@fonoster/identity 0.27.0 → 0.30.0

package/dist/server/config.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.identityServiceConfigSchema = void 0;
 exports.loadConfig = loadConfig;
+exports.loadConfigFile = loadConfigFile;
 /**
  * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
  * http://github.com/fonoster/fonoster
@@ -20,135 +21,100 @@ exports.loadConfig = loadConfig;
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-const fs_1 = require("fs");
-const path_1 = require("path");
+const common_1 = require("@fonoster/common");
 const zod_1 = require("zod");
-const zod_validation_error_1 = require("zod-validation-error");
+const config_1 = require("../config");
 /**
- * Configuration for the standalone Identity service.
- *
- * The service is configured exclusively from a JSON configuration file — no
- * environment variables. The file path is taken from a `--config <path>` CLI
- * flag, defaulting to `./config/identity.json` relative to the working
- * directory.
+ * Configuration for the standalone Identity service: identity.json (or
+ * .jsonc/.yaml), found via --config, /opt/fonoster or ./config. Fields sit at
+ * the root of the file, as they always have; the same settings live under
+ * fonoster.yaml's `identity:` section when Identity is embedded in the API
+ * server. No environment variables, except ${VAR} in the database URL shared
+ * with the Postgres container.
  */
-const keysSchema = zod_1.z
-    .object({
-    privateKey: zod_1.z.string().optional(),
-    publicKey: zod_1.z.string().optional(),
-    privateKeyPath: zod_1.z.string().optional(),
-    publicKeyPath: zod_1.z.string().optional()
-})
-    .refine((k) => (k.privateKey || k.privateKeyPath) && (k.publicKey || k.publicKeyPath), {
-    message: "keys must provide a private and public key, inline or by path"
-});
-const smtpSchema = zod_1.z.object({
-    host: zod_1.z.string(),
-    port: zod_1.z.number(),
-    secure: zod_1.z.boolean().default(false),
-    sender: zod_1.z.string(),
-    auth: zod_1.z
-        .object({ user: zod_1.z.string().default(""), pass: zod_1.z.string().default("") })
-        .default({})
-});
 const identityServiceConfigSchema = zod_1.z.object({
     server: zod_1.z
         .object({
         bindAddr: zod_1.z.string().default("0.0.0.0:50051"),
-        httpBridgePort: zod_1.z.number().default(9000)
+        httpBridgePort: zod_1.z.number().int().positive().default(9000)
     })
         .default({}),
+    logs: common_1.logsSchema,
     database: zod_1.z.object({ url: zod_1.z.string().min(1) }),
-    encryptionKey: zod_1.z.string().min(1),
+    encryptionKey: config_1.encryptionKeySchema,
     issuer: zod_1.z.string().min(1),
-    audience: zod_1.z.string().min(1),
-    keys: keysSchema,
-    tokens: zod_1.z
-        .object({
-        accessTokenExpiresIn: zod_1.z.string().default("15m"),
-        refreshTokenExpiresIn: zod_1.z.string().default("30d"),
-        idTokenExpiresIn: zod_1.z.string().default("15m")
-    })
-        .default({}),
-    security: zod_1.z
-        .object({
-        contactVerificationRequired: zod_1.z.boolean().default(false),
-        twoFactorAuthenticationRequired: zod_1.z.boolean().default(false)
-    })
-        .default({}),
-    invite: zod_1.z
-        .object({
-        url: zod_1.z.string().default(""),
-        failUrl: zod_1.z.string().default(""),
-        expiration: zod_1.z.string().default("2d")
-    })
-        .default({}),
-    appUrl: zod_1.z.string().default(""),
-    smtp: smtpSchema.optional(),
-    oauth2: zod_1.z
-        .object({
-        github: zod_1.z.object({ clientId: zod_1.z.string(), clientSecret: zod_1.z.string() })
+    audience: zod_1.z.string().min(1).default("api"),
+    /** Where the accept-invite bridge redirects. Defaults to the issuer. */
+    appUrl: zod_1.z.string().min(1).optional(),
+    keys: config_1.keysSchema,
+    tokens: config_1.tokensSchema,
+    security: config_1.securitySchema,
+    invite: config_1.invitesSchema,
+    smtp: config_1.smtpSchema
+        .omit({ user: true, password: true })
+        .extend({
+        auth: zod_1.z
+            .object({ user: zod_1.z.string().default(""), pass: zod_1.z.string().default("") })
+            .default({})
     })
         .optional(),
-    defaultUser: zod_1.z
-        .object({
-        name: zod_1.z.string(),
-        email: zod_1.z.string().email(),
-        password: zod_1.z.string()
-    })
-        .optional()
+    twilio: config_1.twilioSchema.optional(),
+    oauth2: config_1.oauth2Schema,
+    /** Sign-in methods and sign-up policy (`features.auth` in fonoster.yaml). */
+    auth: config_1.authFeaturesSchema,
+    defaultUser: config_1.ownerSchema
 });
 exports.identityServiceConfigSchema = identityServiceConfigSchema;
-function configPathFromArgv(argv) {
-    const i = argv.indexOf("--config");
-    const fromFlag = i >= 0 ? argv[i + 1] : undefined;
-    return (0, path_1.resolve)(process.cwd(), fromFlag !== null && fromFlag !== void 0 ? fromFlag : "./config/identity.json");
-}
-function readKey(inline, path) {
-    return inline !== null && inline !== void 0 ? inline : (0, fs_1.readFileSync)((0, path_1.resolve)(process.cwd(), path), "utf8");
-}
-/** Maps the file config into the `IdentityConfig` shape `buildIdentityService` expects. */
-function toIdentityConfig(c) {
-    var _a;
-    return {
-        dbUrl: c.database.url,
-        issuer: c.issuer,
-        audience: c.audience,
-        privateKey: readKey(c.keys.privateKey, c.keys.privateKeyPath),
-        publicKey: readKey(c.keys.publicKey, c.keys.publicKeyPath),
-        encryptionKey: c.encryptionKey,
-        accessTokenExpiresIn: c.tokens.accessTokenExpiresIn,
-        refreshTokenExpiresIn: c.tokens.refreshTokenExpiresIn,
-        idTokenExpiresIn: c.tokens.idTokenExpiresIn,
-        workspaceInviteExpiration: c.invite.expiration,
-        workspaceInviteUrl: c.invite.url,
-        workspaceInviteFailUrl: c.invite.failUrl,
-        contactVerificationRequired: c.security.contactVerificationRequired,
-        twoFactorAuthenticationRequired: c.security.twoFactorAuthenticationRequired,
-        smtpConfig: c.smtp,
-        githubOauth2Config: (_a = c.oauth2) === null || _a === void 0 ? void 0 : _a.github
-    };
+/** Reads and validates the file only (no keys read), e.g. for provisioning. */
+function loadConfigFile(argv = process.argv) {
+    const config = (0, common_1.loadServiceConfig)({
+        service: "identity",
+        schema: identityServiceConfigSchema,
+        argv,
+        interpolatePaths: ["*"],
+        legacyEnvPrefixes: ["APISERVER_IDENTITY_"]
+    });
+    return { config, databaseUrl: config.database.url };
 }
 /** Loads and validates the service configuration from the file, failing fast. */
 function loadConfig(argv = process.argv) {
-    const path = configPathFromArgv(argv);
-    let raw;
-    try {
-        raw = JSON.parse((0, fs_1.readFileSync)(path, "utf8"));
-    }
-    catch (e) {
-        throw new Error(`unable to read Identity config at ${path}: ${e.message}`);
-    }
-    const result = identityServiceConfigSchema.safeParse(raw);
-    if (!result.success) {
-        throw new Error(`invalid Identity config at ${path}: ${(0, zod_validation_error_1.fromError)(result.error).toString()}`);
-    }
-    const config = result.data;
+    var _a;
+    const { config, databaseUrl } = loadConfigFile(argv);
+    const appUrl = (_a = config.appUrl) !== null && _a !== void 0 ? _a : config.issuer;
+    const smtp = config.smtp;
     return {
         bindAddr: config.server.bindAddr,
         httpBridgePort: config.server.httpBridgePort,
-        appUrl: config.appUrl,
+        appUrl,
+        logs: config.logs,
+        databaseUrl,
         defaultUser: config.defaultUser,
-        identityConfig: toIdentityConfig(config)
+        identityConfig: (0, config_1.toIdentityConfig)({
+            identity: {
+                issuer: config.issuer,
+                audience: config.audience,
+                keys: config.keys,
+                tokens: config.tokens,
+                security: config.security,
+                invites: config.invite,
+                oauth2: config.oauth2,
+                owner: config.defaultUser
+            },
+            appUrl,
+            databaseUrl,
+            encryptionKey: config.encryptionKey,
+            smtp: smtp
+                ? {
+                    host: smtp.host,
+                    port: smtp.port,
+                    secure: smtp.secure,
+                    sender: smtp.sender,
+                    user: smtp.auth.user,
+                    password: smtp.auth.pass
+                }
+                : undefined,
+            twilio: config.twilio,
+            auth: config.auth
+        })
     };
 }

package/dist/server/index.js

@@ -72,18 +72,20 @@ const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filena
  * Standalone Identity gRPC service. Wraps `buildIdentityService` with the auth
  * interceptor, the identity allow-list, a health service, and the accept-invite
  * HTTP bridge — without any telephony subsystem. Configured entirely from a
- * file (see `./config`); no environment variables.
+ * file (see `./config`): identity.json, fields at the root.
  */
 function main() {
     return __awaiter(this, void 0, void 0, function* () {
-        const { bindAddr, httpBridgePort, appUrl, defaultUser, identityConfig } = (0, config_1.loadConfig)();
+        const { bindAddr, httpBridgePort, appUrl, logs, defaultUser, identityConfig } = (0, config_1.loadConfig)();
+        (0, logger_1.configureLogger)(logs);
         const { definition, handlers } = (0, __1.buildIdentityService)(identityConfig);
-        const authorization = (0, common_1.createAuthInterceptor)(identityConfig.publicKey, __1.identityAllowList);
+        const authorization = (0, common_1.createAuthInterceptor)(identityConfig.publicKey, __1.identityAllowList, { issuer: identityConfig.issuer, audience: identityConfig.audience });
         const credentials = yield (0, common_1.getServerCredentials)({});
         const healthImpl = new grpc_health_check_1.HealthImplementation(common_1.statusMap);
         const server = new grpc.Server({ interceptors: [authorization] });
         healthImpl.addToServer(server);
         server.addService((0, common_1.createServiceDefinition)(definition), handlers);
+        yield (0, __1.migratePasswordStorage)(identityConfig);
         if (defaultUser) {
             yield (0, __1.upsertDefaultUser)(identityConfig, defaultUser);
         }

package/dist/service.d.ts

@@ -86,6 +86,12 @@ declare function buildIdentityService(identityConfig: IdentityConfig): {
         exchangeRefreshToken: (call: {
             request: unknown;
         }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
+        exchangeVerificationCode: (call: {
+            request: unknown;
+        }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
+        revokeToken: (call: {
+            request: unknown;
+        }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
         getPublicKey: (_: unknown, callback: (error: import("@fonoster/common").GrpcErrorMessage, response?: {
             publicKey: string;
         }) => void) => Promise<void>;

package/dist/service.js

@@ -23,6 +23,7 @@ exports.buildIdentityService = buildIdentityService;
 const db_1 = require("./db");
 const createExchangeOauth2Code_1 = require("./exchanges/createExchangeOauth2Code");
 const getPublicKey_1 = require("./getPublicKey");
+const authMethods_1 = require("./utils/authMethods");
 const verification_1 = require("./verification");
 const _1 = require(".");
 const serviceDefinitionParams = {
@@ -33,13 +34,16 @@ const serviceDefinitionParams = {
 };
 exports.serviceDefinitionParams = serviceDefinitionParams;
 function buildIdentityService(identityConfig) {
+    var _a, _b;
     const prisma = (0, db_1.createPrismaClient)(identityConfig.dbUrl, identityConfig.encryptionKey);
+    // The control plane's regions read workspaces through this (add-private-regions PR-14).
+    (_b = (_a = identityConfig.regions) === null || _a === void 0 ? void 0 : _a.attachDirectory) === null || _b === void 0 ? void 0 : _b.call(_a, (0, _1.createWorkspaceDirectory)(prisma));
     const service = {
         definition: serviceDefinitionParams,
         handlers: {
             // Workspace operations
-            createWorkspace: (0, _1.createCreateWorkspace)(prisma),
-            deleteWorkspace: (0, _1.createDeleteWorkspace)(prisma),
+            createWorkspace: (0, _1.createCreateWorkspace)(prisma, identityConfig.regions),
+            deleteWorkspace: (0, _1.createDeleteWorkspace)(prisma, identityConfig.regions),
             getWorkspace: (0, _1.createGetWorkspace)(prisma),
             updateWorkspace: (0, _1.createUpdateWorkspace)(prisma),
             listWorkspaces: (0, _1.createListWorkspaces)(prisma),
@@ -48,7 +52,7 @@ function buildIdentityService(identityConfig) {
             resendWorkspaceMembershipInvitation: (0, _1.createResendWorkspaceMembershipInvitation)(prisma, identityConfig, _1.sendInvite),
             removeUserFromWorkspace: (0, _1.createRemoveUserFromWorkspace)(prisma),
             // User operations
-            createUser: (0, _1.createCreateUser)(prisma),
+            createUser: (0, _1.createCreateUser)(prisma, identityConfig),
             createUserWithOauth2Code: (0, _1.createCreateUserWithOauth2Code)(prisma, identityConfig),
             getUser: (0, _1.createGetUser)(prisma),
             deleteUser: (0, _1.createDeleteUser)(prisma),
@@ -65,6 +69,8 @@ function buildIdentityService(identityConfig) {
             exchangeCredentials: (0, _1.createExchangeCredentials)(prisma, identityConfig),
             exchangeOauth2Code: (0, createExchangeOauth2Code_1.createExchangeOauth2Code)(prisma, identityConfig),
             exchangeRefreshToken: (0, _1.createExchangeRefreshToken)(prisma, identityConfig),
+            exchangeVerificationCode: (0, _1.createExchangeVerificationCode)(prisma, identityConfig),
+            revokeToken: (0, _1.createRevokeToken)(prisma, identityConfig),
             getPublicKey: (0, getPublicKey_1.createGetPublicKey)(identityConfig.publicKey),
             // Placeholders for conditional handlers
             sendVerificationCode: undefined,
@@ -72,7 +78,8 @@ function buildIdentityService(identityConfig) {
         }
     };
     if (identityConfig.contactVerificationRequired ||
-        identityConfig.twoFactorAuthenticationRequired) {
+        identityConfig.twoFactorAuthenticationRequired ||
+        (0, authMethods_1.isMethodEnabled)(identityConfig, "email_code")) {
         service.handlers.sendVerificationCode = (0, verification_1.createSendVerificationCode)(prisma, identityConfig);
         service.handlers.verifyCode = (0, verification_1.createVerifyCode)(prisma);
     }

package/dist/users/createCreateUser.d.ts

@@ -18,7 +18,12 @@
  */
 import { GrpcErrorMessage } from "@fonoster/common";
 import { Prisma } from "../db";
-declare function createCreateUser(prisma: Prisma): (call: {
+import { IdentityConfig } from "../exchanges/types";
+/**
+ * Self-service sign-up with a password. Allowed only when sign-up is open and
+ * password sign-in is enabled; invited users are created by the invite.
+ */
+declare function createCreateUser(prisma: Prisma, identityConfig: IdentityConfig): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
 export { createCreateUser };

package/dist/users/createCreateUser.js

@@ -30,22 +30,30 @@ exports.createCreateUser = createCreateUser;
  */
 const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
+const grpc_js_1 = require("@grpc/grpc-js");
+const authMethods_1 = require("../utils/authMethods");
 const generateAccessKeyId_1 = require("../utils/generateAccessKeyId");
+const userPasswords_1 = require("../utils/userPasswords");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
-function createCreateUser(prisma) {
+/**
+ * Self-service sign-up with a password. Allowed only when sign-up is open and
+ * password sign-in is enabled; invited users are created by the invite.
+ */
+function createCreateUser(prisma, identityConfig) {
     const createUser = (call, callback) => __awaiter(this, void 0, void 0, function* () {
         const { request } = call;
         const { name, email, password, avatar, phone } = request;
         logger.verbose("call to createUser", { email });
+        if (!(0, authMethods_1.isOpenSignup)(identityConfig) ||
+            !(0, authMethods_1.isMethodEnabled)(identityConfig, "password")) {
+            return callback({
+                code: grpc_js_1.status.PERMISSION_DENIED,
+                message: "Sign-up is by invitation only"
+            });
+        }
         const user = yield prisma.user.create({
-            data: {
-                name,
-                email,
-                accessKeyId: (0, generateAccessKeyId_1.generateAccessKeyId)(generateAccessKeyId_1.AccessKeyIdType.USER),
-                password,
-                avatar,
-                phoneNumber: phone || undefined
-            }
+            data: Object.assign(Object.assign({ name,
+                email, accessKeyId: (0, generateAccessKeyId_1.generateAccessKeyId)(generateAccessKeyId_1.AccessKeyIdType.USER) }, (yield (0, userPasswords_1.passwordColumns)(password))), { avatar, phoneNumber: phone || undefined })
         });
         const { ref } = user;
         callback(null, { ref });

package/dist/users/createCreateUserWithOauth2Code.js

@@ -64,45 +64,49 @@ exports.createCreateUserWithOauth2Code = createCreateUserWithOauth2Code;
 const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
 const grpc = __importStar(require("@grpc/grpc-js"));
-const nanoid_1 = require("nanoid");
 const exchangeTokens_1 = require("../exchanges/exchangeTokens");
-const createGetUserByEmail_1 = require("../utils/createGetUserByEmail");
-const generateAccessKeyId_1 = require("../utils/generateAccessKeyId");
+const authMethods_1 = require("../utils/authMethods");
+const createGetUserByGitHubEmails_1 = require("../utils/createGetUserByGitHubEmails");
 const getGitHubUserWithOauth2Code_1 = require("../utils/getGitHubUserWithOauth2Code");
+const createUserFromGitHub_1 = require("./createUserFromGitHub");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
 function createCreateUserWithOauth2Code(prisma, identityConfig) {
     const createUserWithOauth2Code = (call, callback) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
         const { request } = call;
         const { code } = request;
         logger.verbose("call to createCreateUserWithOauth2Code");
+        if (!(0, authMethods_1.isMethodEnabled)(identityConfig, "github") ||
+            !identityConfig.githubOauth2Config) {
+            return callback((0, authMethods_1.methodDisabledError)("github"));
+        }
+        if (!(0, authMethods_1.isOpenSignup)(identityConfig)) {
+            return callback({
+                code: grpc.status.PERMISSION_DENIED,
+                message: "Sign-up is by invitation only"
+            });
+        }
         const userData = yield (0, getGitHubUserWithOauth2Code_1.getGitHubUserWithOauth2Code)({
             clientId: identityConfig.githubOauth2Config.clientId,
             clientSecret: identityConfig.githubOauth2Config.clientSecret,
+            url: identityConfig.githubOauth2Config.url,
+            apiUrl: identityConfig.githubOauth2Config.apiUrl,
             code
         });
         if (!userData.email) {
             return callback({
                 code: grpc.status.PERMISSION_DENIED,
-                message: "Failed to get user data from GitHub. This typically happens when your GitHub account doesn't have a public email address"
+                message: "Your GitHub account has no verified primary email"
             });
         }
-        const userFromDB = yield (0, createGetUserByEmail_1.createGetUserByEmail)(prisma)(userData.email);
+        const userFromDB = yield (0, createGetUserByGitHubEmails_1.createGetUserByGitHubEmails)(prisma)((_a = userData.verifiedEmails) !== null && _a !== void 0 ? _a : [userData.email]);
         if (userFromDB) {
             return callback({
                 code: grpc.status.ALREADY_EXISTS,
                 message: "User already exists"
             });
         }
-        const user = yield prisma.user.create({
-            data: {
-                name: userData.name,
-                email: userData.email,
-                accessKeyId: (0, generateAccessKeyId_1.generateAccessKeyId)(generateAccessKeyId_1.AccessKeyIdType.USER),
-                emailVerified: true,
-                password: (0, nanoid_1.customAlphabet)("1234567890abcdef", 10)(),
-                avatar: userData.avatar_url
-            }
-        });
+        const user = yield (0, createUserFromGitHub_1.createUserFromGitHub)(prisma)(Object.assign(Object.assign({}, userData), { email: userData.email }));
         callback(null, yield (0, exchangeTokens_1.exchangeTokens)(prisma, identityConfig)(user.accessKeyId));
     });
     return (0, common_1.withErrorHandlingAndValidation)(createUserWithOauth2Code, common_1.Validators.createUserWithOauth2CodeRequestSchema);

package/dist/users/createResetPassword.d.ts

@@ -18,6 +18,11 @@
  */
 import { GrpcErrorMessage } from "@fonoster/common";
 import { Prisma } from "../db";
+/**
+ * Sets a new password with an emailed code and signs the user out everywhere
+ * (their refresh tokens are revoked). Attempts are rate limited per email and
+ * per client IP, in this process's memory.
+ */
 declare function createResetPassword(prisma: Prisma): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;

package/dist/users/createResetPassword.js

@@ -32,18 +32,43 @@ const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
 const types_1 = require("@fonoster/types");
 const grpc_js_1 = require("@grpc/grpc-js");
+const constants_1 = require("../constants");
+const refreshTokens_1 = require("../exchanges/refreshTokens");
+const clientAddress_1 = require("../utils/clientAddress");
 const createIsValidVerificationCode_1 = require("../utils/createIsValidVerificationCode");
+const rateLimiter_1 = require("../utils/rateLimiter");
+const userPasswords_1 = require("../utils/userPasswords");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
+/**
+ * Sets a new password with an emailed code and signs the user out everywhere
+ * (their refresh tokens are revoked). Attempts are rate limited per email and
+ * per client IP, in this process's memory.
+ */
 function createResetPassword(prisma) {
     const isValidVerificationCode = (0, createIsValidVerificationCode_1.createIsValidVerificationCode)(prisma);
+    const refreshTokens = (0, refreshTokens_1.createRefreshTokenStore)(prisma);
+    const { perEmail, perIp, windowMs } = constants_1.RESET_PASSWORD_ATTEMPT_LIMITS;
+    const withinEmailLimit = (0, rateLimiter_1.createSharedRateLimiter)(prisma, {
+        name: "reset-password:contact",
+        limit: perEmail,
+        windowMs
+    });
+    const withinIpLimit = (0, rateLimiter_1.createSharedRateLimiter)(prisma, {
+        name: "reset-password:ip",
+        limit: perIp,
+        windowMs
+    });
     const resetPassword = (call, callback) => __awaiter(this, void 0, void 0, function* () {
         const { request } = call;
         const { username, password, verificationCode } = request;
-        logger.verbose("call to resetPassword", {
-            username,
-            password,
-            verificationCode
-        });
+        logger.verbose("call to resetPassword", { username });
+        if (!(yield withinIpLimit((0, clientAddress_1.clientAddress)(call))) ||
+            !(yield withinEmailLimit(username.toLowerCase()))) {
+            return callback({
+                code: grpc_js_1.status.RESOURCE_EXHAUSTED,
+                message: "Too many password reset attempts; try again later"
+            });
+        }
         const isValid = yield isValidVerificationCode({
             type: types_1.ContactType.EMAIL,
             value: username,
@@ -55,10 +80,11 @@ function createResetPassword(prisma) {
                 message: "Invalid verification code"
             });
         }
-        yield prisma.user.update({
+        const user = yield prisma.user.update({
             where: { email: username },
-            data: { password }
+            data: Object.assign(Object.assign({}, (yield (0, userPasswords_1.passwordColumns)(password))), { mustChangePassword: false })
         });
+        yield refreshTokens.revokeAll(user.accessKeyId);
         callback(null);
     });
     return (0, common_1.withErrorHandlingAndValidation)(resetPassword, common_1.Validators.resetPasswordRequestSchema);

package/dist/users/createSendResetPasswordCode.d.ts

@@ -19,6 +19,12 @@
 import { GrpcErrorMessage } from "@fonoster/common";
 import { Prisma } from "../db";
 import { IdentityConfig } from "../exchanges/types";
+/**
+ * Emails a reset link. The link always points at Identity's configured reset
+ * page (`resetPasswordUrl`); a URL in the request is ignored. Sends are rate
+ * limited per email and per client IP, in this process's memory (each replica
+ * counts on its own).
+ */
 declare function createSendResetPasswordCode(prisma: Prisma, identityConfig: IdentityConfig): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;

package/dist/users/createSendResetPasswordCode.js

@@ -31,16 +31,48 @@ exports.createSendResetPasswordCode = createSendResetPasswordCode;
 const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
 const types_1 = require("@fonoster/types");
+const grpc_js_1 = require("@grpc/grpc-js");
+const constants_1 = require("../constants");
 const utils_1 = require("../utils");
+const clientAddress_1 = require("../utils/clientAddress");
 const createGenerateVerificationCode_1 = require("../utils/createGenerateVerificationCode");
+const rateLimiter_1 = require("../utils/rateLimiter");
 const sendResetPasswordEmail_1 = require("./sendResetPasswordEmail");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
+const tooManyRequests = {
+    code: grpc_js_1.status.RESOURCE_EXHAUSTED,
+    message: "Too many password reset requests; try again later"
+};
+/**
+ * Emails a reset link. The link always points at Identity's configured reset
+ * page (`resetPasswordUrl`); a URL in the request is ignored. Sends are rate
+ * limited per email and per client IP, in this process's memory (each replica
+ * counts on its own).
+ */
 function createSendResetPasswordCode(prisma, identityConfig) {
+    var _a;
     const generateVerificationCode = (0, createGenerateVerificationCode_1.createGenerateVerificationCode)(prisma);
+    const { perEmail, perIp, windowMs } = constants_1.VERIFICATION_CODE_SEND_LIMITS;
+    const withinEmailLimit = (0, rateLimiter_1.createSharedRateLimiter)(prisma, {
+        name: "reset-code:contact",
+        limit: perEmail,
+        windowMs
+    });
+    const withinIpLimit = (0, rateLimiter_1.createSharedRateLimiter)(prisma, {
+        name: "reset-code:ip",
+        limit: perIp,
+        windowMs
+    });
+    const resetPasswordUrl = (_a = identityConfig.resetPasswordUrl) !== null && _a !== void 0 ? _a : `${identityConfig.issuer.replace(/\/+$/, "")}/reset-password`;
     const sendResetPasswordCode = (call, callback) => __awaiter(this, void 0, void 0, function* () {
         const { request } = call;
         const { username } = request;
         logger.verbose("call to sendResetPasswordCode", { username });
+        // Counted before the lookup, so the answer is the same for unknown emails.
+        if (!(yield withinIpLimit((0, clientAddress_1.clientAddress)(call))) ||
+            !(yield withinEmailLimit(username.toLowerCase()))) {
+            return callback(tooManyRequests);
+        }
         const user = yield prisma.user.findUnique({
             where: { email: username }
         });
@@ -57,7 +89,7 @@ function createSendResetPasswordCode(prisma, identityConfig) {
         const encodedPayload = Buffer.from(JSON.stringify(payload)).toString("base64");
         yield (0, sendResetPasswordEmail_1.sendResetPasswordEmail)((0, utils_1.createSendEmail)(identityConfig), {
             recipient: username,
-            resetPasswordUrl: `${request.resetPasswordUrl}?token=${encodedPayload}`
+            resetPasswordUrl: `${resetPasswordUrl}?token=${encodeURIComponent(encodedPayload)}`
         });
         callback(null);
     });

package/dist/users/createUpdateUser.d.ts

@@ -18,6 +18,13 @@
  */
 import { GrpcErrorMessage } from "@fonoster/common";
 import { Prisma } from "../db";
+/**
+ * Updates the caller's own profile. A new password needs the current one
+ * (an access token alone can't change it) and signs the user out everywhere:
+ * every refresh token is revoked. Accounts without a password (GitHub or
+ * email-code sign-in) set one with the password-reset flow, which proves the
+ * email.
+ */
 declare function createUpdateUser(prisma: Prisma): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;