@easy-cms/core 0.47.3 → 0.47.4

package/dist/index.d.ts

@@ -2957,6 +2957,8 @@ interface EndpointRequest {
     readonly cms: EasyCMS;
     /** The request's JSON body, which must be an object (at most 1 MB). */
     json(): Promise<Record<string, unknown>>;
+    /** The request's body as text, as sent (at most 1 MB), e.g. to check a webhook's signature. */
+    text(): Promise<string>;
 }
 /**
  * Work that runs with the scheduled jobs: every minute in a server, or each time a cron calls

package/dist/index.js

@@ -1690,6 +1690,14 @@ var SingleSignOn = class {
       if (!email2 || !profile.emailVerified)
         return await back("login", email2 ? "unverified" : "no-account");
       user = await this.userByEmail(email2);
+      if (user && user.emailVerified === false) {
+        const { id, ...rest } = user;
+        user = await this.cms.db.update({
+          collection: USERS,
+          id,
+          data: { ...rest, emailVerified: true, passwordHash: null }
+        });
+      }
       if (!user) user = await this.signUp(email2, profile.name);
       if (!user) return await back("login", "no-account");
       await this.addIdentity(user.id, provider.id, subject, email2);
@@ -1742,7 +1750,7 @@ var SingleSignOn = class {
     const row = await this.cms.db.findById({ collection: USER_IDENTITIES, id: identityId });
     if (!row) throw new NotFoundError(USER_IDENTITIES, identityId);
     const own = String(row.user) === String(actor.id);
-    if (!own && (actor.role !== "admin" || actor.apiKey)) throw new ForbiddenError();
+    if (!own && (!isSystemAdmin(actor) || actor.apiKey)) throw new ForbiddenError();
     const user = await this.cms.db.findById({ collection: USERS, id: row.user });
     const others = (await this.identities(row.user)).length - 1;
     const password = !!user?.passwordHash && this.passwordAllowed(user);
@@ -1994,8 +2002,16 @@ var Auth = class {
       throw new QueryError("Signing up needs `email` in the config, and a site URL in production");
     const existing = email2 ? await this.findByEmail(email2) : void 0;
     if (existing && verify) {
-      if (existing.emailVerified === false && existing.active !== false)
-        await this.mailVerifyLink(existing, args);
+      if (existing.emailVerified === false && existing.active !== false) {
+        await this.cms.update(USERS, existing.id, { password: args.password }, {
+          context: args.context ?? {}
+        });
+        const pending = await this.db.findById({
+          collection: USERS,
+          id: existing.id
+        });
+        await this.mailVerifyLink(pending, args);
+      }
       return { verify: true };
     }
     const created = await this.cms.create(
@@ -2030,14 +2046,15 @@ var Auth = class {
     const claims = readPasswordToken(token);
     const id = claims && (/^\d+$/.test(claims.userId) ? Number(claims.userId) : claims.userId);
     const user = claims && claims.purpose === "verify" && claims.expiresAt > Date.now() && id !== null ? await this.db.findById({ collection: USERS, id }) : null;
-    if (!user || user.active === false || !passwordTokenMatches(this.config.secret, token, passwordFingerprint(user.passwordHash))) {
+    if (!user || user.active === false || // A link confirms once: it doesn't sign in again afterwards.
+    user.emailVerified !== false || !passwordTokenMatches(this.config.secret, token, passwordFingerprint(user.passwordHash))) {
       await this.recordFailure(key2);
       throw new ValidationError(USERS, [
         { field: "token", message: "This link has expired or is not valid" }
       ]);
     }
     await this.clearFailures(key2);
-    if (user.emailVerified === false) {
+    {
       const { id: _id, ...rest } = user;
       await this.db.update({
         collection: USERS,
@@ -3988,12 +4005,41 @@ for (const [net, prefix] of [
   ["ff00::", 8]
 ])
   PRIVATE.addSubnet(net, prefix, "ipv6");
+var EMBEDS_IPV4 = new BlockList();
+EMBEDS_IPV4.addSubnet("64:ff9b::", 96, "ipv6");
+EMBEDS_IPV4.addSubnet("::", 96, "ipv6");
+function embeddedIPv4(address) {
+  if (address === "::" || address === "::1" || !EMBEDS_IPV4.check(address, "ipv6")) return void 0;
+  const bytes = ipv6Bytes(address);
+  return bytes ? bytes.slice(12).join(".") : void 0;
+}
+function ipv6Bytes(address) {
+  let text2 = address;
+  const tail = /(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(text2);
+  if (tail) {
+    const [a, b, c, d] = tail.slice(1).map(Number);
+    text2 = `${text2.slice(0, tail.index)}${(a << 8 | b).toString(16)}:${(c << 8 | d).toString(16)}`;
+  }
+  const [head = "", rest] = text2.split("::");
+  const left = head ? head.split(":") : [];
+  const right = rest === void 0 ? [] : rest ? rest.split(":") : [];
+  const groups = rest === void 0 ? left : [...left, ...Array(8 - left.length - right.length).fill("0"), ...right];
+  if (groups.length !== 8) return void 0;
+  return groups.flatMap((g) => {
+    const n = Number.parseInt(g, 16);
+    return [n >> 8, n & 255];
+  });
+}
 function isPrivateAddress(address) {
   const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(address);
   if (mapped?.[1]) return PRIVATE.check(mapped[1], "ipv4");
   const family = isIP(address);
   if (family === 4) return PRIVATE.check(address, "ipv4");
-  if (family === 6) return PRIVATE.check(address, "ipv6");
+  if (family === 6) {
+    const embedded = embeddedIPv4(address);
+    if (embedded) return PRIVATE.check(embedded, "ipv4");
+    return PRIVATE.check(address, "ipv6");
+  }
   return true;
 }
 function hostAllowed(host, allowedHosts) {
@@ -6584,9 +6630,10 @@ var EasyCMS = class {
     if (!Number.isInteger(limit) || limit < 0)
       throw new QueryError("limit must be a non-negative integer");
     if (!Number.isInteger(page) || page < 1) throw new QueryError("page must be a positive integer");
+    const draft = readsDrafts(guard, options.draft);
     const where = this.whereFor(
       config,
-      draftWhere(config, options.draft, await this.readWhere(config, guard, options.where)),
+      draftWhere(config, draft, await this.readWhere(config, guard, options.where)),
       options
     );
     const requested = options.sort === void 0 ? ["-createdAt"] : [options.sort].flat();
@@ -6599,8 +6646,8 @@ var EasyCMS = class {
       this.config.localization?.locales ?? []
     );
     const result = await this.db.find({ collection: collection2, where, sort, limit, page });
-    const found = options.draft ? await this.withDrafts(config, result.docs) : result.docs;
-    const docs = await this.output(config, found, guard, options);
+    const found = draft ? await this.withDrafts(config, result.docs) : result.docs;
+    const docs = await this.output(config, found, guard, { ...options, draft });
     return { ...result, docs };
   }
   async findById(collection2, id, options = {}) {
@@ -6608,9 +6655,10 @@ var EasyCMS = class {
     const guard = guardOf(options);
     const parsed = parseId(id);
     if (parsed === void 0) return null;
+    const draft = readsDrafts(guard, options.draft);
     const where = this.whereFor(
       config,
-      draftWhere(config, options.draft, await this.readWhere(config, guard, void 0)),
+      draftWhere(config, draft, await this.readWhere(config, guard, void 0)),
       options
     );
     const doc = where ? (await this.db.find({
@@ -6621,8 +6669,8 @@ var EasyCMS = class {
       page: 1
     })).docs[0] : await this.db.findById({ collection: collection2, id: parsed });
     if (!doc) return null;
-    const [current] = options.draft ? await this.withDrafts(config, [doc]) : [doc];
-    const [out] = await this.output(config, [current], guard, options);
+    const [current] = draft ? await this.withDrafts(config, [doc]) : [doc];
+    const [out] = await this.output(config, [current], guard, { ...options, draft });
     return out ?? null;
   }
   async count(collection2, options = {}) {
@@ -6631,7 +6679,7 @@ var EasyCMS = class {
       config,
       draftWhere(
         config,
-        options.draft,
+        readsDrafts(guardOf(options), options.draft),
         await this.readWhere(config, guardOf(options), options.where)
       ),
       options
@@ -7492,7 +7540,7 @@ var EasyCMS = class {
   /** A global as stored under `key` (see `globalKey`); empty when there is no key. */
   async readGlobal(config, key2, guard, options) {
     const saved = key2 ? await this.db.findGlobal({ slug: key2 }) : null;
-    const stored = saved && options.draft ? await this.globalDraft(config, saved, key2) : saved;
+    const stored = saved && readsDrafts(guard, options.draft) ? await this.globalDraft(config, saved, key2) : saved;
     const data = fillMissing(
       config.fields,
       applyDefaults(config.fields, stored ?? {}, this.config.localization)
@@ -8220,6 +8268,7 @@ var EasyCMS = class {
       );
       return await stripFields(target.fields, hooked, read2);
     };
+    const drafts = readsDrafts(guard, options.draft);
     const load = async (target, ids) => {
       const where = await this.readWhere(target, guard, { id: { in: [...ids] } }).catch((error) => {
         if (error instanceof ForbiddenError || error instanceof UnauthorizedError) return null;
@@ -8228,12 +8277,12 @@ var EasyCMS = class {
       if (where === null) return [];
       const found = await this.db.find({
         collection: target.slug,
-        where: this.whereFor(target, draftWhere(target, options.draft, where), options),
+        where: this.whereFor(target, draftWhere(target, drafts, where), options),
         sort: [],
         limit: 0,
         page: 1
       });
-      const docs2 = options.draft ? await this.withDrafts(target, found.docs) : found.docs;
+      const docs2 = drafts ? await this.withDrafts(target, found.docs) : found.docs;
       return Promise.all(
         docs2.map((d) => finish(target, this.pick(target, d, options)))
       );
@@ -8761,6 +8810,9 @@ function guardOf(options) {
     context: options.context ?? NO_CONTEXT
   };
 }
+function readsDrafts(guard, draft) {
+  return draft === true && (!guard.enforce || guard.user !== null && guard.user.member !== true);
+}
 function deny(user) {
   return user ? new ForbiddenError() : new UnauthorizedError();
 }
@@ -9517,7 +9569,7 @@ async function adminSearch(cms, who, q, perCollection = 5) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.47.3" : "0.0.0-dev";
+var VERSION = true ? "0.47.4" : "0.0.0-dev";
 
 // src/rest/admin-status.ts
 var DAY2 = 864e5;
@@ -9860,7 +9912,8 @@ async function customEndpoint(cms, ctx, method, segments, root, options) {
       context: ctx.context,
       ip: options.getClientIp?.(ctx.request),
       cms,
-      json: () => readJson(ctx.request)
+      json: () => readJson(ctx.request),
+      text: async () => new TextDecoder().decode(await readBody(ctx.request, MAX_BODY_BYTES))
     });
     return { body: body === void 0 ? null : body };
   }
@@ -10703,12 +10756,16 @@ async function readUpload(request, maxFileSize) {
       415
     );
   }
-  const declared = Number(request.headers.get("content-length") ?? 0);
-  if (declared > maxFileSize + 64 * 1024)
-    throw new PayloadTooLargeError(`File is larger than ${maxFileSize} bytes`);
+  const bytes = await readBody(request, maxFileSize + 64 * 1024).catch((error) => {
+    throw error instanceof HttpError && error.status === 413 ? new PayloadTooLargeError(`File is larger than ${maxFileSize} bytes`) : error;
+  });
   let form;
   try {
-    form = await request.formData();
+    form = await new Request(request.url, {
+      method: "POST",
+      headers: { "content-type": request.headers.get("content-type") ?? "" },
+      body: bytes
+    }).formData();
   } catch {
     throw new HttpError("Malformed multipart body", 400);
   }
@@ -10724,15 +10781,37 @@ async function readUpload(request, maxFileSize) {
     data
   };
 }
+async function readBody(request, max) {
+  const tooLarge = () => new HttpError("Request body too large", 413);
+  if (Number(request.headers.get("content-length") ?? 0) > max) throw tooLarge();
+  if (!request.body) return new Uint8Array();
+  const reader = request.body.getReader();
+  const chunks = [];
+  let size = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > max) {
+      reader.releaseLock();
+      throw tooLarge();
+    }
+    chunks.push(value);
+  }
+  const body = new Uint8Array(size);
+  let at = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, at);
+    at += chunk.byteLength;
+  }
+  return body;
+}
 async function readJson(request) {
   const type = request.headers.get("content-type") ?? "";
   if (!type.toLowerCase().startsWith("application/json")) {
     throw new HttpError("Content-Type must be application/json", 415);
   }
-  const declared = Number(request.headers.get("content-length") ?? 0);
-  if (declared > MAX_BODY_BYTES) throw new HttpError("Request body too large", 413);
-  const text2 = await request.text();
-  if (Buffer.byteLength(text2) > MAX_BODY_BYTES) throw new HttpError("Request body too large", 413);
+  const text2 = new TextDecoder().decode(await readBody(request, MAX_BODY_BYTES));
   let body;
   try {
     body = JSON.parse(text2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.47.3",
+  "version": "0.47.4",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",