@madauth/server 0.2.0-beta.2 → 0.3.0-beta.2

package/dist/bin.js

@@ -2,29 +2,35 @@
 import {
   createTablesSql,
   upgradeTablesSql
-} from "./chunk-CNL562LZ.js";
+} from "./chunk-56MOVFO4.js";
 import {
   madauthSchema
-} from "./chunk-XNBWZZHT.js";
+} from "./chunk-CD7Y4T66.js";
 import {
-  Roles,
+  SIGN_IN_METHODS,
+  Settings,
   Users,
+  anyOn,
   checkPasswordPolicy,
+  claimsFromJson,
   hashPassword,
+  isOn,
   isValidEmail,
   loadConfig,
   loadStore,
   loadUserStoreConfig,
   normalizeEmail,
-  parseRoles
-} from "./chunk-5CKEMC6M.js";
+  parseClaims,
+  parseRoles,
+  passwordAccountKey
+} from "./chunk-TI35AZ2U.js";
 import {
   generateSigningKey
 } from "./chunk-JDQLSL36.js";
 import {
   DEV_WEBHOOK_RECEIVER_URL,
   generateWebhookSecret
-} from "./chunk-6EJDVZCD.js";
+} from "./chunk-3QRKWLR7.js";
 
 // src/cli.ts
 import { existsSync, readFileSync, rmSync, writeFileSync } from "fs";
@@ -44,10 +50,17 @@ Commands:
   generate-webhook-secret      Print a new secret to use as WEBHOOK_SECRET (madAuth and your receiver)
   create-user <email>          Create a user with a password (asks for it), already verified.
                                Uses DATABASE_URL and PASSWORD_MIN_LENGTH from the environment.
-  set-roles <email> [role...]  Set the roles of an e-mail address, e.g. to make the first admin:
+  set-roles <email> [role...]  Set the roles of a user (the claim "roles"), e.g. to make the first admin:
                                set-roles you@example.com admin. Without roles, removes them all.
-                               Uses DATABASE_URL from the environment.
-  get-roles <email>            Print the roles of an e-mail address.
+                               The user must exist: signed in once, or created with create-user.
+  get-roles <email>            Print the roles of a user.
+  set-claims <email> <json>    Replace the claims of a user, e.g. '{"roles":["admin"],"plan":"pro"}'.
+  get-claims <email>           Print the claims of a user as JSON.
+  set-methods [method...]      Switch sign-in methods on and off while the server runs: the listed ones
+                               (google, password) are on, the others off. Without any, all are on.
+  get-methods                  Print which sign-in methods are switched on.
+                               The claims commands use DATABASE_URL from the environment; the methods
+                               commands need the server's whole configuration (e.g. --env-file .env).
   schema [--dialect <name>] [--from <version>]
                                Print the SQL that creates madAuth's tables for a custom store adapter.
                                Dialects: postgres (default), mysql, sqlite. With --from, print only the
@@ -166,7 +179,8 @@ ${usage}`, exitCode: 1 };
   }
   const { values: options, positionals } = parsed;
   const [command, ...rest] = positionals;
-  const maxArguments = command === "set-roles" ? Infinity : command === "create-user" || command === "get-roles" ? 1 : 0;
+  const argumentLimits = { "set-roles": Infinity, "set-methods": Infinity, "set-claims": 2, "create-user": 1, "get-roles": 1, "get-claims": 1 };
+  const maxArguments = command ? argumentLimits[command] ?? 0 : 0;
   if (rest.length > maxArguments) {
     return { output: `Unexpected argument: ${rest.at(-1)}
 
@@ -203,8 +217,11 @@ ${usage}`, exitCode: 1 };
     if (command === "create-user") {
       return await createUser(rest[0], io, env);
     }
-    if (command === "set-roles" || command === "get-roles") {
-      return await roles(command, rest[0], rest.slice(1), env);
+    if (command === "set-roles" || command === "get-roles" || command === "set-claims" || command === "get-claims") {
+      return await claims(command, rest[0], rest.slice(1), env);
+    }
+    if (command === "set-methods" || command === "get-methods") {
+      return await methods(command, rest, env);
     }
   } catch (e) {
     return { output: e instanceof Error ? e.message : String(e), exitCode: 1 };
@@ -239,14 +256,14 @@ async function init(options, io) {
   }
   const clientSecret = clientId ? (options["google-client-secret"] ?? await askClientSecret()).trim() : "";
   const password = options.password ?? /^y/i.test(await answer(void 0, "E-mail & password sign-in? (yes/no)", "yes"));
-  if (!password && (options.database !== void 0 || options["webhook-url"] !== void 0)) {
-    return fail("--database and --webhook-url are for e-mail & password sign-in, which is turned off.");
+  if (!password && options["webhook-url"] !== void 0) {
+    return fail("--webhook-url is for e-mail & password sign-in, which is turned off.");
   }
   if (!clientId && !password) {
     return fail("No sign-in method is chosen. Give a Google client ID, turn on e-mail & password sign-in, or both.");
   }
-  const database = password ? await answer(options.database, "Database for the users", "sqlite:./madauth.db") : "";
-  if (password && !/^(sqlite|dynamodb):./.test(database)) {
+  const database = await answer(options.database, "Database for the users", "sqlite:./madauth.db");
+  if (!/^(sqlite|dynamodb):./.test(database)) {
     return fail(`The database must be sqlite:<path> or dynamodb:<table> but is "${database}".`);
   }
   const webhookUrl = password ? await answer(options["webhook-url"], "Webhook URL, where madAuth hands over its e-mails", "http://localhost:8790/webhook") : "";
@@ -271,17 +288,17 @@ ${name}=${value}
     variable("ALLOWED_ORIGINS", origin, "Origins of your apps, comma-separated. Only these may call the server."),
     clientId && variable("GOOGLE_CLIENT_ID", clientId, "Google sign-in: your OAuth client ID, of the type Web application."),
     clientSecret && variable("GOOGLE_CLIENT_SECRET", clientSecret, "Client secret of the same client. It enables the redirect flow."),
-    password && variable("DATABASE_URL", database, "E-mail & password sign-in: where the users are stored."),
+    variable("DATABASE_URL", database, "Where the users are stored, whichever way they sign in."),
     password && variable("WEBHOOK_URL", webhookUrl, "Your webhook receiver. madAuth hands its e-mails to it."),
     password && variable("WEBHOOK_SECRET", generateWebhookSecret(), "Signs every webhook call. Your receiver needs the same one."),
     password && variable(
       "WEBHOOK_EVENTS",
-      "email.verify,email.reset,email.already_registered",
+      "email.verify,email.reset,email.already_registered,email.no_password",
       "The types your webhook receiver handles; only these are sent. Add e.g. signup.before or user.created."
     ),
     variable("PORT", String(PORT), "Port the server listens on.")
   ].filter(Boolean).join("");
-  await loadConfig({ ...parseEnv(content), DATABASE_URL: void 0 }, password ? { store: {} } : {});
+  await loadConfig({ ...parseEnv(content), DATABASE_URL: void 0 }, { store: {} });
   if (options.force) rmSync(file, { force: true });
   writeFileSync(file, content, { mode: 384, flag: "wx" });
   const google = clientSecret ? "GoogleRedirect" : clientId ? "GoogleFedcm" : void 0;
@@ -337,25 +354,74 @@ function nextSteps(file, origin, google, password) {
   ].filter((step) => !!step);
   return steps.map((lines, i) => `${i + 1}. ${lines.map((line, j) => j && line ? `   ${line}` : line).join("\n")}`).join("\n\n");
 }
-async function roles(command, email, names, env) {
+async function claims(command, email, args, env) {
   if (!isValidEmail(email)) return { output: `"${email ?? ""}" is not an e-mail address.
 
 ${usage}`, exitCode: 1 };
-  const store = await loadStore(env);
+  const users = new Users(await loadStore(env));
   const address = normalizeEmail(email);
-  const assignments = new Roles(store);
-  if (command === "set-roles") {
-    const parsed = parseRoles(names);
-    if (!parsed) {
+  const user = await users.findByEmail(address);
+  if (!user) return { output: `No user has the e-mail address ${address}. Users exist once they signed in, or with create-user.`, exitCode: 1 };
+  let current = claimsFromJson(user.claims);
+  if (command === "set-roles" || command === "set-claims") {
+    let next;
+    if (command === "set-roles") {
+      const roles2 = parseRoles(args);
+      if (!roles2) {
+        return {
+          output: 'Role names consist of lower-case letters, digits, "-" and "_", and start with a letter, e.g. admin.',
+          exitCode: 1
+        };
+      }
+      const { roles: _, ...rest } = current;
+      next = parseClaims(roles2.length ? { ...rest, roles: roles2 } : rest);
+    } else {
+      let parsed;
+      try {
+        parsed = JSON.parse(args[0] ?? "");
+      } catch {
+        return { output: `The claims must be JSON, e.g. '{"roles":["admin"]}'.
+
+${usage}`, exitCode: 1 };
+      }
+      next = parseClaims(parsed);
+    }
+    if (!next) {
       return {
-        output: 'Role names consist of lower-case letters, digits, "-" and "_", and start with a letter, e.g. admin.',
+        output: 'Claims are a JSON object of at most 2048 characters whose keys are names (letters, digits and "_", starting with a letter); "roles" is a list of role names.',
         exitCode: 1
       };
     }
-    await assignments.set(address, parsed, null);
+    await users.updateUser(user.id, { claims: Object.keys(next).length ? JSON.stringify(next) : null });
+    current = next;
+  }
+  if (command === "set-claims" || command === "get-claims") {
+    return { output: `${address}: ${JSON.stringify(current)}`, exitCode: 0 };
+  }
+  const roles = Array.isArray(current.roles) ? current.roles : [];
+  return { output: roles.length ? `${address}: ${roles.join(" ")}` : `${address} has no roles.`, exitCode: 0 };
+}
+async function methods(command, names, env) {
+  const config = await loadConfig(env);
+  const available = (method) => method === "google" ? !!config.google : !!config.password;
+  const settings = new Settings(config.store);
+  if (command === "set-methods") {
+    const unknown = names.filter((name) => !SIGN_IN_METHODS.includes(name));
+    if (unknown.length) {
+      return { output: `Unknown sign-in method ${unknown.join(", ")}. Methods: ${SIGN_IN_METHODS.join(", ")}.`, exitCode: 1 };
+    }
+    const next = {};
+    for (const method of SIGN_IN_METHODS) next[method] = !names.length || names.includes(method);
+    if (!anyOn(available, next)) {
+      const configured = SIGN_IN_METHODS.filter(available);
+      return { output: `That would switch off every sign-in method. The server is configured for: ${configured.join(", ")}.`, exitCode: 1 };
+    }
+    await settings.changeMethods(() => next, null);
   }
-  const current = await assignments.get(address);
-  return { output: current.length ? `${address}: ${current.join(" ")}` : `${address} has no roles.`, exitCode: 0 };
+  const current = await settings.methods();
+  const on = SIGN_IN_METHODS.filter((method) => isOn(method, available, current));
+  const off = SIGN_IN_METHODS.filter((method) => available(method) && !isOn(method, available, current));
+  return { output: `Switched on: ${on.join(", ")}.${off.length ? ` Switched off: ${off.join(", ")}.` : ""}`, exitCode: 0 };
 }
 async function createUser(email, io, env) {
   if (!isValidEmail(email)) return { output: `"${email ?? ""}" is not an e-mail address.
@@ -366,12 +432,13 @@ ${usage}`, exitCode: 1 };
   const policy = checkPasswordPolicy(password, minLength);
   if (policy) return { output: policy, exitCode: 1 };
   const users = new Users(store);
-  const user = await users.createPasswordUser({
+  const passwordHash = await hashPassword(password);
+  const user = await users.createUser({
     email: email.trim(),
     emailNormalized: normalizeEmail(email),
     name: null,
-    passwordHash: await hashPassword(password),
-    emailVerified: true
+    emailVerified: true,
+    account: (userId) => ({ key: passwordAccountKey(userId), secret: passwordHash })
   });
   if (!user) return { output: `A user with the e-mail address ${email} already exists.`, exitCode: 1 };
   return { output: `Created user ${user.id} (${user.email}).`, exitCode: 0 };

package/dist/{chunk-6EJDVZCD.js → chunk-3QRKWLR7.js}

@@ -4,14 +4,20 @@ var WEBHOOK_TYPES = [
   "email.verify",
   "email.reset",
   "email.already_registered",
+  "email.no_password",
   "signup.before",
   "user.created",
   "email.verified",
-  "password.reset",
+  "email.password_reset",
   "user.signed_in",
   "user.deleted",
-  "roles.changed"
+  "user.claims_changed"
 ];
+var WEBHOOK_TIMEOUT_MS = 1e4;
+var MAX_LOCALE_LENGTH = 35;
+function localeOf(value) {
+  return typeof value === "string" && value.length <= MAX_LOCALE_LENGTH ? value : void 0;
+}
 var REQUIRED_EMAIL_TYPES = ["email.verify", "email.reset"];
 var SECRET_PREFIX = "whsec_";
 var DEV_WEBHOOK_RECEIVER_URL = "https://github.com/inouiw/madAuth-webhooks/tree/main/dev-receiver";
@@ -93,6 +99,8 @@ function createWebhookClient(settings, fetchImpl = fetch) {
 
 export {
   WEBHOOK_TYPES,
+  WEBHOOK_TIMEOUT_MS,
+  localeOf,
   REQUIRED_EMAIL_TYPES,
   DEV_WEBHOOK_RECEIVER_URL,
   WEBHOOK_TOLERANCE_SECONDS,

package/dist/{chunk-CNL562LZ.js → chunk-56MOVFO4.js}

@@ -1,6 +1,6 @@
 import {
   madauthSchema
-} from "./chunk-XNBWZZHT.js";
+} from "./chunk-CD7Y4T66.js";
 
 // src/store/sql.ts
 function tableName(model) {
@@ -21,8 +21,30 @@ var upgrades = [
     sql: (dialect) => `ALTER TABLE ${tableName("user")} ADD COLUMN ${columnName("wrongCodes")} ${columnTypes[dialect].number} NOT NULL DEFAULT 0;`
   },
   {
+    // Roles were per e-mail address in their own table; since version 4 they are one of the user's claims.
     version: 3,
-    sql: (dialect) => createTablesSql(dialect, { version: 3, models: { role: madauthSchema.models.role } })
+    sql: (dialect) => createTablesSql(dialect, {
+      version: 3,
+      models: {
+        role: {
+          fields: {
+            id: { type: "string", primaryKey: true },
+            roles: { type: "string" },
+            updatedAt: { type: "number" },
+            updatedBy: { type: "string", nullable: true }
+          }
+        }
+      }
+    })
+  },
+  {
+    version: 4,
+    sql: (dialect) => [
+      `ALTER TABLE ${tableName("user")} ADD COLUMN ${columnName("claims")} ${columnTypes[dialect].string};`,
+      `ALTER TABLE ${tableName("account")} ADD COLUMN ${columnName("email")} ${columnTypes[dialect].string};`,
+      `DROP TABLE ${tableName("role")};`,
+      createTablesSql(dialect, { version: 4, models: { setting: madauthSchema.models.setting } })
+    ].join("\n")
   }
 ];
 function upgradeTablesSql(dialect, fromVersion) {

package/dist/{chunk-XNBWZZHT.js → chunk-CD7Y4T66.js}

@@ -1,7 +1,8 @@
 // src/store/schema.ts
 var madauthSchema = {
-  version: 3,
+  version: 4,
   models: {
+    /** Someone who signed in, whichever way: the e-mail address is the identity shared by the sign-in methods. */
     user: {
       fields: {
         id: { type: "string", primaryKey: true },
@@ -13,10 +14,12 @@ var madauthSchema = {
         lastMailAt: { type: "number" },
         /** Wrong e-mail codes in a row, counted across e-mails (since version 2). */
         wrongCodes: { type: "number" },
+        /** What admins attached to the user, as JSON, e.g. `{"roles":["admin"]}` (since version 4). */
+        claims: { type: "string", nullable: true },
         createdAt: { type: "number" }
       }
     },
-    /** How a user signs in. `key` is e.g. `password:<userId>`; later `google:<sub>` or `totp:<userId>`. */
+    /** How a user signs in. `key` is `password:<userId>` or `google:<sub>`; later e.g. `totp:<userId>`. */
     account: {
       fields: {
         id: { type: "string", primaryKey: true },
@@ -25,6 +28,8 @@ var madauthSchema = {
         secret: { type: "string", nullable: true },
         failedAttempts: { type: "number" },
         lockedUntil: { type: "number" },
+        /** The address the provider reported at the last sign-in, e.g. Google's current primary address (since version 4). */
+        email: { type: "string", nullable: true },
         createdAt: { type: "number" }
       }
     },
@@ -39,16 +44,13 @@ var madauthSchema = {
         expiresAt: { type: "number" }
       }
     },
-    /**
-     * The roles of an e-mail address (since version 3). `id` is the normalized address, so the roles
-     * apply whichever way its owner signs in. `roles` holds the names separated by spaces.
-     */
-    role: {
+    /** A setting admins change at runtime, as JSON (since version 4), e.g. `methods`: which sign-in methods are on. */
+    setting: {
       fields: {
         id: { type: "string", primaryKey: true },
-        roles: { type: "string" },
+        value: { type: "string" },
         updatedAt: { type: "number" },
-        /** The address of the admin who set them; empty when set from the command line. */
+        /** The address of the admin who set it; empty when set from the command line. */
         updatedBy: { type: "string", nullable: true }
       }
     }

package/dist/{chunk-7CTAB3QV.js → chunk-DCDTO5LG.js}

@@ -34,7 +34,7 @@ function signSession(keys, issuer, ttlSeconds, user, amr, extra = {}) {
     email_verified: user.email ? true : void 0,
     name: user.name,
     picture: user.picture,
-    roles: user.roles?.length ? user.roles : void 0,
+    claims: user.claims && Object.keys(user.claims).length ? user.claims : void 0,
     amr
   };
   return signToken(keys, issuer, SESSION_TYP, claims, ttlSeconds);
@@ -56,7 +56,7 @@ function userFromClaims(claims) {
   if (claims.email) user.email = claims.email;
   if (claims.name) user.name = claims.name;
   if (claims.picture) user.picture = claims.picture;
-  if (Array.isArray(claims.roles) && claims.roles.length) user.roles = claims.roles;
+  if (claims.claims && typeof claims.claims === "object" && Object.keys(claims.claims).length) user.claims = claims.claims;
   return user;
 }