@nymphjs/tilmeld 1.0.0-beta.8 → 1.0.0-beta.81

package/src/conf/d.ts

@@ -9,7 +9,7 @@ import User, { UserData } from '../User';
  */
 export interface Config {
   /**
-   * The name of the app. Used in emails sent to users.
+   * The name of the app. Used in emails sent to users and as the TOTP issuer.
    */
   appName: string;
   /**
@@ -206,7 +206,11 @@ export interface Config {
    */
   validEmailRegexNotice: string;
   /**
-   * The maximum length for usernames. Infinity for unlimited.
+   * The minimum length for usernames.
+   */
+  minUsernameLength: number;
+  /**
+   * The maximum length for usernames. `Infinity` for unlimited.
    */
   maxUsernameLength: number;
   /**
@@ -217,6 +221,11 @@ export interface Config {
    * How long from current time, in seconds, the JWT token expires.
    */
   jwtExpire: number;
+  /**
+   * How long from current time, in seconds, the JWT token for a user switch
+   * expires.
+   */
+  jwtSwitchExpire: number;
   /**
    * How long, in seconds, before the JWT token expires to give the user a new
    * one.
@@ -225,21 +234,25 @@ export interface Config {
   /**
    * Function to build the JWT for user sessions.
    */
-  jwtBuilder: (config: Config, user: User) => string;
+  jwtBuilder: (
+    config: Config,
+    user: User & UserData,
+    switchToken?: boolean,
+  ) => string;
   /**
-   * Function to verify that a JWT was signed with the secret key, vaildate its
-   * data, validate the XSRF token, and extract the GUID.
+   * Function to verify that a JWT was signed with the secret key, validate its
+   * data, validate the XSRF token, and extract the GUID and dates.
    *
    * If no XSRF token is supplied, ignore it.
    *
-   * Return false if the JWT is not valid, or an array of GUID and expire
-   * timestamp otherwise.
+   * Return false if the JWT is not valid, or an object with GUID, issued date,
+   * and expire date otherwise.
    */
   jwtExtract: (
     config: Config,
     token: string,
-    xsrfToken?: string
-  ) => { guid: string; expire: Date } | null;
+    xsrfToken?: string,
+  ) => { guid: string; issued: Date; expire: Date } | null;
   /**
    * The absolute path to the email template directory. Used by the default
    * email sender.
@@ -255,7 +268,7 @@ export interface Config {
   configEmail: (
     tilmeld: Tilmeld,
     options: EmailOptions,
-    user: User & UserData
+    user: User & UserData,
   ) => Promise<EmailConfig>;
   /**
    * Send an email to a user. Uses `email-templates` by default.
@@ -285,7 +298,7 @@ export interface Config {
   sendEmail: (
     tilmeld: Tilmeld,
     options: EmailOptions,
-    user: User & UserData
+    user: User & UserData,
   ) => Promise<boolean>;
   /**
    * The address you'd like to receive a notification of registered users, if
@@ -295,9 +308,9 @@ export interface Config {
   /**
    * The validator used to check groups before saving.
    */
-  validatorGroup: (group: Group & GroupData) => void;
+  validatorGroup: (tilmeld: Tilmeld, group: Group & GroupData) => void;
   /**
    * The validator used to check users before saving.
    */
-  validatorUser: (user: User & UserData) => void;
+  validatorUser: (tilmeld: Tilmeld, user: User & UserData) => void;
 }

package/src/conf/defaults.ts

@@ -49,11 +49,13 @@ export default {
   validEmailRegex:
     /^[a-zA-Z0-9.!#$%&'*+\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/,
   validEmailRegexNotice: 'Email must be a correctly formatted address.',
+  minUsernameLength: 1,
   maxUsernameLength: 128,
   jwtSecret: '',
-  jwtExpire: 60 * 60 * 24 * 7 * 8, // 8 weeks(ish)
-  jwtRenew: 60 * 60 * 24 * 7 * 2, // 2 weeks(ish)
-  jwtBuilder: (config, user) => {
+  jwtExpire: 60 * 60 * 24 * 7 * 24, // 24 weeks(ish) (6 months)
+  jwtSwitchExpire: 60 * 60 * 6, // 6 hours
+  jwtRenew: 60 * 60 * 24 * 7 * 12, // 12 weeks(ish) (3 months)
+  jwtBuilder: (config, user, switchToken) => {
     const secret = config.jwtSecret;
     if (secret === '') {
       throw new Error('JWT secret is not configured.');
@@ -62,12 +64,14 @@ export default {
     return jwt.sign(
       {
         iss: config.appUrl,
-        nbf: Date.now() / 1000,
+        nbf: Math.floor(Date.now() / 1000),
+        exp:
+          Math.floor(Date.now() / 1000) +
+          (switchToken ? config.jwtSwitchExpire : config.jwtExpire),
         guid: user.guid,
         xsrfToken: 'TILMELDXSRF-' + nanoid(),
       },
       secret,
-      { expiresIn: config.jwtExpire }
     );
   },
   jwtExtract: (config, token, xsrfToken?) => {
@@ -79,14 +83,14 @@ export default {
     try {
       const payload = jwt.verify(token, secret, {
         issuer: config.appUrl,
-        clockTolerance: 10,
+        clockTolerance: 60,
       });
 
       if (typeof payload === 'string') {
         return null;
       }
 
-      const { guid, xsrfToken: jwtXsrfToken, exp } = payload;
+      const { guid, xsrfToken: jwtXsrfToken, exp, nbf } = payload;
 
       if (xsrfToken != null && xsrfToken !== jwtXsrfToken) {
         return null;
@@ -96,13 +100,19 @@ export default {
         return null;
       }
 
+      if (nbf == null) {
+        return null;
+      }
+
+      const issued = new Date(nbf * 1000);
+
       if (exp == null) {
         return null;
       }
 
       const expire = new Date(exp * 1000);
 
-      return { guid, expire };
+      return { guid, issued, expire };
     } catch (e: any) {
       return null;
     }
@@ -121,14 +131,14 @@ export default {
   },
   sendEmail: async (tilmeld, options, user) => {
     const email = new Email(
-      await tilmeld.config.configEmail(tilmeld, options, user)
+      await tilmeld.config.configEmail(tilmeld, options, user),
     );
     try {
       const result = await email.send({
         ...options,
         template: path.join(
           tilmeld.config.emailTemplateDir,
-          options.template ?? '.'
+          options.template ?? '.',
         ),
         locals: {
           // System
@@ -156,29 +166,48 @@ export default {
       });
       return !!result;
     } catch (e: any) {
+      tilmeld.nymph.config.debugError('tilmeld', `Failed to send email: ${e}`);
       return false;
     }
   },
   userRegisteredRecipient: null,
-  validatorGroup: (group) => {
+  validatorGroup: (tilmeld, group) => {
+    const nameFields = tilmeld.config.userFields.includes('name')
+      ? {
+          name: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .max(512)
+            .required(),
+        }
+      : {};
+    const emailFields = tilmeld.config.userFields.includes('email')
+      ? {
+          email: Joi.string()
+            .trim(false)
+            .email({ minDomainSegments: 1, tlds: false })
+            .required(),
+        }
+      : {};
+    const phoneFields = tilmeld.config.userFields.includes('phone')
+      ? {
+          phone: Joi.string()
+            .trim(false)
+            .pattern(/^[0-9]+$/, 'numbers'),
+        }
+      : {};
     Joi.attempt(
       group.$getValidatable(),
       Joi.object().keys({
         ...nymphJoiProps,
+        ...nameFields,
+        ...emailFields,
+        ...phoneFields,
         groupname: Joi.string().trim(false).required(),
         enabled: Joi.boolean().required(),
-        email: Joi.string()
-          .trim(false)
-          .email({ minDomainSegments: 1, tlds: false })
-          .required(),
-        name: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .max(512)
-          .required(),
         avatar: Joi.string()
           .trim(false)
           .uri()
@@ -187,9 +216,6 @@ export default {
             invert: true,
           })
           .max(1024),
-        phone: Joi.string()
-          .trim(false)
-          .pattern(/^[0-9]+$/, 'numbers'),
         parent: Joi.object().instance(Group),
         user: Joi.object().instance(User),
         abilities: Joi.array().items(
@@ -198,56 +224,110 @@ export default {
               name: 'control characters',
               invert: true,
             })
-            .max(256)
+            .max(256),
         ),
         defaultPrimary: Joi.boolean(),
         defaultSecondary: Joi.boolean(),
         unverifiedSecondary: Joi.boolean(),
       }),
-      'Invalid Group: '
+      'Invalid Group: ',
     );
   },
-  validatorUser: (user) => {
+  validatorUser: (tilmeld, user) => {
+    const nameFields = tilmeld.config.userFields.includes('name')
+      ? {
+          nameFirst: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .max(512)
+            .required(),
+          nameMiddle: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .max(512),
+          nameLast: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .max(512),
+          name: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .max(512)
+            .required(),
+        }
+      : {};
+    const emailFields = tilmeld.config.userFields.includes('email')
+      ? {
+          email: Joi.string()
+            .trim(false)
+            .email({ minDomainSegments: 1, tlds: false })
+            .required(),
+          secret: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .length(21),
+          emailChangeDate: Joi.number(),
+          newEmailSecret: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .length(21),
+          newEmailAddress: Joi.string()
+            .trim(false)
+            .email({ minDomainSegments: 1, tlds: false }),
+          cancelEmailSecret: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .length(21),
+          cancelEmailAddress: Joi.string()
+            .trim(false)
+            .email({ minDomainSegments: 1, tlds: false }),
+          recoverSecret: Joi.string()
+            .trim(false)
+            .pattern(/[\x01-\x1F\x7F]/, {
+              name: 'control characters',
+              invert: true,
+            })
+            .length(10),
+          recoverSecretDate: Joi.number(),
+        }
+      : {};
+    const phoneFields = tilmeld.config.userFields.includes('phone')
+      ? {
+          phone: Joi.string()
+            .trim(false)
+            .pattern(/^[0-9]+$/, 'numbers'),
+        }
+      : {};
     Joi.attempt(
       user.$getValidatable(),
       Joi.object().keys({
         ...nymphJoiProps,
+        ...nameFields,
+        ...emailFields,
+        ...phoneFields,
         username: Joi.string().trim(false).required(),
         enabled: Joi.boolean().required(),
-        email: Joi.string()
-          .trim(false)
-          .email({ minDomainSegments: 1, tlds: false })
-          .required(),
-        nameFirst: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .max(512)
-          .required(),
-        nameMiddle: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .max(512),
-        nameLast: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .max(512),
-        name: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .max(512)
-          .required(),
         avatar: Joi.string()
           .trim(false)
           .uri()
@@ -256,9 +336,6 @@ export default {
             invert: true,
           })
           .max(1024),
-        phone: Joi.string()
-          .trim(false)
-          .pattern(/^[0-9]+$/, 'numbers'),
         group: Joi.object().instance(Group),
         groups: Joi.array().items(Joi.object().instance(Group)).required(),
         abilities: Joi.array().items(
@@ -267,49 +344,19 @@ export default {
               name: 'control characters',
               invert: true,
             })
-            .max(256)
+            .max(256),
         ),
         inheritAbilities: Joi.boolean(),
-        secret: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .length(21),
-        emailChangeDate: Joi.number(),
-        newEmailSecret: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .length(21),
-        newEmailAddress: Joi.string()
-          .trim(false)
-          .email({ minDomainSegments: 1, tlds: false }),
-        cancelEmailSecret: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .length(21),
-        cancelEmailAddress: Joi.string()
-          .trim(false)
-          .email({ minDomainSegments: 1, tlds: false }),
-        recoverSecret: Joi.string()
-          .trim(false)
-          .pattern(/[\x01-\x1F\x7F]/, {
-            name: 'control characters',
-            invert: true,
-          })
-          .length(10),
-        recoverSecretDate: Joi.number(),
         salt: Joi.string().trim(false),
         password: Joi.string().trim(false).required(),
+        revokeTokenDate: Joi.number(),
+        totpSecret: Joi.string()
+          .trim(false)
+          .min(24)
+          .max(40)
+          .pattern(/^[A-Z234567]+$/, 'base32 encoded unpadded'),
       }),
-      'Invalid User: '
+      'Invalid User: ',
     );
   },
 } as Config;

package/src/enforceTilmeld.ts

@@ -0,0 +1,20 @@
+import { Entity, EntityConstructor, Nymph } from '@nymphjs/nymph';
+
+import Tilmeld from './Tilmeld';
+
+export function enforceTilmeld(object: Nymph | Entity | EntityConstructor) {
+  let tilmeld: Tilmeld | undefined;
+  if (object instanceof Entity) {
+    tilmeld = object.$nymph.tilmeld as Tilmeld | undefined;
+  } else if (object instanceof Nymph) {
+    tilmeld = object.tilmeld as Tilmeld | undefined;
+  } else {
+    tilmeld = object.nymph.tilmeld as Tilmeld | undefined;
+  }
+
+  if (tilmeld == null) {
+    throw new Error('Tilmeld was not configured on this Nymph instance!');
+  }
+
+  return tilmeld;
+}

package/src/errors/AccessControlError.ts

@@ -1,6 +1,8 @@
-export class AccessControlError extends Error {
+import { HttpError } from '@nymphjs/server';
+
+export class AccessControlError extends HttpError {
   constructor(message: string) {
-    super(message);
+    super(message, 403);
     this.name = 'AccessControlError';
   }
 }

package/src/errors/BadDataError.ts

@@ -1,6 +1,8 @@
-export class BadDataError extends Error {
+import { HttpError } from '@nymphjs/server';
+
+export class BadDataError extends HttpError {
   constructor(message: string) {
-    super(message);
+    super(message, 400);
     this.name = 'BadDataError';
   }
 }

package/src/errors/BadEmailError.ts

@@ -1,6 +1,8 @@
-export class BadEmailError extends Error {
+import { HttpError } from '@nymphjs/server';
+
+export class BadEmailError extends HttpError {
   constructor(message: string) {
-    super(message);
+    super(message, 400);
     this.name = 'BadEmailError';
   }
 }

package/src/errors/BadUsernameError.ts

@@ -1,6 +1,8 @@
-export class BadUsernameError extends Error {
+import { HttpError } from '@nymphjs/server';
+
+export class BadUsernameError extends HttpError {
   constructor(message: string) {
-    super(message);
+    super(message, 400);
     this.name = 'BadUsernameError';
   }
 }

package/src/index.ts

@@ -1,5 +1,7 @@
 export * from './conf';
 
+export * from './enforceTilmeld';
+
 export * from './errors';
 
 import AbleObject from './AbleObject';

package/src/tilmeldJoiProps.ts

@@ -11,36 +11,36 @@ export default {
     TilmeldAccessLevels.NO_ACCESS,
     TilmeldAccessLevels.READ_ACCESS,
     TilmeldAccessLevels.WRITE_ACCESS,
-    TilmeldAccessLevels.FULL_ACCESS
+    TilmeldAccessLevels.FULL_ACCESS,
   ),
   acGroup: Joi.number().valid(
     TilmeldAccessLevels.NO_ACCESS,
     TilmeldAccessLevels.READ_ACCESS,
     TilmeldAccessLevels.WRITE_ACCESS,
-    TilmeldAccessLevels.FULL_ACCESS
+    TilmeldAccessLevels.FULL_ACCESS,
   ),
   acOther: Joi.number().valid(
     TilmeldAccessLevels.NO_ACCESS,
     TilmeldAccessLevels.READ_ACCESS,
     TilmeldAccessLevels.WRITE_ACCESS,
-    TilmeldAccessLevels.FULL_ACCESS
+    TilmeldAccessLevels.FULL_ACCESS,
   ),
   acRead: Joi.array().items(
     Joi.alternatives().try(
       Joi.object().instance(User),
-      Joi.object().instance(Group)
-    )
+      Joi.object().instance(Group),
+    ),
   ),
   acWrite: Joi.array().items(
     Joi.alternatives().try(
       Joi.object().instance(User),
-      Joi.object().instance(Group)
-    )
+      Joi.object().instance(Group),
+    ),
   ),
   acFull: Joi.array().items(
     Joi.alternatives().try(
       Joi.object().instance(User),
-      Joi.object().instance(Group)
-    )
+      Joi.object().instance(Group),
+    ),
   ),
 };

package/tsconfig.json

@@ -2,10 +2,10 @@
   "extends": "@tsconfig/recommended/tsconfig.json",
 
   "compilerOptions": {
-    "lib": ["ES2021"],
-    "target": "ES2021",
+    "lib": ["ES2023"],
+    "target": "ES2022",
     "noImplicitAny": true,
-    "removeComments": true,
+    "removeComments": false,
     "sourceMap": true,
     "outDir": "dist",
     "resolveJsonModule": true,

package/typedoc.json

@@ -0,0 +1,4 @@
+{
+  "extends": ["../../typedoc.base.json"],
+  "entryPoints": ["src/index.ts"]
+}