@gasboost/auth 0.7.0 → 0.8.0

package/README.md

@@ -691,3 +691,33 @@ const auth = new AppsScriptAuth({
 ## License
 
 MIT
+
+### 再実行可能な複数認証方式の登録（0.8.0）
+
+`registration.methods` は設定の `enabled` を返します。
+`registration.ensure({ id, name, email, password? })` は、その全認証方式を
+同じ User ID に登録します。通常の signup 設定とは独立した、サーバー側の管理用 API です。
+呼び出し元で権限を検証し、Script Lock などで登録全体を排他制御してください。
+Apps Script 認証が有効なら `email` は `Session.getActiveUser().getEmail()` と一致する必要があります。
+
+```ts
+const user = await auth.registration.ensure({
+  id: recovery.userId, // 初回書き込み前に永続化した固定 ID
+  name: "システム管理者",
+  email: Session.getActiveUser().getEmail(),
+  password: Utilities.getUuid() + Utilities.getUuid(),
+});
+// Email が有効な場合は password reset delivery で本人に設定を促す。
+await auth.password?.forgot({ email: Session.getActiveUser().getEmail() });
+```
+
+既存の認証情報は維持し、不足する Account だけを固定 ID で追加します。
+別 User が所有するメールアドレスは取り込みません。仮パスワードを本人へ送信しないでください。
+メール通知失敗時は `password.forgot()` を再実行して新しいリセットトークンを送れます。
+再発行すると以前のリセットトークンは失効します。
+
+この API は Repository の任意メソッド `user.save(user)` を必要とします。
+実装は User と各 Account を ID で upsert し、途中失敗後も同じ ID で修復できる必要があります。
+`@gasboost/auth-sheetorm >=0.4.0` はこれを実装します。
+既存の `registration.email()` / `.appsScript()` と `user.create()` の動作は変更しません。
+関連: [gasboost/app#64](https://github.com/gasboost/app/issues/64)。

package/dist/api/AppsScriptAuthRegistration.d.ts

@@ -1,12 +1,20 @@
 import type { AppsScriptAuthenticationConfig } from "../authentication/AppsScriptAuthentication";
 import type { EmailPasswordAuthConfig } from "../authentication/EmailPasswordAuthentication";
-import type { User } from "../domain/User";
+import { User } from "../domain/User";
 import { type AppsScriptRegistrationInput } from "../registration/AppsScriptRegistration";
 import { type EmailPasswordRegistrationInput } from "../registration/EmailPasswordRegistration";
 import type { AppsScriptAuthRepository } from "../storage/AppsScriptAuthRepository";
 export declare class AppsScriptAuthRegistration {
     private readonly emailPasswordRegistration?;
     private readonly appsScriptRegistration?;
+    readonly methods: {
+        readonly emailPassword: boolean;
+        readonly appsScript: boolean;
+    };
+    private readonly repository;
+    private readonly utilities;
+    private readonly session;
+    private readonly emailPassword?;
     constructor({ emailPassword, appsScript, repository, utilities, session, }: {
         emailPassword?: EmailPasswordAuthConfig;
         appsScript?: AppsScriptAuthenticationConfig;
@@ -16,4 +24,11 @@ export declare class AppsScriptAuthRegistration {
     });
     email(input: EmailPasswordRegistrationInput): Promise<User>;
     appsScript(input: AppsScriptRegistrationInput): Promise<User>;
+    /** Privileged server API. Caller must authorize and serialize provisioning. */
+    ensure(input: {
+        id: string;
+        name: string;
+        email: string;
+        password?: string;
+    }): Promise<User>;
 }

package/dist/api/AppsScriptAuthRegistration.js

@@ -1,12 +1,31 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AppsScriptAuthRegistration = void 0;
+const User_1 = require("../domain/User");
+const Account_1 = require("../domain/Account");
+const Password_1 = require("../domain/Password");
+const AuthPattern_1 = require("../AuthPattern");
+const AppsScriptIdentity_1 = require("../identity/AppsScriptIdentity");
+const EmailPasswordIdentity_1 = require("../identity/EmailPasswordIdentity");
 const AppsScriptRegistration_1 = require("../registration/AppsScriptRegistration");
 const EmailPasswordRegistration_1 = require("../registration/EmailPasswordRegistration");
 class AppsScriptAuthRegistration {
     emailPasswordRegistration;
     appsScriptRegistration;
+    methods;
+    repository;
+    utilities;
+    session;
+    emailPassword;
     constructor({ emailPassword, appsScript, repository, utilities, session, }) {
+        this.repository = repository;
+        this.utilities = utilities;
+        this.session = session;
+        this.emailPassword = emailPassword;
+        this.methods = Object.freeze({
+            emailPassword: !!emailPassword?.enabled,
+            appsScript: !!appsScript?.enabled,
+        });
         if (emailPassword?.enabled) {
             this.emailPasswordRegistration = new EmailPasswordRegistration_1.EmailPasswordRegistration(repository, utilities, emailPassword);
         }
@@ -26,5 +45,67 @@ class AppsScriptAuthRegistration {
         }
         return this.appsScriptRegistration.register(input);
     }
+    /** Privileged server API. Caller must authorize and serialize provisioning. */
+    async ensure(input) {
+        if (!this.methods.emailPassword && !this.methods.appsScript) {
+            throw new Error("No authentication method is enabled");
+        }
+        if (!input.id || !input.email.trim())
+            throw new Error("User ID and email are required");
+        if (!this.repository.user.save)
+            throw new Error("Repository must support idempotent user.save");
+        if (this.methods.appsScript &&
+            this.session.getActiveUser().getEmail() !== input.email) {
+            throw new Error("Active user does not match registration email");
+        }
+        const existing = await this.repository.user.find(input.id);
+        const accounts = [...(existing?.accounts ?? [])];
+        for (const provider of [
+            AuthPattern_1.authPattern.emailPassword,
+            AuthPattern_1.authPattern.appsScript,
+        ]) {
+            if (provider === AuthPattern_1.authPattern.emailPassword
+                ? !this.methods.emailPassword
+                : !this.methods.appsScript)
+                continue;
+            const collision = await this.repository.account.findByIdentity(provider, input.email);
+            if (collision && collision.userId !== input.id)
+                throw new Error("Account belongs to another user");
+            const current = accounts.find((account) => account.identity.providerName === provider);
+            if (current) {
+                if (current.userId !== input.id ||
+                    current.identity.accountId !== input.email)
+                    throw new Error("Existing user identity does not match");
+                continue;
+            }
+            if (collision) {
+                accounts.push(collision);
+                continue;
+            }
+            const accountId = `${input.id}:${provider}`;
+            let identity;
+            if (provider === AuthPattern_1.authPattern.emailPassword) {
+                if (!input.password || !this.emailPassword)
+                    throw new Error("Password is required");
+                const password = new Password_1.Password(input.password, this.utilities, this.emailPassword.pepper, this.emailPassword.iterations);
+                identity = new EmailPasswordIdentity_1.EmailPasswordIdentity({
+                    accountId: input.email,
+                    password: await password.hash(accountId),
+                });
+            }
+            else {
+                identity = new AppsScriptIdentity_1.AppsScriptIdentity({
+                    googleAccountAddress: input.email,
+                });
+            }
+            accounts.push(new Account_1.Account({ id: accountId, userId: input.id, identity }));
+        }
+        const user = new User_1.User({
+            id: input.id,
+            name: existing?.name ?? input.name,
+            accounts,
+        });
+        return this.repository.user.save(user);
+    }
 }
 exports.AppsScriptAuthRegistration = AppsScriptAuthRegistration;

package/dist/storage/AppsScriptAuthRepository.d.ts

@@ -9,6 +9,8 @@ export interface AppsScriptAuthRepository {
     user: {
         find: (id: string) => Promise<User | null>;
         create: (user: User) => Promise<User>;
+        /** Upsert user/accounts by their stable IDs; retries must preserve a single user. */
+        save?: (user: User) => Promise<User>;
     };
     passwordCredential: {
         findByResetTokenHash(tokenHash: string): Promise<PasswordCredential | null>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gasboost/auth",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Modern authentication for Google Apps Script with email/password, Apps Script authentication, sessions, and password reset.",
   "keywords": [
     "google-apps-script",