npm - @lenne.tech/nest-server - Versions diffs - 11.35.1 → 11.36.1 - Mend

@lenne.tech/nest-server 11.35.1 → 11.36.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (51) hide show

package/src/core/modules/tenant/core-tenant.service.ts CHANGED Viewed

@@ -74,7 +74,22 @@ export class CoreTenantService {
   }
   /**
-   * Get a single membership (any status).
+   * Get a single membership REGARDLESS of its status.
+   *
+   * Read the name literally: a removal is a status change to `SUSPENDED`, not
+   * a delete, so this still answers for somebody who was thrown out. That is
+   * deliberate and `addMember` depends on it — it reactivates the existing row
+   * instead of creating a duplicate.
+   *
+   * It is therefore the WRONG method for an authorization check. Asking "is
+   * this user a member with role X?" through it answers yes for a removed
+   * member, and a route that guards itself this way keeps granting a
+   * suspended administrator the right to invite, remove and re-role — the very
+   * rights that being removed was supposed to take away. Routes that carry
+   * `@SkipTenantCheck()` and decide for themselves are exactly the ones at
+   * risk, because the tenant guard never sees them.
+   *
+   * For an authorization check use {@link getActiveMembership}.
    */
   async getMembership(tenantId: string, userId: string): Promise<CoreTenantMemberModel | null> {
     return this.memberModel
@@ -83,6 +98,25 @@ export class CoreTenantService {
       .exec() as Promise<CoreTenantMemberModel | null>;
   }
+  /**
+   * Get a membership only while it is live — the one to use when deciding what
+   * somebody may do.
+   *
+   * Returns `null` for a suspended or invited membership, so "removed" means
+   * removed everywhere, not just for the data the tenant guard happens to
+   * cover.
+   */
+  async getActiveMembership(tenantId: string, userId: string): Promise<CoreTenantMemberModel | null> {
+    if (!tenantId?.trim() || !userId?.trim()) {
+      return null;
+    }
+    return this.memberModel
+      .findOne({ status: TenantMemberStatus.ACTIVE, tenant: tenantId, user: userId })
+      .lean()
+      .exec() as Promise<CoreTenantMemberModel | null>;
+  }
   /**
    * Add a member to a tenant.
    * Uses bypassTenantGuard to avoid tenant filtering on the membership collection itself.
@@ -193,8 +227,11 @@ export class CoreTenantService {
     assertAssignableMembershipRole(role);
     const highestRole = this.getHighestRole();
-    // If demoting from highest role, ensure it's not the last one
-    const existing = await this.getMembership(tenantId, userId);
+    // If demoting from highest role, ensure it's not the last one. Active
+    // only: a suspended membership is not an owner any more, and letting it
+    // trigger the guard produces "cannot demote the last owner" for a user who
+    // is not even a member.
+    const existing = await this.getActiveMembership(tenantId, userId);
     if (existing?.role === highestRole && role !== highestRole) {
       await this.assertNotLastOwner(tenantId, userId);
     }
@@ -237,7 +274,7 @@ export class CoreTenantService {
       });
       if (ownerCount <= 1) {
-        const membership = await this.getMembership(tenantId, userId);
+        const membership = await this.getActiveMembership(tenantId, userId);
         if (membership?.role === highestRole) {
           throw new BadRequestException('Cannot remove or demote the last owner of a tenant');
         }

package/src/templates/password-reset-de.ejs ADDED Viewed

@@ -0,0 +1,65 @@
+<% /* `appName` is optional so a caller that omits it cannot turn a password-reset mail into a 500. */ const brand = (typeof appName !== 'undefined' && appName) ? appName : ''; -%>
+<!DOCTYPE html>
+<html lang="de">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <meta http-equiv="X-UA-Compatible" content="IE=edge">
+  <title>Passwort zurücksetzen</title>
+  <style>
+    /* Responsive: on phones let the card fill the width and tighten the side
+       padding. Clients that ignore <style>/@media still get a fluid card via
+       the inline width:100% + max-width:600px below. */
+    @media only screen and (max-width: 600px) {
+      .ns-px { padding-left: 24px !important; padding-right: 24px !important; }
+      .ns-logo { width: 160px !important; height: auto !important; }
+    }
+  </style>
+</head>
+<body style="margin:0; padding:0; background-color:#f8fafc; -webkit-text-size-adjust:100%; -ms-text-size-adjust:100%;">
+  <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" bgcolor="#f8fafc" style="background-color:#f8fafc;">
+    <tr>
+      <td align="center" style="padding:32px 16px;">
+        <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" bgcolor="#ffffff" style="width:100%; max-width:600px; background-color:#ffffff; border:1px solid #e2e8f0; border-radius:8px; overflow:hidden;">
+          <!-- Header: the logo when the deployment supplies one, the app name otherwise -->
+          <tr>
+            <td align="center" bgcolor="#ffffff" style="background-color:#ffffff; padding:32px 32px 24px 32px; font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;">
+              <% if (typeof logoSrc !== 'undefined' && logoSrc) { %>
+                <img src="<%= logoSrc %>" alt="<%= brand %>" class="ns-logo" width="200" style="display:block; width:200px; height:auto; border:0; text-decoration:none;">
+              <% } else { %>
+                <span style="font-size:20px; line-height:26px; font-weight:700; color:#262626;"><%= brand %></span>
+              <% } %>
+            </td>
+          </tr>
+          <tr>
+            <td class="ns-px" style="padding:36px 40px 8px 40px; font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;">
+              <h1 style="margin:0 0 16px 0; font-size:22px; line-height:28px; font-weight:700; color:#262626;">Hallo <%= name %>,</h1>
+              <p style="margin:0 0 16px 0; font-size:16px; line-height:24px; color:#262626;">du hast ein neues Passwort angefordert. Über die Schaltfläche unten kannst du eines festlegen.</p>
+            </td>
+          </tr>
+          <tr>
+            <td class="ns-px" style="padding:8px 40px 36px 40px; font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;">
+              <table role="presentation" cellpadding="0" cellspacing="0" border="0">
+                <tr>
+                  <td align="center" bgcolor="#2563eb" style="border-radius:6px; mso-padding-alt:13px 28px;">
+                    <a href="<%= link %>" target="_blank" style="display:inline-block; padding:13px 28px; font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif; font-size:16px; line-height:20px; font-weight:600; color:#ffffff; text-decoration:none; border-radius:6px;">Passwort zurücksetzen</a>
+                  </td>
+                </tr>
+              </table>
+              <p style="margin:24px 0 0 0; font-size:13px; line-height:20px; color:#737373;">
+                Falls die Schaltfläche nicht funktioniert, kopiere diesen Link in deinen Browser:<br>
+                <a href="<%= link %>" style="color:#1d4ed8; word-break:break-all; overflow-wrap:break-word;"><%= link %></a>
+              </p>
+            </td>
+          </tr>
+          <tr>
+            <td class="ns-px" style="padding:24px 40px 32px 40px; border-top:1px solid #e2e8f0; font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;">
+              <p style="margin:0; font-size:12px; line-height:18px; color:#a3a3a3;">Dies ist eine automatisch versendete Nachricht <% if (brand) { %>zu deinem <%= brand %>-Konto<% } else { %>zu deinem Konto<% } %>. Wenn du kein neues Passwort angefordert hast, kannst du diese E-Mail ignorieren — dein Passwort bleibt unverändert.</p>
+            </td>
+          </tr>
+        </table>
+      </td>
+    </tr>
+  </table>
+</body>
+</html>

package/src/templates/password-reset-en.ejs ADDED Viewed

@@ -0,0 +1,65 @@
+<% /* `appName` is optional so a caller that omits it cannot turn a password-reset mail into a 500. */ const brand = (typeof appName !== 'undefined' && appName) ? appName : ''; -%>
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <meta http-equiv="X-UA-Compatible" content="IE=edge">
+  <title>Reset your password</title>
+  <style>
+    /* Responsive: on phones let the card fill the width and tighten the side
+       padding. Clients that ignore <style>/@media still get a fluid card via
+       the inline width:100% + max-width:600px below. */
+    @media only screen and (max-width: 600px) {
+      .ns-px { padding-left: 24px !important; padding-right: 24px !important; }
+      .ns-logo { width: 160px !important; height: auto !important; }
+    }
+  </style>
+</head>
+<body style="margin:0; padding:0; background-color:#f8fafc; -webkit-text-size-adjust:100%; -ms-text-size-adjust:100%;">
+  <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" bgcolor="#f8fafc" style="background-color:#f8fafc;">
+    <tr>
+      <td align="center" style="padding:32px 16px;">
+        <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" bgcolor="#ffffff" style="width:100%; max-width:600px; background-color:#ffffff; border:1px solid #e2e8f0; border-radius:8px; overflow:hidden;">
+          <!-- Header: the logo when the deployment supplies one, the app name otherwise -->
+          <tr>
+            <td align="center" bgcolor="#ffffff" style="background-color:#ffffff; padding:32px 32px 24px 32px; font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;">
+              <% if (typeof logoSrc !== 'undefined' && logoSrc) { %>
+                <img src="<%= logoSrc %>" alt="<%= brand %>" class="ns-logo" width="200" style="display:block; width:200px; height:auto; border:0; text-decoration:none;">
+              <% } else { %>
+                <span style="font-size:20px; line-height:26px; font-weight:700; color:#262626;"><%= brand %></span>
+              <% } %>
+            </td>
+          </tr>
+          <tr>
+            <td class="ns-px" style="padding:36px 40px 8px 40px; font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;">
+              <h1 style="margin:0 0 16px 0; font-size:22px; line-height:28px; font-weight:700; color:#262626;">Hello <%= name %>,</h1>
+              <p style="margin:0 0 16px 0; font-size:16px; line-height:24px; color:#262626;">you asked to set a new password. Use the button below to choose one.</p>
+            </td>
+          </tr>
+          <tr>
+            <td class="ns-px" style="padding:8px 40px 36px 40px; font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;">
+              <table role="presentation" cellpadding="0" cellspacing="0" border="0">
+                <tr>
+                  <td align="center" bgcolor="#2563eb" style="border-radius:6px; mso-padding-alt:13px 28px;">
+                    <a href="<%= link %>" target="_blank" style="display:inline-block; padding:13px 28px; font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif; font-size:16px; line-height:20px; font-weight:600; color:#ffffff; text-decoration:none; border-radius:6px;">Reset password</a>
+                  </td>
+                </tr>
+              </table>
+              <p style="margin:24px 0 0 0; font-size:13px; line-height:20px; color:#737373;">
+                If the button doesn't work, copy and paste this link into your browser:<br>
+                <a href="<%= link %>" style="color:#1d4ed8; word-break:break-all; overflow-wrap:break-word;"><%= link %></a>
+              </p>
+            </td>
+          </tr>
+          <tr>
+            <td class="ns-px" style="padding:24px 40px 32px 40px; border-top:1px solid #e2e8f0; font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;">
+              <p style="margin:0; font-size:12px; line-height:18px; color:#a3a3a3;">This is an automated message regarding <% if (brand) { %>your <%= brand %> account<% } else { %>your account<% } %>. If you did not ask for a password reset, you can safely ignore this email — your password stays unchanged.</p>
+            </td>
+          </tr>
+        </table>
+      </td>
+    </tr>
+  </table>
+</body>
+</html>

package/src/templates/password-reset.ejs CHANGED Viewed

@@ -1,3 +1,3 @@
 <h1>Hello <%= name %>,</h1>
 <p>you requested a link for setting a new password. Here it is.</p><br />
-<a href="<%= link %>">Passwort zurücksetzten</a>
+<a href="<%= link %>">Reset password</a>