@k2b/cloud 0.17.0 → 0.18.0

package/src/services/providers/local/users.ts

@@ -13,12 +13,32 @@ import * as settings from "../../settings";
 type DbRow = Record<string, unknown>;
 
 export type LocalUserCreateData = {
-  email: string;
+  /** Blank or missing stores NULL, which the email policy below allows only for full accounts. */
+  email?: string | null;
   givenname?: string;
   sn?: string;
   displayName?: string;
 };
 
+/** Created and repaired by the emergency admin login; it never needs an email address. */
+export const EMERGENCY_ADMIN_UID = "admin";
+
+/**
+ * A local account may lack an email only as a full account while
+ * `user.local_email_optional` is on. The setting guards writes only, so
+ * existing accounts stay valid when it is turned off.
+ */
+const missingEmailError = async (profile: UserProfile, uid?: string): Promise<MutationResult<never> | null> => {
+  if (uid === EMERGENCY_ADMIN_UID) return null;
+  if (profile !== "user") return { ok: false, error: "Guest accounts need an email address.", status: 400 };
+  if (await settings.get<boolean>("user.local_email_optional")) return null;
+  return {
+    ok: false,
+    error: "Local accounts need an email address. Administrators can allow accounts without one in the account settings.",
+    status: 400,
+  };
+};
+
 const createLocalUid = async (): Promise<string> => {
   const abbrLen = await settings.get<number>("user.abbr_length");
   return generateUniqueAbbreviation(abbrLen);
@@ -31,7 +51,11 @@ export const create = async (params: {
   admin?: boolean;
   actor?: AuditActor;
 }): Promise<MutationResult<{ id: string }>> => {
-  const email = normalizeAccountEmail(params.data.email);
+  const email = normalizeAccountEmail(params.data.email ?? "") || null;
+  if (!email) {
+    const missing = await missingEmailError(params.profile);
+    if (missing) return missing;
+  }
   const uid = await createLocalUid();
   const admin = resolveStoredAdminState({
     provider: "local",
@@ -43,8 +67,10 @@ export const create = async (params: {
     return await writeLocalAccount(async (tx) => {
       if (!(await isAccountCategoryAllowed({ provider: "local", profile: params.profile }, tx)))
         return { ok: false, error: "This account category is disabled. Contact an administrator.", status: 403 };
-      await lockAccountEmail(tx, email);
-      if ((await findAccountsByEmail(tx, email)).length > 0) return emailAlreadyUsed();
+      if (email) {
+        await lockAccountEmail(tx, email);
+        if ((await findAccountsByEmail(tx, email)).length > 0) return emailAlreadyUsed();
+      }
       const rows = await tx<{ id: string }[]>`
       INSERT INTO auth.users (
         uid,
@@ -118,18 +144,23 @@ export const update = async (params: {
     givenname?: string;
     sn?: string;
     displayName?: string;
-    mail?: string;
+    /** `null` or blank removes the address when the email policy below allows it. */
+    mail?: string | null;
   };
 }): Promise<MutationResult<void>> => {
   return sql.begin(async (tx) => {
-    if (params.data.mail !== undefined) await lockAccountEmail(tx, params.data.mail);
+    const email = params.data.mail === undefined ? undefined : normalizeAccountEmail(params.data.mail ?? "");
+    if (email) await lockAccountEmail(tx, email);
     else await tx`LOCK TABLE auth.users IN ROW EXCLUSIVE MODE`;
-    const [existing] = await tx<{ mail: string | null }[]>`
-      SELECT mail FROM auth.users WHERE id = ${params.id}::uuid AND provider = 'local' FOR UPDATE
+    const [existing] = await tx<{ uid: string; profile: UserProfile; mail: string | null }[]>`
+      SELECT uid, profile, mail FROM auth.users WHERE id = ${params.id}::uuid AND provider = 'local' FOR UPDATE
     `;
     if (!existing) return { ok: false, error: "Local user not found", status: 404 };
-    const email = params.data.mail === undefined ? undefined : normalizeAccountEmail(params.data.mail);
     const changed = email !== undefined && email !== normalizeAccountEmail(existing.mail ?? "");
+    if (changed && !email) {
+      const missing = await missingEmailError(existing.profile, existing.uid);
+      if (missing) return missing;
+    }
     if (changed && email && (await findAccountsByEmail(tx, email)).some((row) => row.id !== params.id)) return emailAlreadyUsed();
     await tx`
       UPDATE auth.users
@@ -150,8 +181,8 @@ export const setProfile = async (params: {
   actor?: AuditActor;
 }): Promise<MutationResult<void>> => {
   const result = await writeLocalAccount(async (tx) => {
-    const rows = await tx<{ provider: string; profile: UserProfile; admin: boolean }[]>`
-    SELECT provider, profile, admin
+    const rows = await tx<{ provider: string; profile: UserProfile; admin: boolean; mail: string | null }[]>`
+    SELECT provider, profile, admin, mail
     FROM auth.users
     WHERE id = ${params.id}::uuid
   `;
@@ -159,6 +190,8 @@ export const setProfile = async (params: {
     if (rows[0]!.provider !== "local") {
       return { ok: false, error: "Only local accounts can change profile locally", status: 400 };
     }
+    if (params.profile === "guest" && !rows[0]!.mail?.trim())
+      return { ok: false, error: "Guest accounts need an email address.", status: 400 };
     if (rows[0]!.profile !== params.profile && !(await isAccountCategoryAllowed({ provider: "local", profile: params.profile }, tx)))
       return { ok: false, error: "This account category is disabled. Contact an administrator.", status: 403 };
 

package/src/services/session/index.ts

@@ -1,4 +1,4 @@
-import { sql } from "bun";
+import { type SQL, sql } from "bun";
 import type { Context } from "hono";
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
 import { HTTPException } from "hono/http-exception";
@@ -6,6 +6,7 @@ import { env } from "../../config/env";
 import type { User } from "../../contracts/shared";
 import { isAccountCategoryAllowed } from "../account-category-policy";
 import { isAccountExpired } from "../account-model";
+import { audit } from "../audit";
 import { IDENTITY_CLOCK_TOLERANCE_SECONDS, IDENTITY_ROLLOUT_MARGIN_MS } from "../identity/constants";
 import { invalidateIdentitySignerCache, prepareIdentitySigner } from "../identity/key-ring";
 import { getIdentityRuntimeConfig } from "../identity/runtime-config";
@@ -59,6 +60,17 @@ const requestCached = <T>(
 const verifyForRequest = (c: Context, token: string): Promise<CloudSessionClaims | null> =>
   requestCached(verificationByRequest, c, token, () => verifyCredential(token));
 
+/** Moves the account's authentication epoch, which ends every session issued before it.
+ * Request-time expiry uses only this: device operations check expiry themselves and an
+ * administrator can lift it, so revoking devices would depend on which request came first. */
+const endSessions = async (db: SQL, userId: string): Promise<void> => {
+  const [updated] = await db<Array<{ id: string }>>`
+    UPDATE auth.users SET auth_epoch = auth_epoch + 1
+    WHERE id = ${userId}::uuid RETURNING id
+  `;
+  if (!updated) throw new Error("Cannot revoke sessions for an unknown user");
+};
+
 const authenticateVerified = async (credential: CloudSessionClaims): Promise<AuthenticatedSession | null> => {
   const { groupsAdmin } = await getIdentityRuntimeConfig();
   const user = await loadJwtSessionUser({
@@ -69,7 +81,7 @@ const authenticateVerified = async (credential: CloudSessionClaims): Promise<Aut
   });
   if (!user) return null;
   if (isAccountExpired(user.accountExpires)) {
-    await session.revokeAllForUser(user.id);
+    await endSessions(sql, user.id);
     return null;
   }
   return {
@@ -94,7 +106,7 @@ const authenticateUserId = async (token: string): Promise<string | null> => {
   const identity = await loadJwtSessionIdentity({ userId: credential.sub, sid: credential.sid, authEpoch: credential.auth_epoch });
   if (!identity) return null;
   if (isAccountExpired(identity.accountExpires)) {
-    await session.revokeAllForUser(identity.userId);
+    await endSessions(sql, identity.userId);
     return null;
   }
   return identity.userId;
@@ -224,12 +236,25 @@ export const session = {
     deleteCookie(c, "session_token", { path: "/" });
   },
 
+  /** Signs the account out everywhere: every session and every paired sign-in device, audited per device. */
   revokeAllForUser: async (userId: string): Promise<void> => {
-    const [updated] = await sql<Array<{ id: string }>>`
-      UPDATE auth.users SET auth_epoch = auth_epoch + 1
-      WHERE id = ${userId}::uuid RETURNING id
-    `;
-    if (!updated) throw new Error("Cannot revoke sessions for an unknown user");
+    await sql.begin(async (tx) => {
+      await endSessions(tx, userId);
+      // A paired device approves new sign-ins on its own, so a lost one would outlive the epoch change.
+      const devices = await tx<Array<{ id: string }>>`
+        UPDATE auth.app_devices SET revoked_at = now() WHERE user_id = ${userId}::uuid AND revoked_at IS NULL RETURNING id
+      `;
+      for (const device of devices)
+        await audit.record(
+          {
+            action: "auth.app.device.revoke",
+            outcome: "allowed",
+            target: { type: "app_device", id: device.id },
+            metadata: { targetUserId: userId, provenance: "system", reason: "sign_out_everywhere" },
+          },
+          tx,
+        );
+    });
   },
 
   authenticate: authenticateToken,

package/src/services/settings/core-settings.ts

@@ -502,6 +502,13 @@ export const CORE_SETTINGS = {
     default: false,
     description: "Allow creating a local guest account automatically during first email sign-in when no local account exists yet.",
   },
+  "user.local_email_optional": {
+    kind: "boolean",
+    label: "Allow local accounts without email",
+    default: false,
+    description:
+      "Administrators may create local full accounts without an email address or remove it later. These accounts sign in with a paired app or a passkey; email sign-in links, welcome emails and email notifications are unavailable to them. Guests and FreeIPA accounts still need an email address. Turning this off leaves existing accounts unchanged.",
+  },
   "user.abbr_length": {
     kind: "number",
     label: "Username Abbreviation Length",

package/src/styles/global.css

@@ -278,6 +278,11 @@ solid-island {
 @media (max-width: 1023px) {
   .cloud-app-canvas {
     padding: env(safe-area-inset-top, 0px) env(safe-area-inset-right, 0px) env(safe-area-inset-bottom, 0px) env(safe-area-inset-left, 0px);
+  }
+  /* The flat surface replaces the app gradient in both themes. The dark
+     selector matches the specificity of the dark gradient above. */
+  .cloud-app-canvas,
+  .dark .cloud-app-canvas {
     background: var(--ui-surface);
   }
   /* Below lg the document is the page scroller; reserve its scrollbar gutter