@madauth/server 0.2.0-beta.2 → 0.3.0-beta.1

package/dist/{chunk-5CKEMC6M.js → chunk-ODITZLMM.js}

@@ -8,7 +8,132 @@ import {
   WEBHOOK_TYPES,
   checkWebhookSecret,
   generateWebhookSecret
-} from "./chunk-6EJDVZCD.js";
+} from "./chunk-NPNM26J3.js";
+
+// src/claims.ts
+var ADMIN_ROLE = "admin";
+var MAX_ROLES = 20;
+var MAX_CLAIMS_LENGTH = 2048;
+var ROLE_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
+var CLAIM_NAME = /^[a-zA-Z][a-zA-Z0-9_]{0,63}$/;
+function parseRoles(input) {
+  if (!Array.isArray(input)) return null;
+  if (!input.every((role) => typeof role === "string" && ROLE_NAME.test(role))) return null;
+  const roles = [...new Set(input)].sort();
+  return roles.length <= MAX_ROLES ? roles : null;
+}
+function parseClaims(input) {
+  if (!isJsonObject(input)) return null;
+  const claims = {};
+  for (const key of Object.keys(input).sort()) {
+    const value = input[key];
+    if (!CLAIM_NAME.test(key) || !isJsonValue(value)) return null;
+    if (key === "roles") {
+      const roles = parseRoles(value);
+      if (!roles) return null;
+      claims[key] = roles;
+    } else {
+      claims[key] = value;
+    }
+  }
+  return JSON.stringify(claims).length <= MAX_CLAIMS_LENGTH ? claims : null;
+}
+function isJsonObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isJsonValue(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+  if (typeof value === "number") return Number.isFinite(value);
+  if (Array.isArray(value)) return value.every(isJsonValue);
+  return isJsonObject(value) && Object.values(value).every(isJsonValue);
+}
+function sameClaims(a, b) {
+  return JSON.stringify(a ?? {}) === JSON.stringify(b ?? {});
+}
+function claimsFromJson(json) {
+  if (!json) return {};
+  try {
+    const parsed = JSON.parse(json);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function rolesOf(user) {
+  const roles = user.claims?.roles;
+  return Array.isArray(roles) ? roles.filter((role) => typeof role === "string") : [];
+}
+function isAdmin(user) {
+  return rolesOf(user).includes(ADMIN_ROLE);
+}
+
+// src/settings.ts
+var SIGN_IN_METHODS = ["google", "password"];
+var METHODS_SETTING = "methods";
+function parseMethodSettings(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
+  const settings = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (!SIGN_IN_METHODS.includes(key) || typeof value !== "boolean") return null;
+    settings[key] = value;
+  }
+  return settings;
+}
+var MAX_TRIES = 3;
+var Settings = class {
+  constructor(store) {
+    this.store = store;
+  }
+  /** The setting's value, or undefined if it was never set. */
+  async get(id) {
+    return (await this.read(id)).value;
+  }
+  /** The stored JSON and what it holds; both undefined if the setting was never set. */
+  async read(id) {
+    const record = await this.store.findOne("setting", { id });
+    if (typeof record?.value !== "string") return {};
+    try {
+      return { json: record.value, value: JSON.parse(record.value) };
+    } catch {
+      return { json: record.value };
+    }
+  }
+  /**
+   * Changes the setting: `apply` gets the current value and returns the new one, or null to refuse the
+   * change. The write only lands if nobody changed the setting since `apply` read it; otherwise `apply` runs
+   * again with the newer value. Resolves to the new value, or null if `apply` refused.
+   * `updatedBy` is the address of the admin, or null for the command line.
+   */
+  async change(id, apply, updatedBy) {
+    for (let attempt = 0; attempt < MAX_TRIES; attempt++) {
+      const { json, value } = await this.read(id);
+      const next = apply(value);
+      if (next === null) return null;
+      const patch = { value: JSON.stringify(next), updatedAt: Date.now(), updatedBy };
+      const written = json === void 0 ? await this.store.create("setting", { id, ...patch }) : await this.store.update("setting", { id, value: json }, patch) === 1;
+      if (written) return next;
+    }
+    throw new Error(`Setting "${id}" kept changing; try again.`);
+  }
+  /** Replaces the setting. */
+  async set(id, value, updatedBy) {
+    await this.change(id, () => value, updatedBy);
+  }
+  /** Which sign-in methods are on; a method that was never switched off is on. */
+  async methods() {
+    return parseMethodSettings(await this.get(METHODS_SETTING)) ?? {};
+  }
+  /** Changes which methods are on, see {@link change}; `apply` gets the methods as they are now. */
+  async changeMethods(apply, updatedBy) {
+    return this.change(METHODS_SETTING, (current) => apply(parseMethodSettings(current) ?? {}), updatedBy);
+  }
+};
+function isOn(method, available, methods) {
+  return available(method) && methods[method] !== false;
+}
+function anyOn(available, methods) {
+  return SIGN_IN_METHODS.some((method) => isOn(method, available, methods));
+}
 
 // src/config.ts
 var envVars = {
@@ -17,7 +142,7 @@ var envVars = {
   ALLOWED_ORIGINS: true,
   GOOGLE_CLIENT_ID: false,
   GOOGLE_CLIENT_SECRET: false,
-  DATABASE_URL: false,
+  DATABASE_URL: true,
   PASSWORD_MIN_LENGTH: false,
   WEBHOOK_URL: false,
   WEBHOOK_SECRET: false,
@@ -86,19 +211,18 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
   if (clientId && !clientId.endsWith(".apps.googleusercontent.com")) {
     throw new ConfigError(`GOOGLE_CLIENT_ID must end with ".apps.googleusercontent.com" but is "${clientId}".`);
   }
-  const sendsEmails = !!(overrides.store || read("DATABASE_URL"));
-  const webhook = webhookFromEnv(read("WEBHOOK_URL"), read("WEBHOOK_SECRET"), read("WEBHOOK_EVENTS"), sendsEmails);
-  if (sendsEmails && !webhook) {
+  const webhook = webhookFromEnv(read("WEBHOOK_URL"), read("WEBHOOK_SECRET"), read("WEBHOOK_EVENTS"));
+  const sendsEmails = !!webhook && REQUIRED_EMAIL_TYPES.every((type) => webhook.events.has(type));
+  const password = sendsEmails ? { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")) } : void 0;
+  if (!clientId && !password) {
     throw new ConfigError(
-      `WEBHOOK_URL is not set. E-mail & password sign-in sends its e-mails through your webhook. For development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered. See "Webhooks" in docs/server.md.`
+      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, and/or a webhook that sends the e-mails for e-mail & password sign-in: for development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered. See docs/server.md.`
     );
   }
   const store = overrides.store ?? await storeFromDatabaseUrl(read("DATABASE_URL"));
-  let password;
-  if (store) password = { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")), store };
-  if (!clientId && !password) {
+  if (!store) {
     throw new ConfigError(
-      "No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in and/or DATABASE_URL (e.g. sqlite:./madauth.db) for e-mail & password sign-in. See docs/server.md."
+      "DATABASE_URL is not set. madAuth stores every user, whichever way they sign in: set e.g. DATABASE_URL=sqlite:./madauth.db or DATABASE_URL=dynamodb:<table>. See docs/server.md."
     );
   }
   const ttlValue = read("SESSION_TTL");
@@ -121,6 +245,7 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
     renewalTtlSeconds,
     cookieDomain: read("COOKIE_DOMAIN"),
     google: clientId ? { clientId, clientSecret: read("GOOGLE_CLIENT_SECRET") } : void 0,
+    store,
     password,
     webhook
   };
@@ -174,8 +299,9 @@ async function dynamoDbStore(tableName) {
   const { createDynamoDbAdapter } = await import("./dynamodb.js");
   return createDynamoDbAdapter({ tableName });
 }
+var RENAMED_TYPES = { "password.reset": "email.password_reset", "roles.changed": "user.claims_changed" };
 var LOCAL_HOSTS = ["localhost", "127.0.0.1", "[::1]", "host.docker.internal"];
-function webhookFromEnv(url, secret, events, sendsEmails) {
+function webhookFromEnv(url, secret, events) {
   if (!url) {
     if (secret || events) throw new ConfigError("WEBHOOK_SECRET and WEBHOOK_EVENTS need WEBHOOK_URL.");
     return void 0;
@@ -205,24 +331,22 @@ WEBHOOK_SECRET=${generateWebhookSecret()}
   const allTypes = `All types: ${WEBHOOK_TYPES.join(", ")}. See "Webhooks" in docs/server.md.`;
   if (!selected.size) {
     throw new ConfigError(
-      "WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. " + (sendsEmails ? `E-mail & password sign-in needs ${REQUIRED_EMAIL_TYPES.join(" and ")}. For a receiver that sends the e-mails:
+      `WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. E-mail & password sign-in is on when they include ${REQUIRED_EMAIL_TYPES.join(" and ")}. For a receiver that sends the e-mails:
 
 WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered
 
-` : "For example:\n\nWEBHOOK_EVENTS=user.signed_in\n\n") + allTypes
+For one that only wants to know who signed in:
+
+WEBHOOK_EVENTS=user.signed_in
+
+` + allTypes
     );
   }
   const unknown = [...selected].filter((e) => !WEBHOOK_TYPES.includes(e));
   if (unknown.length) {
-    throw new ConfigError(`WEBHOOK_EVENTS: unknown type ${unknown.join(", ")}. Known types: ${WEBHOOK_TYPES.join(", ")}.`);
-  }
-  const missing = sendsEmails ? REQUIRED_EMAIL_TYPES.filter((type) => !selected.has(type)) : [];
-  if (missing.length) {
+    const renamed = unknown.filter((e) => e in RENAMED_TYPES).map((e) => `${e} is now ${RENAMED_TYPES[e]}`);
     throw new ConfigError(
-      `WEBHOOK_EVENTS lacks ${missing.join(" and ")}. E-mail & password sign-in can't work without these e-mails, so your webhook receiver must send them:
-
-WEBHOOK_EVENTS=${[...selected, ...missing].join(",")}
-`
+      `WEBHOOK_EVENTS: unknown type ${unknown.join(", ")}. ${renamed.length ? `${renamed.join("; ")}. ` : ""}Known types: ${WEBHOOK_TYPES.join(", ")}.`
     );
   }
   return { url: parsed.href, secret, events: selected };
@@ -303,45 +427,6 @@ function safeEqual(a, b) {
   return x.length === y.length && timingSafeEqual(x, y);
 }
 
-// src/roles.ts
-var ADMIN_ROLE = "admin";
-var MAX_ROLES = 20;
-var ROLE_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
-function parseRoles(input) {
-  if (!Array.isArray(input)) return null;
-  if (!input.every((role) => typeof role === "string" && ROLE_NAME.test(role))) return null;
-  const roles = [...new Set(input)].sort();
-  return roles.length <= MAX_ROLES ? roles : null;
-}
-function sameRoles(a, b) {
-  return a.length === b.length && a.every((role, i) => role === b[i]);
-}
-var Roles = class {
-  constructor(store) {
-    this.store = store;
-  }
-  /** The address's roles, sorted; empty if it has none. */
-  async get(emailNormalized) {
-    const record = await this.store.findOne("role", { id: emailNormalized });
-    return typeof record?.roles === "string" && record.roles ? record.roles.split(" ").filter(Boolean) : [];
-  }
-  /** Replaces the address's roles. `updatedBy` is the address of the admin, or null for the command line. */
-  async set(emailNormalized, roles, updatedBy) {
-    if (!roles.length) {
-      await this.remove(emailNormalized);
-      return;
-    }
-    const data = { roles: roles.join(" "), updatedAt: Date.now(), updatedBy };
-    if (await this.store.update("role", { id: emailNormalized }, data) === 1) return;
-    if (!await this.store.create("role", { id: emailNormalized, ...data })) {
-      await this.store.update("role", { id: emailNormalized }, data);
-    }
-  }
-  async remove(emailNormalized) {
-    await this.store.delete("role", { id: emailNormalized });
-  }
-};
-
 // src/users.ts
 import { randomBytes as randomBytes2 } from "crypto";
 var MAX_CODE_ATTEMPTS = 5;
@@ -350,6 +435,18 @@ var newId = (prefix) => `${prefix}_${randomBytes2(16).toString("base64url")}`;
 function passwordAccountKey(userId) {
   return `password:${userId}`;
 }
+function googleAccountKey(sub) {
+  return `google:${sub}`;
+}
+function toMadauthUser(user, profile = {}) {
+  const result = { id: user.id, email: user.email };
+  const name = user.name ?? profile.name;
+  if (name) result.name = name;
+  if (profile.picture) result.picture = profile.picture;
+  const claims = claimsFromJson(user.claims);
+  if (Object.keys(claims).length) result.claims = claims;
+  return result;
+}
 var Users = class {
   /** `codeKey` keys the e-mail codes (see deriveCodeKey); only needed to issue and check them. */
   constructor(store, codeKey) {
@@ -367,11 +464,16 @@ var Users = class {
     return await this.store.findOne("user", { id });
   }
   async passwordAccount(userId) {
-    return await this.store.findOne("account", { key: passwordAccountKey(userId) });
+    return this.findAccountByKey(passwordAccountKey(userId));
+  }
+  async findAccountByKey(key) {
+    return await this.store.findOne("account", { key });
   }
-  /** Creates a user with a password. Resolves to null if the e-mail address is taken. */
-  async createPasswordUser(data) {
-    const now = Date.now();
+  /**
+   * Creates a user with their first account. Resolves to null if the e-mail address or the account key is
+   * taken. `account.key` is `password:<userId>` for a password (its hash as `secret`), or e.g. `google:<sub>`.
+   */
+  async createUser(data) {
     const user = {
       id: newId("usr"),
       email: data.email,
@@ -381,39 +483,59 @@ var Users = class {
       sessionVersion: 0,
       lastMailAt: 0,
       wrongCodes: 0,
-      createdAt: now
+      claims: null,
+      createdAt: Date.now()
     };
     if (!await this.store.create("user", user)) return null;
-    const account = {
-      id: newId("acc"),
-      userId: user.id,
-      key: passwordAccountKey(user.id),
-      secret: data.passwordHash,
-      failedAttempts: 0,
-      lockedUntil: 0,
-      createdAt: now
-    };
-    if (!await this.store.create("account", account)) {
+    const account = typeof data.account === "function" ? data.account(user.id) : data.account;
+    if (!await this.linkAccount(user.id, account)) {
       await this.store.delete("user", { id: user.id });
       return null;
     }
     return user;
   }
   /**
-   * Deletes the user with this e-mail address and everything stored for them. Resolves to the deleted
-   * user's ID, or null if there is no such user (any more).
+   * A provider verified the user's address: an unconfirmed password sign-up with it, whose password nobody
+   * has proven, is dropped (the account and its pending links and codes), and the user counts as verified.
+   */
+  async verifyByProvider(user) {
+    if (user.emailVerified) return;
+    await this.store.delete("account", { key: passwordAccountKey(user.id) });
+    await this.clearVerifications(user.id);
+    await this.updateUser(user.id, { emailVerified: true, wrongCodes: 0 });
+  }
+  /** Removes an account record, e.g. one left behind by a deletion that did not finish. */
+  async deleteAccount(id) {
+    await this.store.delete("account", { id });
+  }
+  /** Adds a sign-in method to a user. Resolves to null if the account key is taken. */
+  async linkAccount(userId, account) {
+    const record = {
+      id: newId("acc"),
+      userId,
+      key: account.key,
+      secret: account.secret ?? null,
+      failedAttempts: 0,
+      lockedUntil: 0,
+      email: account.email ?? null,
+      createdAt: Date.now()
+    };
+    return await this.store.create("account", record) ? record : null;
+  }
+  /**
+   * Deletes the user and everything stored for them. Resolves to false if there is no such user (any more).
    */
-  async deleteByEmail(emailNormalized) {
-    const user = await this.findByEmail(emailNormalized);
-    if (!user) return null;
-    if (await this.store.delete("user", { id: user.id }) !== 1) return null;
+  async deleteById(id) {
+    const user = await this.findById(id);
+    if (!user) return false;
+    if (await this.store.delete("user", { id: user.id }) !== 1) return false;
     try {
       await this.store.delete("account", { userId: user.id });
       await this.store.delete("verification", { userId: user.id });
     } catch (e) {
       console.error(`[madauth] Deleted user ${user.id}, but not all of their records: ${e.message}`);
     }
-    return user.id;
+    return true;
   }
   async updateUser(id, patch) {
     await this.store.update("user", { id }, patch);
@@ -499,6 +621,12 @@ var Users = class {
 };
 
 export {
+  ADMIN_ROLE,
+  parseRoles,
+  parseClaims,
+  sameClaims,
+  claimsFromJson,
+  isAdmin,
   MAX_PASSWORD_LENGTH,
   hashPassword,
   verifyPassword,
@@ -507,11 +635,15 @@ export {
   normalizeEmail,
   isValidEmail,
   deriveCodeKey,
-  ADMIN_ROLE,
-  parseRoles,
-  sameRoles,
-  Roles,
+  passwordAccountKey,
+  googleAccountKey,
+  toMadauthUser,
   Users,
+  SIGN_IN_METHODS,
+  parseMethodSettings,
+  Settings,
+  isOn,
+  anyOn,
   envVars,
   resolveEnv,
   ConfigError,