@elytracms/studio 0.0.47 → 0.0.48

package/convex/auth.ts

@@ -1,5 +1,7 @@
 import { convexAuth } from '@convex-dev/auth/server'
 import { Password } from '@convex-dev/auth/providers/Password'
+import { ConvexError } from 'convex/values'
+import { classifyInviteSignup, normalizeInviteEmail } from '@elytracms/core/persistence'
 
 /** The provider list `convexAuth` accepts, derived from its own signature. */
 type ConvexAuthProviders = Parameters<typeof convexAuth>[0]['providers']
@@ -29,21 +31,68 @@ export function defineStudioAuth(options?: { providers?: ConvexAuthProviders })
     providers: options?.providers ?? [Password],
     callbacks: {
       /**
-       * First-principal admin bootstrap (EC-182 follow-up). On a freshly-provisioned
-       * deployment the `members` table is empty, so no one can pass the role guard and
-       * the studio is unreachable. Rather than require a manual seed step, the **first
-       * user to authenticate while the deployment has no members** is auto-granted
-       * `admin`. Once any membership exists this is a no-op (one indexed read) — further
-       * roles are assigned by an admin via `members:set`. Single-tenant: one `members`
-       * table per deployment. `beforeSessionCreation` fires on every sign-in (not just
-       * account creation), so it also recovers a member-less account and never lets a
-       * deployment lock itself out.
+       * Invite-based onboarding gate + first-principal bootstrap (EC-324 / EC-150).
+       * Fires on EVERY sign-in (not just account creation), right before the session
+       * is persisted — throwing here rejects the sign-in. The ONE decision lives in
+       * the pure `classifyInviteSignup` (shared with its tests):
+       *
+       * - **existing member** → normal re-sign-in; no-op (also recovers a member-less
+       *   account it created earlier and never lets the deployment lock itself out).
+       * - **first user** (no members yet) → bootstrap as `admin` (was the only case).
+       * - **invited** → grant the invited role + CONSUME the invite (delete the row).
+       * - **uninvited** → REJECT. This closes the open-sign-up hole (EC-304): an
+       *   anonymous person can no longer self-register into the deployment. The
+       *   `ConvexError` message ("not-invited: …") survives to the client even in
+       *   production, so the sign-in screen tells the truth.
+       *
+       * Single-tenant: one `members` table per deployment. Invite mechanism: a plain
+       * email allowlist (`invites` table) — the simplest server-enforced design, no
+       * token infrastructure.
        */
       async beforeSessionCreation(ctx, { userId }) {
-        const existing = await ctx.db.query('members').first()
-        if (existing) return
         const now = new Date().toISOString()
-        await ctx.db.insert('members', { userId, role: 'admin', createdAt: now, updatedAt: now })
+        // The convexAuth callback ctx is `AnyDataModel` (not schema-bound), so use
+        // `.filter()` rather than `.withIndex()` here. The members/invites tables are
+        // tiny (single-tenant), and this runs only at sign-in.
+        const existingMember = await ctx.db
+          .query('members')
+          .filter((q) => q.eq(q.field('userId'), userId))
+          .first()
+        const anyMember = existingMember ?? (await ctx.db.query('members').first())
+        const user = await ctx.db.get(userId)
+        const rawEmail = (user as { email?: string } | null)?.email
+        const email = rawEmail ? normalizeInviteEmail(rawEmail) : null
+        const invite = email
+          ? await ctx.db
+              .query('invites')
+              .filter((q) => q.eq(q.field('email'), email))
+              .first()
+          : null
+
+        const decision = classifyInviteSignup({
+          hasAnyMember: anyMember !== null,
+          existingRole: existingMember?.role ?? null,
+          invite: invite ? { role: invite.role } : null,
+        })
+
+        switch (decision.kind) {
+          case 'existing-member':
+            return
+          case 'bootstrap-admin':
+            await ctx.db.insert('members', { userId, role: 'admin', createdAt: now, updatedAt: now })
+            return
+          case 'grant-role':
+            await ctx.db.insert('members', {
+              userId,
+              role: decision.role,
+              createdAt: now,
+              updatedAt: now,
+            })
+            if (invite) await ctx.db.delete(invite._id)
+            return
+          case 'reject':
+            throw new ConvexError(decision.reason)
+        }
       },
     },
   })

package/convex/authority.ts

@@ -1,6 +1,11 @@
 import { checkAuthorityFloor } from '@elytracms/core/operations'
-import { defaultRolePolicy, roleGrantsCapability } from '@elytracms/core/persistence'
-import type { ProjectRole } from '@elytracms/core/persistence'
+import {
+  buildAuthorityAuditEntry,
+  defaultRolePolicy,
+  roleGrantsCapability,
+} from '@elytracms/core/persistence'
+import type { AuthorityAuditOutcome, ProjectRole } from '@elytracms/core/persistence'
+import type { MutationCtx } from './functions'
 import { memberRole, type GuardCtx } from './guard'
 
 /**
@@ -58,3 +63,36 @@ export async function assertAuthorityFloor(
   )
   if (!decision.allow) throw new Error(`unauthorized: ${decision.reason}`)
 }
+
+/**
+ * Append one {@link buildAuthorityAuditEntry} row to the `authorityAudit` table
+ * (EC-240 H-tail item 6). Called at the floor chokepoint (`members:set` /
+ * `members:remove`) AFTER a COMMITTED authority change (`outcome: 'allowed'`).
+ * Best-effort provenance: `op` is the floor operation even when reached via the
+ * users rail (`users.save`/`remove` delegate to it). Denied attempts are NOT
+ * recorded here — a throwing mutation rolls back its transaction, this insert
+ * included (see `members.ts`); logging denials needs an out-of-transaction sink
+ * (deferred). No surfacing UI (deferred).
+ */
+export async function recordAuthorityAudit(
+  ctx: MutationCtx,
+  input: {
+    readonly actorId: string
+    readonly targetUserId: string
+    readonly op: string
+    readonly outcome: AuthorityAuditOutcome
+    readonly rolesGranted?: readonly string[]
+    readonly detail?: string
+  },
+): Promise<void> {
+  const entry = buildAuthorityAuditEntry({
+    actorId: input.actorId,
+    targetUserId: input.targetUserId,
+    op: input.op,
+    outcome: input.outcome,
+    ...(input.rolesGranted !== undefined ? { rolesGranted: input.rolesGranted } : {}),
+    ...(input.detail !== undefined ? { detail: input.detail } : {}),
+    at: new Date().toISOString(),
+  })
+  await ctx.db.insert('authorityAudit', entry)
+}

package/convex/functions.ts

@@ -1,5 +1,6 @@
 import { customCtx, customMutation } from 'convex-helpers/server/customFunctions'
 import {
+  actionGeneric,
   httpActionGeneric,
   internalMutationGeneric,
   internalQueryGeneric,
@@ -27,6 +28,14 @@ export type QueryCtx = GenericQueryCtx<DataModel>
 export type MutationCtx = GenericMutationCtx<DataModel>
 
 export const query = queryGeneric as QueryBuilder<DataModel, 'public'>
+/**
+ * Public action builder (EC-240 H-tail). Actions reach data only through
+ * `ctx.runQuery`/`runMutation` and may call provider helpers that run their own
+ * mutations (e.g. Convex Auth's `retrieveAccount`/`modifyAccountCredentials` for
+ * the self-service password change). Not DataModel-bound in the trigger sense —
+ * an action never writes `ctx.db` directly, so it bypasses the write chokepoint.
+ */
+export const action = actionGeneric
 /**
  * EC-286: every mutation runs through the write-chokepoint triggers (`triggers.ts`)
  * via `customCtx(triggers.wrapDB)`, so reference-index maintenance and host

package/convex/invites.ts

@@ -0,0 +1,75 @@
+import { v } from 'convex/values'
+import { mutation, query } from './functions'
+import { requireCapability } from './guard'
+
+/**
+ * Invite allowlist management (EC-324). An admin invites an email + role; the
+ * invite is CONSUMED at first sign-up by the auth boundary (`auth.ts`
+ * `beforeSessionCreation`). Management is **admin-only, server-side** —
+ * `requireCapability('project.administer')`, the same trust boundary as
+ * member/user management; UI gating alone is never trusted.
+ *
+ * The invited `role` is validated against the active policy at the operations
+ * write boundary (`invites.create` input); this store keeps it a lenient string
+ * (schema-as-lens, EC-277). Keyed by normalized (lowercased) email; `create`
+ * upserts so re-inviting the same email replaces the pending role.
+ */
+
+const normalizeEmail = (email: string): string => email.trim().toLowerCase()
+
+export const list = query({
+  args: {},
+  handler: async (ctx) => {
+    await requireCapability(ctx, 'project.administer')
+    const rows = await ctx.db.query('invites').collect()
+    return rows.sort((a, b) => (a.email < b.email ? -1 : a.email > b.email ? 1 : 0))
+  },
+})
+
+export const create = mutation({
+  args: {
+    email: v.string(),
+    role: v.string(),
+    invitedBy: v.optional(v.string()),
+    createdAt: v.string(),
+    updatedAt: v.string(),
+  },
+  handler: async (ctx, args) => {
+    await requireCapability(ctx, 'project.administer')
+    const email = normalizeEmail(args.email)
+    const existing = await ctx.db
+      .query('invites')
+      .withIndex('by_email', (q) => q.eq('email', email))
+      .first()
+    if (existing) {
+      await ctx.db.patch(existing._id, {
+        role: args.role,
+        updatedAt: args.updatedAt,
+        ...(args.invitedBy !== undefined ? { invitedBy: args.invitedBy } : {}),
+      })
+      return ctx.db.get(existing._id)
+    }
+    const id = await ctx.db.insert('invites', {
+      email,
+      role: args.role,
+      ...(args.invitedBy !== undefined ? { invitedBy: args.invitedBy } : {}),
+      createdAt: args.createdAt,
+      updatedAt: args.updatedAt,
+    })
+    return ctx.db.get(id)
+  },
+})
+
+export const revoke = mutation({
+  args: { email: v.string() },
+  handler: async (ctx, { email }) => {
+    await requireCapability(ctx, 'project.administer')
+    const key = normalizeEmail(email)
+    const existing = await ctx.db
+      .query('invites')
+      .withIndex('by_email', (q) => q.eq('email', key))
+      .first()
+    if (!existing) throw new Error(`not-found: invite "${key}"`)
+    await ctx.db.delete(existing._id)
+  },
+})

package/convex/members.ts

@@ -1,7 +1,7 @@
 import { v } from 'convex/values'
 import { mutation, query } from './functions'
 import { getOptionalUserId, requireCapability, requireUserId } from './guard'
-import { assertAuthorityFloor } from './authority'
+import { assertAuthorityFloor, recordAuthorityAudit } from './authority'
 
 /**
  * Deployment membership persistence (EC-150, single-tenant per EC-179). The
@@ -76,6 +76,13 @@ export const set = mutation({
   handler: async (ctx, args) => {
     const callerId = await requireCapability(ctx, 'project.administer')
     // Integrity floor (EC-240): can't demote the last admin / assign above self.
+    // Throws `unauthorized: …` on denial — a first-class, visible error (verified
+    // live). NOTE (EC-240 H-tail item 6): a denied attempt is NOT audited here. A
+    // Convex mutation that throws rolls back its ENTIRE transaction, so any audit
+    // insert in a catch would roll back with it (confirmed live — the denied rows
+    // never persisted). The audit therefore records only COMMITTED authority changes;
+    // durably logging *denied* attempts needs an out-of-transaction sink (an action
+    // wrapper / separate log), deferred with the surfacing UI.
     await assertAuthorityFloor(ctx, {
       callerId,
       targetUserId: args.userId,
@@ -86,23 +93,34 @@ export const set = mutation({
       .query('members')
       .withIndex('by_user', (q) => q.eq('userId', args.userId))
       .first()
-    if (existing) {
-      await ctx.db.patch(existing._id, {
-        role: args.role,
-        updatedAt: args.updatedAt,
-        // Only touch `meta` when supplied — a bare role change preserves it.
-        ...(args.meta !== undefined ? { meta: args.meta } : {}),
-      })
-      return ctx.db.get(existing._id)
-    }
-    const id = await ctx.db.insert('members', {
-      userId: args.userId,
-      role: args.role,
-      ...(args.meta !== undefined ? { meta: args.meta } : {}),
-      createdAt: args.createdAt,
-      updatedAt: args.updatedAt,
+    const result = existing
+      ? await (async () => {
+          await ctx.db.patch(existing._id, {
+            role: args.role,
+            updatedAt: args.updatedAt,
+            // Only touch `meta` when supplied — a bare role change preserves it.
+            ...(args.meta !== undefined ? { meta: args.meta } : {}),
+          })
+          return ctx.db.get(existing._id)
+        })()
+      : await (async () => {
+          const id = await ctx.db.insert('members', {
+            userId: args.userId,
+            role: args.role,
+            ...(args.meta !== undefined ? { meta: args.meta } : {}),
+            createdAt: args.createdAt,
+            updatedAt: args.updatedAt,
+          })
+          return ctx.db.get(id)
+        })()
+    await recordAuthorityAudit(ctx, {
+      actorId: callerId,
+      targetUserId: args.userId,
+      op: 'members.set',
+      outcome: 'allowed',
+      rolesGranted: [args.role],
     })
-    return ctx.db.get(id)
+    return result
   },
 })
 
@@ -110,7 +128,9 @@ export const remove = mutation({
   args: { userId: v.string() },
   handler: async (ctx, { userId }) => {
     const callerId = await requireCapability(ctx, 'project.administer')
-    // Integrity floor (EC-240): the last admin cannot be removed.
+    // Integrity floor (EC-240): the last admin cannot be removed. Throws on denial
+    // (a visible error). Denied attempts are not audited — see the `set` note above
+    // (a throwing mutation rolls back its transaction, audit insert included).
     await assertAuthorityFloor(ctx, {
       callerId,
       targetUserId: userId,
@@ -123,5 +143,11 @@ export const remove = mutation({
       .first()
     if (!existing) throw new Error(`not-found: member "${userId}"`)
     await ctx.db.delete(existing._id)
+    await recordAuthorityAudit(ctx, {
+      actorId: callerId,
+      targetUserId: userId,
+      op: 'members.remove',
+      outcome: 'allowed',
+    })
   },
 })

package/convex/schema.ts

@@ -72,6 +72,43 @@ export default defineSchema({
     updatedAt: v.string(),
   }).index('by_user', ['userId']),
 
+  /**
+   * Invite allowlist (EC-324) — invite-based onboarding. An admin pre-authorizes
+   * an email + role; the row is CONSUMED (deleted) when that email first signs up.
+   * Keyed by normalized (lowercased) email. Admin-gated through the operations
+   * chokepoint + `guard.ts`; the Convex auth boundary (`auth.ts`
+   * `beforeSessionCreation`) reads it to gate open sign-up (the EC-304 hole) and
+   * grant the invited role. `invitedBy` is the acting admin (audit provenance).
+   */
+  invites: defineTable({
+    email: v.string(),
+    role: v.string(),
+    invitedBy: v.optional(v.string()),
+    createdAt: v.string(),
+    updatedAt: v.string(),
+  }).index('by_email', ['email']),
+
+  /**
+   * Authority audit log (EC-240 H-tail item 6) — append-only. One row per
+   * COMMITTED authority-mutating op at the integrity-floor chokepoint
+   * (`members.set` / `members.remove`, and therefore `users.save` / `users.remove`
+   * which delegate to them): actor, target, op, outcome, granted role(s), timestamp.
+   * `outcome` is currently always `allowed`: a DENIED op throws, and a throwing
+   * Convex mutation rolls back its whole transaction (audit insert included), so
+   * denied attempts can't be logged in-transaction (verified live). Durably logging
+   * denials needs an out-of-transaction sink — deferred with the surfacing UI. The
+   * `denied` outcome stays in the shared vocabulary for that future sink.
+   */
+  authorityAudit: defineTable({
+    actorId: v.string(),
+    targetUserId: v.string(),
+    op: v.string(),
+    outcome: v.string(),
+    rolesGranted: v.array(v.string()),
+    detail: v.optional(v.string()),
+    at: v.string(),
+  }).index('by_time', ['at']),
+
   /**
    * Revocable CLI sync tokens (EC-150, consumed by the EC-147 push CLI).
    * Only the SHA-256 hash of a token is ever stored; revoked tokens keep

package/convex/users.ts

@@ -1,6 +1,11 @@
-import { getAuthUserId } from '@convex-dev/auth/server'
+import {
+  getAuthUserId,
+  modifyAccountCredentials,
+  retrieveAccount,
+} from '@convex-dev/auth/server'
+import { makeFunctionReference } from 'convex/server'
 import { v } from 'convex/values'
-import { query } from './functions'
+import { action, mutation, query } from './functions'
 import type { QueryCtx } from './functions'
 import { requireCapability } from './guard'
 
@@ -10,6 +15,9 @@ import { requireCapability } from './guard'
  * `AuthSession`. Returns `null` when the caller is unauthenticated — never an
  * error, so the adapter can treat it as "signed out".
  */
+/** The `users:me` wire shape (also the return type of the {@link meRef} ref). */
+type MeResult = { id: string; email: string; name?: string }
+
 export const me = query({
   args: {},
   handler: async (ctx) => {
@@ -84,3 +92,82 @@ export const get = query({
     return joinUser(ctx, member)
   },
 })
+
+/**
+ * The signed-in caller's OWN user projection (EC-240 H-tail item 1) — the
+ * self-permitted account-settings read. Distinct from the admin-only `get`/`list`:
+ * it takes NO target id and derives the caller from the JWT (`getAuthUserId`), so
+ * a non-admin can read ONLY their own record and never another's. Returns `null`
+ * when unauthenticated or not a member.
+ */
+export const getSelf = query({
+  args: {},
+  handler: async (ctx) => {
+    const userId = await getAuthUserId(ctx)
+    if (userId === null) return null
+    const member = await ctx.db
+      .query('members')
+      .withIndex('by_user', (q) => q.eq('userId', userId))
+      .first()
+    if (!member) return null
+    return joinUser(ctx, member)
+  },
+})
+
+/**
+ * Self-service identity edit (EC-240 H-tail item 2). Patches the caller's OWN
+ * auth `users` row — name / avatar (`image`). Self-scoped by construction: it
+ * derives the target from `getAuthUserId`, so it can never touch another user's
+ * identity. Auth-owned fields never flow through the members-rail `members:set`.
+ */
+export const updateProfile = mutation({
+  args: { name: v.optional(v.string()), avatar: v.optional(v.string()) },
+  handler: async (ctx, args) => {
+    const userId = await getAuthUserId(ctx)
+    if (userId === null) throw new Error('unauthorized: this function requires an authenticated user')
+    const patch: { name?: string; image?: string } = {}
+    if (args.name !== undefined) patch.name = args.name
+    if (args.avatar !== undefined) patch.image = args.avatar
+    if (Object.keys(patch).length > 0) await ctx.db.patch(userId, patch)
+    return null
+  },
+})
+
+/** The self identity read used by the password-change action (email = the
+ *  Password provider's account id). String ref — package convex code never
+ *  imports `./_generated/api` (see `sync.ts`). */
+const meRef = makeFunctionReference<'query', Record<string, never>, MeResult | null>('users:me')
+
+/**
+ * Self-service password change (EC-240 H-tail item 3), provider-delegated. An
+ * ACTION because it uses Convex Auth's `retrieveAccount` (verify the CURRENT
+ * password) + `modifyAccountCredentials` (set the new one), which run their own
+ * mutations. **Seam only:** the raw password values are handed straight to the
+ * provider and are NEVER logged or persisted by this code. Self-scoped: it
+ * derives the caller from the JWT and cross-checks the retrieved account is the
+ * caller's own before modifying.
+ */
+export const changePassword = action({
+  args: { currentPassword: v.string(), newPassword: v.string() },
+  handler: async (ctx, { currentPassword, newPassword }) => {
+    const userId = await getAuthUserId(ctx)
+    if (userId === null) throw new Error('unauthorized: this function requires an authenticated user')
+    // Enforce the provider's default password policy (min length) — the reset
+    // flow validates it, but `modifyAccountCredentials` does not.
+    if (newPassword.length < 8) throw new Error('Password must be at least 8 characters')
+    const me = await ctx.runQuery(meRef, {})
+    if (!me?.email) throw new Error('unauthorized: no account email on file')
+    // Verify the CURRENT password; throws on mismatch (→ invalid-credentials).
+    const { user } = await retrieveAccount(ctx, {
+      provider: 'password',
+      account: { id: me.email, secret: currentPassword },
+    })
+    // Defense in depth: the retrieved account MUST be the caller's own.
+    if (String(user._id) !== String(userId)) throw new Error('unauthorized: account mismatch')
+    await modifyAccountCredentials(ctx, {
+      provider: 'password',
+      account: { id: me.email, secret: newPassword },
+    })
+    return null
+  },
+})

package/dist/components/account/account-settings.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The **account-settings** surface (EC-240 H-tail items 1–4). A member — admin or
+ * not — opens their OWN record here (via the user menu → `users/<selfId>`). It is
+ * self-permitted: the self record is read through `users.getSelf` (never the
+ * admin-only `users.list`/`get`), so a non-admin reaches ONLY their own account.
+ *
+ * Reuses the portable edit shell (AD-19) for the identity form (name/avatar
+ * editable → `updateProfile`; email/role read-only) and appends the credential
+ * seam (change password). No bespoke form — the shell + the self source carry it.
+ */
+export declare function AccountSettings({ projectId }: {
+    projectId: string;
+}): import("react").JSX.Element;

package/dist/components/account/account-settings.js

@@ -0,0 +1,54 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { UserCog } from 'lucide-react';
+import { Heading, Stack, Text } from '@elytracms/studio/ui';
+import { listStoreState, useOperationQuery } from '@elytracms/studio/lib/query';
+import { translate } from '@elytracms/studio/lib/i18n';
+import { useAuth } from '../auth-context';
+import { PortableDetailEditor } from '../cms/detail-editor';
+import { CredentialPanel } from './credential-panel';
+import { useSelfAccountViewSource } from './self-account-view-source';
+/**
+ * The **account-settings** surface (EC-240 H-tail items 1–4). A member — admin or
+ * not — opens their OWN record here (via the user menu → `users/<selfId>`). It is
+ * self-permitted: the self record is read through `users.getSelf` (never the
+ * admin-only `users.list`/`get`), so a non-admin reaches ONLY their own account.
+ *
+ * Reuses the portable edit shell (AD-19) for the identity form (name/avatar
+ * editable → `updateProfile`; email/role read-only) and appends the credential
+ * seam (change password). No bespoke form — the shell + the self source carry it.
+ */
+export function AccountSettings({ projectId }) {
+    const auth = useAuth();
+    const userId = auth.session?.user?.id ?? null;
+    const query = useOperationQuery({
+        queryKey: ['account', projectId, userId ?? '∅'],
+        loader: async (operations) => {
+            const result = await operations.users.getSelf({ projectId });
+            if (!result.ok)
+                throw new Error(result.error.message);
+            return result.value ?? null;
+        },
+        enabled: userId !== null,
+    });
+    const { status, errorMessage } = listStoreState(query);
+    const self = query.data ?? null;
+    if (status === 'loading') {
+        return _jsx(CenteredNote, { children: translate('account.loading') });
+    }
+    if (status === 'error') {
+        return (_jsx(CenteredNote, { testId: "account-error", children: errorMessage ?? translate('account.loadFailed') }));
+    }
+    if (!self) {
+        // Authenticated but not a member (no role yet) — honest, not a raw auth error.
+        return (_jsxs(Stack, { gap: "2", align: "center", justify: "center", className: "h-full p-8 text-center", children: [_jsx(UserCog, { className: "size-6 text-muted-foreground" }), _jsx(Heading, { level: 2, size: "h3", children: translate('account.notMemberTitle') }), _jsx(Text, { size: "sm", tone: "muted", className: "max-w-sm", children: translate('account.notMemberBody') })] }));
+    }
+    return _jsx(LoadedAccount, { projectId: projectId, self: self, refresh: async () => void (await query.refetch()) });
+}
+function LoadedAccount({ projectId, self, refresh, }) {
+    const source = useSelfAccountViewSource({ projectId, self, refresh });
+    return (_jsxs("div", { className: "flex h-full flex-col overflow-y-auto", children: [_jsx("div", { className: "flex min-h-[28rem] flex-col", children: _jsx(PortableDetailEditor, { source: source, projectId: projectId, documentId: self.id }) }), _jsx("div", { className: "mx-auto w-full max-w-2xl px-4 pb-8 sm:px-6", children: _jsx(CredentialPanel, {}) })] }));
+}
+function CenteredNote({ children, testId }) {
+    return (_jsx(Stack, { className: "h-full place-items-center p-8", align: "center", justify: "center", children: _jsx(Text, { size: "sm", tone: "muted", ...(testId ? { 'data-testid': testId } : {}), children: children }) }));
+}
+//# sourceMappingURL=account-settings.js.map

package/dist/components/account/account-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-settings.js","sourceRoot":"","sources":["../../../src/components/account/account-settings.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAA;AAErE;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,EAAE,SAAS,EAAyB;IAClE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI,CAAA;IAE7C,MAAM,KAAK,GAAG,iBAAiB,CAAoB;QACjD,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,IAAI,GAAG,CAAC;QAC/C,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;YAC3B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;YAC5D,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACrD,OAAO,MAAM,CAAC,KAAK,IAAI,IAAI,CAAA;QAC7B,CAAC;QACD,OAAO,EAAE,MAAM,KAAK,IAAI;KACzB,CAAC,CAAA;IACF,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAA;IAE/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAC,YAAY,cAAE,SAAS,CAAC,iBAAiB,CAAC,GAAgB,CAAA;IACpE,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,CACL,KAAC,YAAY,IAAC,MAAM,EAAC,eAAe,YACjC,YAAY,IAAI,SAAS,CAAC,oBAAoB,CAAC,GACnC,CAChB,CAAA;IACH,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,+EAA+E;QAC/E,OAAO,CACL,MAAC,KAAK,IAAC,GAAG,EAAC,GAAG,EAAC,KAAK,EAAC,QAAQ,EAAC,OAAO,EAAC,QAAQ,EAAC,SAAS,EAAC,wBAAwB,aAC/E,KAAC,OAAO,IAAC,SAAS,EAAC,8BAA8B,GAAG,EACpD,KAAC,OAAO,IAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAC,IAAI,YACzB,SAAS,CAAC,wBAAwB,CAAC,GAC5B,EACV,KAAC,IAAI,IAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAC,SAAS,EAAC,UAAU,YAC9C,SAAS,CAAC,uBAAuB,CAAC,GAC9B,IACD,CACT,CAAA;IACH,CAAC;IAED,OAAO,KAAC,aAAa,IAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,GAAI,CAAA;AAC/G,CAAC;AAED,SAAS,aAAa,CAAC,EACrB,SAAS,EACT,IAAI,EACJ,OAAO,GAKR;IACC,MAAM,MAAM,GAAG,wBAAwB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IACrE,OAAO,CACL,eAAK,SAAS,EAAC,sCAAsC,aAEnD,cAAK,SAAS,EAAC,6BAA6B,YAC1C,KAAC,oBAAoB,IAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,GAAI,GAC/E,EAEN,cAAK,SAAS,EAAC,4CAA4C,YACzD,KAAC,eAAe,KAAG,GACf,IACF,CACP,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAkD;IACxF,OAAO,CACL,KAAC,KAAK,IAAC,SAAS,EAAC,+BAA+B,EAAC,KAAK,EAAC,QAAQ,EAAC,OAAO,EAAC,QAAQ,YAC9E,KAAC,IAAI,IAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,YACvE,QAAQ,GACJ,GACD,CACT,CAAA;AACH,CAAC","sourcesContent":["import { UserCog } from 'lucide-react'\nimport type { UserRecord } from '@elytracms/core/persistence'\nimport { Heading, Stack, Text } from '@elytracms/studio/ui'\nimport { listStoreState, useOperationQuery } from '@elytracms/studio/lib/query'\nimport { translate } from '@elytracms/studio/lib/i18n'\nimport { useAuth } from '../auth-context'\nimport { PortableDetailEditor } from '../cms/detail-editor'\nimport { CredentialPanel } from './credential-panel'\nimport { useSelfAccountViewSource } from './self-account-view-source'\n\n/**\n * The **account-settings** surface (EC-240 H-tail items 1–4). A member — admin or\n * not — opens their OWN record here (via the user menu → `users/<selfId>`). It is\n * self-permitted: the self record is read through `users.getSelf` (never the\n * admin-only `users.list`/`get`), so a non-admin reaches ONLY their own account.\n *\n * Reuses the portable edit shell (AD-19) for the identity form (name/avatar\n * editable → `updateProfile`; email/role read-only) and appends the credential\n * seam (change password). No bespoke form — the shell + the self source carry it.\n */\nexport function AccountSettings({ projectId }: { projectId: string }) {\n  const auth = useAuth()\n  const userId = auth.session?.user?.id ?? null\n\n  const query = useOperationQuery<UserRecord | null>({\n    queryKey: ['account', projectId, userId ?? '∅'],\n    loader: async (operations) => {\n      const result = await operations.users.getSelf({ projectId })\n      if (!result.ok) throw new Error(result.error.message)\n      return result.value ?? null\n    },\n    enabled: userId !== null,\n  })\n  const { status, errorMessage } = listStoreState(query)\n  const self = query.data ?? null\n\n  if (status === 'loading') {\n    return <CenteredNote>{translate('account.loading')}</CenteredNote>\n  }\n  if (status === 'error') {\n    return (\n      <CenteredNote testId=\"account-error\">\n        {errorMessage ?? translate('account.loadFailed')}\n      </CenteredNote>\n    )\n  }\n  if (!self) {\n    // Authenticated but not a member (no role yet) — honest, not a raw auth error.\n    return (\n      <Stack gap=\"2\" align=\"center\" justify=\"center\" className=\"h-full p-8 text-center\">\n        <UserCog className=\"size-6 text-muted-foreground\" />\n        <Heading level={2} size=\"h3\">\n          {translate('account.notMemberTitle')}\n        </Heading>\n        <Text size=\"sm\" tone=\"muted\" className=\"max-w-sm\">\n          {translate('account.notMemberBody')}\n        </Text>\n      </Stack>\n    )\n  }\n\n  return <LoadedAccount projectId={projectId} self={self} refresh={async () => void (await query.refetch())} />\n}\n\nfunction LoadedAccount({\n  projectId,\n  self,\n  refresh,\n}: {\n  projectId: string\n  self: UserRecord\n  refresh: () => Promise<void>\n}) {\n  const source = useSelfAccountViewSource({ projectId, self, refresh })\n  return (\n    <div className=\"flex h-full flex-col overflow-y-auto\">\n      {/* The identity form via the portable edit shell (name/avatar editable). */}\n      <div className=\"flex min-h-[28rem] flex-col\">\n        <PortableDetailEditor source={source} projectId={projectId} documentId={self.id} />\n      </div>\n      {/* The credential seam — part of the property surface, below the identity form. */}\n      <div className=\"mx-auto w-full max-w-2xl px-4 pb-8 sm:px-6\">\n        <CredentialPanel />\n      </div>\n    </div>\n  )\n}\n\nfunction CenteredNote({ children, testId }: { children: React.ReactNode; testId?: string }) {\n  return (\n    <Stack className=\"h-full place-items-center p-8\" align=\"center\" justify=\"center\">\n      <Text size=\"sm\" tone=\"muted\" {...(testId ? { 'data-testid': testId } : {})}>\n        {children}\n      </Text>\n    </Stack>\n  )\n}\n"]}

package/dist/components/account/credential-panel.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The credential seam (EC-240 H-tail item 3) — part of the account **property
+ * surface**, never a modal. Two blocks:
+ *
+ * - **Sign-in method** (read-only): today every studio account is email + password.
+ *   OAuth "connected accounts" is a deferred extension.
+ * - **Change password**: current + new + confirm, handed straight to
+ *   `AuthAdapter.changePassword` (provider-delegated). SEAM ONLY — the raw values
+ *   are never logged, stored, or inspected here; they leave in the adapter call.
+ *
+ * The current-password field is the gate around this sensitive action (no separate
+ * confirm dialog needed).
+ */
+export declare function CredentialPanel(): import("react").JSX.Element;

package/dist/components/account/credential-panel.js

@@ -0,0 +1,52 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useState } from 'react';
+import { KeyRound, ShieldCheck } from 'lucide-react';
+import { Button, Card, CardContent, Field, Heading, Input, Row, Stack, Text, toast, } from '@elytracms/studio/ui';
+import { translate } from '@elytracms/studio/lib/i18n';
+import { useAuth } from '../auth-context';
+/**
+ * The credential seam (EC-240 H-tail item 3) — part of the account **property
+ * surface**, never a modal. Two blocks:
+ *
+ * - **Sign-in method** (read-only): today every studio account is email + password.
+ *   OAuth "connected accounts" is a deferred extension.
+ * - **Change password**: current + new + confirm, handed straight to
+ *   `AuthAdapter.changePassword` (provider-delegated). SEAM ONLY — the raw values
+ *   are never logged, stored, or inspected here; they leave in the adapter call.
+ *
+ * The current-password field is the gate around this sensitive action (no separate
+ * confirm dialog needed).
+ */
+export function CredentialPanel() {
+    const auth = useAuth();
+    const [current, setCurrent] = useState('');
+    const [next, setNext] = useState('');
+    const [confirm, setConfirm] = useState('');
+    const [phase, setPhase] = useState('idle');
+    const [error, setError] = useState(null);
+    async function handleSubmit(event) {
+        event.preventDefault();
+        setError(null);
+        if (next !== confirm) {
+            setError(translate('account.password.mismatch'));
+            return;
+        }
+        setPhase('submitting');
+        // The raw values leave here ONLY into the provider adapter — never logged.
+        const result = await auth.changePassword({ currentPassword: current, newPassword: next });
+        setPhase('idle');
+        if (result.ok) {
+            setCurrent('');
+            setNext('');
+            setConfirm('');
+            toast.success(translate('account.password.changed'));
+            return;
+        }
+        setError(result.message);
+    }
+    const submitting = phase === 'submitting';
+    return (_jsx(Card, { "data-testid": "credential-panel", children: _jsx(CardContent, { className: "pt-5", children: _jsxs(Stack, { gap: "4", children: [_jsxs(Stack, { gap: "1", children: [_jsxs(Row, { gap: "2", align: "center", children: [_jsx(ShieldCheck, { className: "size-4 text-muted-foreground" }), _jsx(Heading, { level: 3, size: "h4", children: translate('account.security.title') })] }), _jsx(Text, { size: "sm", tone: "muted", children: translate('account.security.method') })] }), _jsx("form", { onSubmit: handleSubmit, noValidate: true, children: _jsxs(Stack, { gap: "3", children: [_jsx(Field, { label: translate('account.password.current'), htmlFor: "account-current-password", required: true, children: _jsx(Input, { id: "account-current-password", type: "password", autoComplete: "current-password", value: current, onChange: (e) => setCurrent(e.target.value), disabled: submitting }) }), _jsx(Field, { label: translate('account.password.new'), htmlFor: "account-new-password", required: true, children: _jsx(Input, { id: "account-new-password", type: "password", autoComplete: "new-password", value: next, onChange: (e) => setNext(e.target.value), disabled: submitting }) }), _jsx(Field, { label: translate('account.password.confirm'), htmlFor: "account-confirm-password", required: true, error: error, children: _jsx(Input, { id: "account-confirm-password", type: "password", autoComplete: "new-password", value: confirm, onChange: (e) => setConfirm(e.target.value), disabled: submitting }) }), _jsx(Row, { children: _jsxs(Button, { type: "submit", variant: "outline", disabled: submitting || !current || !next || !confirm, children: [_jsx(KeyRound, {}), submitting
+                                                ? translate('account.password.changing')
+                                                : translate('account.password.change')] }) })] }) })] }) }) }));
+}
+//# sourceMappingURL=credential-panel.js.map