@gasboost/auth 0.6.0 → 0.8.0

package/README.md

@@ -339,7 +339,8 @@ Session 発行
 
 `@gasboost/auth` は、認証成功後に外部処理を実行するための lifecycle hook を提供します。
 
-現在は `afterSignIn` を利用できます。
+現在は `afterSignIn` を利用できます。Sign In と、Session を自動発行する Sign Up の
+email / Apps Script 両経路で、Session 保存後に同じ Hook を1回 await します。
 
 ```ts
 import { AppsScriptAuth, type EmailPasswordAuthOptions } from "@gasboost/auth";
@@ -384,7 +385,7 @@ hooks: {
 },
 ```
 
-hook の戻り値は Sign In result の `hooks` から取得できます。
+hook の戻り値は Sign In / Sign Up result の `hooks` から取得できます。
 
 ```ts
 const result = await auth.signIn.email({
@@ -409,7 +410,7 @@ const auth = new AppsScriptAuth<EmailPasswordAuthOptions, HookResult>({
 });
 ```
 
-hook を設定しない場合、従来どおり Sign In result は `user` と `session` のみを返します。
+hook を設定しない場合、従来どおり Sign In / Sign Up result は `user` と `session` のみを返します。
 
 ```ts
 const auth = new AppsScriptAuth({
@@ -448,7 +449,7 @@ hooks: {
 
 ### Hook Failure
 
-`afterSignIn` は Sign In 処理の一部として扱われます。
+`afterSignIn` は Sign In / Sign Up 処理の一部として扱われます。
 
 処理順序は以下です。
 
@@ -466,9 +467,11 @@ afterSignIn
 Sign In result
 ```
 
-`afterSignIn` で例外が発生した場合、Sign In 全体が失敗します。
+`afterSignIn` で例外が発生した場合、Sign In / Sign Up 全体が失敗します。
 
 その際、すでに保存された Session は SessionStorage から削除されます。
+削除が失敗しても元の Hook エラーを返します。Sign Up で作成済みの User / Account は削除しません。
+登録は完了しているため、再認証には Sign In を使い、Sign Up を自動再試行しないでください。
 
 ```text
 afterSignIn error
@@ -688,3 +691,33 @@ const auth = new AppsScriptAuth({
 ## License
 
 MIT
+
+### 再実行可能な複数認証方式の登録（0.8.0）
+
+`registration.methods` は設定の `enabled` を返します。
+`registration.ensure({ id, name, email, password? })` は、その全認証方式を
+同じ User ID に登録します。通常の signup 設定とは独立した、サーバー側の管理用 API です。
+呼び出し元で権限を検証し、Script Lock などで登録全体を排他制御してください。
+Apps Script 認証が有効なら `email` は `Session.getActiveUser().getEmail()` と一致する必要があります。
+
+```ts
+const user = await auth.registration.ensure({
+  id: recovery.userId, // 初回書き込み前に永続化した固定 ID
+  name: "システム管理者",
+  email: Session.getActiveUser().getEmail(),
+  password: Utilities.getUuid() + Utilities.getUuid(),
+});
+// Email が有効な場合は password reset delivery で本人に設定を促す。
+await auth.password?.forgot({ email: Session.getActiveUser().getEmail() });
+```
+
+既存の認証情報は維持し、不足する Account だけを固定 ID で追加します。
+別 User が所有するメールアドレスは取り込みません。仮パスワードを本人へ送信しないでください。
+メール通知失敗時は `password.forgot()` を再実行して新しいリセットトークンを送れます。
+再発行すると以前のリセットトークンは失効します。
+
+この API は Repository の任意メソッド `user.save(user)` を必要とします。
+実装は User と各 Account を ID で upsert し、途中失敗後も同じ ID で修復できる必要があります。
+`@gasboost/auth-sheetorm >=0.4.0` はこれを実装します。
+既存の `registration.email()` / `.appsScript()` と `user.create()` の動作は変更しません。
+関連: [gasboost/app#64](https://github.com/gasboost/app/issues/64)。

package/dist/AppsScriptAuth.d.ts

@@ -32,7 +32,7 @@ type AppsScriptAuthPasswordApi<TEmailPassword> = TEmailPassword extends {
 } ? AppsScriptAuthPassword : undefined;
 export declare class AppsScriptAuth<TEmailPassword extends EmailPasswordAuthOptions | undefined = undefined, THookResult = undefined> {
     readonly signIn: AppsScriptAuthSignIn<THookResult>;
-    readonly signUp: AppsScriptAuthSignUp;
+    readonly signUp: AppsScriptAuthSignUp<THookResult>;
     readonly session: AppsScriptAuthSession;
     readonly signOut: AppsScriptAuthSignOut;
     readonly password: AppsScriptAuthPasswordApi<TEmailPassword>;

package/dist/AppsScriptAuth.js

@@ -44,6 +44,7 @@ class AppsScriptAuth {
                 : {}),
         });
         this.signUp = new AppsScriptAuthSignUp_1.AppsScriptAuthSignUp({
+            afterSignIn: hooks?.afterSignIn,
             sessionStorage,
             expiresIn,
             repository,

package/dist/api/AppsScriptAuthRegistration.d.ts

@@ -1,12 +1,20 @@
 import type { AppsScriptAuthenticationConfig } from "../authentication/AppsScriptAuthentication";
 import type { EmailPasswordAuthConfig } from "../authentication/EmailPasswordAuthentication";
-import type { User } from "../domain/User";
+import { User } from "../domain/User";
 import { type AppsScriptRegistrationInput } from "../registration/AppsScriptRegistration";
 import { type EmailPasswordRegistrationInput } from "../registration/EmailPasswordRegistration";
 import type { AppsScriptAuthRepository } from "../storage/AppsScriptAuthRepository";
 export declare class AppsScriptAuthRegistration {
     private readonly emailPasswordRegistration?;
     private readonly appsScriptRegistration?;
+    readonly methods: {
+        readonly emailPassword: boolean;
+        readonly appsScript: boolean;
+    };
+    private readonly repository;
+    private readonly utilities;
+    private readonly session;
+    private readonly emailPassword?;
     constructor({ emailPassword, appsScript, repository, utilities, session, }: {
         emailPassword?: EmailPasswordAuthConfig;
         appsScript?: AppsScriptAuthenticationConfig;
@@ -16,4 +24,11 @@ export declare class AppsScriptAuthRegistration {
     });
     email(input: EmailPasswordRegistrationInput): Promise<User>;
     appsScript(input: AppsScriptRegistrationInput): Promise<User>;
+    /** Privileged server API. Caller must authorize and serialize provisioning. */
+    ensure(input: {
+        id: string;
+        name: string;
+        email: string;
+        password?: string;
+    }): Promise<User>;
 }

package/dist/api/AppsScriptAuthRegistration.js

@@ -1,12 +1,31 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AppsScriptAuthRegistration = void 0;
+const User_1 = require("../domain/User");
+const Account_1 = require("../domain/Account");
+const Password_1 = require("../domain/Password");
+const AuthPattern_1 = require("../AuthPattern");
+const AppsScriptIdentity_1 = require("../identity/AppsScriptIdentity");
+const EmailPasswordIdentity_1 = require("../identity/EmailPasswordIdentity");
 const AppsScriptRegistration_1 = require("../registration/AppsScriptRegistration");
 const EmailPasswordRegistration_1 = require("../registration/EmailPasswordRegistration");
 class AppsScriptAuthRegistration {
     emailPasswordRegistration;
     appsScriptRegistration;
+    methods;
+    repository;
+    utilities;
+    session;
+    emailPassword;
     constructor({ emailPassword, appsScript, repository, utilities, session, }) {
+        this.repository = repository;
+        this.utilities = utilities;
+        this.session = session;
+        this.emailPassword = emailPassword;
+        this.methods = Object.freeze({
+            emailPassword: !!emailPassword?.enabled,
+            appsScript: !!appsScript?.enabled,
+        });
         if (emailPassword?.enabled) {
             this.emailPasswordRegistration = new EmailPasswordRegistration_1.EmailPasswordRegistration(repository, utilities, emailPassword);
         }
@@ -26,5 +45,67 @@ class AppsScriptAuthRegistration {
         }
         return this.appsScriptRegistration.register(input);
     }
+    /** Privileged server API. Caller must authorize and serialize provisioning. */
+    async ensure(input) {
+        if (!this.methods.emailPassword && !this.methods.appsScript) {
+            throw new Error("No authentication method is enabled");
+        }
+        if (!input.id || !input.email.trim())
+            throw new Error("User ID and email are required");
+        if (!this.repository.user.save)
+            throw new Error("Repository must support idempotent user.save");
+        if (this.methods.appsScript &&
+            this.session.getActiveUser().getEmail() !== input.email) {
+            throw new Error("Active user does not match registration email");
+        }
+        const existing = await this.repository.user.find(input.id);
+        const accounts = [...(existing?.accounts ?? [])];
+        for (const provider of [
+            AuthPattern_1.authPattern.emailPassword,
+            AuthPattern_1.authPattern.appsScript,
+        ]) {
+            if (provider === AuthPattern_1.authPattern.emailPassword
+                ? !this.methods.emailPassword
+                : !this.methods.appsScript)
+                continue;
+            const collision = await this.repository.account.findByIdentity(provider, input.email);
+            if (collision && collision.userId !== input.id)
+                throw new Error("Account belongs to another user");
+            const current = accounts.find((account) => account.identity.providerName === provider);
+            if (current) {
+                if (current.userId !== input.id ||
+                    current.identity.accountId !== input.email)
+                    throw new Error("Existing user identity does not match");
+                continue;
+            }
+            if (collision) {
+                accounts.push(collision);
+                continue;
+            }
+            const accountId = `${input.id}:${provider}`;
+            let identity;
+            if (provider === AuthPattern_1.authPattern.emailPassword) {
+                if (!input.password || !this.emailPassword)
+                    throw new Error("Password is required");
+                const password = new Password_1.Password(input.password, this.utilities, this.emailPassword.pepper, this.emailPassword.iterations);
+                identity = new EmailPasswordIdentity_1.EmailPasswordIdentity({
+                    accountId: input.email,
+                    password: await password.hash(accountId),
+                });
+            }
+            else {
+                identity = new AppsScriptIdentity_1.AppsScriptIdentity({
+                    googleAccountAddress: input.email,
+                });
+            }
+            accounts.push(new Account_1.Account({ id: accountId, userId: input.id, identity }));
+        }
+        const user = new User_1.User({
+            id: input.id,
+            name: existing?.name ?? input.name,
+            accounts,
+        });
+        return this.repository.user.save(user);
+    }
 }
 exports.AppsScriptAuthRegistration = AppsScriptAuthRegistration;

package/dist/api/AppsScriptAuthSignUp.d.ts

@@ -1,16 +1,18 @@
 import type { AppsScriptAuthenticationConfig } from "../authentication/AppsScriptAuthentication";
 import type { EmailPasswordAuthConfig } from "../authentication/EmailPasswordAuthentication";
+import type { AfterSignInHook } from "../hooks/AuthHooks";
 import { type AppsScriptRegistrationInput } from "../registration/AppsScriptRegistration";
 import { type EmailPasswordRegistrationInput } from "../registration/EmailPasswordRegistration";
 import type { AppsScriptAuthRepository } from "../storage/AppsScriptAuthRepository";
 import type { AppsScriptSessionStorage } from "../storage/AppsScriptSessionStorage";
 import { SignUp } from "./SignUp";
-export declare class AppsScriptAuthSignUp {
-    email: SignUp<EmailPasswordRegistrationInput>["execute"];
-    appsScript: SignUp<AppsScriptRegistrationInput>["execute"];
-    constructor({ sessionStorage, expiresIn, repository, emailPassword, appsScript, utilities, session, }: {
+export declare class AppsScriptAuthSignUp<THookResult = undefined> {
+    email: SignUp<EmailPasswordRegistrationInput, THookResult>["execute"];
+    appsScript: SignUp<AppsScriptRegistrationInput, THookResult>["execute"];
+    constructor({ sessionStorage, expiresIn, afterSignIn, repository, emailPassword, appsScript, utilities, session, }: {
         sessionStorage: AppsScriptSessionStorage;
         expiresIn: number;
+        afterSignIn?: AfterSignInHook<THookResult>;
         repository: AppsScriptAuthRepository;
         emailPassword?: EmailPasswordAuthConfig;
         appsScript?: AppsScriptAuthenticationConfig;

package/dist/api/AppsScriptAuthSignUp.js

@@ -7,7 +7,7 @@ const SignUp_1 = require("./SignUp");
 class AppsScriptAuthSignUp {
     email;
     appsScript;
-    constructor({ sessionStorage, expiresIn, repository, emailPassword, appsScript, utilities, session, }) {
+    constructor({ sessionStorage, expiresIn, afterSignIn, repository, emailPassword, appsScript, utilities, session, }) {
         this.email = async (input) => {
             if (!emailPassword) {
                 throw new Error("Email and password authentication is disabled");
@@ -15,6 +15,7 @@ class AppsScriptAuthSignUp {
             emailPassword.ensureSignUpEnabled();
             const emailSignUp = new SignUp_1.SignUp({
                 sessionStorage,
+                afterSignIn,
                 expiresIn,
                 registration: new EmailPasswordRegistration_1.EmailPasswordRegistration(repository, utilities, emailPassword),
                 utilities,
@@ -28,6 +29,7 @@ class AppsScriptAuthSignUp {
             appsScript.ensureSignUpEnabled();
             const appsScriptSignUp = new SignUp_1.SignUp({
                 sessionStorage,
+                afterSignIn,
                 expiresIn,
                 registration: new AppsScriptRegistration_1.AppsScriptRegistration(utilities, session, repository),
                 utilities,

package/dist/api/SignUp.d.ts

@@ -1,20 +1,20 @@
-import { Session } from "../domain/Session";
-import { User } from "../domain/User";
+import type { AfterSignInHook } from "../hooks/AuthHooks";
 import type { Registration } from "../registration/Registration";
 import type { AppsScriptSessionStorage } from "../storage/AppsScriptSessionStorage";
-export declare class SignUp<T> {
+import type { SignInResult } from "./SignIn";
+export type SignUpResult<THookResult = undefined> = SignInResult<THookResult>;
+export declare class SignUp<T, THookResult = undefined> {
+    private readonly afterSignIn;
     private readonly sessionStorage;
     private readonly registration;
     private readonly utilities;
     private readonly expiresIn;
-    constructor({ sessionStorage, registration, utilities, expiresIn, }: {
+    constructor({ sessionStorage, registration, utilities, expiresIn, afterSignIn, }: {
         sessionStorage: AppsScriptSessionStorage;
         registration: Registration<T>;
         utilities: GoogleAppsScript.Utilities.Utilities;
         expiresIn: number;
+        afterSignIn?: AfterSignInHook<THookResult>;
     });
-    execute(input: T): Promise<{
-        user: User;
-        session: Session;
-    }>;
+    execute(input: T): Promise<SignUpResult<THookResult>>;
 }

package/dist/api/SignUp.js

@@ -3,15 +3,17 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SignUp = void 0;
 const Session_1 = require("../domain/Session");
 class SignUp {
+    afterSignIn;
     sessionStorage;
     registration;
     utilities;
     expiresIn;
-    constructor({ sessionStorage, registration, utilities, expiresIn, }) {
+    constructor({ sessionStorage, registration, utilities, expiresIn, afterSignIn, }) {
         this.sessionStorage = sessionStorage;
         this.registration = registration;
         this.utilities = utilities;
         this.expiresIn = expiresIn;
+        this.afterSignIn = afterSignIn;
     }
     async execute(input) {
         const user = await this.registration.register(input);
@@ -23,7 +25,22 @@ class SignUp {
             expiresAt: new Date(now.getTime() + this.expiresIn),
         });
         await this.sessionStorage.save(session);
-        return { user, session };
+        if (!this.afterSignIn) {
+            return { user, session };
+        }
+        try {
+            const hooks = await this.afterSignIn({ user, session });
+            return { user, session, hooks };
+        }
+        catch (error) {
+            try {
+                await this.sessionStorage.delete(session.id);
+            }
+            catch {
+                // Preserve the original hook error. Registration remains intact.
+            }
+            throw error;
+        }
     }
 }
 exports.SignUp = SignUp;

package/dist/storage/AppsScriptAuthRepository.d.ts

@@ -9,6 +9,8 @@ export interface AppsScriptAuthRepository {
     user: {
         find: (id: string) => Promise<User | null>;
         create: (user: User) => Promise<User>;
+        /** Upsert user/accounts by their stable IDs; retries must preserve a single user. */
+        save?: (user: User) => Promise<User>;
     };
     passwordCredential: {
         findByResetTokenHash(tokenHash: string): Promise<PasswordCredential | null>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gasboost/auth",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Modern authentication for Google Apps Script with email/password, Apps Script authentication, sessions, and password reset.",
   "keywords": [
     "google-apps-script",