@meith/web 0.35.0 → 0.35.1

package/app/auth/passkey/verify/route.ts

@@ -213,7 +213,7 @@ export async function POST(request: NextRequest): Promise<Response> {
         return problem(await tr('authRoute.passkey.signInExpired'), 403)
       }
 
-      await identity.assertSecondFactorAttemptsLeft(pending.userId)
+      await identity.spendSecondFactorAttempt(pending.userId)
 
       const proved = await service.proveOwnership({
         userId: pending.userId,
@@ -224,7 +224,6 @@ export async function POST(request: NextRequest): Promise<Response> {
       })
 
       if (!proved) {
-        await identity.recordSecondFactorFailure(pending.userId)
         await recordAuthEvent({ userId: pending.userId, kind: 'second_factor_failed' })
         return problem(await tr('authRoute.passkey.notForAccount'), 403)
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meith/web",
-  "version": "0.35.0",
+  "version": "0.35.1",
   "description": "The board itself: the Next.js app, and the forum-web bin that materializes it into an external board workspace.",
   "license": "MIT",
   "repository": {
@@ -43,55 +43,55 @@
     "react-dom": "19.2.8",
     "tailwindcss": "^4.3.3",
     "typescript": "7.0.2",
-    "@meith/accounts": "0.35.0",
-    "@meith/admin": "0.35.0",
-    "@meith/antispam": "0.35.0",
-    "@meith/api": "0.35.0",
-    "@meith/attachments": "0.35.0",
-    "@meith/authorization": "0.35.0",
-    "@meith/avatars": "0.35.0",
-    "@meith/backup": "0.35.0",
-    "@meith/board-digest": "0.35.0",
-    "@meith/core": "0.35.0",
-    "@meith/db": "0.35.0",
-    "@meith/demo": "0.35.0",
-    "@meith/drafts": "0.35.0",
-    "@meith/drivers": "0.35.0",
-    "@meith/events": "0.35.0",
-    "@meith/forums": "0.35.0",
-    "@meith/groups": "0.35.0",
-    "@meith/i18n": "0.35.0",
-    "@meith/import": "0.35.0",
-    "@meith/install": "0.35.0",
-    "@meith/mail": "0.35.0",
-    "@meith/markdown": "0.35.0",
-    "@meith/marketplace": "0.35.0",
-    "@meith/messages": "0.35.0",
-    "@meith/moderation": "0.35.0",
-    "@meith/notifications": "0.35.0",
-    "@meith/plugin-calendar": "0.35.0",
-    "@meith/plugin-dues": "0.35.0",
-    "@meith/plugin-kit": "0.35.0",
-    "@meith/polls": "0.35.0",
-    "@meith/posts": "0.35.0",
-    "@meith/profile-fields": "0.35.0",
-    "@meith/relations": "0.35.0",
-    "@meith/reputation": "0.35.0",
-    "@meith/runtime": "0.35.0",
-    "@meith/search": "0.35.0",
-    "@meith/settings": "0.35.0",
-    "@meith/signatures": "0.35.0",
-    "@meith/subscriptions": "0.35.0",
-    "@meith/tasks": "0.35.0",
-    "@meith/theme-clubhouse": "0.35.0",
-    "@meith/theme-default": "0.35.0",
-    "@meith/theme-kit": "0.35.0",
-    "@meith/theme-midnight": "0.35.0",
-    "@meith/theme-phasebook": "0.35.0",
-    "@meith/theme-raidframe": "0.35.0",
-    "@meith/threads": "0.35.0",
-    "@meith/ui": "0.35.0",
-    "@meith/upgrade": "0.35.0"
+    "@meith/accounts": "0.35.1",
+    "@meith/admin": "0.35.1",
+    "@meith/antispam": "0.35.1",
+    "@meith/api": "0.35.1",
+    "@meith/attachments": "0.35.1",
+    "@meith/authorization": "0.35.1",
+    "@meith/avatars": "0.35.1",
+    "@meith/backup": "0.35.1",
+    "@meith/board-digest": "0.35.1",
+    "@meith/core": "0.35.1",
+    "@meith/db": "0.35.1",
+    "@meith/demo": "0.35.1",
+    "@meith/drafts": "0.35.1",
+    "@meith/drivers": "0.35.1",
+    "@meith/events": "0.35.1",
+    "@meith/forums": "0.35.1",
+    "@meith/groups": "0.35.1",
+    "@meith/i18n": "0.35.1",
+    "@meith/import": "0.35.1",
+    "@meith/install": "0.35.1",
+    "@meith/mail": "0.35.1",
+    "@meith/markdown": "0.35.1",
+    "@meith/marketplace": "0.35.1",
+    "@meith/messages": "0.35.1",
+    "@meith/moderation": "0.35.1",
+    "@meith/notifications": "0.35.1",
+    "@meith/plugin-calendar": "0.35.1",
+    "@meith/plugin-dues": "0.35.1",
+    "@meith/plugin-kit": "0.35.1",
+    "@meith/polls": "0.35.1",
+    "@meith/posts": "0.35.1",
+    "@meith/profile-fields": "0.35.1",
+    "@meith/relations": "0.35.1",
+    "@meith/reputation": "0.35.1",
+    "@meith/runtime": "0.35.1",
+    "@meith/search": "0.35.1",
+    "@meith/settings": "0.35.1",
+    "@meith/signatures": "0.35.1",
+    "@meith/subscriptions": "0.35.1",
+    "@meith/tasks": "0.35.1",
+    "@meith/theme-clubhouse": "0.35.1",
+    "@meith/theme-default": "0.35.1",
+    "@meith/theme-kit": "0.35.1",
+    "@meith/theme-midnight": "0.35.1",
+    "@meith/theme-phasebook": "0.35.1",
+    "@meith/theme-raidframe": "0.35.1",
+    "@meith/threads": "0.35.1",
+    "@meith/ui": "0.35.1",
+    "@meith/upgrade": "0.35.1"
   },
   "scripts": {
     "dev": "next dev",

package/src/server/admin-actions.ts

@@ -55,28 +55,33 @@ export async function adminSignInAction(_prev: FormState, form: FormData): Promi
     const config = await boardAuthConfig()
     const attemptBucket = await adminReauthenticationBucket(actor.userId)
     const attemptSince = new Date(Date.now() - config.lockoutMinutes * 60_000)
-    if (
-      config.maxLoginAttempts > 0 &&
-      (await accountStore.loginAttempts.countFailuresSince(attemptBucket, attemptSince)) >=
-        config.maxLoginAttempts
-    ) {
-      throw new ForbiddenError(msg('error.accounts.too-many-failed-attempts-please'))
+
+    let attemptId: number | null = null
+    if (config.maxLoginAttempts > 0) {
+      const spent = await accountStore.loginAttempts.recordFailureAndCount(
+        attemptBucket,
+        attemptSince,
+        new Date(),
+      )
+      attemptId = spent.id
+      if (spent.count > config.maxLoginAttempts) {
+        throw new ForbiddenError(msg('error.accounts.too-many-failed-attempts-please'))
+      }
     }
 
-    const failAttempt = async (): Promise<void> => {
-      await accountStore.loginAttempts.record(attemptBucket, false, new Date())
+    const auditFailure = async (): Promise<void> => {
       await recordAdminAction({ action: 'admin.signin_failed' })
     }
 
     const password = text(form, 'password')
     if (password === '') {
-      await failAttempt()
+      await auditFailure()
       throw new ValidationError(msg('error.app.enter-password'))
     }
 
     const ok = await verifyPassword(password, account.passwordHash)
     if (!ok) {
-      await failAttempt()
+      await auditFailure()
       throw new ForbiddenError(msg('error.app.password-right'))
     }
 
@@ -84,11 +89,12 @@ export async function adminSignInAction(_prev: FormState, form: FormData): Promi
     const twoFactor = twoFactorService()
 
     if (twoFactor !== null && (await twoFactor.isEnrolled(actor.userId))) {
+      if (attemptId !== null) await accountStore.loginAttempts.removeAttempt(attemptId)
       await holdAdminSecondFactor(actor.userId, next)
       target = '/admin'
     } else {
       if (twoFactor !== null && (await twoFactorRequiredForStaff())) {
-        await failAttempt()
+        await auditFailure()
         throw new ForbiddenError(msg('adminAction.twoFactorRequired'))
       }
 
@@ -133,28 +139,31 @@ export async function adminVerifySecondFactorAction(
     const config = await boardAuthConfig()
     const attemptBucket = await adminReauthenticationBucket(actor.userId)
     const attemptSince = new Date(Date.now() - config.lockoutMinutes * 60_000)
-    if (
-      config.maxLoginAttempts > 0 &&
-      (await accountStore.loginAttempts.countFailuresSince(attemptBucket, attemptSince)) >=
-        config.maxLoginAttempts
-    ) {
-      throw new ForbiddenError(msg('error.accounts.too-many-failed-attempts-please'))
+
+    if (config.maxLoginAttempts > 0) {
+      const spent = await accountStore.loginAttempts.recordFailureAndCount(
+        attemptBucket,
+        attemptSince,
+        new Date(),
+      )
+      if (spent.count > config.maxLoginAttempts) {
+        throw new ForbiddenError(msg('error.accounts.too-many-failed-attempts-please'))
+      }
     }
 
-    const failAttempt = async (): Promise<void> => {
-      await accountStore.loginAttempts.record(attemptBucket, false, new Date())
+    const auditFailure = async (): Promise<void> => {
       await recordAdminAction({ action: 'admin.signin_failed' })
     }
 
     const code = text(form, 'code')
     if (code === '') {
-      await failAttempt()
+      await auditFailure()
       throw new ValidationError(msg('error.app.enter-code-from-authenticator-app'))
     }
 
     const outcome = await twoFactor.verify({ userId: pending.userId, code })
     if (outcome.status !== 'ok') {
-      await failAttempt()
+      await auditFailure()
       throw new ForbiddenError(
         msg(outcome.status === 'replayed' ? 'adminAction.codeReplayed' : 'adminAction.codeWrong'),
       )

package/src/server/auth-actions.ts

@@ -1,6 +1,7 @@
 'use server'
 
 import { redirect } from 'next/navigation'
+import { after } from 'next/server'
 
 import { type AuthConfig, foldIdentifier, hashToken, type LoginBucket } from '@meith/accounts'
 import { env, logger } from '@meith/core'
@@ -344,12 +345,11 @@ export async function verifySecondFactorAction(
   if (service === null) return { error: await tr('authAction.secondFactorExpired') }
 
   try {
-    await identity.assertSecondFactorAttemptsLeft(pending.userId)
+    await identity.spendSecondFactorAttempt(pending.userId)
 
     const outcome = await service.verify({ userId: pending.userId, code })
 
     if (outcome.status !== 'ok') {
-      await identity.recordSecondFactorFailure(pending.userId)
       await recordAuthEvent({ userId: pending.userId, kind: 'second_factor_failed' })
       return {
         error: await tr(
@@ -440,9 +440,10 @@ export async function requestResetAction(_prev: FormState, form: FormData): Prom
     const { token, userId } = await identity.requestPasswordReset(email)
 
     if (token !== null && userId !== null) {
-      const account = await getContainer().accountStore.accounts.findById(userId)
-      if (account !== null) {
+      const deliver = async (): Promise<void> => {
         try {
+          const account = await getContainer().accountStore.accounts.findById(userId)
+          if (account === null) return
           await sendPasswordResetEmail({
             token,
             email: account.email,
@@ -456,6 +457,12 @@ export async function requestResetAction(_prev: FormState, form: FormData): Prom
           )
         }
       }
+
+      try {
+        after(deliver)
+      } catch {
+        await deliver()
+      }
     }
 
     if (token && env.NODE_ENV === 'development') {

package/src/server/federation.ts

@@ -54,7 +54,9 @@ export async function federationProvider(id: string): Promise<IdentityProvider |
   if (!isProviderKind(id)) return null
   if (getContainer().dataSource !== 'postgres') return null
 
-  return providerFor(id, federationOptions(await getSettingsUncached()))
+  return providerFor(id, federationOptions(await getSettingsUncached()), {
+    allowPrivateHosts: env.OIDC_ALLOW_PRIVATE_HOSTS,
+  })
 }
 
 export async function signInProviders(): Promise<readonly ProviderButton[]> {

package/src/server/upgrade-notice.ts

@@ -17,7 +17,7 @@ import { planUpgrade, type UpgradeState, upgradeNotice } from '@meith/upgrade'
 
 import { activeDefinitions } from './plugin-host'
 
-export const CODE_VERSION = '0.35.0'
+export const CODE_VERSION = '0.35.1'
 
 export interface UpgradeApplied {
   readonly plugins: readonly string[]