@nymphjs/tilmeld 1.0.0-beta.14 → 1.0.0-beta.140

package/src/conf/defaults.ts

@@ -1,14 +1,16 @@
-import path from 'path';
-import { URL } from 'url';
+import path from 'node:path';
+import { URL, fileURLToPath } from 'node:url';
 import jwt from 'jsonwebtoken';
 import Email from 'email-templates';
 import Joi from 'joi';
 import { nanoid } from '@nymphjs/guid';
 import { nymphJoiProps } from '@nymphjs/nymph';
 
-import { Config } from './d';
-import User from '../User';
-import Group from '../Group';
+import type { Config } from './index.js';
+import { User } from '../User.js';
+import { Group } from '../Group.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 export default {
   appName: 'My Nymph App',
@@ -18,6 +20,7 @@ export default {
   setupPath: '/tilmeld',
   createAdmin: true,
   emailUsernames: true,
+  domainSupport: false,
   allowRegistration: true,
   allowUsernameChange: true,
   enableUserSearch: false,
@@ -49,25 +52,43 @@ export default {
   validEmailRegex:
     /^[a-zA-Z0-9.!#$%&'*+\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/,
   validEmailRegexNotice: 'Email must be a correctly formatted address.',
+  validDomainRegex:
+    /^(((?!-))(xn--|_)?[a-z0-9\-]{0,61}[a-z0-9]{1,1}\.)*(xn--)?([a-z0-9][a-z0-9\-]{0,60}|[a-z0-9\-]{1,30}\.[a-z]{2,})$/,
+  validDomainRegexNotice: 'Domain must be a correctly formatted domain name.',
+  minUsernameLength: 1,
   maxUsernameLength: 128,
   jwtSecret: '',
-  jwtExpire: 60 * 60 * 24 * 7 * 8, // 8 weeks(ish)
-  jwtRenew: 60 * 60 * 24 * 7 * 2, // 2 weeks(ish)
-  jwtBuilder: (config, user) => {
+  jwtExpire: 60 * 60 * 24 * 7 * 24, // 24 weeks(ish) (6 months)
+  jwtSwitchExpire: 60 * 60 * 6, // 6 hours
+  jwtRenew: 60 * 60 * 24 * 7 * 12, // 12 weeks(ish) (3 months)
+  jwtBuilder: (config, user, switchToken, switchForUser) => {
     const secret = config.jwtSecret;
     if (secret === '') {
       throw new Error('JWT secret is not configured.');
     }
 
+    if (switchToken && (!switchForUser || switchForUser.guid == null)) {
+      throw new Error(
+        "Issuing a switch token requires providing the user it's for.",
+      );
+    }
+
     return jwt.sign(
       {
         iss: config.appUrl,
-        nbf: Date.now() / 1000,
+        sub: switchForUser ? switchForUser.guid : user.guid,
+        nbf: Math.floor(Date.now() / 1000),
+        exp:
+          Math.floor(Date.now() / 1000) +
+          (switchToken ? config.jwtSwitchExpire : config.jwtExpire),
+        // TODO: remove this guid claim in favor of sub claim
+        // this needs to be done long enough after Nov 1 2026, when sub added
+        // also don't forget to change how switchForUser guid is stored.
         guid: user.guid,
         xsrfToken: 'TILMELDXSRF-' + nanoid(),
+        ...(switchToken ? { switch: true } : {}),
       },
       secret,
-      { expiresIn: config.jwtExpire }
     );
   },
   jwtExtract: (config, token, xsrfToken?) => {
@@ -79,14 +100,21 @@ export default {
     try {
       const payload = jwt.verify(token, secret, {
         issuer: config.appUrl,
-        clockTolerance: 10,
+        clockTolerance: 60,
       });
 
       if (typeof payload === 'string') {
         return null;
       }
 
-      const { guid, xsrfToken: jwtXsrfToken, exp } = payload;
+      const {
+        sub,
+        guid,
+        xsrfToken: jwtXsrfToken,
+        switch: switchBool,
+        exp,
+        nbf,
+      } = payload;
 
       if (xsrfToken != null && xsrfToken !== jwtXsrfToken) {
         return null;
@@ -96,13 +124,19 @@ export default {
         return null;
       }
 
+      if (nbf == null) {
+        return null;
+      }
+
+      const issued = new Date(nbf * 1000);
+
       if (exp == null) {
         return null;
       }
 
       const expire = new Date(exp * 1000);
 
-      return { guid, expire };
+      return { sub, guid, issued, expire, switch: switchBool };
     } catch (e: any) {
       return null;
     }
@@ -117,18 +151,21 @@ export default {
           address: `noreply@${appUrl.hostname}`,
         },
       },
+      preview: {
+        openSimulator: false,
+      },
     };
   },
   sendEmail: async (tilmeld, options, user) => {
     const email = new Email(
-      await tilmeld.config.configEmail(tilmeld, options, user)
+      await tilmeld.config.configEmail(tilmeld, options, user),
     );
     try {
       const result = await email.send({
         ...options,
         template: path.join(
           tilmeld.config.emailTemplateDir,
-          options.template ?? '.'
+          options.template ?? '.',
         ),
         locals: {
           // System
@@ -156,29 +193,70 @@ export default {
       });
       return !!result;
     } catch (e: any) {
+      tilmeld.nymph.config.debugError('tilmeld', `Failed to send email: ${e}`);
       return false;
     }
   },
   userRegisteredRecipient: null,
-  validatorGroup: (group) => {
+  failedLoginAttempt: (_user, _data) => {
+    // Wait 3-5 seconds to return a failure. This rate limits failed login
+    // attempts.
+    return new Promise((resolve) =>
+      setTimeout(resolve, Math.random() * 2000 + 3000),
+    );
+  },
+  validatorGroup: (tilmeld, group) => {
+    const nameFields = tilmeld.config.userFields.includes('name')
+      ? {
+          name: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .max(512)
+            .required(),
+        }
+      : {};
+    const emailFields = tilmeld.config.userFields.includes('email')
+      ? {
+          email: Joi.string()
+            .trim(false)
+            .email({ minDomainSegments: 1, tlds: false })
+            .required(),
+        }
+      : {};
+    const phoneFields = tilmeld.config.userFields.includes('phone')
+      ? {
+          phone: Joi.string()
+            .trim(false)
+            .pattern(/^[0-9]+$/, 'numbers'),
+        }
+      : {};
+    for (let ability of group.abilities ?? []) {
+      if (ability.startsWith('system/')) {
+        throw new Error('Invalid Group: Groups cannot have system abilities.');
+      }
+      if (ability === 'tilmeld/admin') {
+        throw new Error(
+          'Invalid Group: Groups cannot have Tilmeld admin ability.',
+        );
+      }
+      if (ability === 'tilmeld/switch') {
+        throw new Error(
+          'Invalid Group: Groups cannot have Tilmeld switch ability.',
+        );
+      }
+    }
     Joi.attempt(
       group.$getValidatable(),
       Joi.object().keys({
         ...nymphJoiProps,
+        ...nameFields,
+        ...emailFields,
+        ...phoneFields,
         groupname: Joi.string().trim(false).required(),
         enabled: Joi.boolean().required(),
-        email: Joi.string()
-          .trim(false)
-          .email({ minDomainSegments: 1, tlds: false })
-          .required(),
-        name: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .max(512)
-          .required(),
         avatar: Joi.string()
           .trim(false)
           .uri()
@@ -187,9 +265,6 @@ export default {
             invert: true,
           })
           .max(1024),
-        phone: Joi.string()
-          .trim(false)
-          .pattern(/^[0-9]+$/, 'numbers'),
         parent: Joi.object().instance(Group),
         user: Joi.object().instance(User),
         abilities: Joi.array().items(
@@ -198,56 +273,110 @@ export default {
               name: 'control characters',
               invert: true,
             })
-            .max(256)
+            .max(256),
         ),
         defaultPrimary: Joi.boolean(),
         defaultSecondary: Joi.boolean(),
         unverifiedSecondary: Joi.boolean(),
       }),
-      'Invalid Group: '
+      'Invalid Group: ',
     );
   },
-  validatorUser: (user) => {
+  validatorUser: (tilmeld, user) => {
+    const nameFields = tilmeld.config.userFields.includes('name')
+      ? {
+          nameFirst: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .max(512)
+            .required(),
+          nameMiddle: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .max(512),
+          nameLast: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .max(512),
+          name: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .max(512)
+            .required(),
+        }
+      : {};
+    const emailFields = tilmeld.config.userFields.includes('email')
+      ? {
+          email: Joi.string()
+            .trim(false)
+            .email({ minDomainSegments: 1, tlds: false })
+            .required(),
+          secret: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .length(21),
+          emailChangeDate: Joi.number(),
+          newEmailSecret: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .length(21),
+          newEmailAddress: Joi.string()
+            .trim(false)
+            .email({ minDomainSegments: 1, tlds: false }),
+          cancelEmailSecret: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .length(21),
+          cancelEmailAddress: Joi.string()
+            .trim(false)
+            .email({ minDomainSegments: 1, tlds: false }),
+          recoverSecret: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .length(10),
+          recoverSecretDate: Joi.number(),
+        }
+      : {};
+    const phoneFields = tilmeld.config.userFields.includes('phone')
+      ? {
+          phone: Joi.string()
+            .trim(false)
+            .pattern(/^[0-9]+$/, 'numbers'),
+        }
+      : {};
     Joi.attempt(
       user.$getValidatable(),
       Joi.object().keys({
         ...nymphJoiProps,
+        ...nameFields,
+        ...emailFields,
+        ...phoneFields,
         username: Joi.string().trim(false).required(),
         enabled: Joi.boolean().required(),
-        email: Joi.string()
-          .trim(false)
-          .email({ minDomainSegments: 1, tlds: false })
-          .required(),
-        nameFirst: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .max(512)
-          .required(),
-        nameMiddle: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .max(512),
-        nameLast: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .max(512),
-        name: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .max(512)
-          .required(),
         avatar: Joi.string()
           .trim(false)
           .uri()
@@ -256,9 +385,6 @@ export default {
             invert: true,
           })
           .max(1024),
-        phone: Joi.string()
-          .trim(false)
-          .pattern(/^[0-9]+$/, 'numbers'),
         group: Joi.object().instance(Group),
         groups: Joi.array().items(Joi.object().instance(Group)).required(),
         abilities: Joi.array().items(
@@ -267,49 +393,19 @@ export default {
               name: 'control characters',
               invert: true,
             })
-            .max(256)
+            .max(256),
         ),
         inheritAbilities: Joi.boolean(),
-        secret: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .length(21),
-        emailChangeDate: Joi.number(),
-        newEmailSecret: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .length(21),
-        newEmailAddress: Joi.string()
-          .trim(false)
-          .email({ minDomainSegments: 1, tlds: false }),
-        cancelEmailSecret: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .length(21),
-        cancelEmailAddress: Joi.string()
-          .trim(false)
-          .email({ minDomainSegments: 1, tlds: false }),
-        recoverSecret: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .length(10),
-        recoverSecretDate: Joi.number(),
         salt: Joi.string().trim(false),
         password: Joi.string().trim(false).required(),
+        revokeTokenDate: Joi.number(),
+        totpSecret: Joi.string()
+          .trim(false)
+          .min(24)
+          .max(40)
+          .pattern(/^[A-Z234567]+$/, 'base32 encoded unpadded'),
       }),
-      'Invalid User: '
+      'Invalid User: ',
     );
   },
 } as Config;