@capybara-hq/kernel 0.1.0-rc.2 → 0.1.0-rc.21

package/dist/identity/cookies.js

@@ -1,12 +1,22 @@
 /** access token Cookie：随所有请求发送。 */
 export const ACCESS_COOKIE = "cap_at";
-/** refresh token Cookie：只发往认证端点。 */
+/**
+ * The refresh-token cookie: SameSite=Lax so a top-level navigation from another site (an IM card
+ * link, an email, an OAuth return) carries it and the web tier can renew the session. The refresh
+ * endpoint is POST-only and requires `X-Capybara-Csrf`, and Lax cookies are not sent on cross-site
+ * POSTs, so this does not widen CSRF exposure.
+ */
 export const REFRESH_COOKIE = "cap_rt";
-/** refresh Cookie 的 Path。 */
-export const REFRESH_COOKIE_PATH = "/api/v1/auth";
 /**
- * 写会话 Cookie。两个 Cookie 都 HttpOnly、都**不设 Domain**（只属于当前主机）；
- * `cap_at` 为 SameSite=Lax、Path=/；`cap_rt` 为 SameSite=Strict、只发往 `/api/v1/auth`。
+ * Path of the refresh Cookie: `/`, so the web tier sees it on page requests and can renew the
+ * session while rendering on the server.
+ */
+export const REFRESH_COOKIE_PATH = "/";
+/** The Path earlier releases set `cap_rt` on; browsers may still hold it, so it is cleared too. */
+export const LEGACY_REFRESH_COOKIE_PATH = "/api/v1/auth";
+/**
+ * Writes the session cookies. Both are HttpOnly, host-only (no Domain), SameSite=Lax and Path=/;
+ * the `cap_rt` on the legacy Path is cleared at the same time.
  */
 export function setSessionCookies(reply, s, cfg) {
     const secure = cfg.auth.cookieSecure;
@@ -20,13 +30,55 @@ export function setSessionCookies(reply, s, cfg) {
     reply.setCookie(REFRESH_COOKIE, s.refreshToken, {
         path: REFRESH_COOKIE_PATH,
         httpOnly: true,
-        sameSite: "strict",
+        sameSite: "lax",
         secure,
         maxAge: cfg.auth.refreshTokenTtlDays * 86400,
     });
+    reply.clearCookie(REFRESH_COOKIE, { path: LEGACY_REFRESH_COOKIE_PATH });
 }
 /** 清除会话 Cookie（Path 必须与设置时一致才能覆盖）。 */
 export function clearSessionCookies(reply) {
     reply.clearCookie(ACCESS_COOKIE, { path: "/" });
     reply.clearCookie(REFRESH_COOKIE, { path: REFRESH_COOKIE_PATH });
+    reply.clearCookie(REFRESH_COOKIE, { path: LEGACY_REFRESH_COOKIE_PATH });
+}
+/**
+ * Every `cap_rt` value of a raw `cookie` header, in header order. A browser holding the legacy
+ * Path cookie and the new one sends both, the more specific Path first.
+ */
+export function refreshCookieValues(header) {
+    if (!header)
+        return [];
+    const out = [];
+    for (const part of header.split(";")) {
+        const eq = part.indexOf("=");
+        if (eq < 0 || part.slice(0, eq).trim() !== REFRESH_COOKIE)
+            continue;
+        let v = part.slice(eq + 1).trim();
+        if (v.startsWith('"') && v.endsWith('"') && v.length >= 2)
+            v = v.slice(1, -1);
+        try {
+            v = decodeURIComponent(v);
+        }
+        catch {
+            // keep the raw value
+        }
+        if (v)
+            out.push(v);
+    }
+    return out;
+}
+/**
+ * The startup warning for an http trial that cannot sign in: session cookies are Secure but the
+ * configured public URL is plain http, so browsers drop them. Null when cookies are not Secure,
+ * or the public URL is https or unset (an unset URL says nothing about how people reach the app).
+ */
+export function insecurePublicUrlWarning(cfg) {
+    const url = cfg.http.publicUrl;
+    if (!cfg.auth.cookieSecure || url === undefined || !url.startsWith("http://"))
+        return null;
+    const host = new URL(url).hostname;
+    if (host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1")
+        return null;
+    return `http.publicUrl is ${url} (plain http) while auth.cookieSecure is true: browsers drop the Secure session cookies, so sign-in will not stick. Serve the app over HTTPS, or for a short http trial set auth.cookieSecure=false (CAPYBARA_AUTH__COOKIE_SECURE=false; CAPYBARA_COOKIE_SECURE=false in the compose .env)`;
 }

package/dist/identity/identity.module.d.ts

@@ -1,5 +1,5 @@
 /**
- * Identity: accounts, sessions, API tokens, deployment settings and the enterprise admin lock,
+ * Identity: accounts, sessions, API tokens, deployment settings and the super admin lock,
  * external identities with IM binding and third-party sign-in.
  */
 export declare class IdentityModule {

package/dist/identity/identity.module.js

@@ -11,14 +11,15 @@ import { OrgLockModule } from "../orgs/org-lock.js";
 import { AccountsModule } from "./accounts.js";
 import { ApiTokenService } from "./api-tokens.js";
 import { IdentityBinding } from "./binding.js";
-import { EnterpriseAdminLockModule } from "./enterprise-admin.js";
 import { ExternalIdentities } from "./external.js";
 import { ExternalIdentityLock } from "./external-identity-lock.js";
+import { InitialPasswords } from "./initial-passwords.js";
 import { SessionService } from "./sessions.js";
 import { SettingsService } from "./settings.js";
 import { SsoFlow } from "./sso.js";
+import { SuperAdminLockModule } from "./super-admin.js";
 /**
- * Identity: accounts, sessions, API tokens, deployment settings and the enterprise admin lock,
+ * Identity: accounts, sessions, API tokens, deployment settings and the super admin lock,
  * external identities with IM binding and third-party sign-in.
  */
 let IdentityModule = class IdentityModule {
@@ -29,7 +30,7 @@ IdentityModule = __decorate([
             AccountsModule,
             OrgLockModule,
             SetupLockModule,
-            EnterpriseAdminLockModule,
+            SuperAdminLockModule,
             ExtensionRegistryModule,
         ],
         providers: [
@@ -40,16 +41,18 @@ IdentityModule = __decorate([
             ExternalIdentities,
             IdentityBinding,
             SsoFlow,
+            InitialPasswords,
         ],
         exports: [
             AccountsModule,
             SessionService,
             ApiTokenService,
             SettingsService,
-            EnterpriseAdminLockModule,
+            SuperAdminLockModule,
             ExternalIdentities,
             IdentityBinding,
             SsoFlow,
+            InitialPasswords,
         ],
     })
 ], IdentityModule);

package/dist/identity/initial-passwords.controller.d.ts

@@ -0,0 +1,22 @@
+import { z } from "zod";
+import { type OrgContext } from "../orgs/org.guard.js";
+import { InitialPasswords } from "./initial-passwords.js";
+import { type Principal } from "./principal.js";
+declare const ApprovalParams: z.ZodObject<{
+    approvalId: z.ZodString;
+}, z.core.$strip>;
+/**
+ * The generated initial password of an account the super admin's agent created (Platform tool
+ * spec §14.5 item 2): shown once, on the web, to the person who approved the `accounts.create`
+ * call. A POST because reading consumes it.
+ */
+export declare class InitialPasswordsController {
+    private readonly passwords;
+    constructor(passwords: InitialPasswords);
+    reveal(principal: Principal, org: OrgContext, params: z.infer<typeof ApprovalParams>): Promise<{
+        accountId: string;
+        login: string | null;
+        password: string;
+    }>;
+}
+export {};

package/dist/identity/initial-passwords.controller.js

@@ -0,0 +1,49 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Controller, HttpCode, Inject, Post } from "@nestjs/common";
+import { z } from "zod";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZParam } from "../infra/validation/zod-params.js";
+import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
+import { InitialPasswords } from "./initial-passwords.js";
+import { CurrentPrincipal, requireUser, SessionOnly, SuperAdmin, } from "./principal.js";
+const ApprovalParams = z.object({ approvalId: z.string().min(1).max(100) });
+class ApprovalParamsDto extends createZodDto(ApprovalParams, "InitialPasswordParams") {
+}
+/**
+ * The generated initial password of an account the super admin's agent created (Platform tool
+ * spec §14.5 item 2): shown once, on the web, to the person who approved the `accounts.create`
+ * call. A POST because reading consumes it.
+ */
+let InitialPasswordsController = class InitialPasswordsController {
+    passwords;
+    constructor(passwords) {
+        this.passwords = passwords;
+    }
+    async reveal(principal, org, params) {
+        const p = requireUser(principal);
+        return this.passwords.reveal(org.orgId, params.approvalId, p.account.id);
+    }
+};
+__decorate([
+    Post(),
+    HttpCode(200),
+    OrgAction("org.read"),
+    SuperAdmin(),
+    SessionOnly(),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(ApprovalParamsDto))
+], InitialPasswordsController.prototype, "reveal", null);
+InitialPasswordsController = __decorate([
+    Controller("api/v1/orgs/:orgId/approvals/:approvalId/initial-password"),
+    __param(0, Inject(InitialPasswords))
+], InitialPasswordsController);
+export { InitialPasswordsController };

package/dist/identity/initial-passwords.d.ts

@@ -0,0 +1,61 @@
+import type { Keyring } from "../ctx/secrets.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { type Account, AccountsService } from "./accounts.js";
+/**
+ * How long a generated password waits for its reader. The approving person reads it right after
+ * the call runs; one that is never read expires (the account can still be disabled and recreated).
+ */
+export declare const INITIAL_PASSWORD_TTL_MS: number;
+/** The tool key of the approval a generated password belongs to. */
+export declare const CREATE_ACCOUNT_TOOL_KEY = "Platform:accounts.create";
+/** A one-time initial password, cryptographically random. */
+export declare function generateInitialPassword(): string;
+/** Where a generated password is delivered: the approved tool call and the person who approved. */
+export interface InitialPasswordDelivery {
+    conversationId: string;
+    /** The run of the call: a call id is unique only within its run. */
+    runId: string;
+    callId: string;
+    /** The account that may read it: the actor who confirmed the call. */
+    recipientAccountId: string;
+}
+/**
+ * Accounts created with a kernel-generated one-time password (Platform tool spec §14.5 item 2).
+ * The password never leaves the kernel except through {@link reveal}: it is not returned to the
+ * caller, not written to the audit, the event log or the logs. It is sealed with the master keyring
+ * in the creation's transaction and read once, on the web, by the person who approved the call.
+ */
+export declare class InitialPasswords {
+    private readonly db;
+    readonly txHost: TransactionHost;
+    private readonly keyring;
+    private readonly accounts;
+    constructor(db: KernelDb, txHost: TransactionHost, keyring: Keyring, accounts: AccountsService);
+    /**
+     * Creates a local account (never a super admin) with a generated password it must change at
+     * first sign-in, and seals the password for `to`. Returns the account only.
+     */
+    createAccount(input: {
+        login: string;
+        displayName: string;
+        email?: string;
+    }, actorAccountId: string, to: InitialPasswordDelivery, auditDetail?: Record<string, unknown>): Promise<Account>;
+    /** Stores the sealed password in the creation's transaction (the hourly job drops expired ones). */
+    private seal;
+    /**
+     * The password created by an approved `accounts.create` call, read once by the person who
+     * approved it (`approvalId` in `orgId`, decided by `accountId`), then deleted. Anything else (not
+     * that person, not approved, not run yet, read already, expired) is
+     * `account.initial_password_unavailable`, saying nothing about which. Audits the read (without
+     * the password).
+     */
+    reveal(orgId: string, approvalId: string, accountId: string): Promise<{
+        accountId: string;
+        login: string | null;
+        password: string;
+    }>;
+}
+/** Deletes the sealed passwords past `expires_at`; returns how many. */
+export declare function deleteExpiredInitialPasswords(db: KernelSchemaDb): Promise<number>;

package/dist/identity/initial-passwords.job.d.ts

@@ -0,0 +1,16 @@
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { LockService } from "../infra/lock/lock.service.js";
+import type { KernelLogger } from "../log.js";
+/** The hourly cleanup of expired sealed initial passwords (`@LockedCron`). */
+export declare const INITIAL_PASSWORD_CLEANUP_JOB = "initial-password-cleanup";
+/**
+ * Deletes generated initial passwords nobody read before they expired (Platform tool spec §14.5
+ * item 2), once per tick across replicas; the worker role's.
+ */
+export declare class InitialPasswordCleanupJob {
+    private readonly db;
+    readonly lockService: LockService;
+    readonly log: KernelLogger;
+    constructor(db: KernelDb, lockService: LockService, log: KernelLogger);
+    cleanup(): Promise<void>;
+}

package/dist/identity/initial-passwords.job.js

@@ -0,0 +1,46 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { LockService } from "../infra/lock/lock.service.js";
+import { LockedCron } from "../infra/schedule/locked-cron.decorator.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { deleteExpiredInitialPasswords } from "./initial-passwords.js";
+/** The hourly cleanup of expired sealed initial passwords (`@LockedCron`). */
+export const INITIAL_PASSWORD_CLEANUP_JOB = "initial-password-cleanup";
+/**
+ * Deletes generated initial passwords nobody read before they expired (Platform tool spec §14.5
+ * item 2), once per tick across replicas; the worker role's.
+ */
+let InitialPasswordCleanupJob = class InitialPasswordCleanupJob {
+    db;
+    lockService;
+    log;
+    constructor(db, lockService, log) {
+        this.db = db;
+        this.lockService = lockService;
+        this.log = log;
+    }
+    async cleanup() {
+        const n = await deleteExpiredInitialPasswords(this.db.db);
+        if (n > 0)
+            this.log.info("expired initial passwords deleted", { count: n });
+    }
+};
+__decorate([
+    LockedCron("20 * * * *", { name: INITIAL_PASSWORD_CLEANUP_JOB })
+], InitialPasswordCleanupJob.prototype, "cleanup", null);
+InitialPasswordCleanupJob = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(LockService)),
+    __param(2, Inject(KERNEL_LOGGER))
+], InitialPasswordCleanupJob);
+export { InitialPasswordCleanupJob };

package/dist/identity/initial-passwords.js

@@ -0,0 +1,159 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { randomInt } from "node:crypto";
+import { Inject, Injectable } from "@nestjs/common";
+import { sql } from "kysely";
+import { ApiError } from "../errors.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KEYRING } from "../infra/tokens.js";
+import { AccountsService } from "./accounts.js";
+import { audit } from "./audit.js";
+/** Letters and digits without the look-alikes (0 O 1 l I): read off a screen and typed by hand. */
+const ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789";
+/** 20 characters of 56: about 116 bits. */
+const LENGTH = 20;
+/**
+ * How long a generated password waits for its reader. The approving person reads it right after
+ * the call runs; one that is never read expires (the account can still be disabled and recreated).
+ */
+export const INITIAL_PASSWORD_TTL_MS = 24 * 60 * 60 * 1000;
+/** The tool key of the approval a generated password belongs to. */
+export const CREATE_ACCOUNT_TOOL_KEY = "Platform:accounts.create";
+/** A one-time initial password, cryptographically random. */
+export function generateInitialPassword() {
+    let out = "";
+    for (let i = 0; i < LENGTH; i++)
+        out += ALPHABET[randomInt(ALPHABET.length)];
+    return out;
+}
+/** The AAD binding a sealed password to its account (a row moved to another account fails). */
+const aadOf = (accountId) => `capybara:initial-password:${accountId}`;
+/**
+ * Accounts created with a kernel-generated one-time password (Platform tool spec §14.5 item 2).
+ * The password never leaves the kernel except through {@link reveal}: it is not returned to the
+ * caller, not written to the audit, the event log or the logs. It is sealed with the master keyring
+ * in the creation's transaction and read once, on the web, by the person who approved the call.
+ */
+let InitialPasswords = class InitialPasswords {
+    db;
+    txHost;
+    keyring;
+    accounts;
+    constructor(db, txHost, keyring, accounts) {
+        this.db = db;
+        this.txHost = txHost;
+        this.keyring = keyring;
+        this.accounts = accounts;
+    }
+    /**
+     * Creates a local account (never a super admin) with a generated password it must change at
+     * first sign-in, and seals the password for `to`. Returns the account only.
+     */
+    async createAccount(input, actorAccountId, to, auditDetail) {
+        const password = generateInitialPassword();
+        return this.accounts.createByAdmin({ ...input, password, superAdmin: false, mustChangePassword: true }, actorAccountId, undefined, {
+            ...(auditDetail !== undefined && { auditDetail }),
+            inTransaction: (account) => this.seal(account.id, password, to),
+        });
+    }
+    /** Stores the sealed password in the creation's transaction (the hourly job drops expired ones). */
+    async seal(accountId, password, to) {
+        const { data, masterKeyId } = this.keyring.wrap(Buffer.from(password, "utf8"), aadOf(accountId));
+        await this.db
+            .insertInto("account_initial_passwords")
+            .values({
+            account_id: accountId,
+            recipient_account_id: to.recipientAccountId,
+            conversation_id: to.conversationId,
+            run_id: to.runId,
+            call_id: to.callId,
+            master_key_id: masterKeyId,
+            ciphertext: data,
+            expires_at: new Date(Date.now() + INITIAL_PASSWORD_TTL_MS),
+        })
+            .execute();
+    }
+    /**
+     * The password created by an approved `accounts.create` call, read once by the person who
+     * approved it (`approvalId` in `orgId`, decided by `accountId`), then deleted. Anything else (not
+     * that person, not approved, not run yet, read already, expired) is
+     * `account.initial_password_unavailable`, saying nothing about which. Audits the read (without
+     * the password).
+     */
+    async reveal(orgId, approvalId, accountId) {
+        const unavailable = () => new ApiError("account.initial_password_unavailable", "No initial password to show: it was shown already, has expired, or the account was not created by a call you approved");
+        const approval = await this.db
+            .selectFrom("approvals")
+            .select(["conversation_id", "run_id", "call_id", "tool_key", "status", "decided_by"])
+            .where("id", "=", approvalId)
+            .where("org_id", "=", orgId)
+            .executeTakeFirst();
+        if (approval === undefined ||
+            approval.tool_key !== CREATE_ACCOUNT_TOOL_KEY ||
+            approval.status !== "approved" ||
+            approval.decided_by !== accountId) {
+            throw unavailable();
+        }
+        // exactly the row of this approval's call: locked, then deleted by its key
+        const found = await this.db
+            .selectFrom("account_initial_passwords")
+            .select("account_id")
+            .where("conversation_id", "=", approval.conversation_id)
+            .where("run_id", "=", approval.run_id)
+            .where("call_id", "=", approval.call_id)
+            .where("recipient_account_id", "=", accountId)
+            .where("expires_at", ">", sql `now()`)
+            .limit(1)
+            .forUpdate()
+            .executeTakeFirst();
+        if (found === undefined)
+            throw unavailable();
+        const row = await this.db
+            .deleteFrom("account_initial_passwords")
+            .where("account_id", "=", found.account_id)
+            .returning(["account_id", "master_key_id", "ciphertext"])
+            .executeTakeFirst();
+        if (row === undefined)
+            throw unavailable();
+        const password = this.keyring
+            .unwrap(row.master_key_id, row.ciphertext, aadOf(row.account_id))
+            .toString("utf8");
+        const login = (await this.accounts.localLogins([row.account_id])).get(row.account_id) ?? null;
+        await audit(this.db.db, {
+            actorAccountId: accountId,
+            orgId,
+            action: "account.initial_password_shown",
+            target: row.account_id,
+            detail: { approvalId },
+        });
+        return { accountId: row.account_id, login, password };
+    }
+};
+__decorate([
+    Transactional()
+], InitialPasswords.prototype, "reveal", null);
+InitialPasswords = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(KEYRING)),
+    __param(3, Inject(AccountsService))
+], InitialPasswords);
+export { InitialPasswords };
+/** Deletes the sealed passwords past `expires_at`; returns how many. */
+export async function deleteExpiredInitialPasswords(db) {
+    const r = await db
+        .deleteFrom("account_initial_passwords")
+        .where("expires_at", "<=", sql `now()`)
+        .executeTakeFirst();
+    return Number(r.numDeletedRows);
+}

package/dist/identity/me.controller.d.ts

@@ -6,8 +6,10 @@ import { OrgsService } from "../orgs/orgs.service.js";
 import type { OrgRole } from "../orgs/roles.js";
 import { type Account, AccountsService } from "./accounts.js";
 import { type ApiTokenRecord, ApiTokenService } from "./api-tokens.js";
+import { type Preferences, type PreferencesSchema } from "./me.schemas.js";
 import { type Principal } from "./principal.js";
 import { SessionService } from "./sessions.js";
+import { SettingsService } from "./settings.js";
 declare const ChangePasswordSchema: z.ZodObject<{
     currentPassword: z.ZodString;
     newPassword: z.ZodString;
@@ -33,13 +35,27 @@ export declare class MeController {
     private readonly tokens;
     private readonly throttler;
     private readonly log;
-    constructor(accounts: AccountsService, sessions: SessionService, orgs: OrgsService, tokens: ApiTokenService, throttler: CredentialThrottler, log: Logger);
+    private readonly settings;
+    constructor(accounts: AccountsService, sessions: SessionService, orgs: OrgsService, tokens: ApiTokenService, throttler: CredentialThrottler, log: Logger, settings: SettingsService);
     me(principal: Principal): Promise<{
         account: Account;
         via: "session" | "pat";
         currentOrgId: string | null;
         memberships: MembershipView[];
+        /** Whether `POST /api/v1/orgs` would accept this account (the `orgCreation` setting). */
+        canCreateOrg: boolean;
     }>;
+    /**
+     * The person's preferences: `timeZone` null = follow the browser's time zone sent with each
+     * message, a set zone overrides it for the messages sent afterwards (run context spec §3.4);
+     * `theme` null = follow the org (themes spec §7).
+     */
+    preferences(principal: Principal): Promise<Preferences>;
+    /**
+     * Updates the preferences given; a field left out keeps its value. An unknown time zone → 400
+     * `validation_failed`; a theme on in none of the person's orgs → 400 `theme.not_available`.
+     */
+    setPreferences(principal: Principal, body: z.infer<typeof PreferencesSchema>): Promise<Preferences>;
     /** 切换当前组织（仅 Web 会话）；`null` 清空。非成员或已软删除的组织 → `org.not_found`。 */
     setCurrentOrg(principal: Principal, body: z.infer<typeof CurrentOrgSchema>): Promise<void>;
     /**

package/dist/identity/me.controller.js

@@ -18,8 +18,10 @@ import { OrgsService } from "../orgs/orgs.service.js";
 import { AccountsService } from "./accounts.js";
 import { ApiTokenService, FutureIsoDate } from "./api-tokens.js";
 import { MAX_PASSWORD_LENGTH } from "./login.js";
-import { CurrentPrincipal, requireUser, SessionOnly } from "./principal.js";
+import { PreferencesBody } from "./me.schemas.js";
+import { AllowPendingPasswordChange, CurrentPrincipal, requireUser, SessionOnly, } from "./principal.js";
 import { SessionService } from "./sessions.js";
+import { SettingsService } from "./settings.js";
 /** The credential throttlers of a password change (per account, per client IP). */
 const CHANGE_PASSWORD_THROTTLERS = ["change-password", "change-password-ip"];
 const ChangePasswordSchema = z.object({
@@ -45,13 +47,15 @@ let MeController = class MeController {
     tokens;
     throttler;
     log;
-    constructor(accounts, sessions, orgs, tokens, throttler, log) {
+    settings;
+    constructor(accounts, sessions, orgs, tokens, throttler, log, settings) {
         this.accounts = accounts;
         this.sessions = sessions;
         this.orgs = orgs;
         this.tokens = tokens;
         this.throttler = throttler;
         this.log = log;
+        this.settings = settings;
     }
     async me(principal) {
         const p = requireUser(principal);
@@ -62,7 +66,27 @@ let MeController = class MeController {
             name: o.name,
             role: o.role,
         }));
-        return { account: p.account, via: p.via, currentOrgId, memberships };
+        // a session's org the account has since left reads as none (removal clears it, but a session
+        // created at that moment may still name it)
+        const current = memberships.some((m) => m.orgId === currentOrgId) ? currentOrgId : null;
+        const { orgCreation } = await this.settings.get();
+        const canCreateOrg = orgCreation === "anyone" || p.account.isSuperAdmin;
+        return { account: p.account, via: p.via, currentOrgId: current, memberships, canCreateOrg };
+    }
+    /**
+     * The person's preferences: `timeZone` null = follow the browser's time zone sent with each
+     * message, a set zone overrides it for the messages sent afterwards (run context spec §3.4);
+     * `theme` null = follow the org (themes spec §7).
+     */
+    async preferences(principal) {
+        return this.accounts.preferences(requireUser(principal).account.id);
+    }
+    /**
+     * Updates the preferences given; a field left out keeps its value. An unknown time zone → 400
+     * `validation_failed`; a theme on in none of the person's orgs → 400 `theme.not_available`.
+     */
+    async setPreferences(principal, body) {
+        return this.accounts.setPreferences(requireUser(principal).account.id, body);
     }
     /** 切换当前组织（仅 Web 会话）；`null` 清空。非成员或已软删除的组织 → `org.not_found`。 */
     async setCurrentOrg(principal, body) {
@@ -89,6 +113,11 @@ let MeController = class MeController {
             throw new ApiError("auth.invalid_credentials", "Current password is incorrect");
         }
         await this.throttler.succeeded(CHANGE_PASSWORD_THROTTLERS, req);
+        if (p.account.mustChangePassword && body.newPassword === body.currentPassword) {
+            throw new ApiError("validation_failed", "Choose a password other than the initial one", [
+                { path: "newPassword", message: "must differ from the initial password" },
+            ]);
+        }
         // 新密码、吊销其他会话（PG revoked_at）与个人令牌在同一个 PG 事务里完成
         const revoked = await this.accounts.changePassword(p.account.id, body.newPassword, p.sessionId);
         try {
@@ -117,8 +146,18 @@ let MeController = class MeController {
 };
 __decorate([
     Get(),
+    AllowPendingPasswordChange(),
     __param(0, CurrentPrincipal())
 ], MeController.prototype, "me", null);
+__decorate([
+    Get("preferences"),
+    __param(0, CurrentPrincipal())
+], MeController.prototype, "preferences", null);
+__decorate([
+    Put("preferences"),
+    __param(0, CurrentPrincipal()),
+    __param(1, ZBody(PreferencesBody))
+], MeController.prototype, "setPreferences", null);
 __decorate([
     Put("current-org"),
     SessionOnly(),
@@ -129,6 +168,7 @@ __decorate([
 __decorate([
     Put("password"),
     SessionOnly(),
+    AllowPendingPasswordChange(),
     HttpCode(204),
     __param(0, CurrentPrincipal()),
     __param(1, ZBody(ChangePasswordBody)),
@@ -160,6 +200,7 @@ MeController = __decorate([
     __param(2, Inject(OrgsService)),
     __param(3, Inject(ApiTokenService)),
     __param(4, Inject(CredentialThrottler)),
-    __param(5, Inject(KERNEL_LOGGER))
+    __param(5, Inject(KERNEL_LOGGER)),
+    __param(6, Inject(SettingsService))
 ], MeController);
 export { MeController };