@crombolo/server 0.13.2 → 0.14.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crombolo/server",
-  "version": "0.13.2",
+  "version": "0.14.4",
   "description": "The crombolo HTTP server: routing, configuration, media stores and background jobs.",
   "license": "MIT",
   "author": "Crombolo",
@@ -28,17 +28,17 @@
     "access": "public"
   },
   "dependencies": {
-    "@crombolo/api-delivery": "0.13.2",
-    "@crombolo/api-management": "0.13.2",
-    "@crombolo/assistant": "0.13.2",
-    "@crombolo/auth": "0.13.2",
-    "@crombolo/backoffice-host": "0.13.2",
-    "@crombolo/contracts": "0.13.2",
-    "@crombolo/core": "0.13.2",
-    "@crombolo/data": "0.13.2",
-    "@crombolo/render": "0.13.2",
-    "@crombolo/schema": "0.13.2",
-    "@crombolo/transfer": "0.13.2",
+    "@crombolo/api-delivery": "0.14.4",
+    "@crombolo/api-management": "0.14.4",
+    "@crombolo/assistant": "0.14.4",
+    "@crombolo/auth": "0.14.4",
+    "@crombolo/backoffice-host": "0.14.4",
+    "@crombolo/contracts": "0.14.4",
+    "@crombolo/core": "0.14.4",
+    "@crombolo/data": "0.14.4",
+    "@crombolo/render": "0.14.4",
+    "@crombolo/schema": "0.14.4",
+    "@crombolo/transfer": "0.14.4",
     "@logtape/logtape": "^2.3.8"
   }
 }

package/src/adapters/bundles.ts

@@ -8,7 +8,6 @@
  * items as the `.udt` the dictionary already exports. The build is composition,
  * which is why a bundle can carry everything the builder UI offers.
  */
-import { join } from 'node:path'
 import {
   type BuiltPackage,
   type FileSystemPort,
@@ -23,31 +22,15 @@ import {
   type Bundle,
   BundleRepository,
   type ComponentFileStore,
-  ComponentRepository,
-  currentSchemaState,
   type Db,
-  DictionaryRepository,
   type NodeRow,
   resolveNodeRef,
 } from '@crombolo/data'
 import {
-  exportSchemaSet,
-  fileNameFor,
-  type SchemaSet,
-  writeContentType,
-  writeDataType,
-  writeLanguages,
-  writeMediaType,
-  writeSchemaVersion,
-} from '@crombolo/schema'
-import {
-  BUNDLE_SECTIONS,
   type BundleBlob,
   type BundleDependency,
-  type BundleFile,
   type BundleKind,
   type BundleNode,
-  type BundleSection,
   bundleIdFor,
   bundlePeerRange,
   type ContentSet,
@@ -58,9 +41,9 @@ import {
   writeBundlePackage,
 } from '@crombolo/transfer'
 import { VERSION } from '../config.ts'
-import { dictionaryToUdt, writeDictionaryUdt } from '../dictionary-transfer.ts'
 import { readBlobs } from '../media-files.ts'
 import type { MediaStore } from '../media-store.ts'
+import { siteSections } from '../site-sections.ts'
 import { writeNpmTarball } from '../tar.ts'
 
 /** The npm package a definition is built as: what was set on it, or what its name gives. */
@@ -119,48 +102,6 @@ const stored = <T extends PackageDefinitionInput>(input: T) => ({
   components: [...input.templates, ...input.partialViews],
 })
 
-/** Matches a selection against a type's key or its alias, since the UI sends either. */
-const picks = (selected: readonly string[]) => {
-  const wanted = new Set(selected.map((value) => value.trim().toLowerCase()))
-  return (type: { key?: string; alias: string }): boolean =>
-    wanted.has(type.alias.toLowerCase()) ||
-    (type.key !== undefined && wanted.has(type.key.toLowerCase()))
-}
-
-/** The selected slice of the site's schema, as the files `schema/` would hold. */
-function schemaEntries(set: SchemaSet, from: PackageDefinition): BundleFile[] {
-  const entries: BundleFile[] = []
-  const put = (path: string, text: string) =>
-    entries.push({ path: `${BUNDLE_SECTIONS.schema}/${path}`, text })
-
-  const contentTypes = set.contentTypes.filter(picks(from.contentTypes))
-  const mediaTypes = (set.mediaTypes ?? []).filter(picks(from.mediaTypes))
-  // Member types have no picker in the builder, and the contract's definition
-  // has no field for them, so a bundle never carries one.
-  const dataTypes = set.dataTypes.filter(picks(from.dataTypes))
-  const languages = set.languages.filter((language) =>
-    from.languages.some((pick) => pick.toLowerCase() === language.iso.toLowerCase()),
-  )
-
-  if (
-    contentTypes.length === 0 &&
-    mediaTypes.length === 0 &&
-    dataTypes.length === 0 &&
-    languages.length === 0
-  )
-    return entries
-
-  put('schema.toml', writeSchemaVersion(set.version))
-  for (const type of contentTypes)
-    put(join('content-types', fileNameFor(type.alias)), writeContentType(type))
-  for (const type of mediaTypes)
-    put(join('media-types', fileNameFor(type.alias)), writeMediaType(type))
-  for (const type of dataTypes)
-    put(join('data-types', fileNameFor(type.alias)), writeDataType(type))
-  if (languages.length > 0) put('languages.toml', writeLanguages(languages))
-  return entries
-}
-
 /**
  * Several exports as one bundle: the nodes deduped by key, the counts summed,
  * and the dependencies and selector unioned, so the manifest describes what the
@@ -227,73 +168,6 @@ export function createPackagePort(db: Db, options: PackagePortOptions): PackageP
   const validate = (input: PackageDefinitionInput): PackageWriteResult | undefined =>
     input.name.length === 0 ? { ok: false, status: 'InvalidName' } : undefined
 
-  /**
-   * The files a selection of file-system paths resolves to, under one section.
-   *
-   * The section is a logical name — `styles`, not `css` — because a site holds
-   * these wherever it is configured to, and the importer is what maps a section
-   * onto a directory.
-   */
-  const fileEntries = async (
-    port: FileSystemPort | undefined,
-    paths: readonly string[],
-    section: BundleSection,
-  ): Promise<BundleFile[]> => {
-    if (!port) return []
-    const files: BundleFile[] = []
-    for (const path of paths) {
-      const file = await port.read(path)
-      if (!file) continue
-      const relative = file.path.replace(/^\/+/, '')
-      files.push({ path: `${BUNDLE_SECTIONS[section]}/${relative}`, text: file.content })
-    }
-    return files
-  }
-
-  const componentEntries = async (keys: readonly string[]): Promise<BundleFile[]> => {
-    if (keys.length === 0) return []
-    const templates = new ComponentRepository(db, options.componentFiles)
-    const all = await templates.all()
-    const wanted = new Set(keys.map((key) => key.trim().toLowerCase()))
-    const files: BundleFile[] = []
-    for (const template of all) {
-      if (!wanted.has(template.key.toLowerCase()) && !wanted.has(template.alias.toLowerCase()))
-        continue
-      files.push({
-        path: `${BUNDLE_SECTIONS.components}/${template.alias}.tsx`,
-        text: template.content ?? '',
-      })
-    }
-    return files
-  }
-
-  /**
-   * The components a bundle carries, from one list that holds two kinds of
-   * name.
-   *
-   * The contract has `templates` and `partialViews`; this side has one list, so
-   * a picked component arrives either as a template alias — a row in
-   * `template`, whose file is read through the alias — or as a path in the
-   * components tree. Both are tried and the results are keyed by path, so a
-   * component picked both ways is carried once.
-   */
-  const componentSection = async (picked: readonly string[]): Promise<BundleFile[]> => {
-    const byPath = new Map<string, BundleFile>()
-    for (const file of await componentEntries(picked)) byPath.set(file.path, file)
-    for (const file of await fileEntries(options.components, picked, 'components'))
-      byPath.set(file.path, file)
-    return [...byPath.values()]
-  }
-
-  const dictionaryEntries = async (keys: readonly string[]): Promise<BundleFile[]> => {
-    if (keys.length === 0) return []
-    const repo = new DictionaryRepository(db)
-    const items = []
-    for (const key of keys) items.push(...(await dictionaryToUdt(repo, key)))
-    if (items.length === 0) return []
-    return [{ path: `${BUNDLE_SECTIONS.dictionary}.udt`, text: writeDictionaryUdt(items) }]
-  }
-
   /**
    * The content, media and element picks as one transfer bundle, blobs included.
    *
@@ -404,18 +278,25 @@ export function createPackagePort(db: Db, options: PackagePortOptions): PackageP
       const from = definition(row)
       const pkg = bundlePackageOf(row)
 
-      // The schema version the site is actually at, so the files a package
-      // carries say where they came from rather than claiming version 0.
-      const state = await currentSchemaState(db).catch(() => undefined)
-      const schema = await exportSchemaSet(db, state?.version ?? '0')
-
-      const sections: BundleFile[] = [
-        ...schemaEntries(schema, from),
-        ...(await componentSection([...from.templates, ...from.partialViews])),
-        ...(await fileEntries(options.stylesheets, from.stylesheets, 'styles')),
-        ...(await fileEntries(options.scripts, from.scripts, 'scripts')),
-        ...(await dictionaryEntries(from.dictionaryItems)),
-      ]
+      const sections = await siteSections(
+        {
+          db,
+          componentFiles: options.componentFiles,
+          components: options.components,
+          stylesheets: options.stylesheets,
+          scripts: options.scripts,
+        },
+        {
+          contentTypes: from.contentTypes,
+          mediaTypes: from.mediaTypes,
+          dataTypes: from.dataTypes,
+          languages: from.languages,
+          components: [...from.templates, ...from.partialViews],
+          stylesheets: from.stylesheets,
+          scripts: from.scripts,
+          dictionaryItems: from.dictionaryItems,
+        },
+      )
 
       const content = await contentEntries(from)
       // A package with nothing picked is still a bundle: an empty selection

package/src/adapters/members.ts

@@ -12,9 +12,9 @@
  * - **Passwords.** Plaintext arrives here and nowhere deeper; a change of one
  *   rotates the security stamp, which ends the member's sessions.
  *
- * `kind` is always `Default`: Umbraco reports `Api` only for a Delivery API
- * client-credentials member and `ExternalOnly` only for one in its lightweight
- * external-member table, and we have neither.
+ * `kind` is `Api` for a Delivery API client-credentials member, `ExternalOnly`
+ * for one with no password, who signs in only through an identity provider,
+ * and `Default` otherwise.
  */
 import type {
   MemberFilterCriteria,
@@ -37,6 +37,7 @@ import {
   type DocumentRepositoryOptions,
   type MemberCredentials,
   MemberRepository,
+  TwoFactorRepository,
   type ValueIntake,
   WriteRejectedError,
 } from '@crombolo/data'
@@ -60,10 +61,18 @@ const notFound = () => ({
 
 export function createMemberPort(db: Db, options: MemberPortOptions = {}): MemberPort {
   const apiMembers = new Set((options.apiMemberUserNames ?? []).map((n) => n.toLowerCase()))
-  const kindOf = (userName: string): 'Api' | 'Default' =>
-    apiMembers.has(userName.toLowerCase()) ? 'Api' : 'Default'
+  // A member with no password of their own signs in only through an identity
+  // provider (story 031): Umbraco's `ExternalOnly`, which the workspace shows
+  // with the username read-only and the password optional.
+  const kindOf = (member: MemberCredentials): 'Api' | 'ExternalOnly' | 'Default' =>
+    apiMembers.has(member.username.toLowerCase())
+      ? 'Api'
+      : member.passwordHash
+        ? 'Default'
+        : 'ExternalOnly'
   const members = new MemberRepository(db, options)
   const memberTypes = new ContentTypeRepository(db, { kind: 'member' })
+  const twoFactor = new TwoFactorRepository(db)
 
   const userIdOf = async (principal: Principal): Promise<number | undefined> => {
     const rows = await db.query<{ id: number }>('SELECT id FROM user_account WHERE key = ?', [
@@ -111,14 +120,13 @@ export function createMemberPort(db: Db, options: MemberPortOptions = {}): Membe
       },
       isApproved: member.isApproved,
       isLockedOut: member.isLockedOut,
-      // No second factor is offered yet, so no member has one enabled.
-      isTwoFactorEnabled: false,
+      isTwoFactorEnabled: (await twoFactor.providers(member.key)).length > 0,
       failedPasswordAttempts: member.failedPasswordAttempts,
       lastLoginDate: member.lastLoginDate?.toISOString() ?? null,
       lastLockoutDate: member.lastLockoutDate?.toISOString() ?? null,
       lastPasswordChangeDate: member.lastPasswordChangeDate?.toISOString() ?? null,
       groups: await members.groupKeys(member.key),
-      kind: kindOf(member.username),
+      kind: kindOf(member),
       profileData: null,
       flags: [],
       values: content.values
@@ -144,7 +152,7 @@ export function createMemberPort(db: Db, options: MemberPortOptions = {}): Membe
     id: member.key,
     memberType: { id: member.contentTypeKey, icon: member.contentTypeIcon ?? 'icon-user' },
     variants: [{ name: member.name, culture: null }],
-    kind: kindOf(member.username),
+    kind: kindOf(member),
     flags: [],
   })
 
@@ -239,7 +247,11 @@ export function createMemberPort(db: Db, options: MemberPortOptions = {}): Membe
             groupKeys: input.groupKeys,
           },
         )
-        return updated ? { ok: true as const } : notFound()
+        if (!updated) return notFound()
+        // The workspace's two-factor toggle can only be turned off: an
+        // administrator's reset for a member who lost their phone (story 032).
+        if (!input.isTwoFactorEnabled) await twoFactor.disable(key)
+        return { ok: true as const }
       } catch (error) {
         return failure(error)
       }

package/src/adapters/schema-proposals.ts

@@ -36,6 +36,7 @@ import type { CromboloConfig } from '../config.ts'
 import { formTypesFor } from '../form-types.ts'
 import { logger } from '../logging.ts'
 import { componentAliasesIn, importSchema } from '../schema.ts'
+import { publishSchema, useSchemaStore } from '../schema-store.ts'
 
 const log = logger('schema')
 
@@ -124,6 +125,9 @@ export function createSchemaProposals(options: SchemaProposalOptions): SchemaPro
         return { ok: false, error: problems.map((problem) => problem.message).join('; ') }
       }
 
+      // Fresh from the store first, then written, imported and published without
+      // materialising again, which would lay the store's copy over this write.
+      await useSchemaStore(config)
       const path = pathFor(kind, alias)
       const versionFile = join(config.schemaDir, 'schema.toml')
       const previous = existsSync(path) ? await readFile(path, 'utf8') : undefined
@@ -143,14 +147,17 @@ export function createSchemaProposals(options: SchemaProposalOptions): SchemaPro
       // is nothing left to compare. The version moves in the same breath, or the
       // import lands at a version the other nodes already have and they never
       // learn they are behind.
-      const ahead = await importSchema(options.db, config, options.boot, { dryRun: true })
+      const ahead = await importSchema(options.db, config, options.boot, {
+        dryRun: true,
+        materialise: false,
+      })
       const { version, urls } = loadSchemaDirectory(config.schemaDir, {
         formTypes: formTypesFor(config),
       }).set
       const next = nextSchemaVersion(version, ahead.classification)
       if (next !== version) await writeFile(versionFile, writeSchemaVersion(next, urls), 'utf8')
 
-      const result = await importSchema(options.db, config, options.boot)
+      const result = await importSchema(options.db, config, options.boot, { materialise: false })
       if (result.report && result.report.action !== 'applied') {
         // Put the files back: a refused import leaves the site with a file it will
         // not accept, which is worse than the change not having happened.
@@ -160,6 +167,7 @@ export function createSchemaProposals(options: SchemaProposalOptions): SchemaPro
           error: result.report.reason ?? `the import was ${result.report.action}`,
         }
       }
+      if (config.schemaStore) await publishSchema(config.schemaStore, config.schemaDir)
       await options.afterSync?.(result.report)
       log.info('{alias} applied from a proposal: {classification}, schema at {version}', {
         alias,

package/src/adapters/users.ts

@@ -41,6 +41,8 @@ import {
 import {
   type Db,
   DbDate,
+  ExternalLoginRepository,
+  externalLoginProvider,
   type GranularPermission,
   SUPER_USER_KEY,
   UserDataRepository,
@@ -106,7 +108,12 @@ type Tree = 'document' | 'media' | 'element'
 export interface UserPortOptions {
   config: Pick<
     CromboloConfig,
-    'usernameIsEmail' | 'applicationUrl' | 'sendUserLink' | 'allowPasswordReset' | 'backOfficePath'
+    | 'usernameIsEmail'
+    | 'applicationUrl'
+    | 'sendUserLink'
+    | 'allowPasswordReset'
+    | 'backOfficePath'
+    | 'backofficeIdentityProviders'
   >
   mediaFiles: MediaFileStore
   nodes: NodeLookup
@@ -276,6 +283,21 @@ export function createUserPorts(
     }),
     passwordConfiguration: () => DEFAULT_PASSWORD_CONFIGURATION,
 
+    // Linking happens by signing in through the provider; the profile only lists it.
+    async loginProviders(principal) {
+      const linked = await new ExternalLoginRepository(db).forOwner(principal.id)
+      return config.backofficeIdentityProviders.map((provider) => {
+        const scheme = externalLoginProvider('user', provider.oidc.id)
+        const link = linked.find((l) => l.loginProvider.toLowerCase() === scheme.toLowerCase())
+        return {
+          providerSchemeName: scheme,
+          providerKey: link?.providerKey ?? null,
+          isLinkedOnUser: Boolean(link),
+          hasManualLinkingEnabled: false,
+        }
+      })
+    },
+
     async list(principal, skip, take) {
       const admin = await adminKey()
       const visible = (await users.all()).filter(await visibleTo(principal))

package/src/api-client.ts

@@ -0,0 +1,47 @@
+/**
+ * The API client an unattended install seeds (story 034): an API user in the
+ * administrators group, holding the configured client, so a pipeline can sign
+ * in with the client-credentials grant on a site whose backoffice only takes an
+ * identity provider. Created once; a client that exists is never rotated from
+ * config. `docs/operations.md`.
+ */
+import { hashPassword } from '@crombolo/auth'
+import { ADMIN_GROUP_ALIAS } from '@crombolo/core'
+import { BUILT_IN_GROUPS, closeSetup, type Db, UserRepository } from '@crombolo/data'
+import { recordAudit } from './adapters/audit.ts'
+
+/** Seeds the client when no user holds its id; `existed` when one already does. */
+export async function ensureApiClient(
+  db: Db,
+  client: { id: string; secret: string },
+): Promise<'created' | 'existed'> {
+  const users = new UserRepository(db)
+  if (await users.clientCredentialOwner(client.id)) {
+    // A machine can already administer the site, so the browser setup step goes.
+    await closeSetup(db)
+    return 'existed'
+  }
+  const admins = BUILT_IN_GROUPS.find((group) => group.alias === ADMIN_GROUP_ALIAS)
+  const created = await users.create({
+    key: crypto.randomUUID(),
+    name: 'API client',
+    userName: client.id,
+    email: '',
+    kind: 'Api',
+    groupKeys: admins ? [admins.key] : [],
+    languageIsoCode: null,
+  })
+  if (!created) throw new Error(`The API client ${client.id} could not be created.`)
+  await users.addClientCredential(created.id, client.id, await hashPassword(client.secret))
+  await closeSetup(db)
+  await recordAudit(db, {
+    category: 'user',
+    action: 'Create',
+    source: 'cli',
+    entityType: 'User',
+    entityKey: created.key,
+    entityName: client.id,
+    detail: 'API client seeded from CROMBOLO_API_CLIENT_ID',
+  })
+  return 'created'
+}

package/src/backoffice-external.ts

@@ -0,0 +1,99 @@
+/**
+ * Backoffice users signing in through an identity provider (story 031): the
+ * user side of `external-sign-in.ts`. A sign-in ends in the same session a
+ * password sign-in does, so the authorize endpoint carries on from there.
+ */
+import type { AuthService } from '@crombolo/auth'
+import { type Db, UserGroupRepository, type UserRecord, UserRepository } from '@crombolo/data'
+import type { ExternalAccount, ExternalSignInAudience } from './external-sign-in.ts'
+import type { IdentityProvider } from './identity-providers.ts'
+
+/** Where backoffice sign-ins through a provider answer, under the security path the login uses. */
+export const BACKOFFICE_EXTERNAL_PATH = '/umbraco/management/api/v1/security/back-office/external'
+
+export function backofficeAudience(
+  db: Db,
+  options: {
+    auth: AuthService
+    providers: readonly IdentityProvider[]
+    backOfficePath: string
+    /** The `Set-Cookie` value for a new backoffice session. */
+    sessionCookie(sessionId: string): string
+    clientAddress?(request: Request): string | undefined
+    /** Called once a user is signed in, for the audit log. */
+    onSignIn?(user: UserRecord, request: Request): Promise<void>
+  },
+): ExternalSignInAudience {
+  const users = new UserRepository(db)
+  const groups = new UserGroupRepository(db)
+
+  const aliasesOf = async (user: UserRecord) => {
+    const found = await groups.byKeys(user.groupKeys)
+    return found.map((g) => g.alias)
+  }
+  const keysOf = async (aliases: readonly string[]) => {
+    const all = await groups.all()
+    return aliases.flatMap((alias) => {
+      const group = all.find((g) => g.alias.toLowerCase() === alias.toLowerCase())
+      return group ? [group.key] : []
+    })
+  }
+  const asAccount = async (user: UserRecord): Promise<ExternalAccount> => ({
+    key: user.key,
+    email: user.email,
+    groups: await aliasesOf(user),
+  })
+
+  return {
+    audience: 'user',
+    providers: options.providers,
+    basePath: BACKOFFICE_EXTERNAL_PATH,
+    byKey: async (key) => {
+      const user = await users.byKey(key)
+      return user ? asAccount(user) : undefined
+    },
+    byEmail: async (email) => {
+      const user = await users.byEmail(email)
+      return user ? asAccount(user) : undefined
+    },
+    create: async (identity, provider, groupAliases) => {
+      const email = identity.email as string
+      const userName = (await users.byUserName(email))
+        ? `${provider.oidc.id}-${identity.subject}`
+        : email
+      const created = await users.create({
+        key: crypto.randomUUID(),
+        name: identity.name || email,
+        userName,
+        email,
+        kind: 'Default',
+        groupKeys: await keysOf(groupAliases),
+        languageIsoCode: null,
+      })
+      if (!created) throw new Error(`A user for ${email} could not be created.`)
+      return asAccount(created)
+    },
+    setGroups: async (account, groupAliases) => {
+      await users.setGroups([account.key], await keysOf(groupAliases))
+    },
+    signIn: async (account, request) => {
+      const user = await users.byKey(account.key)
+      if (!user) return { refused: 'This account no longer exists.' }
+      const result = await options.auth.signInExternally(
+        user.userName,
+        options.clientAddress?.(request),
+      )
+      if (result.status !== 'success')
+        return {
+          refused:
+            result.reason === 'lockedOut'
+              ? 'This account is locked out.'
+              : 'This account is not allowed to sign in yet.',
+        }
+      await options.onSignIn?.(user, request)
+      return { cookies: [options.sessionCookie(result.sessionId)] }
+    },
+    failed: (returnUrl, reason) =>
+      `${options.backOfficePath}/login?returnUrl=${encodeURIComponent(returnUrl)}&externalLoginError=${encodeURIComponent(reason)}`,
+  }
+}