@fonoster/identity 0.26.0 → 0.30.0

package/dist/users/createUpdateUser.js

@@ -30,21 +30,51 @@ exports.createUpdateUser = createUpdateUser;
  */
 const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
+const grpc_js_1 = require("@grpc/grpc-js");
+const refreshTokens_1 = require("../exchanges/refreshTokens");
 const utils_1 = require("../utils");
+const userPasswords_1 = require("../utils/userPasswords");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
+/**
+ * Updates the caller's own profile. A new password needs the current one
+ * (an access token alone can't change it) and signs the user out everywhere:
+ * every refresh token is revoked. Accounts without a password (GitHub or
+ * email-code sign-in) set one with the password-reset flow, which proves the
+ * email.
+ */
 function createUpdateUser(prisma) {
+    const verifyUserPassword = (0, userPasswords_1.createVerifyUserPassword)(prisma);
+    const refreshTokens = (0, refreshTokens_1.createRefreshTokenStore)(prisma);
     const updateUser = (call, callback) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
         const { request } = call;
-        const { ref, name, avatar, password, phone } = request;
+        const { ref, name, avatar, password, currentPassword, phone } = request;
         const token = (0, common_1.getTokenFromCall)(call);
         const accessKeyId = (0, utils_1.getAccessKeyIdFromToken)(token);
-        logger.verbose("call to updateUser", { ref, password });
-        const updateData = {
-            name,
-            avatar,
-            password: password || undefined,
-            updatedAt: new Date()
-        };
+        logger.verbose("call to updateUser", { ref });
+        if (password) {
+            const user = yield prisma.user.findFirst({
+                where: { ref, accessKeyId }
+            });
+            if (!user) {
+                return callback({ code: grpc_js_1.status.NOT_FOUND, message: "User not found" });
+            }
+            if (!user.passwordDigest && !user.password) {
+                return callback({
+                    code: grpc_js_1.status.FAILED_PRECONDITION,
+                    message: "This account has no password; set one with the password reset flow"
+                });
+            }
+            if (!(yield verifyUserPassword(user, (_a = currentPassword === null || currentPassword === void 0 ? void 0 : currentPassword.trim()) !== null && _a !== void 0 ? _a : ""))) {
+                return callback({
+                    code: grpc_js_1.status.PERMISSION_DENIED,
+                    message: "The current password is incorrect"
+                });
+            }
+        }
+        const updateData = Object.assign(Object.assign({ name,
+            avatar }, (password
+            ? Object.assign(Object.assign({}, (yield (0, userPasswords_1.passwordColumns)(password))), { mustChangePassword: false }) : {})), { updatedAt: new Date() });
         if (phone && phone !== "") {
             updateData.phoneNumber = phone;
             updateData.phoneNumberVerified = false;
@@ -56,6 +86,9 @@ function createUpdateUser(prisma) {
             },
             data: updateData
         });
+        if (password) {
+            yield refreshTokens.revokeAll(accessKeyId);
+        }
         const response = {
             ref
         };

package/dist/users/createUserFromGitHub.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { Prisma } from "../db";
+import { GitHubUser } from "../utils/getGitHubUserWithOauth2Code";
+/** Creates a user from a GitHub profile; GitHub users have no password. */
+declare function createUserFromGitHub(prisma: Prisma): (githubUser: GitHubUser & {
+    email: string;
+}) => Promise<{
+    name: string;
+    ref: string;
+    accessKeyId: string;
+    createdAt: Date;
+    updatedAt: Date;
+    email: string;
+    emailVerified: boolean;
+    password: string | null;
+    passwordDigest: string | null;
+    mustChangePassword: boolean;
+    phoneNumber: string | null;
+    phoneNumberVerified: boolean;
+    avatar: string | null;
+    extended: import("../generated/@prisma/client/runtime/library").JsonValue | null;
+}>;
+export { createUserFromGitHub };

package/dist/users/createUserFromGitHub.js

@@ -0,0 +1,27 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createUserFromGitHub = createUserFromGitHub;
+const generateAccessKeyId_1 = require("../utils/generateAccessKeyId");
+/** Creates a user from a GitHub profile; GitHub users have no password. */
+function createUserFromGitHub(prisma) {
+    return (githubUser) => __awaiter(this, void 0, void 0, function* () {
+        return prisma.user.create({
+            data: {
+                name: (githubUser.name || githubUser.email).slice(0, 60),
+                email: githubUser.email,
+                accessKeyId: (0, generateAccessKeyId_1.generateAccessKeyId)(generateAccessKeyId_1.AccessKeyIdType.USER),
+                emailVerified: true,
+                avatar: githubUser.avatar_url
+            }
+        });
+    });
+}

package/dist/users/index.d.ts

@@ -24,3 +24,4 @@ export * from "./createUpdateUser";
 export * from "./upsertDefaultUser";
 export * from "./createSendResetPasswordCode";
 export * from "./createResetPassword";
+export * from "./migratePasswordStorage";

package/dist/users/index.js

@@ -40,3 +40,4 @@ __exportStar(require("./createUpdateUser"), exports);
 __exportStar(require("./upsertDefaultUser"), exports);
 __exportStar(require("./createSendResetPasswordCode"), exports);
 __exportStar(require("./createResetPassword"), exports);
+__exportStar(require("./migratePasswordStorage"), exports);

package/dist/users/migratePasswordStorage.d.ts

@@ -0,0 +1,7 @@
+import { IdentityConfig } from "../exchanges/types";
+/**
+ * Boot-time step: moves passwords still stored with reversible encryption to
+ * one-way digests. Idempotent, so it runs on every start.
+ */
+declare function migratePasswordStorage(identityConfig: IdentityConfig): Promise<number>;
+export { migratePasswordStorage };

package/dist/users/migratePasswordStorage.js

@@ -0,0 +1,47 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.migratePasswordStorage = migratePasswordStorage;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const db_1 = require("../db");
+const userPasswords_1 = require("../utils/userPasswords");
+/**
+ * Boot-time step: moves passwords still stored with reversible encryption to
+ * one-way digests. Idempotent, so it runs on every start.
+ */
+function migratePasswordStorage(identityConfig) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const prisma = (0, db_1.createPrismaClient)(identityConfig.dbUrl, identityConfig.encryptionKey);
+        try {
+            return yield (0, userPasswords_1.backfillPasswordDigests)(prisma);
+        }
+        finally {
+            yield prisma.$disconnect();
+        }
+    });
+}

package/dist/users/types.d.ts

@@ -24,7 +24,9 @@ type SendResetPasswordEmailRequest = {
 type UserUpdateInput = {
     name?: string;
     avatar?: string;
-    password?: string;
+    password?: string | null;
+    passwordDigest?: string;
+    mustChangePassword?: boolean;
     phoneNumber?: string;
     phoneNumberVerified?: boolean;
 };

package/dist/users/upsertDefaultUser.js

@@ -32,6 +32,7 @@ const logger_1 = require("@fonoster/logger");
 const zod_1 = require("zod");
 const zod_validation_error_1 = require("zod-validation-error");
 const db_1 = require("../db");
+const userPasswords_1 = require("../utils/userPasswords");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
 const createUserRequestSchema = zod_1.z.object({
     name: zod_1.z
@@ -51,26 +52,17 @@ function upsertDefaultUser(identityConfig, request) {
         try {
             const validatedRequest = createUserRequestSchema.parse(request);
             const { name, email, password } = validatedRequest;
+            const passwordData = password ? yield (0, userPasswords_1.passwordColumns)(password) : {};
             logger.verbose("call to upsertDefaultUser", {
                 email,
                 accessKeyId: USER_ACCESS_KEY_ID
             });
             yield prisma.user.upsert({
                 where: { ref: USER_REF },
-                update: {
-                    name,
-                    email,
-                    password: password || undefined,
-                    accessKeyId: USER_ACCESS_KEY_ID,
-                    updatedAt: new Date()
-                },
-                create: {
-                    ref: USER_REF,
-                    name,
-                    email,
-                    password,
-                    accessKeyId: USER_ACCESS_KEY_ID
-                }
+                update: Object.assign(Object.assign({ name,
+                    email }, passwordData), { accessKeyId: USER_ACCESS_KEY_ID, updatedAt: new Date() }),
+                create: Object.assign(Object.assign({ ref: USER_REF, name,
+                    email }, passwordData), { accessKeyId: USER_ACCESS_KEY_ID })
             });
             yield prisma.workspace.upsert({
                 where: { ref: WORKSPACE_REF },

package/dist/utils/authMethods.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { status } from "@grpc/grpc-js";
+import { IdentityConfig } from "../exchanges/types";
+type AuthMethod = "password" | "email_code" | "github";
+/** Whether a sign-in method is enabled (features.auth.methods). */
+declare function isMethodEnabled(config: IdentityConfig, method: AuthMethod): boolean;
+/** Whether people may create their own account (features.auth.signup: open). */
+declare function isOpenSignup(config: IdentityConfig): boolean;
+/** The error an exchange returns when its method is disabled. */
+declare function methodDisabledError(method: AuthMethod): {
+    code: status;
+    message: string;
+};
+export { AuthMethod, isMethodEnabled, isOpenSignup, methodDisabledError };

package/dist/utils/authMethods.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isMethodEnabled = isMethodEnabled;
+exports.isOpenSignup = isOpenSignup;
+exports.methodDisabledError = methodDisabledError;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const grpc_js_1 = require("@grpc/grpc-js");
+/** Whether a sign-in method is enabled (features.auth.methods). */
+function isMethodEnabled(config, method) {
+    return config.auth.methods.includes(method);
+}
+/** Whether people may create their own account (features.auth.signup: open). */
+function isOpenSignup(config) {
+    return config.auth.signup === "open";
+}
+const METHOD_LABELS = {
+    password: "Password",
+    email_code: "Email code",
+    github: "GitHub"
+};
+/** The error an exchange returns when its method is disabled. */
+function methodDisabledError(method) {
+    return {
+        code: grpc_js_1.status.PERMISSION_DENIED,
+        message: `${METHOD_LABELS[method]} sign-in is disabled`
+    };
+}

package/dist/utils/claimUnverifiedAccount.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { Prisma } from "../db";
+type ClaimableUser = {
+    ref: string;
+    accessKeyId: string;
+    emailVerified: boolean;
+};
+/**
+ * Called when someone proves they own an account's email (an emailed code, or
+ * a GitHub account with that verified email) and signs in with it. If the
+ * email had never been verified, whoever set the account's password may not
+ * own the address (they could have signed up with someone else's email before
+ * its owner did), so that password stops working and every session of the
+ * account ends. The email is marked verified. Already verified accounts are
+ * returned unchanged.
+ */
+declare function createClaimUnverifiedAccount(prisma: Prisma): <T extends ClaimableUser>(user: T) => Promise<T>;
+export { createClaimUnverifiedAccount };

package/dist/utils/claimUnverifiedAccount.js

@@ -0,0 +1,43 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createClaimUnverifiedAccount = createClaimUnverifiedAccount;
+const refreshTokens_1 = require("../exchanges/refreshTokens");
+/**
+ * Called when someone proves they own an account's email (an emailed code, or
+ * a GitHub account with that verified email) and signs in with it. If the
+ * email had never been verified, whoever set the account's password may not
+ * own the address (they could have signed up with someone else's email before
+ * its owner did), so that password stops working and every session of the
+ * account ends. The email is marked verified. Already verified accounts are
+ * returned unchanged.
+ */
+function createClaimUnverifiedAccount(prisma) {
+    const refreshTokens = (0, refreshTokens_1.createRefreshTokenStore)(prisma);
+    return function claimUnverifiedAccount(user) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (user.emailVerified) {
+                return user;
+            }
+            const claimed = yield prisma.user.update({
+                where: { ref: user.ref },
+                data: {
+                    emailVerified: true,
+                    password: null,
+                    passwordDigest: null,
+                    mustChangePassword: false
+                }
+            });
+            yield refreshTokens.revokeAll(user.accessKeyId);
+            return claimed;
+        });
+    };
+}

package/dist/utils/clientAddress.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { Metadata } from "@grpc/grpc-js";
+type CallWithAddress = {
+    metadata?: Metadata;
+    getPeer?: () => string;
+};
+/** The caller's address: Envoy's x-forwarded-for when present, else the peer. */
+declare function clientAddress(call: CallWithAddress): string;
+export { CallWithAddress, clientAddress };

package/dist/utils/clientAddress.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clientAddress = clientAddress;
+/** The caller's address: Envoy's x-forwarded-for when present, else the peer. */
+function clientAddress(call) {
+    var _a, _b, _c, _d;
+    const forwarded = (_c = (_b = (_a = call.metadata) === null || _a === void 0 ? void 0 : _a.get("x-forwarded-for")) === null || _b === void 0 ? void 0 : _b[0]) === null || _c === void 0 ? void 0 : _c.toString();
+    return (forwarded === null || forwarded === void 0 ? void 0 : forwarded.split(",")[0].trim()) || ((_d = call.getPeer) === null || _d === void 0 ? void 0 : _d.call(call)) || "unknown";
+}

package/dist/utils/createGenerateVerificationCode.d.ts

@@ -1,5 +1,9 @@
 import { Prisma } from "../db";
 import { VerificationType } from "../generated/@prisma/client";
+/**
+ * Issues a 6-digit code for a contact. Earlier unused codes for the same
+ * contact stop working, so only the latest email or SMS is valid.
+ */
 declare function createGenerateVerificationCode(prisma: Prisma): (params: {
     type: VerificationType;
     value: string;

package/dist/utils/createGenerateVerificationCode.js

@@ -28,11 +28,21 @@ exports.createGenerateVerificationCode = createGenerateVerificationCode;
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+const crypto_1 = require("crypto");
 const constants_1 = require("../constants");
+const normalizeContact_1 = require("./normalizeContact");
+/**
+ * Issues a 6-digit code for a contact. Earlier unused codes for the same
+ * contact stop working, so only the latest email or SMS is valid.
+ */
 function createGenerateVerificationCode(prisma) {
     return (params) => __awaiter(this, void 0, void 0, function* () {
-        const { type, value } = params;
-        const code = Math.floor(100000 + Math.random() * 900000).toString();
+        const { type } = params;
+        const value = (0, normalizeContact_1.normalizeContact)(type, params.value);
+        const code = (0, crypto_1.randomInt)(100000, 1000000).toString();
+        yield prisma.verificationCode.deleteMany({
+            where: { type, value, consumedAt: null }
+        });
         yield prisma.verificationCode.create({
             data: {
                 type,

package/dist/utils/createGenerateWorkspaceInviteToken.js

@@ -31,6 +31,7 @@ exports.createGenerateWorkspaceInviteToken = createGenerateWorkspaceInviteToken;
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+const common_1 = require("@fonoster/common");
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const constants_1 = require("../constants");
 function createGenerateWorkspaceInviteToken(identityConfig) {
@@ -47,6 +48,8 @@ function createGenerateWorkspaceInviteToken(identityConfig) {
                 iss: issuer,
                 sub: userRef,
                 aud: audience,
+                // Its own tokenUse: never accepted as an access or refresh token.
+                tokenUse: common_1.TokenUseEnum.INVITE,
                 memberRef: memberRef,
                 accessKeyId
             };

package/dist/utils/createGetApiKeyByAccessKeyId.d.ts

@@ -27,4 +27,8 @@ declare function createGetApiKeyByAccessKeyId(prisma: Prisma): (accessKeyId: str
     accessKeySecret: string;
     workspaceRef: string;
 }>;
-export { createGetApiKeyByAccessKeyId };
+/** A key past its `expiresAt` no longer exchanges or refreshes. */
+declare function isApiKeyExpired(key: {
+    expiresAt?: Date | null;
+}, now?: Date): boolean;
+export { createGetApiKeyByAccessKeyId, isApiKeyExpired };

package/dist/utils/createGetApiKeyByAccessKeyId.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createGetApiKeyByAccessKeyId = createGetApiKeyByAccessKeyId;
+exports.isApiKeyExpired = isApiKeyExpired;
 function createGetApiKeyByAccessKeyId(prisma) {
     return function getApiKeyByAccessKeyId(accessKeyId) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -25,3 +26,7 @@ function createGetApiKeyByAccessKeyId(prisma) {
         });
     };
 }
+/** A key past its `expiresAt` no longer exchanges or refreshes. */
+function isApiKeyExpired(key, now = new Date()) {
+    return key.expiresAt ? key.expiresAt.getTime() <= now.getTime() : false;
+}

package/dist/utils/createGetUserByAccessKeyId.d.ts

@@ -30,7 +30,9 @@ declare function createGetUserByAccessKeyId(prisma: Prisma): (accessKeyId: strin
     updatedAt: Date;
     email: string;
     emailVerified: boolean;
-    password: string;
+    password: string | null;
+    passwordDigest: string | null;
+    mustChangePassword: boolean;
     phoneNumber: string | null;
     phoneNumberVerified: boolean;
     avatar: string | null;

package/dist/utils/createGetUserByEmail.d.ts

@@ -25,7 +25,9 @@ declare function createGetUserByEmail(prisma: Prisma): (email: string) => Promis
     updatedAt: Date;
     email: string;
     emailVerified: boolean;
-    password: string;
+    password: string | null;
+    passwordDigest: string | null;
+    mustChangePassword: boolean;
     phoneNumber: string | null;
     phoneNumberVerified: boolean;
     avatar: string | null;

package/dist/utils/createGetUserByGitHubEmails.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { Prisma } from "../db";
+/**
+ * Finds the user for a GitHub account by any of its verified emails, primary
+ * first. Fonoster 0.27 matched GitHub's public profile email, which isn't
+ * always the primary one, so those users would otherwise get a second account.
+ */
+declare function createGetUserByGitHubEmails(prisma: Prisma): (emails: string[]) => Promise<{
+    name: string;
+    ref: string;
+    accessKeyId: string;
+    createdAt: Date;
+    updatedAt: Date;
+    email: string;
+    emailVerified: boolean;
+    password: string | null;
+    passwordDigest: string | null;
+    mustChangePassword: boolean;
+    phoneNumber: string | null;
+    phoneNumberVerified: boolean;
+    avatar: string | null;
+    extended: import("../generated/@prisma/client/runtime/library").JsonValue | null;
+}>;
+export { createGetUserByGitHubEmails };

package/dist/utils/createGetUserByGitHubEmails.js

@@ -0,0 +1,31 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createGetUserByGitHubEmails = createGetUserByGitHubEmails;
+const createGetUserByEmail_1 = require("./createGetUserByEmail");
+/**
+ * Finds the user for a GitHub account by any of its verified emails, primary
+ * first. Fonoster 0.27 matched GitHub's public profile email, which isn't
+ * always the primary one, so those users would otherwise get a second account.
+ */
+function createGetUserByGitHubEmails(prisma) {
+    const getUserByEmail = (0, createGetUserByEmail_1.createGetUserByEmail)(prisma);
+    return function getUserByGitHubEmails(emails) {
+        return __awaiter(this, void 0, void 0, function* () {
+            for (const email of emails) {
+                const user = yield getUserByEmail(email);
+                if (user)
+                    return user;
+            }
+            return null;
+        });
+    };
+}

package/dist/utils/createGetUserByWorkspaceAccessKeyId.d.ts

@@ -25,7 +25,9 @@ declare function createGetUserByWorkspaceAccessKeyId(prisma: Prisma): (accessKey
     updatedAt: Date;
     email: string;
     emailVerified: boolean;
-    password: string;
+    password: string | null;
+    passwordDigest: string | null;
+    mustChangePassword: boolean;
     phoneNumber: string | null;
     phoneNumberVerified: boolean;
     avatar: string | null;