@crombolo/api-management 0.13.2 → 0.14.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crombolo/api-management",
-  "version": "0.13.2",
+  "version": "0.14.1",
   "description": "Umbraco-compatible Management API handlers for crombolo.",
   "license": "MIT",
   "author": "Crombolo",
@@ -28,7 +28,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@crombolo/core": "0.13.2",
-    "@crombolo/contracts": "0.13.2"
+    "@crombolo/core": "0.14.1",
+    "@crombolo/contracts": "0.14.1"
   }
 }

package/src/handlers/member.ts

@@ -66,7 +66,7 @@ export function toSaveMember(key: string, body: Record<string, unknown>): SaveMe
     oldPassword: typeof body.oldPassword === 'string' ? body.oldPassword : null,
     isApproved: body.isApproved !== false,
     isLockedOut: body.isLockedOut === true,
-    isTwoFactorEnabled: body.isTwoFactorEnabled === true,
+    isTwoFactorEnabled: body.isTwoFactorEnabled !== false,
     groupKeys: strings(body.groups),
     values: readValues(body),
     variants: readVariants(body),

package/src/handlers/user.ts

@@ -459,7 +459,8 @@ function registerUsers(router: ManagementApiRouter, users: UserPort): void {
       }),
     )
 
-  // No two-factor providers are installed: every provider lookup finds nothing.
+  // Story 032: the authenticator provider, when the server offers one; any other
+  // provider name finds nothing, as an uninstalled provider does in Umbraco.
   const noProvider = () =>
     bad(
       'Provider not found',
@@ -467,17 +468,57 @@ function registerUsers(router: ManagementApiRouter, users: UserPort): void {
       'ProviderNameNotFound',
       404,
     )
-  router.handle('GetUserCurrent2fa', () => Response.json([]))
-  router.handle('GetUserCurrent2faByProviderName', noProvider)
-  router.handle('PostUserCurrent2faByProviderName', noProvider)
-  router.handle('DeleteUserCurrent2faByProviderName', noProvider)
+  const twoFactor = users.twoFactor
+  const provided = (ctx: RequestContext) =>
+    twoFactor && ctx.params.providerName === twoFactor.providerName ? twoFactor : undefined
+  const refused = (message: string) => bad('Invalid code', message, 'InvalidCode', 400)
+  router.handle('GetUserCurrent2fa', async (ctx) =>
+    Response.json(twoFactor ? await twoFactor.list(me(ctx).id) : []),
+  )
+  router.handle('GetUserCurrent2faByProviderName', async (ctx) => {
+    const provider = provided(ctx)
+    if (!provider) return noProvider()
+    const setup = provider.setup(me(ctx).email || me(ctx).userName)
+    return setup.ok
+      ? Response.json({
+          $type: 'TwoFactorAuthInfo',
+          secret: setup.secret,
+          qrCodeSetupImageUrl: setup.qrCodeSetupImageUrl,
+        })
+      : bad('Two-factor sign-in is not available', setup.message, 'NotAvailable', 400)
+  })
+  router.handle('PostUserCurrent2faByProviderName', async (ctx) => {
+    const provider = provided(ctx)
+    if (!provider) return noProvider()
+    const b = await body(ctx)
+    const enabled = await provider.enable(me(ctx).id, str(b.code), str(b.secret))
+    return enabled.ok
+      ? Response.json({ $type: 'TwoFactorRecoveryCodes', recoveryCodes: enabled.recoveryCodes })
+      : refused(enabled.message)
+  })
+  router.handle('DeleteUserCurrent2faByProviderName', async (ctx) => {
+    const provider = provided(ctx)
+    if (!provider) return noProvider()
+    const disabled = await provider.disable(me(ctx).id, ctx.url.searchParams.get('code') ?? '')
+    return disabled.ok ? ok() : refused(disabled.message)
+  })
   router.handle('GetUserById2fa', async (ctx) => {
     const found = await users.get(me(ctx), ctx.params.id as string)
-    return found.status === 'Success' ? Response.json([]) : status(found.status)
+    if (found.status !== 'Success') return status(found.status)
+    return Response.json(twoFactor ? await twoFactor.list(ctx.params.id as string) : [])
   })
-  router.handle('DeleteUserById2faByProviderName', noProvider)
-  // External backoffice logins arrive with story 031's providers.
-  router.handle('GetUserCurrentLoginProviders', () => Response.json([]))
+  router.handle('DeleteUserById2faByProviderName', async (ctx) => {
+    const provider = provided(ctx)
+    if (!provider) return noProvider()
+    // Who may manage this user, by the same rule every user operation follows.
+    const found = await users.get(me(ctx), ctx.params.id as string)
+    if (found.status !== 'Success') return status(found.status)
+    await provider.reset(ctx.params.id as string)
+    return ok()
+  })
+  router.handle('GetUserCurrentLoginProviders', async (ctx) =>
+    Response.json((await users.loginProviders?.(me(ctx))) ?? []),
+  )
 
   router.handle('PostSecurityForgotPassword', async (ctx) => {
     await users.forgotPassword(str((await body(ctx)).email).trim())

package/src/ports-users.ts

@@ -86,7 +86,26 @@ export interface UserUpdateInput {
 
 export type Result<T> = { status: 'Success'; value: T } | { status: Exclude<UserStatus, 'Success'> }
 
+/** Two-factor sign-in for users (story 032): the one authenticator provider. */
+export interface UserTwoFactorPort {
+  providerName: string
+  list(userKey: string): Promise<Array<{ providerName: string; isEnabledOnUser: boolean }>>
+  setup(
+    account: string,
+  ): { ok: true; secret: string; qrCodeSetupImageUrl: string } | { ok: false; message: string }
+  enable(
+    userKey: string,
+    code: string,
+    secret: string,
+  ): Promise<{ ok: true; recoveryCodes: string[] } | { ok: false; message: string }>
+  disable(userKey: string, code: string): Promise<{ ok: true } | { ok: false; message: string }>
+  /** An administrator turning it off for someone who lost their phone. */
+  reset(userKey: string): Promise<void>
+}
+
 export interface UserPort {
+  /** Two-factor sign-in, when the server offers it. */
+  twoFactor?: UserTwoFactorPort
   list(principal: Principal, skip: number, take: number): Promise<Page<UserResponse>>
   filter(principal: Principal, query: UserFilter): Promise<Page<UserResponse>>
   get(principal: Principal, key: string): Promise<Result<UserResponse>>
@@ -138,6 +157,8 @@ export interface UserPort {
   ): Promise<Array<{ nodeKey: string; permissions: string[] }>>
   configuration(): ResponseOf<'GetUserConfiguration'>
   currentConfiguration(): ResponseOf<'GetUserCurrentConfiguration'>
+  /** The backoffice identity providers, and which the caller has signed in with (story 031). */
+  loginProviders?(principal: Principal): Promise<ResponseOf<'GetUserCurrentLoginProviders'>>
   passwordConfiguration(): ResponseOf<'GetSecurityConfiguration'>['passwordConfiguration']
   /** Anonymous: sends a reset link when the address belongs to a user; says nothing either way. */
   forgotPassword(email: string): Promise<void>