@nymphjs/tilmeld 1.0.0-beta.11 → 1.0.0-beta.111

package/src/conf/d.ts

@@ -1,15 +1,17 @@
-import { EmailOptions, EmailConfig } from 'email-templates';
+import type { EmailOptions, EmailConfig } from 'email-templates';
 
-import type Tilmeld from '../Tilmeld';
-import Group, { GroupData } from '../Group';
-import User, { UserData } from '../User';
+import type Tilmeld from '../Tilmeld.js';
+import type Group from '../Group.js';
+import type { GroupData } from '../Group.js';
+import type User from '../User.js';
+import type { UserData } from '../User.js';
 
 /**
  * Tilmeld Config
  */
 export interface Config {
   /**
-   * The name of the app. Used in emails sent to users.
+   * The name of the app. Used in emails sent to users and as the TOTP issuer.
    */
   appName: string;
   /**
@@ -45,8 +47,27 @@ export interface Config {
    * Instead of a "username", a user logs in and is referred to by their email
    * address. Enabling this after many users have been created can be messy.
    * Make sure they all have email addresses first.
+   *
+   * Email usernames cannot be enabled if domain support is.
    */
   emailUsernames: boolean;
+  /**
+   * Enable domain support.
+   *
+   * If domain support is enabled, usernames can be either bare, meaning they
+   * belong to the root domain, or can include a domain part (username@domain),
+   * meaning they belong to that domain.
+   *
+   * It also enables domain admin abilities, meaning a domain admin has the
+   * ability to create and modify users on the domain
+   * ("tilmeld/domain/example.com/admin").
+   *
+   * Once a user is created, whether it has a domain part can't be changed.
+   * However, it can be moved to a different domain.
+   *
+   * Domain support cannot be enabled if email usernames is.
+   */
+  domainSupport: boolean;
   /**
    * Allow users to register.
    */
@@ -206,7 +227,23 @@ export interface Config {
    */
   validEmailRegexNotice: string;
   /**
-   * The maximum length for usernames. Infinity for unlimited.
+   * Domains must match this regular expression. By default, this uses a regex
+   * that should match most domains:
+   *
+   * https://stackoverflow.com/a/26987741
+   */
+  validDomainRegex: RegExp;
+  /**
+   * When a user enters a domain that doesn't match the regex, this message will
+   * be displayed.
+   */
+  validDomainRegexNotice: string;
+  /**
+   * The minimum length for usernames.
+   */
+  minUsernameLength: number;
+  /**
+   * The maximum length for usernames. `Infinity` for unlimited.
    */
   maxUsernameLength: number;
   /**
@@ -217,6 +254,11 @@ export interface Config {
    * How long from current time, in seconds, the JWT token expires.
    */
   jwtExpire: number;
+  /**
+   * How long from current time, in seconds, the JWT token for a user switch
+   * expires.
+   */
+  jwtSwitchExpire: number;
   /**
    * How long, in seconds, before the JWT token expires to give the user a new
    * one.
@@ -225,21 +267,25 @@ export interface Config {
   /**
    * Function to build the JWT for user sessions.
    */
-  jwtBuilder: (config: Config, user: User) => string;
+  jwtBuilder: (
+    config: Config,
+    user: User & UserData,
+    switchToken?: boolean,
+  ) => string;
   /**
-   * Function to verify that a JWT was signed with the secret key, vaildate its
-   * data, validate the XSRF token, and extract the GUID.
+   * Function to verify that a JWT was signed with the secret key, validate its
+   * data, validate the XSRF token, and extract the GUID and dates.
    *
    * If no XSRF token is supplied, ignore it.
    *
-   * Return false if the JWT is not valid, or an array of GUID and expire
-   * timestamp otherwise.
+   * Return false if the JWT is not valid, or an object with GUID, issued date,
+   * and expire date otherwise.
    */
   jwtExtract: (
     config: Config,
     token: string,
-    xsrfToken?: string
-  ) => { guid: string; expire: Date } | null;
+    xsrfToken?: string,
+  ) => { guid: string; issued: Date; expire: Date } | null;
   /**
    * The absolute path to the email template directory. Used by the default
    * email sender.
@@ -255,7 +301,7 @@ export interface Config {
   configEmail: (
     tilmeld: Tilmeld,
     options: EmailOptions,
-    user: User & UserData
+    user: User & UserData,
   ) => Promise<EmailConfig>;
   /**
    * Send an email to a user. Uses `email-templates` by default.
@@ -285,19 +331,39 @@ export interface Config {
   sendEmail: (
     tilmeld: Tilmeld,
     options: EmailOptions,
-    user: User & UserData
+    user: User & UserData,
   ) => Promise<boolean>;
   /**
    * The address you'd like to receive a notification of registered users, if
    * any.
    */
   userRegisteredRecipient: string | null;
+  /**
+   * A function to run on a failed login attempt.
+   *
+   * If the username the client attempted doesn't exist, user will be null.
+   *
+   * This defaults to a promise that resolves after 3-5 seconds. This rate
+   * limits failed login attempts.
+   *
+   * Please note that the data comes from the client, so the types have not been
+   * verified. For example, username might be an array or a number.
+   */
+  failedLoginAttempt: (
+    user: (User & UserData) | null,
+    data: {
+      username: string;
+      password: string;
+      code?: string;
+      additionalData?: { [k: string]: any };
+    },
+  ) => Promise<void>;
   /**
    * The validator used to check groups before saving.
    */
-  validatorGroup: (group: Group & GroupData) => void;
+  validatorGroup: (tilmeld: Tilmeld, group: Group & GroupData) => void;
   /**
    * The validator used to check users before saving.
    */
-  validatorUser: (user: User & UserData) => void;
+  validatorUser: (tilmeld: Tilmeld, user: User & UserData) => void;
 }

package/src/conf/defaults.ts

@@ -1,14 +1,16 @@
-import path from 'path';
-import { URL } from 'url';
+import path from 'node:path';
+import { URL, fileURLToPath } from 'node:url';
 import jwt from 'jsonwebtoken';
 import Email from 'email-templates';
 import Joi from 'joi';
 import { nanoid } from '@nymphjs/guid';
 import { nymphJoiProps } from '@nymphjs/nymph';
 
-import { Config } from './d';
-import User from '../User';
-import Group from '../Group';
+import type { Config } from './d.js';
+import User from '../User.js';
+import Group from '../Group.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 export default {
   appName: 'My Nymph App',
@@ -18,6 +20,7 @@ export default {
   setupPath: '/tilmeld',
   createAdmin: true,
   emailUsernames: true,
+  domainSupport: false,
   allowRegistration: true,
   allowUsernameChange: true,
   enableUserSearch: false,
@@ -49,11 +52,16 @@ export default {
   validEmailRegex:
     /^[a-zA-Z0-9.!#$%&'*+\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/,
   validEmailRegexNotice: 'Email must be a correctly formatted address.',
+  validDomainRegex:
+    /^(((?!-))(xn--|_)?[a-z0-9\-]{0,61}[a-z0-9]{1,1}\.)*(xn--)?([a-z0-9][a-z0-9\-]{0,60}|[a-z0-9\-]{1,30}\.[a-z]{2,})$/,
+  validDomainRegexNotice: 'Domain must be a correctly formatted domain name.',
+  minUsernameLength: 1,
   maxUsernameLength: 128,
   jwtSecret: '',
-  jwtExpire: 60 * 60 * 24 * 7 * 8, // 8 weeks(ish)
-  jwtRenew: 60 * 60 * 24 * 7 * 2, // 2 weeks(ish)
-  jwtBuilder: (config, user) => {
+  jwtExpire: 60 * 60 * 24 * 7 * 24, // 24 weeks(ish) (6 months)
+  jwtSwitchExpire: 60 * 60 * 6, // 6 hours
+  jwtRenew: 60 * 60 * 24 * 7 * 12, // 12 weeks(ish) (3 months)
+  jwtBuilder: (config, user, switchToken) => {
     const secret = config.jwtSecret;
     if (secret === '') {
       throw new Error('JWT secret is not configured.');
@@ -62,12 +70,14 @@ export default {
     return jwt.sign(
       {
         iss: config.appUrl,
-        nbf: Date.now() / 1000,
+        nbf: Math.floor(Date.now() / 1000),
+        exp:
+          Math.floor(Date.now() / 1000) +
+          (switchToken ? config.jwtSwitchExpire : config.jwtExpire),
         guid: user.guid,
         xsrfToken: 'TILMELDXSRF-' + nanoid(),
       },
       secret,
-      { expiresIn: config.jwtExpire }
     );
   },
   jwtExtract: (config, token, xsrfToken?) => {
@@ -79,14 +89,14 @@ export default {
     try {
       const payload = jwt.verify(token, secret, {
         issuer: config.appUrl,
-        clockTolerance: 10,
+        clockTolerance: 60,
       });
 
       if (typeof payload === 'string') {
         return null;
       }
 
-      const { guid, xsrfToken: jwtXsrfToken, exp } = payload;
+      const { guid, xsrfToken: jwtXsrfToken, exp, nbf } = payload;
 
       if (xsrfToken != null && xsrfToken !== jwtXsrfToken) {
         return null;
@@ -96,13 +106,19 @@ export default {
         return null;
       }
 
+      if (nbf == null) {
+        return null;
+      }
+
+      const issued = new Date(nbf * 1000);
+
       if (exp == null) {
         return null;
       }
 
       const expire = new Date(exp * 1000);
 
-      return { guid, expire };
+      return { guid, issued, expire };
     } catch (e: any) {
       return null;
     }
@@ -117,18 +133,21 @@ export default {
           address: `noreply@${appUrl.hostname}`,
         },
       },
+      preview: {
+        openSimulator: false,
+      },
     };
   },
   sendEmail: async (tilmeld, options, user) => {
     const email = new Email(
-      await tilmeld.config.configEmail(tilmeld, options, user)
+      await tilmeld.config.configEmail(tilmeld, options, user),
     );
     try {
       const result = await email.send({
         ...options,
         template: path.join(
           tilmeld.config.emailTemplateDir,
-          options.template ?? '.'
+          options.template ?? '.',
         ),
         locals: {
           // System
@@ -156,29 +175,55 @@ export default {
       });
       return !!result;
     } catch (e: any) {
+      tilmeld.nymph.config.debugError('tilmeld', `Failed to send email: ${e}`);
       return false;
     }
   },
   userRegisteredRecipient: null,
-  validatorGroup: (group) => {
+  failedLoginAttempt: (_user, _data) => {
+    // Wait 3-5 seconds to return a failure. This rate limits failed login
+    // attempts.
+    return new Promise((resolve) =>
+      setTimeout(resolve, Math.random() * 2000 + 3000),
+    );
+  },
+  validatorGroup: (tilmeld, group) => {
+    const nameFields = tilmeld.config.userFields.includes('name')
+      ? {
+          name: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .max(512)
+            .required(),
+        }
+      : {};
+    const emailFields = tilmeld.config.userFields.includes('email')
+      ? {
+          email: Joi.string()
+            .trim(false)
+            .email({ minDomainSegments: 1, tlds: false })
+            .required(),
+        }
+      : {};
+    const phoneFields = tilmeld.config.userFields.includes('phone')
+      ? {
+          phone: Joi.string()
+            .trim(false)
+            .pattern(/^[0-9]+$/, 'numbers'),
+        }
+      : {};
     Joi.attempt(
       group.$getValidatable(),
       Joi.object().keys({
         ...nymphJoiProps,
+        ...nameFields,
+        ...emailFields,
+        ...phoneFields,
         groupname: Joi.string().trim(false).required(),
         enabled: Joi.boolean().required(),
-        email: Joi.string()
-          .trim(false)
-          .email({ minDomainSegments: 1, tlds: false })
-          .required(),
-        name: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .max(512)
-          .required(),
         avatar: Joi.string()
           .trim(false)
           .uri()
@@ -187,9 +232,6 @@ export default {
             invert: true,
           })
           .max(1024),
-        phone: Joi.string()
-          .trim(false)
-          .pattern(/^[0-9]+$/, 'numbers'),
         parent: Joi.object().instance(Group),
         user: Joi.object().instance(User),
         abilities: Joi.array().items(
@@ -198,56 +240,110 @@ export default {
               name: 'control characters',
               invert: true,
             })
-            .max(256)
+            .max(256),
         ),
         defaultPrimary: Joi.boolean(),
         defaultSecondary: Joi.boolean(),
         unverifiedSecondary: Joi.boolean(),
       }),
-      'Invalid Group: '
+      'Invalid Group: ',
     );
   },
-  validatorUser: (user) => {
+  validatorUser: (tilmeld, user) => {
+    const nameFields = tilmeld.config.userFields.includes('name')
+      ? {
+          nameFirst: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .max(512)
+            .required(),
+          nameMiddle: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .max(512),
+          nameLast: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .max(512),
+          name: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .max(512)
+            .required(),
+        }
+      : {};
+    const emailFields = tilmeld.config.userFields.includes('email')
+      ? {
+          email: Joi.string()
+            .trim(false)
+            .email({ minDomainSegments: 1, tlds: false })
+            .required(),
+          secret: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .length(21),
+          emailChangeDate: Joi.number(),
+          newEmailSecret: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .length(21),
+          newEmailAddress: Joi.string()
+            .trim(false)
+            .email({ minDomainSegments: 1, tlds: false }),
+          cancelEmailSecret: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .length(21),
+          cancelEmailAddress: Joi.string()
+            .trim(false)
+            .email({ minDomainSegments: 1, tlds: false }),
+          recoverSecret: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .length(10),
+          recoverSecretDate: Joi.number(),
+        }
+      : {};
+    const phoneFields = tilmeld.config.userFields.includes('phone')
+      ? {
+          phone: Joi.string()
+            .trim(false)
+            .pattern(/^[0-9]+$/, 'numbers'),
+        }
+      : {};
     Joi.attempt(
       user.$getValidatable(),
       Joi.object().keys({
         ...nymphJoiProps,
+        ...nameFields,
+        ...emailFields,
+        ...phoneFields,
         username: Joi.string().trim(false).required(),
         enabled: Joi.boolean().required(),
-        email: Joi.string()
-          .trim(false)
-          .email({ minDomainSegments: 1, tlds: false })
-          .required(),
-        nameFirst: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .max(512)
-          .required(),
-        nameMiddle: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .max(512),
-        nameLast: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .max(512),
-        name: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .max(512)
-          .required(),
         avatar: Joi.string()
           .trim(false)
           .uri()
@@ -256,9 +352,6 @@ export default {
             invert: true,
           })
           .max(1024),
-        phone: Joi.string()
-          .trim(false)
-          .pattern(/^[0-9]+$/, 'numbers'),
         group: Joi.object().instance(Group),
         groups: Joi.array().items(Joi.object().instance(Group)).required(),
         abilities: Joi.array().items(
@@ -267,49 +360,19 @@ export default {
               name: 'control characters',
               invert: true,
             })
-            .max(256)
+            .max(256),
         ),
         inheritAbilities: Joi.boolean(),
-        secret: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .length(21),
-        emailChangeDate: Joi.number(),
-        newEmailSecret: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .length(21),
-        newEmailAddress: Joi.string()
-          .trim(false)
-          .email({ minDomainSegments: 1, tlds: false }),
-        cancelEmailSecret: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .length(21),
-        cancelEmailAddress: Joi.string()
-          .trim(false)
-          .email({ minDomainSegments: 1, tlds: false }),
-        recoverSecret: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .length(10),
-        recoverSecretDate: Joi.number(),
         salt: Joi.string().trim(false),
         password: Joi.string().trim(false).required(),
+        revokeTokenDate: Joi.number(),
+        totpSecret: Joi.string()
+          .trim(false)
+          .min(24)
+          .max(40)
+          .pattern(/^[A-Z234567]+$/, 'base32 encoded unpadded'),
       }),
-      'Invalid User: '
+      'Invalid User: ',
     );
   },
 } as Config;

package/src/conf/index.ts

@@ -1,4 +1,4 @@
-export { Config } from './d';
+export { Config } from './d.js';
 
-import defaults from './defaults';
+import defaults from './defaults.js';
 export { defaults as ConfigDefaults };

package/src/enforceTilmeld.ts

@@ -0,0 +1,20 @@
+import { Entity, EntityConstructor, Nymph } from '@nymphjs/nymph';
+
+import Tilmeld from './Tilmeld.js';
+
+export function enforceTilmeld(object: Nymph | Entity | EntityConstructor) {
+  let tilmeld: Tilmeld | undefined;
+  if (object instanceof Entity) {
+    tilmeld = object.$nymph.tilmeld as Tilmeld | undefined;
+  } else if (object instanceof Nymph) {
+    tilmeld = object.tilmeld as Tilmeld | undefined;
+  } else {
+    tilmeld = object.nymph.tilmeld as Tilmeld | undefined;
+  }
+
+  if (tilmeld == null) {
+    throw new Error('Tilmeld was not configured on this Nymph instance!');
+  }
+
+  return tilmeld;
+}

package/src/errors/AccessControlError.ts

@@ -1,6 +1,8 @@
-export class AccessControlError extends Error {
+import { HttpError } from '@nymphjs/nymph';
+
+export class AccessControlError extends HttpError {
   constructor(message: string) {
-    super(message);
+    super(message, 403);
     this.name = 'AccessControlError';
   }
 }

package/src/errors/BadDataError.ts

@@ -1,6 +1,8 @@
-export class BadDataError extends Error {
+import { HttpError } from '@nymphjs/nymph';
+
+export class BadDataError extends HttpError {
   constructor(message: string) {
-    super(message);
+    super(message, 400);
     this.name = 'BadDataError';
   }
 }

package/src/errors/BadEmailError.ts

@@ -1,6 +1,8 @@
-export class BadEmailError extends Error {
+import { HttpError } from '@nymphjs/nymph';
+
+export class BadEmailError extends HttpError {
   constructor(message: string) {
-    super(message);
+    super(message, 400);
     this.name = 'BadEmailError';
   }
 }

package/src/errors/BadUsernameError.ts

@@ -1,6 +1,8 @@
-export class BadUsernameError extends Error {
+import { HttpError } from '@nymphjs/nymph';
+
+export class BadUsernameError extends HttpError {
   constructor(message: string) {
-    super(message);
+    super(message, 400);
     this.name = 'BadUsernameError';
   }
 }

package/src/errors/index.ts

@@ -1,11 +1,11 @@
-export * from './AccessControlError';
+export * from './AccessControlError.js';
 
-export * from './BadDataError';
+export * from './BadDataError.js';
 
-export * from './BadEmailError';
+export * from './BadEmailError.js';
 
-export * from './BadUsernameError';
+export * from './BadUsernameError.js';
 
-export * from './CouldNotChangeDefaultPrimaryGroupError';
+export * from './CouldNotChangeDefaultPrimaryGroupError.js';
 
-export * from './EmailChangeRateLimitExceededError';
+export * from './EmailChangeRateLimitExceededError.js';