 100),
+        task('logins', 30 * DAY, async (cutoff)=>{
+            const candidate = await store.authMaintenance.findTerminalLogin(cutoff);
+            if (!candidate) return false;
+            await store.withSessionLock(candidate.adminUserId, async (scoped)=>{
+                await scoped.authMaintenance.pruneTerminalLogin({
+                    ...candidate,
+                    before: cutoff
+                });
+            });
+            return true;
+        }),
+        task('legacy-refresh', 30 * DAY, async (cutoff)=>await store.authMaintenance.purgeLegacyRefreshTokens(cutoff) === 100)
+    ];
+}
+export { createAuthMaintenanceTasks };

package/dist/modules/auth/auth-maintenance.test.node.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/auth/components/passkey-browser.d.ts

@@ -0,0 +1,14 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { PasskeyManagementAction } from '@byline/auth';
+import type { PasskeyAdminServices, PasskeyPageBinding } from '../../../services/admin-services-types.js';
+export declare function signInWithPasskey(services: PasskeyAdminServices, isActive?: () => boolean): Promise<unknown>;
+export declare function provePasskeyAction(services: PasskeyAdminServices, binding: PasskeyPageBinding, action: PasskeyManagementAction, password?: string): Promise<import("@byline/auth").PasskeyManagementGrant>;
+export declare function enrollPasskey(services: PasskeyAdminServices, binding: PasskeyPageBinding, name: string, password?: string): Promise<import("@byline/auth").PasskeyCredentialSummary>;
+/** Render fixed translated messages, never provider payloads or authenticator identifiers. */
+export declare function passkeyErrorKey(error: unknown): string;

package/dist/modules/auth/components/passkey-browser.js

@@ -0,0 +1,118 @@
+import { browserSupportsWebAuthn, startAuthentication, startRegistration } from "@simplewebauthn/browser";
+function ready(binding, expiresAt) {
+    binding.assertCurrent();
+    if (expiresAt && Date.parse(expiresAt) <= Date.now()) throw Object.assign(new Error('Expired ceremony'), {
+        code: 'ERR_INVALID_TOKEN'
+    });
+}
+function supported() {
+    if (!browserSupportsWebAuthn()) throw Object.assign(new Error('WebAuthn unavailable'), {
+        code: 'PASSKEY_UNSUPPORTED'
+    });
+}
+async function signInWithPasskey(services, isActive = ()=>true) {
+    supported();
+    const captured = services.captureLogin(true);
+    const binding = {
+        ...captured,
+        assertCurrent: ()=>{
+            if (!isActive()) throw new Error('Sign-in page closed');
+            captured.assertCurrent();
+        }
+    };
+    const ceremony = await services.signInOptions({
+        data: {}
+    });
+    ready(binding, ceremony.expiresAt);
+    const response = await startAuthentication({
+        optionsJSON: ceremony.options
+    });
+    ready(binding, ceremony.expiresAt);
+    return services.signIn({
+        data: {
+            ceremonyId: ceremony.ceremonyId,
+            response
+        }
+    }, binding);
+}
+async function provePasskeyAction(services, binding, action, password) {
+    ready(binding);
+    const expectedSessionId = binding.expectedSessionId;
+    if (!expectedSessionId) throw Object.assign(new Error('Login changed'), {
+        code: 'ERR_SESSION_CHANGED'
+    });
+    if (void 0 !== password) {
+        const grant = await services.passwordProof({
+            data: {
+                expectedSessionId,
+                action,
+                password
+            }
+        });
+        ready(binding, grant.expiresAt);
+        return grant;
+    }
+    supported();
+    const ceremony = await services.proofOptions({
+        data: {
+            expectedSessionId,
+            action
+        }
+    });
+    ready(binding, ceremony.expiresAt);
+    const response = await startAuthentication({
+        optionsJSON: ceremony.options
+    });
+    ready(binding, ceremony.expiresAt);
+    const grant = await services.proof({
+        data: {
+            expectedSessionId,
+            ceremonyId: ceremony.ceremonyId,
+            response
+        }
+    });
+    ready(binding, grant.expiresAt);
+    return grant;
+}
+async function enrollPasskey(services, binding, name, password) {
+    supported();
+    const grant = await provePasskeyAction(services, binding, {
+        purpose: 'enroll'
+    }, password);
+    const expectedSessionId = binding.expectedSessionId;
+    const ceremony = await services.enrollmentOptions({
+        data: {
+            expectedSessionId,
+            grantId: grant.grantId
+        }
+    });
+    ready(binding, ceremony.expiresAt);
+    const response = await startRegistration({
+        optionsJSON: ceremony.options
+    });
+    ready(binding, ceremony.expiresAt);
+    return services.enrollment({
+        data: {
+            expectedSessionId,
+            ceremonyId: ceremony.ceremonyId,
+            response,
+            name
+        }
+    });
+}
+function passkeyErrorKey(error) {
+    const value = error;
+    const name = value?.cause?.name ?? value?.name;
+    if ('AbortError' === name || 'NotAllowedError' === name || value?.code === 'ERROR_CEREMONY_ABORTED') return 'passkeys.errors.cancelled';
+    if ('ConstraintError' === name || 'NotSupportedError' === name || value?.code === 'PASSKEY_UNSUPPORTED' || value?.code?.startsWith('ERROR_AUTHENTICATOR_MISSING_') || value?.code === 'ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG') return 'passkeys.errors.unsupported';
+    if ('UnknownError' === name || value?.code === 'ERROR_AUTHENTICATOR_GENERAL_ERROR') return 'passkeys.errors.device';
+    if (value?.code === 'ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED') return 'passkeys.errors.duplicate';
+    if (value?.code === 'ERR_INVALID_TOKEN') return 'passkeys.errors.expired';
+    if (value?.code === 'ERR_SESSION_CHANGED') return 'passkeys.errors.sessionChanged';
+    if (value?.code === 'ERR_PASSKEY_LIMIT') return 'passkeys.errors.limit';
+    if (value?.code === 'ERR_FORBIDDEN') return 'passkeys.errors.forbidden';
+    if (value?.code === 'ERR_INVALID_CREDENTIALS') return 'passkeys.errors.proof';
+    if (value?.status === 429) return 'passkeys.errors.rateLimited';
+    return 'passkeys.errors.unavailable';
+}
+export { enrollPasskey, passkeyErrorKey, provePasskeyAction, signInWithPasskey };

package/dist/modules/auth/components/passkey-browser.test.node.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/auth/components/passkey-manager.d.ts

@@ -0,0 +1,26 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type React from 'react';
+/** A host page's card component, so the passkey panel matches the cards around it. */
+type PasskeySectionComponent = React.ComponentType<{
+    title: string;
+    children: React.ReactNode;
+}>;
+export declare function PasskeyManager({ targetUserId, targetIsSuperAdmin, section: Section, ownAccountNotice, }: {
+    targetUserId: string;
+    targetIsSuperAdmin?: boolean;
+    /** Renders the panel inside the page's own card; defaults to a standalone card. */
+    section?: PasskeySectionComponent;
+    /**
+     * Admin screens pass this to keep the admin (recovery) view even when the
+     * target is the signed-in user; it replaces the description in that case,
+     * typically pointing the user to their own account page.
+     */
+    ownAccountNotice?: React.ReactNode;
+}): React.JSX.Element | null;
+export {};