@materializecms/server 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -4,6 +4,14 @@ Ogni versione, dalla più recente. Le novità in arrivo si scrivono sotto «Pros
 
 ## Prossima versione
 
+## 0.2.0 — 2026-11-01
+
+- **Password dimenticata?** nella pagina di accesso: un link per email, valido un'ora. Senza email configurata, il comando `materialize reset-password` stampa il link sul server, anche per l'unico amministratore.
+- **Cronologia per le pagine sulla tela**: ogni versione si guarda su desktop, tablet e mobile prima di ripristinarla.
+- **Esporta la pagina in PDF o PNG** dall'editor, per mandarla al cliente: desktop, tablet e mobile, ognuno come un'unica immagine lunga.
+- **Guida per chi usa Materialize**, in `docs/guida`: installazione, editor, contenuti, lingue, SEO, persone, aggiornamenti, backup e problemi comuni.
+- **Sicurezza**: i link degli inviti e delle nuove password puntano sempre all'indirizzo pubblico del sito, mai a quello dichiarato da chi fa la richiesta. Consigliato aggiornare.
+
 ## 0.1.0 — 2026-10-31
 
 La prima versione pubblica.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@materializecms/server",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Il server di Materialize: API, accessi, media, backup, aggiornamenti dal pannello e server MCP.",
   "type": "module",
   "license": "MIT",
@@ -20,9 +20,9 @@
   "dependencies": {
     "@anthropic-ai/sdk": "1.3.0",
     "@hono/node-server": "2.1.5",
-    "@materializecms/admin": "0.1.0",
-    "@materializecms/core": "0.1.0",
-    "@materializecms/db": "0.1.0",
+    "@materializecms/admin": "0.2.0",
+    "@materializecms/core": "0.2.0",
+    "@materializecms/db": "0.2.0",
     "@modelcontextprotocol/sdk": "1.32.2",
     "hono": "4.13.14",
     "htmlparser2": "12.0.0",

package/src/app.js

@@ -52,6 +52,11 @@ const CHALLENGE_TTL = 5 * 60 * 1000;
 const dummyHash = hashPassword(randomBytes(16).toString('hex'));
 const INVITE_TTL = 7 * 24 * 60 * 60 * 1000;
 const RESET_TTL = 24 * 60 * 60 * 1000;
+/** A link asked for from the sign-in page: shorter, since nobody vouched for the request. */
+const FORGOT_TTL = 60 * 60 * 1000;
+/** Links asked for per email, and per address, before a pause: no one is flooded with emails. */
+const FORGOT_THRESHOLD = 3;
+const FORGOT_IP_THRESHOLD = 10;
 /** Where people open their one-time link: the admin's welcome screen. */
 const linkPath = (token) => `/admin/_invite/${token}`;
 /** The custom code blocks in a document: it runs on the public site, so only admins may change it. */
@@ -643,6 +648,40 @@ export function createApp(base) {
         const { passwordHash: _, ...user } = found;
         return signIn(c, user);
     });
+    /** For the sign-in page: whether "Password dimenticata?" can send an email, or someone has to help. */
+    app.get('/api/auth/recovery', async (c) => c.json({ mail: isConfigured(await settings.get('mail')) }));
+    /**
+     * A forgotten password: a one-time link by email, valid an hour. The answer is the same whether
+     * the email has an account or not, so nobody can learn who is registered; requests per email and
+     * per address are limited, so nobody can flood an inbox.
+     */
+    app.post('/api/auth/forgot', async (c) => {
+        const input = await body(c, z.object({ email: z.email() }));
+        const email = input.email.trim().toLowerCase();
+        const ip = clientIp(c);
+        await checkLocks(`forgot:${email}`, `forgot-ip:${ip}`);
+        await auth.recordFailure(`forgot:${email}`, FORGOT_THRESHOLD);
+        await auth.recordFailure(`forgot-ip:${ip}`, FORGOT_IP_THRESHOLD);
+        const mail = isConfigured(await settings.get('mail'));
+        const found = mail ? await auth.findForLogin(email) : null;
+        if (found) {
+            const { token } = await auth.createInvite({
+                kind: 'reset',
+                email: found.email,
+                name: found.name,
+                role: found.role,
+                userId: found.id,
+                ttlMs: FORGOT_TTL,
+            });
+            await mailLink(c, found.email, 'Nuova password', [
+                `Qualcuno ha chiesto una nuova password per il tuo account su ${ctx.config().site.name}.`,
+                'Se non sei stato tu, ignora questa email: la password resta quella di prima.',
+                'Per sceglierne una nuova, apri questo link entro un’ora:',
+            ], linkPath(token));
+            await record(c, 'password.forgot', found.email, null, { id: found.id, name: found.name });
+        }
+        return c.json({ ok: true, mail });
+    });
     /** The second step: a code from the app, or a recovery code. */
     app.post('/api/auth/login/verify', async (c) => {
         const input = await body(c, z.object({ ticket: z.string().min(1).max(100), code: z.string().trim().min(6).max(20) }));
@@ -770,7 +809,7 @@ export function createApp(base) {
     app.get('/api/security', requireUser, requireAdmin, async (c) => c.json({ requireTwoFactor: await twoFactorRequired() }));
     /** Groups of the activity log, by the start of their action codes. */
     const ACTIVITY_GROUPS = {
-        access: ['login.', 'logout', 'session.', 'twofactor.', 'token.', 'security.'],
+        access: ['login.', 'logout', 'session.', 'twofactor.', 'token.', 'security.', 'password.'],
         people: ['user.'],
         content: ['document.', 'media.', 'message.'],
         settings: ['settings.', 'backup.', 'update.'],
@@ -1448,12 +1487,26 @@ export function createApp(base) {
             return false;
         }
     };
+    /**
+     * The address links in emails point to: the site's own (MATERIALIZE_SITE_URL, site.url) when it
+     * is known. The request's Host header is used only without it, as in local development: anyone
+     * can send a request with a false Host, and a link to their server would carry the token there.
+     */
+    const publicOrigin = (c) => {
+        const site = ctx.config().site.url;
+        try {
+            if (site)
+                return new URL(site).origin;
+        }
+        catch { }
+        return new URL(c.req.url).origin;
+    };
     const mailLink = async (c, to, subject, lines, path) => {
         const mail = await settings.get('mail');
         if (!isConfigured(mail))
             return false;
         try {
-            const url = new URL(path, new URL(c.req.url).origin).toString();
+            const url = new URL(path, publicOrigin(c)).toString();
             await sendMail(mail, { to, subject, text: `${lines.join('\n')}\n\n${url}\n` });
             return true;
         }