@crombolo/api-management 0.13.1 → 0.14.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crombolo/api-management",
-  "version": "0.13.1",
+  "version": "0.14.1",
   "description": "Umbraco-compatible Management API handlers for crombolo.",
   "license": "MIT",
   "author": "Crombolo",
@@ -28,7 +28,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@crombolo/core": "0.13.1",
-    "@crombolo/contracts": "0.13.1"
+    "@crombolo/core": "0.14.1",
+    "@crombolo/contracts": "0.14.1"
   }
 }

package/src/handlers/member-group.ts

@@ -62,6 +62,12 @@ export function registerMemberGroupHandlers(
       name,
     })
     if (result.status !== 'ok' || !result.key) return statusResponse(result.status)
+    // The toast the backoffice shows, as for every other type it saves.
+    ctx.notifications.push({
+      message: 'Member group created',
+      category: 'Member Group',
+      type: 'Success',
+    })
     return created(`${ctx.url.origin}${V1}/member-group/${result.key}`, result.key)
   })
 
@@ -69,7 +75,14 @@ export function registerMemberGroupHandlers(
     const body = ((await ctx.request.json().catch(() => ({}))) ?? {}) as Record<string, unknown>
     const name = typeof body.name === 'string' ? body.name.trim() : ''
     if (!name) return problemResponse(problemDetails({ title: 'A name is required', status: 400 }))
-    return statusResponse(await groups.rename(ctx.params.id as string, name))
+    const status = await groups.rename(ctx.params.id as string, name)
+    if (status === 'ok')
+      ctx.notifications.push({
+        message: 'Member group saved',
+        category: 'Member Group',
+        type: 'Success',
+      })
+    return statusResponse(status)
   })
 
   router.handle('DeleteMemberGroupById', async (ctx) =>

package/src/handlers/member.ts

@@ -66,7 +66,7 @@ export function toSaveMember(key: string, body: Record<string, unknown>): SaveMe
     oldPassword: typeof body.oldPassword === 'string' ? body.oldPassword : null,
     isApproved: body.isApproved !== false,
     isLockedOut: body.isLockedOut === true,
-    isTwoFactorEnabled: body.isTwoFactorEnabled === true,
+    isTwoFactorEnabled: body.isTwoFactorEnabled !== false,
     groupKeys: strings(body.groups),
     values: readValues(body),
     variants: readVariants(body),

package/src/handlers/user.ts

@@ -459,7 +459,8 @@ function registerUsers(router: ManagementApiRouter, users: UserPort): void {
       }),
     )
 
-  // No two-factor providers are installed: every provider lookup finds nothing.
+  // Story 032: the authenticator provider, when the server offers one; any other
+  // provider name finds nothing, as an uninstalled provider does in Umbraco.
   const noProvider = () =>
     bad(
       'Provider not found',
@@ -467,17 +468,57 @@ function registerUsers(router: ManagementApiRouter, users: UserPort): void {
       'ProviderNameNotFound',
       404,
     )
-  router.handle('GetUserCurrent2fa', () => Response.json([]))
-  router.handle('GetUserCurrent2faByProviderName', noProvider)
-  router.handle('PostUserCurrent2faByProviderName', noProvider)
-  router.handle('DeleteUserCurrent2faByProviderName', noProvider)
+  const twoFactor = users.twoFactor
+  const provided = (ctx: RequestContext) =>
+    twoFactor && ctx.params.providerName === twoFactor.providerName ? twoFactor : undefined
+  const refused = (message: string) => bad('Invalid code', message, 'InvalidCode', 400)
+  router.handle('GetUserCurrent2fa', async (ctx) =>
+    Response.json(twoFactor ? await twoFactor.list(me(ctx).id) : []),
+  )
+  router.handle('GetUserCurrent2faByProviderName', async (ctx) => {
+    const provider = provided(ctx)
+    if (!provider) return noProvider()
+    const setup = provider.setup(me(ctx).email || me(ctx).userName)
+    return setup.ok
+      ? Response.json({
+          $type: 'TwoFactorAuthInfo',
+          secret: setup.secret,
+          qrCodeSetupImageUrl: setup.qrCodeSetupImageUrl,
+        })
+      : bad('Two-factor sign-in is not available', setup.message, 'NotAvailable', 400)
+  })
+  router.handle('PostUserCurrent2faByProviderName', async (ctx) => {
+    const provider = provided(ctx)
+    if (!provider) return noProvider()
+    const b = await body(ctx)
+    const enabled = await provider.enable(me(ctx).id, str(b.code), str(b.secret))
+    return enabled.ok
+      ? Response.json({ $type: 'TwoFactorRecoveryCodes', recoveryCodes: enabled.recoveryCodes })
+      : refused(enabled.message)
+  })
+  router.handle('DeleteUserCurrent2faByProviderName', async (ctx) => {
+    const provider = provided(ctx)
+    if (!provider) return noProvider()
+    const disabled = await provider.disable(me(ctx).id, ctx.url.searchParams.get('code') ?? '')
+    return disabled.ok ? ok() : refused(disabled.message)
+  })
   router.handle('GetUserById2fa', async (ctx) => {
     const found = await users.get(me(ctx), ctx.params.id as string)
-    return found.status === 'Success' ? Response.json([]) : status(found.status)
+    if (found.status !== 'Success') return status(found.status)
+    return Response.json(twoFactor ? await twoFactor.list(ctx.params.id as string) : [])
+  })
+  router.handle('DeleteUserById2faByProviderName', async (ctx) => {
+    const provider = provided(ctx)
+    if (!provider) return noProvider()
+    // Who may manage this user, by the same rule every user operation follows.
+    const found = await users.get(me(ctx), ctx.params.id as string)
+    if (found.status !== 'Success') return status(found.status)
+    await provider.reset(ctx.params.id as string)
+    return ok()
   })
-  router.handle('DeleteUserById2faByProviderName', noProvider)
-  // External backoffice logins arrive with story 031's providers.
-  router.handle('GetUserCurrentLoginProviders', () => Response.json([]))
+  router.handle('GetUserCurrentLoginProviders', async (ctx) =>
+    Response.json((await users.loginProviders?.(me(ctx))) ?? []),
+  )
 
   router.handle('PostSecurityForgotPassword', async (ctx) => {
     await users.forgotPassword(str((await body(ctx)).email).trim())
@@ -527,11 +568,24 @@ function registerGroups(router: ManagementApiRouter, groups: UserGroupPort): voi
   router.handle('PostUserGroup', async (ctx) => {
     const result = await groups.create(me(ctx), readGroup(await body(ctx)))
     if (result.status !== 'Success' || !result.key) return status(result.status)
+    // The toast the backoffice shows, as for every other type it saves.
+    ctx.notifications.push({
+      message: 'User group created',
+      category: 'User Group',
+      type: 'Success',
+    })
     return created(`${ctx.url.origin}${V1}/user-group/${result.key}`, result.key)
   })
-  router.handle('PutUserGroupById', async (ctx) =>
-    status(await groups.update(me(ctx), ctx.params.id as string, readGroup(await body(ctx)))),
-  )
+  router.handle('PutUserGroupById', async (ctx) => {
+    const result = await groups.update(me(ctx), ctx.params.id as string, readGroup(await body(ctx)))
+    if (result === 'Success')
+      ctx.notifications.push({
+        message: 'User group saved',
+        category: 'User Group',
+        type: 'Success',
+      })
+    return status(result)
+  })
   router.handle('DeleteUserGroupById', async (ctx) =>
     status(await groups.delete(me(ctx), [ctx.params.id as string])),
   )

package/src/ports-users.ts

@@ -86,7 +86,26 @@ export interface UserUpdateInput {
 
 export type Result<T> = { status: 'Success'; value: T } | { status: Exclude<UserStatus, 'Success'> }
 
+/** Two-factor sign-in for users (story 032): the one authenticator provider. */
+export interface UserTwoFactorPort {
+  providerName: string
+  list(userKey: string): Promise<Array<{ providerName: string; isEnabledOnUser: boolean }>>
+  setup(
+    account: string,
+  ): { ok: true; secret: string; qrCodeSetupImageUrl: string } | { ok: false; message: string }
+  enable(
+    userKey: string,
+    code: string,
+    secret: string,
+  ): Promise<{ ok: true; recoveryCodes: string[] } | { ok: false; message: string }>
+  disable(userKey: string, code: string): Promise<{ ok: true } | { ok: false; message: string }>
+  /** An administrator turning it off for someone who lost their phone. */
+  reset(userKey: string): Promise<void>
+}
+
 export interface UserPort {
+  /** Two-factor sign-in, when the server offers it. */
+  twoFactor?: UserTwoFactorPort
   list(principal: Principal, skip: number, take: number): Promise<Page<UserResponse>>
   filter(principal: Principal, query: UserFilter): Promise<Page<UserResponse>>
   get(principal: Principal, key: string): Promise<Result<UserResponse>>
@@ -138,6 +157,8 @@ export interface UserPort {
   ): Promise<Array<{ nodeKey: string; permissions: string[] }>>
   configuration(): ResponseOf<'GetUserConfiguration'>
   currentConfiguration(): ResponseOf<'GetUserCurrentConfiguration'>
+  /** The backoffice identity providers, and which the caller has signed in with (story 031). */
+  loginProviders?(principal: Principal): Promise<ResponseOf<'GetUserCurrentLoginProviders'>>
   passwordConfiguration(): ResponseOf<'GetSecurityConfiguration'>['passwordConfiguration']
   /** Anonymous: sends a reset link when the address belongs to a user; says nothing either way. */
   forgotPassword(email: string): Promise<void>