@nymphjs/tilmeld 1.0.0-beta.5 → 1.0.0-beta.51

package/src/conf/d.ts

@@ -9,7 +9,7 @@ import User, { UserData } from '../User';
  */
 export interface Config {
   /**
-   * The name of the app. Used in emails sent to users.
+   * The name of the app. Used in emails sent to users and as the TOTP issuer.
    */
   appName: string;
   /**
@@ -206,7 +206,11 @@ export interface Config {
    */
   validEmailRegexNotice: string;
   /**
-   * The maximum length for usernames. Infinity for unlimited.
+   * The minimum length for usernames.
+   */
+  minUsernameLength: number;
+  /**
+   * The maximum length for usernames. `Infinity` for unlimited.
    */
   maxUsernameLength: number;
   /**
@@ -217,6 +221,11 @@ export interface Config {
    * How long from current time, in seconds, the JWT token expires.
    */
   jwtExpire: number;
+  /**
+   * How long from current time, in seconds, the JWT token for a user switch
+   * expires.
+   */
+  jwtSwitchExpire: number;
   /**
    * How long, in seconds, before the JWT token expires to give the user a new
    * one.
@@ -225,21 +234,25 @@ export interface Config {
   /**
    * Function to build the JWT for user sessions.
    */
-  jwtBuilder: (config: Config, user: User) => string;
+  jwtBuilder: (
+    config: Config,
+    user: User & UserData,
+    switchToken?: boolean,
+  ) => string;
   /**
-   * Function to verify that a JWT was signed with the secret key, vaildate its
-   * data, validate the XSRF token, and extract the GUID.
+   * Function to verify that a JWT was signed with the secret key, validate its
+   * data, validate the XSRF token, and extract the GUID and dates.
    *
    * If no XSRF token is supplied, ignore it.
    *
-   * Return false if the JWT is not valid, or an array of GUID and expire
-   * timestamp otherwise.
+   * Return false if the JWT is not valid, or an object with GUID, issued date,
+   * and expire date otherwise.
    */
   jwtExtract: (
     config: Config,
     token: string,
-    xsrfToken?: string
-  ) => { guid: string; expire: Date } | null;
+    xsrfToken?: string,
+  ) => { guid: string; issued: Date; expire: Date } | null;
   /**
    * The absolute path to the email template directory. Used by the default
    * email sender.
@@ -255,7 +268,7 @@ export interface Config {
   configEmail: (
     tilmeld: Tilmeld,
     options: EmailOptions,
-    user: User & UserData
+    user: User & UserData,
   ) => Promise<EmailConfig>;
   /**
    * Send an email to a user. Uses `email-templates` by default.
@@ -285,7 +298,7 @@ export interface Config {
   sendEmail: (
     tilmeld: Tilmeld,
     options: EmailOptions,
-    user: User & UserData
+    user: User & UserData,
   ) => Promise<boolean>;
   /**
    * The address you'd like to receive a notification of registered users, if

package/src/conf/defaults.ts

@@ -49,11 +49,13 @@ export default {
   validEmailRegex:
     /^[a-zA-Z0-9.!#$%&'*+\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/,
   validEmailRegexNotice: 'Email must be a correctly formatted address.',
+  minUsernameLength: 1,
   maxUsernameLength: 128,
   jwtSecret: '',
-  jwtExpire: 60 * 60 * 24 * 7 * 8, // 8 weeks(ish)
-  jwtRenew: 60 * 60 * 24 * 7 * 2, // 2 weeks(ish)
-  jwtBuilder: (config, user) => {
+  jwtExpire: 60 * 60 * 24 * 7 * 24, // 24 weeks(ish) (6 months)
+  jwtSwitchExpire: 60 * 60 * 6, // 6 hours
+  jwtRenew: 60 * 60 * 24 * 7 * 12, // 12 weeks(ish) (3 months)
+  jwtBuilder: (config, user, switchToken) => {
     const secret = config.jwtSecret;
     if (secret === '') {
       throw new Error('JWT secret is not configured.');
@@ -62,12 +64,14 @@ export default {
     return jwt.sign(
       {
         iss: config.appUrl,
-        nbf: Date.now() / 1000,
+        nbf: Math.floor(Date.now() / 1000),
+        exp:
+          Math.floor(Date.now() / 1000) +
+          (switchToken ? config.jwtSwitchExpire : config.jwtExpire),
         guid: user.guid,
         xsrfToken: 'TILMELDXSRF-' + nanoid(),
       },
       secret,
-      { expiresIn: config.jwtExpire }
     );
   },
   jwtExtract: (config, token, xsrfToken?) => {
@@ -79,14 +83,14 @@ export default {
     try {
       const payload = jwt.verify(token, secret, {
         issuer: config.appUrl,
-        clockTolerance: 10,
+        clockTolerance: 60,
       });
 
       if (typeof payload === 'string') {
         return null;
       }
 
-      const { guid, xsrfToken: jwtXsrfToken, exp } = payload;
+      const { guid, xsrfToken: jwtXsrfToken, exp, nbf } = payload;
 
       if (xsrfToken != null && xsrfToken !== jwtXsrfToken) {
         return null;
@@ -96,13 +100,19 @@ export default {
         return null;
       }
 
+      if (nbf == null) {
+        return null;
+      }
+
+      const issued = new Date(nbf * 1000);
+
       if (exp == null) {
         return null;
       }
 
       const expire = new Date(exp * 1000);
 
-      return { guid, expire };
+      return { guid, issued, expire };
     } catch (e: any) {
       return null;
     }
@@ -121,14 +131,14 @@ export default {
   },
   sendEmail: async (tilmeld, options, user) => {
     const email = new Email(
-      await tilmeld.config.configEmail(tilmeld, options, user)
+      await tilmeld.config.configEmail(tilmeld, options, user),
     );
     try {
       const result = await email.send({
         ...options,
         template: path.join(
           tilmeld.config.emailTemplateDir,
-          options.template ?? '.'
+          options.template ?? '.',
         ),
         locals: {
           // System
@@ -198,13 +208,13 @@ export default {
               name: 'control characters',
               invert: true,
             })
-            .max(256)
+            .max(256),
         ),
         defaultPrimary: Joi.boolean(),
         defaultSecondary: Joi.boolean(),
         unverifiedSecondary: Joi.boolean(),
       }),
-      'Invalid Group: '
+      'Invalid Group: ',
     );
   },
   validatorUser: (user) => {
@@ -267,7 +277,7 @@ export default {
               name: 'control characters',
               invert: true,
             })
-            .max(256)
+            .max(256),
         ),
         inheritAbilities: Joi.boolean(),
         secret: Joi.string()
@@ -308,8 +318,14 @@ export default {
         recoverSecretDate: Joi.number(),
         salt: Joi.string().trim(false),
         password: Joi.string().trim(false).required(),
+        revokeTokenDate: Joi.number(),
+        totpSecret: Joi.string()
+          .trim(false)
+          .min(24)
+          .max(40)
+          .pattern(/^[A-Z234567]+$/, 'base32 encoded unpadded'),
       }),
-      'Invalid User: '
+      'Invalid User: ',
     );
   },
 } as Config;

package/src/enforceTilmeld.ts

@@ -0,0 +1,20 @@
+import { Entity, EntityConstructor, Nymph } from '@nymphjs/nymph';
+
+import Tilmeld from './Tilmeld';
+
+export function enforceTilmeld(object: Nymph | Entity | EntityConstructor) {
+  let tilmeld: Tilmeld | undefined;
+  if (object instanceof Entity) {
+    tilmeld = object.$nymph.tilmeld as Tilmeld | undefined;
+  } else if (object instanceof Nymph) {
+    tilmeld = object.tilmeld as Tilmeld | undefined;
+  } else {
+    tilmeld = object.nymph.tilmeld as Tilmeld | undefined;
+  }
+
+  if (tilmeld == null) {
+    throw new Error('Tilmeld was not configured on this Nymph instance!');
+  }
+
+  return tilmeld;
+}

package/src/index.ts

@@ -1,5 +1,7 @@
 export * from './conf';
 
+export * from './enforceTilmeld';
+
 export * from './errors';
 
 import AbleObject from './AbleObject';

package/src/tilmeldJoiProps.ts

@@ -11,36 +11,36 @@ export default {
     TilmeldAccessLevels.NO_ACCESS,
     TilmeldAccessLevels.READ_ACCESS,
     TilmeldAccessLevels.WRITE_ACCESS,
-    TilmeldAccessLevels.FULL_ACCESS
+    TilmeldAccessLevels.FULL_ACCESS,
   ),
   acGroup: Joi.number().valid(
     TilmeldAccessLevels.NO_ACCESS,
     TilmeldAccessLevels.READ_ACCESS,
     TilmeldAccessLevels.WRITE_ACCESS,
-    TilmeldAccessLevels.FULL_ACCESS
+    TilmeldAccessLevels.FULL_ACCESS,
   ),
   acOther: Joi.number().valid(
     TilmeldAccessLevels.NO_ACCESS,
     TilmeldAccessLevels.READ_ACCESS,
     TilmeldAccessLevels.WRITE_ACCESS,
-    TilmeldAccessLevels.FULL_ACCESS
+    TilmeldAccessLevels.FULL_ACCESS,
   ),
   acRead: Joi.array().items(
     Joi.alternatives().try(
       Joi.object().instance(User),
-      Joi.object().instance(Group)
-    )
+      Joi.object().instance(Group),
+    ),
   ),
   acWrite: Joi.array().items(
     Joi.alternatives().try(
       Joi.object().instance(User),
-      Joi.object().instance(Group)
-    )
+      Joi.object().instance(Group),
+    ),
   ),
   acFull: Joi.array().items(
     Joi.alternatives().try(
       Joi.object().instance(User),
-      Joi.object().instance(Group)
-    )
+      Joi.object().instance(Group),
+    ),
   ),
 };

package/typedoc.json

@@ -0,0 +1,4 @@
+{
+  "extends": ["../../typedoc.base.json"],
+  "entryPoints": ["src/index.ts"]
+}