@gasboost/auth 0.8.0 → 0.9.0

package/README.md

@@ -281,12 +281,13 @@ const user = await auth.registration.email({
 ```ts
 const user = await auth.registration.appsScript({
   name: "Taro",
+  email: "taro@example.com",
 });
 ```
 
-Apps Script方式では
-`Session.getActiveUser().getEmail()` を使用するため、
-任意の他ユーザーを指定して登録することはできません。
+Registration は指定された対象者の新規 User と最初の Account を作成します。
+Session は参照しません。同じ provider / email の重複は拒否し、
+別方式の User とメールが一致しても自動統合しません。
 
 ### Sign Upとの違い
 
@@ -692,32 +693,55 @@ const auth = new AppsScriptAuth({
 
 MIT
 
-### 再実行可能な複数認証方式の登録（0.8.0）
+## 既存 User への Account 追加（0.9.0）
 
 `registration.methods` は設定の `enabled` を返します。
-`registration.ensure({ id, name, email, password? })` は、その全認証方式を
-同じ User ID に登録します。通常の signup 設定とは独立した、サーバー側の管理用 API です。
-呼び出し元で権限を検証し、Script Lock などで登録全体を排他制御してください。
-Apps Script 認証が有効なら `email` は `Session.getActiveUser().getEmail()` と一致する必要があります。
+`auth.account.add(userId, input)` は明示した既存 User に Account を追加して返します。
+新規 User や Session は作成せず、`isSignupEnabled` に依存しません。
+同一 Identity の重複、他 User の Identity、同じ User の同一方式の追加は拒否します。
+対象の認証方式は `enabled: true` が必要です。
 
 ```ts
-const user = await auth.registration.ensure({
-  id: recovery.userId, // 初回書き込み前に永続化した固定 ID
-  name: "システム管理者",
-  email: Session.getActiveUser().getEmail(),
-  password: Utilities.getUuid() + Utilities.getUuid(),
-});
-// Email が有効な場合は password reset delivery で本人に設定を促す。
-await auth.password?.forgot({ email: Session.getActiveUser().getEmail() });
+// 呼び出し元で初期化権限・実行主体を検証した後に実行
+const email = Session.getEffectiveUser().getEmail();
+const user = auth.registration.methods.appsScript
+  ? await auth.registration.appsScript({ name: "システム管理者", email })
+  : await auth.registration.email({
+      name: "システム管理者",
+      email,
+      password: temporaryPassword,
+    });
+
+if (
+  auth.registration.methods.appsScript &&
+  auth.registration.methods.emailPassword
+) {
+  await auth.account.add(user.id, {
+    provider: "emailPassword",
+    email,
+    password: temporaryPassword,
+  });
+}
+// Apps Script Account を既存 User に追加する場合:
+// await auth.account.add(userId, { provider: "appsScript", email });
 ```
 
-既存の認証情報は維持し、不足する Account だけを固定 ID で追加します。
-別 User が所有するメールアドレスは取り込みません。仮パスワードを本人へ送信しないでください。
-メール通知失敗時は `password.forgot()` を再実行して新しいリセットトークンを送れます。
-再発行すると以前のリセットトークンは失効します。
+メールとパスワードの Account は新しい Account ID を salt としてパスワードをハッシュ化します。
+既存 Account や User 名は変更しません。
+呼び出し元で対象 User への追加権限を検証してください。
+`@gasboost/auth-app` の `handlers(auth)` はこの管理用 API を RPC に公開しません。
+公開 `signUp.appsScript({ name })` は引き続き ActiveUser を登録し、Session を発行します。
+
+### Repository と移行
+
+0.9.0 では `registration.appsScript({ name })` を `{ name, email }` に変更しました。
+0.8.0 の `registration.ensure()` と任意の `repository.user.save()` は削除しました。
+旧 PR の EffectiveUser 専用登録経路も提供しません。
+通常の `registration.email()` と公開 SignUp の契約は維持します。
 
-この API は Repository の任意メソッド `user.save(user)` を必要とします。
-実装は User と各 Account を ID で upsert し、途中失敗後も同じ ID で修復できる必要があります。
-`@gasboost/auth-sheetorm >=0.4.0` はこれを実装します。
-既存の `registration.email()` / `.appsScript()` と `user.create()` の動作は変更しません。
-関連: [gasboost/app#64](https://github.com/gasboost/app/issues/64)。
+Account 追加には任意の Repository メソッド `account.create(account): Promise<Account>` が必要です。
+未対応の Repository は既存 API を継続利用でき、`account.add` 呼び出し時にエラーになります。
+実装は存在する User への追加だけを許可し、Account ID・Identity・User ごとの同一方式の重複を
+保存と同じ transaction 内で再検証してください。`@gasboost/auth-sheetorm >=0.4.1` が対応します。
+複数 API にまたがる初期化の排他制御、途中失敗時の保存済み User ID の復旧や
+再開処理は呼び出し元（Bootstrap 等）の責務です。

package/dist/AppsScriptAuth.d.ts

@@ -1,3 +1,4 @@
+import { AppsScriptAuthAccount } from "./api/AppsScriptAuthAccount";
 import { AppsScriptAuthPassword } from "./api/AppsScriptAuthPassword";
 import { AppsScriptAuthRegistration } from "./api/AppsScriptAuthRegistration";
 import { AppsScriptAuthSession } from "./api/AppsScriptAuthSession";
@@ -37,6 +38,7 @@ export declare class AppsScriptAuth<TEmailPassword extends EmailPasswordAuthOpti
     readonly signOut: AppsScriptAuthSignOut;
     readonly password: AppsScriptAuthPasswordApi<TEmailPassword>;
     readonly registration: AppsScriptAuthRegistration;
+    readonly account: AppsScriptAuthAccount;
     constructor({ repository, session, runtime, emailPassword, appsScript, hooks, }: AppsScriptAuthConfig<TEmailPassword, THookResult>);
 }
 export {};

package/dist/AppsScriptAuth.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AppsScriptAuth = void 0;
+const AppsScriptAuthAccount_1 = require("./api/AppsScriptAuthAccount");
 const AppsScriptAuthPassword_1 = require("./api/AppsScriptAuthPassword");
 const AppsScriptAuthRegistration_1 = require("./api/AppsScriptAuthRegistration");
 const AppsScriptAuthSession_1 = require("./api/AppsScriptAuthSession");
@@ -17,6 +18,7 @@ class AppsScriptAuth {
     signOut;
     password;
     registration;
+    account;
     constructor({ repository, session, runtime, emailPassword, appsScript, hooks, }) {
         const sessionStorage = (0, sessionStorageFactory_1.sessionStorageFactory)(session.storageType, {
             cacheService: runtime.cacheService,
@@ -64,12 +66,17 @@ class AppsScriptAuth {
                 emailPassword: emailPasswordConfig,
             })
             : undefined);
+        this.account = new AppsScriptAuthAccount_1.AppsScriptAuthAccount({
+            emailPassword: emailPasswordConfig,
+            appsScript: appsScriptConfig,
+            repository,
+            utilities: runtime.utilities,
+        });
         this.registration = new AppsScriptAuthRegistration_1.AppsScriptAuthRegistration({
             emailPassword: emailPasswordConfig,
             appsScript: appsScriptConfig,
             repository,
             utilities: runtime.utilities,
-            session: runtime.session,
         });
     }
 }

package/dist/api/AppsScriptAuthAccount.d.ts

@@ -0,0 +1,23 @@
+import type { AppsScriptAuthenticationConfig } from "../authentication/AppsScriptAuthentication";
+import type { EmailPasswordAuthConfig } from "../authentication/EmailPasswordAuthentication";
+import { Account } from "../domain/Account";
+import type { AppsScriptAuthRepository } from "../storage/AppsScriptAuthRepository";
+export type AddAccountInput = {
+    provider: "appsScript";
+    email: string;
+} | {
+    provider: "emailPassword";
+    email: string;
+    password: string;
+};
+/** Server API. The caller must authorize account linking to the specified user. */
+export declare class AppsScriptAuthAccount {
+    private readonly config;
+    constructor(config: {
+        repository: AppsScriptAuthRepository;
+        utilities: GoogleAppsScript.Utilities.Utilities;
+        emailPassword?: EmailPasswordAuthConfig;
+        appsScript?: AppsScriptAuthenticationConfig;
+    });
+    add(userId: string, input: AddAccountInput): Promise<Account>;
+}

package/dist/api/AppsScriptAuthAccount.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppsScriptAuthAccount = void 0;
+const AuthPattern_1 = require("../AuthPattern");
+const Account_1 = require("../domain/Account");
+const Password_1 = require("../domain/Password");
+const AppsScriptIdentity_1 = require("../identity/AppsScriptIdentity");
+const EmailPasswordIdentity_1 = require("../identity/EmailPasswordIdentity");
+/** Server API. The caller must authorize account linking to the specified user. */
+class AppsScriptAuthAccount {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    async add(userId, input) {
+        const { repository, utilities, emailPassword, appsScript } = this.config;
+        if (!userId?.trim() || !input.email?.trim())
+            throw new Error("User ID and email are required");
+        switch (input.provider) {
+            case AuthPattern_1.authPattern.emailPassword:
+                if (!emailPassword?.enabled)
+                    throw new Error("Email and password authentication is disabled");
+                break;
+            case AuthPattern_1.authPattern.appsScript:
+                if (!appsScript?.enabled)
+                    throw new Error("Apps Script authentication is disabled");
+                break;
+            default:
+                throw new Error("Unsupported auth provider");
+        }
+        if (!repository.account.create)
+            throw new Error("Repository must support account.create");
+        const user = await repository.user.find(userId);
+        if (!user || user.id !== userId)
+            throw new Error("User not found");
+        if (user.account(input.provider))
+            throw new Error("User already has an account for this provider");
+        if (await repository.account.findByIdentity(input.provider, input.email))
+            throw new Error("Account already registered");
+        const id = utilities.getUuid();
+        const identity = input.provider === AuthPattern_1.authPattern.emailPassword
+            ? new EmailPasswordIdentity_1.EmailPasswordIdentity({
+                accountId: input.email,
+                password: await new Password_1.Password(input.password, utilities, emailPassword.pepper, emailPassword.iterations).hash(id),
+            })
+            : new AppsScriptIdentity_1.AppsScriptIdentity({ googleAccountAddress: input.email });
+        return repository.account.create(new Account_1.Account({ id, userId, identity }));
+    }
+}
+exports.AppsScriptAuthAccount = AppsScriptAuthAccount;

package/dist/api/AppsScriptAuthRegistration.d.ts

@@ -11,24 +11,12 @@ export declare class AppsScriptAuthRegistration {
         readonly emailPassword: boolean;
         readonly appsScript: boolean;
     };
-    private readonly repository;
-    private readonly utilities;
-    private readonly session;
-    private readonly emailPassword?;
-    constructor({ emailPassword, appsScript, repository, utilities, session, }: {
+    constructor({ emailPassword, appsScript, repository, utilities, }: {
         emailPassword?: EmailPasswordAuthConfig;
         appsScript?: AppsScriptAuthenticationConfig;
         repository: AppsScriptAuthRepository;
         utilities: GoogleAppsScript.Utilities.Utilities;
-        session: GoogleAppsScript.Base.Session;
     });
     email(input: EmailPasswordRegistrationInput): Promise<User>;
     appsScript(input: AppsScriptRegistrationInput): Promise<User>;
-    /** Privileged server API. Caller must authorize and serialize provisioning. */
-    ensure(input: {
-        id: string;
-        name: string;
-        email: string;
-        password?: string;
-    }): Promise<User>;
 }

package/dist/api/AppsScriptAuthRegistration.js

@@ -1,27 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AppsScriptAuthRegistration = void 0;
-const User_1 = require("../domain/User");
-const Account_1 = require("../domain/Account");
-const Password_1 = require("../domain/Password");
-const AuthPattern_1 = require("../AuthPattern");
-const AppsScriptIdentity_1 = require("../identity/AppsScriptIdentity");
-const EmailPasswordIdentity_1 = require("../identity/EmailPasswordIdentity");
 const AppsScriptRegistration_1 = require("../registration/AppsScriptRegistration");
 const EmailPasswordRegistration_1 = require("../registration/EmailPasswordRegistration");
 class AppsScriptAuthRegistration {
     emailPasswordRegistration;
     appsScriptRegistration;
     methods;
-    repository;
-    utilities;
-    session;
-    emailPassword;
-    constructor({ emailPassword, appsScript, repository, utilities, session, }) {
-        this.repository = repository;
-        this.utilities = utilities;
-        this.session = session;
-        this.emailPassword = emailPassword;
+    constructor({ emailPassword, appsScript, repository, utilities, }) {
         this.methods = Object.freeze({
             emailPassword: !!emailPassword?.enabled,
             appsScript: !!appsScript?.enabled,
@@ -30,7 +16,7 @@ class AppsScriptAuthRegistration {
             this.emailPasswordRegistration = new EmailPasswordRegistration_1.EmailPasswordRegistration(repository, utilities, emailPassword);
         }
         if (appsScript?.enabled) {
-            this.appsScriptRegistration = new AppsScriptRegistration_1.AppsScriptRegistration(utilities, session, repository);
+            this.appsScriptRegistration = new AppsScriptRegistration_1.AppsScriptRegistration(utilities, repository);
         }
     }
     async email(input) {
@@ -45,67 +31,5 @@ class AppsScriptAuthRegistration {
         }
         return this.appsScriptRegistration.register(input);
     }
-    /** Privileged server API. Caller must authorize and serialize provisioning. */
-    async ensure(input) {
-        if (!this.methods.emailPassword && !this.methods.appsScript) {
-            throw new Error("No authentication method is enabled");
-        }
-        if (!input.id || !input.email.trim())
-            throw new Error("User ID and email are required");
-        if (!this.repository.user.save)
-            throw new Error("Repository must support idempotent user.save");
-        if (this.methods.appsScript &&
-            this.session.getActiveUser().getEmail() !== input.email) {
-            throw new Error("Active user does not match registration email");
-        }
-        const existing = await this.repository.user.find(input.id);
-        const accounts = [...(existing?.accounts ?? [])];
-        for (const provider of [
-            AuthPattern_1.authPattern.emailPassword,
-            AuthPattern_1.authPattern.appsScript,
-        ]) {
-            if (provider === AuthPattern_1.authPattern.emailPassword
-                ? !this.methods.emailPassword
-                : !this.methods.appsScript)
-                continue;
-            const collision = await this.repository.account.findByIdentity(provider, input.email);
-            if (collision && collision.userId !== input.id)
-                throw new Error("Account belongs to another user");
-            const current = accounts.find((account) => account.identity.providerName === provider);
-            if (current) {
-                if (current.userId !== input.id ||
-                    current.identity.accountId !== input.email)
-                    throw new Error("Existing user identity does not match");
-                continue;
-            }
-            if (collision) {
-                accounts.push(collision);
-                continue;
-            }
-            const accountId = `${input.id}:${provider}`;
-            let identity;
-            if (provider === AuthPattern_1.authPattern.emailPassword) {
-                if (!input.password || !this.emailPassword)
-                    throw new Error("Password is required");
-                const password = new Password_1.Password(input.password, this.utilities, this.emailPassword.pepper, this.emailPassword.iterations);
-                identity = new EmailPasswordIdentity_1.EmailPasswordIdentity({
-                    accountId: input.email,
-                    password: await password.hash(accountId),
-                });
-            }
-            else {
-                identity = new AppsScriptIdentity_1.AppsScriptIdentity({
-                    googleAccountAddress: input.email,
-                });
-            }
-            accounts.push(new Account_1.Account({ id: accountId, userId: input.id, identity }));
-        }
-        const user = new User_1.User({
-            id: input.id,
-            name: existing?.name ?? input.name,
-            accounts,
-        });
-        return this.repository.user.save(user);
-    }
 }
 exports.AppsScriptAuthRegistration = AppsScriptAuthRegistration;

package/dist/api/AppsScriptAuthSignUp.d.ts

@@ -8,7 +8,7 @@ import type { AppsScriptSessionStorage } from "../storage/AppsScriptSessionStora
 import { SignUp } from "./SignUp";
 export declare class AppsScriptAuthSignUp<THookResult = undefined> {
     email: SignUp<EmailPasswordRegistrationInput, THookResult>["execute"];
-    appsScript: SignUp<AppsScriptRegistrationInput, THookResult>["execute"];
+    appsScript: SignUp<Pick<AppsScriptRegistrationInput, "name">, THookResult>["execute"];
     constructor({ sessionStorage, expiresIn, afterSignIn, repository, emailPassword, appsScript, utilities, session, }: {
         sessionStorage: AppsScriptSessionStorage;
         expiresIn: number;

package/dist/api/AppsScriptAuthSignUp.js

@@ -27,14 +27,17 @@ class AppsScriptAuthSignUp {
                 throw new Error("Apps Script authentication is disabled");
             }
             appsScript.ensureSignUpEnabled();
+            const email = session.getActiveUser().getEmail();
+            if (!email)
+                throw new Error("No active user found");
             const appsScriptSignUp = new SignUp_1.SignUp({
                 sessionStorage,
                 afterSignIn,
                 expiresIn,
-                registration: new AppsScriptRegistration_1.AppsScriptRegistration(utilities, session, repository),
+                registration: new AppsScriptRegistration_1.AppsScriptRegistration(utilities, repository),
                 utilities,
             });
-            return appsScriptSignUp.execute(input);
+            return appsScriptSignUp.execute({ name: input.name, email });
         };
     }
 }

package/dist/index.d.ts

@@ -16,3 +16,4 @@ export { PasswordReset } from "./domain/PasswordReset";
 export { AppsScriptIdentity } from "./identity/AppsScriptIdentity";
 export { EmailPasswordIdentity } from "./identity/EmailPasswordIdentity";
 export type { AfterSignInContext, AfterSignInHook, AuthHooks, } from "./hooks/AuthHooks";
+export type { AddAccountInput } from "./api/AppsScriptAuthAccount";

package/dist/registration/AppsScriptRegistration.d.ts

@@ -3,11 +3,11 @@ import type { AppsScriptAuthRepository } from "../storage/AppsScriptAuthReposito
 import type { Registration } from "./Registration";
 export interface AppsScriptRegistrationInput {
     readonly name: string;
+    readonly email: string;
 }
 export declare class AppsScriptRegistration implements Registration<AppsScriptRegistrationInput> {
     private readonly utilities;
-    private readonly session;
     private readonly repository;
-    constructor(utilities: GoogleAppsScript.Utilities.Utilities, session: GoogleAppsScript.Base.Session, repository: AppsScriptAuthRepository);
+    constructor(utilities: GoogleAppsScript.Utilities.Utilities, repository: AppsScriptAuthRepository);
     register(input: AppsScriptRegistrationInput): Promise<User>;
 }

package/dist/registration/AppsScriptRegistration.js

@@ -7,19 +7,15 @@ const User_1 = require("../domain/User");
 const AppsScriptIdentity_1 = require("../identity/AppsScriptIdentity");
 class AppsScriptRegistration {
     utilities;
-    session;
     repository;
-    constructor(utilities, session, repository) {
+    constructor(utilities, repository) {
         this.utilities = utilities;
-        this.session = session;
         this.repository = repository;
     }
     async register(input) {
-        // Session.getActiveUser() から識別子取得
-        const email = this.session.getActiveUser().getEmail();
-        if (!email) {
-            throw new Error("No active user found");
-        }
+        const email = input.email;
+        if (!email?.trim())
+            throw new Error("Email is required");
         const existingAccount = await this.repository.account.findByIdentity(AuthPattern_1.authPattern.appsScript, email);
         if (existingAccount) {
             throw new Error("Account already registered");

package/dist/storage/AppsScriptAuthRepository.d.ts

@@ -4,13 +4,13 @@ import type { PasswordCredential } from "../domain/PasswordCredential";
 import type { User } from "../domain/User";
 export interface AppsScriptAuthRepository {
     account: {
+        /** Create an account for an existing user. Reject identity, ID and provider duplicates atomically. */
+        create?: (account: Account) => Promise<Account>;
         findByIdentity(provider: AuthPattern, identifier: string): Promise<Account | null>;
     };
     user: {
         find: (id: string) => Promise<User | null>;
         create: (user: User) => Promise<User>;
-        /** Upsert user/accounts by their stable IDs; retries must preserve a single user. */
-        save?: (user: User) => Promise<User>;
     };
     passwordCredential: {
         findByResetTokenHash(tokenHash: string): Promise<PasswordCredential | null>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gasboost/auth",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Modern authentication for Google Apps Script with email/password, Apps Script authentication, sessions, and password reset.",
   "keywords": [
     "google-apps-script",