@meith/accounts 0.21.2 → 0.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meith/accounts",
-  "version": "0.21.2",
+  "version": "0.23.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -20,6 +20,6 @@
   },
   "dependencies": {
     "hash-wasm": "^4.12.0",
-    "@meith/i18n": "0.21.2"
+    "@meith/i18n": "0.23.0"
   }
 }

package/src/ban-filters-not-consulted.ts

@@ -0,0 +1,5 @@
+import type { BanFilterRepository } from './ports'
+
+export const BAN_FILTERS_NOT_CONSULTED: BanFilterRepository = {
+  listAll: async () => [],
+}

package/src/federation/catalog.ts

@@ -11,11 +11,6 @@ import type {
 
 export const PROVIDER_KINDS: readonly ProviderKind[] = ['github', 'google', 'oidc']
 
-/**
- * What a link is called when the provider behind it is switched off: the
- * identity stays on the account, so the row still has to say something a
- * member recognises rather than the key it is stored under.
- */
 const PROVIDER_LABELS: Readonly<Record<ProviderKind, string>> = {
   github: 'GitHub',
   google: 'Google',

package/src/index.ts

@@ -8,6 +8,7 @@ export {
   type BanFilterType,
   matchBanFilter,
 } from './ban-filter'
+export { BAN_FILTERS_NOT_CONSULTED } from './ban-filters-not-consulted'
 export { type BanInput, BanService, type BanServiceDeps } from './ban-service'
 export { foldIdentifier } from './case-fold'
 export {
@@ -114,10 +115,13 @@ export type {
   AuthEventKind,
   AuthEventRecord,
   AuthEventRepository,
+  BanFilterAdminRepository,
+  BanFilterRecord,
   BanFilterRepository,
   BanRecord,
   BanRepository,
   Clock,
+  CreateBanFilterInput,
   CreateBanInput,
   CredentialPurpose,
   CredentialTokenRepository,

package/src/member-settings.ts

@@ -32,6 +32,7 @@ export interface MemberSettings {
   readonly website: string | null
   readonly bio: string | null
   readonly displayGroupId: number | null
+  readonly massMailOptInAt: Date | null
 }
 
 export interface MemberGroupChoice {
@@ -67,6 +68,8 @@ export interface MemberSettingsRepository {
     readonly invisible: boolean
   }): Promise<void>
 
+  saveMassMailOptIn(input: { readonly userId: number; readonly optIn: boolean }): Promise<void>
+
   adoptEmail(input: {
     readonly userId: number
     readonly email: string

package/src/memory-bans.ts

@@ -1,9 +1,14 @@
-import type { BanFilter } from './ban-filter'
+import { ValidationError } from '@meith/core'
+import { msg } from '@meith/i18n'
+
+import { assertUsableFilter, type BanFilter } from './ban-filter'
 import type {
   AccountRepository,
-  BanFilterRepository,
+  BanFilterAdminRepository,
+  BanFilterRecord,
   BanRecord,
   BanRepository,
+  CreateBanFilterInput,
   CreateBanInput,
 } from './ports'
 
@@ -72,17 +77,60 @@ export class MemoryBans implements BanRepository {
   }
 }
 
-export class MemoryBanFilters implements BanFilterRepository {
-  private readonly rows: BanFilter[] = []
+export class MemoryBanFilters implements BanFilterAdminRepository {
+  private readonly rows: BanFilterRecord[] = []
   private nextId = 1
 
-  add(type: BanFilter['type'], pattern: string): BanFilter {
-    const row = { id: this.nextId++, type, pattern }
-    this.rows.push(row)
-    return row
+  add(type: BanFilter['type'], pattern: string, note: string | null = null): BanFilter {
+    return this.insert({ type, pattern, note, createdByUserId: null })
   }
 
   async listAll(): Promise<readonly BanFilter[]> {
-    return [...this.rows]
+    return this.rows.map((row) => ({ id: row.id, type: row.type, pattern: row.pattern }))
+  }
+
+  async listForAdmin(): Promise<readonly BanFilterRecord[]> {
+    return [...this.rows].sort((a, b) => b.id - a.id)
+  }
+
+  async create(input: CreateBanFilterInput): Promise<number> {
+    assertUsableFilter(input.type, input.pattern)
+
+    const pattern = input.pattern.trim()
+    const note = input.note?.trim()
+
+    if (this.rows.some((row) => row.type === input.type && row.pattern === pattern)) {
+      throw new ValidationError(msg('error.accounts.ban-filter-already-held'))
+    }
+
+    return this.insert({
+      type: input.type,
+      pattern,
+      note: note === undefined || note === '' ? null : note,
+      createdByUserId: input.createdByUserId,
+    }).id
+  }
+
+  async remove(id: number): Promise<void> {
+    const at = this.rows.findIndex((row) => row.id === id)
+    if (at !== -1) this.rows.splice(at, 1)
+  }
+
+  private insert(input: {
+    type: BanFilter['type']
+    pattern: string
+    note: string | null
+    createdByUserId: number | null
+  }): BanFilterRecord {
+    const row: BanFilterRecord = {
+      id: this.nextId++,
+      type: input.type,
+      pattern: input.pattern,
+      note: input.note,
+      createdByUserId: input.createdByUserId,
+      createdAt: new Date(),
+    }
+    this.rows.push(row)
+    return row
   }
 }

package/src/ports.ts

@@ -1,4 +1,4 @@
-import type { BanFilter } from './ban-filter'
+import type { BanFilter, BanFilterType } from './ban-filter'
 
 export type AccountState = 'active' | 'awaiting_activation' | 'banned'
 
@@ -115,27 +115,8 @@ export type RememberRotation =
   | { readonly status: 'reuse'; readonly userId: number; readonly familyId: string }
   | { readonly status: 'invalid' }
 
-/**
- * How long after a remember token is rotated its old value is still honoured.
- *
- * Rotation is single-use, and two requests carrying the same cookie arrive
- * whenever a browser restores several tabs at once, a link is double-clicked, or
- * a prefetch races the navigation that prompted it. Exactly one wins the claim;
- * without this window the others are indistinguishable from a stolen token and
- * cost the member every session they hold. Real theft reuses a token long after
- * the fact, not inside the same breath.
- */
 export const REMEMBER_ROTATION_GRACE_SECONDS = 30
 
-/**
- * Whether a spent remember token is a concurrent request rather than a theft.
- *
- * A revoked family is always theft: the board has already decided about it.
- * Elapsed time is not required to be positive — requests racing each other
- * stamp `now` on the way in, so the one that loses the claim can carry a
- * timestamp from just before the winner wrote `usedAt`, which is the very case
- * this window exists to forgive.
- */
 export function withinRotationGrace(
   row: { readonly usedAt: Date | null; readonly revokedAt: Date | null },
   now: Date,
@@ -187,11 +168,6 @@ export interface CredentialTokenRepository {
     purpose: CredentialPurpose,
     now: Date,
   ): Promise<{ userId: number; payload: string | null } | null>
-  /**
-   * The same lookup without spending the token. A half-finished sign-in has to
-   * survive a mistyped code, so the token that carries it is only consumed once
-   * the second factor is actually satisfied.
-   */
   peek(
     tokenHash: string,
     purpose: CredentialPurpose,
@@ -272,7 +248,6 @@ export interface TwoFactorRepository {
     now: Date
   }): Promise<TwoFactorRecord>
   confirm(userId: number, step: number, now: Date): Promise<boolean>
-  /** False when the step has already been spent, which is a replayed code. */
   spendStep(userId: number, step: number): Promise<boolean>
   remove(userId: number): Promise<boolean>
 }
@@ -413,3 +388,24 @@ export interface BanRepository {
 export interface BanFilterRepository {
   listAll(): Promise<readonly BanFilter[]>
 }
+
+export interface BanFilterRecord extends BanFilter {
+  readonly note: string | null
+  readonly createdByUserId: number | null
+  readonly createdAt: Date
+}
+
+export interface CreateBanFilterInput {
+  readonly type: BanFilterType
+  readonly pattern: string
+  readonly note?: string | null
+  readonly createdByUserId: number | null
+}
+
+export interface BanFilterAdminRepository extends BanFilterRepository {
+  listForAdmin(): Promise<readonly BanFilterRecord[]>
+
+  create(input: CreateBanFilterInput): Promise<number>
+
+  remove(id: number): Promise<void>
+}

package/src/service.ts

@@ -20,16 +20,11 @@ export interface IdentityDeps {
   readonly store: AccountStore
   readonly config: AuthConfig
   readonly clock?: Clock
-  readonly banFilters?: BanFilterRepository
+  readonly banFilters: BanFilterRepository
   readonly bans?: BanLookup
   readonly secondFactor?: SecondFactorLookup
 }
 
-/**
- * Whether an account asks for something beyond its password. Kept as a port
- * rather than the whole two-factor service so that the login path cannot reach
- * the secrets it holds — it only ever needs the yes or no.
- */
 export interface SecondFactorLookup {
   isEnrolled(userId: number): Promise<boolean>
 }
@@ -61,11 +56,6 @@ export interface LoginResult {
   readonly expiresAt: Date
 }
 
-/**
- * How long a half-finished sign-in waits for its second factor. Long enough to
- * fetch a phone from another room, short enough that a password proven on a
- * shared machine does not stay proven.
- */
 export const SECOND_FACTOR_TTL_MINUTES = 10
 
 export type LoginOutcome =
@@ -127,7 +117,7 @@ export class IdentityService {
   private readonly config: AuthConfig
   private readonly now: Clock
 
-  private readonly banFilters: BanFilterRepository | undefined
+  private readonly banFilters: BanFilterRepository
 
   private readonly bans: BanLookup | undefined
 
@@ -432,11 +422,6 @@ export class IdentityService {
     return { token, expiresAt }
   }
 
-  /**
-   * Who a half-finished sign-in belongs to, without spending it — the code can
-   * be mistyped, and a member who fumbles it should not have to start from
-   * their password again.
-   */
   async pendingSecondFactor(token: string): Promise<PendingSecondFactor | null> {
     const held = await this.store.tokens.peek(await hashToken(token), 'second_factor', this.now())
     if (held === null) return null
@@ -444,7 +429,6 @@ export class IdentityService {
     return { userId: held.userId, remember: held.payload === 'remember' }
   }
 
-  /** Spends the hold and starts the session it was standing in for. */
   async redeemSecondFactor(token: string, context: RequestContext = {}): Promise<LoginResult> {
     const at = this.now()
     const redeemed = await this.store.tokens.consume(await hashToken(token), 'second_factor', at)
@@ -464,11 +448,6 @@ export class IdentityService {
     await this.store.tokens.revokeAllForUser(userId, 'second_factor')
   }
 
-  /**
-   * The second step gets its own counter. The password counters were cleared
-   * when the password proved out, and a six-digit code is worth a million
-   * guesses — far fewer than a password, and so worth far less patience.
-   */
   async assertSecondFactorAttemptsLeft(userId: number): Promise<void> {
     const max = this.config.maxLoginAttempts
     if (max <= 0) return
@@ -527,8 +506,6 @@ export class IdentityService {
   }
 
   private async assertNotFiltered(subject: BanFilterSubject): Promise<void> {
-    if (!this.banFilters) return
-
     const match = matchBanFilter(await this.banFilters.listAll(), subject)
     if (match) {
       throw new ForbiddenError(msg('error.accounts.account-used-board-contact-administrator'))

package/src/totp/secret-box.ts

@@ -8,12 +8,6 @@ const IV_BYTES = 12
 
 const INFO = new TextEncoder().encode('meith/two-factor-secret')
 
-/**
- * The shared secret an authenticator app holds is a password equivalent: with
- * it, anybody can mint that member's codes forever. It is sealed with a key
- * derived from AUTH_SECRET so that a leaked backup, or a read of the table by
- * anything that never had the environment, is not enough on its own.
- */
 export async function sealSecret(plaintext: string, passphrase: string): Promise<string> {
   const key = await deriveKey(passphrase)
   const iv = new Uint8Array(IV_BYTES)

package/src/totp/service.ts

@@ -117,11 +117,6 @@ export class TwoFactorService {
     }
   }
 
-  /**
-   * The enrolment already under way, so the setup screen survives a reload
-   * without minting a second secret — which would strand whatever the member
-   * had already typed into their authenticator app.
-   */
   async pendingEnrolment(userId: number, boardName: string): Promise<Enrolment | null> {
     const record = await this.twoFactor.find(userId)
     if (record === null || record.confirmedAt !== null) return null
@@ -223,11 +218,6 @@ export class TwoFactorService {
   }
 }
 
-/**
- * The yes-or-no the login path needs, straight off the repository. Built here
- * rather than from the whole service so that composing the two does not hand
- * the login path a key it has no use for.
- */
 export function enrolmentLookup(repository: TwoFactorRepository): {
   isEnrolled(userId: number): Promise<boolean>
 } {

package/src/totp/totp.ts

@@ -6,11 +6,6 @@ export const TOTP_DIGITS = 6
 
 export const TOTP_SECRET_BYTES = 20
 
-/**
- * How far either side of now a code is still taken. One step each way covers a
- * device whose clock has drifted and a member who started typing at 29 seconds
- * past; more than that widens the window an intercepted code stays usable in.
- */
 export const TOTP_SKEW_STEPS = 1
 
 export function generateTotpSecret(byteLength = TOTP_SECRET_BYTES): string {
@@ -57,12 +52,6 @@ export interface TotpMatch {
   readonly step: number
 }
 
-/**
- * The step the code belongs to, or null. The step is returned rather than a
- * bare yes so the caller can refuse a code it has already accepted: a code is
- * valid for thirty seconds, and anybody who reads it over a shoulder or off a
- * proxy log has that long to use it first.
- */
 export async function matchTotp(input: {
   readonly secret: string
   readonly code: string

package/src/webauthn/service.ts

@@ -200,12 +200,6 @@ export class PasskeyService {
     return { account, login }
   }
 
-  /**
-   * The same signature check as signing in, against one named account and with
-   * no session at the end of it. A second factor has to prove the device
-   * belongs to the member who has just given their password — accepting any
-   * registered passkey would let anybody past anybody's second step.
-   */
   async proveOwnership(input: {
     readonly userId: number
     readonly credentialId: string