@ofidj/generator-fidj 3.17.0 → 3.18.1

package/generators/app/templates/typescript/package.json

@@ -15,8 +15,8 @@
     "privacy:rehearse": "npm run build && node --test test/server.test.mjs"
   },
   "dependencies": {
-    "@ofidj/entry": "^3.17.0",
-    "@ofidj/node": "^3.17.0"
+    "@ofidj/entry": "^3.18.0",
+    "@ofidj/node": "^3.18.1"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

package/generators/app/templates/typescript/src/content.ts

@@ -1,5 +1,5 @@
-import {signInErrorMessage, formatDate, optionalPurposes, agreementRequired, agreementFromRefusal, verificationPending, pollVerification, rememberSignIn, forgetSignIn, signInHint, type SigninShape} from "@ofidj/entry";
-import {agreementScreen, bindAgreementScreen, bindPasswordReveal, acceptedAgreement, verificationWait, providerEntry, showEmailEntry, showVersionBadge, escape, masthead, highlightCells, badgeStrip, credentialFields, accountForm, passkeySupported, passkeyAssertion, walletDoor, oidcInteractionMarkup, oidcInteractionStyles, bindOidcInteraction} from "@ofidj/entry/dom";
+import {signInErrorMessage, formatDate, agreementRequired, agreementFromRefusal, verificationPending, pollVerification, rememberSignIn, forgetSignIn, signInHint, type SigninShape} from "@ofidj/entry";
+import {agreementScreen, bindAgreementScreen, bindPasswordReveal, acceptedAgreement, verificationWait, providerEntry, showEmailEntry, showVersionBadge, escape, masthead, highlightCells, badgeStrip, credentialFields, accountForm, passkeySupported, passkeyAssertion, walletDoor, memberCard, oidcInteractionMarkup, oidcInteractionStyles, bindOidcInteraction} from "@ofidj/entry/dom";
 import {openProviderWindow, relayProviderAnswer, type ProviderWindow} from "@ofidj/entry/window";
 import { FidjNodeService, FidjOidcClient } from "@ofidj/node";
 import config from "../app.config.json";
@@ -167,7 +167,10 @@ async function request(path: string, method = "GET", data?: unknown) {
   });
   const result = await response.json();
   if (!response.ok) {
-    if ([401, 403].includes(response.status)) {
+    // Only a 401 means the session is gone; a 403 refuses one action to
+    // somebody still signed in, and signing them out for it ended the console's
+    // session on the first forbidden request.
+    if (response.status === 401) {
       signedIn = false;
       await sdk.logout(true);
     }
@@ -412,16 +415,16 @@ function signInThroughProvider(
   void action(async () => {
     let url: string;
     try {
-      // Being recognised again is the one thing somebody who has just signed
-      // out did not ask for, and skipping this is what let a sign-out be undone
-      // by pressing the door again: the provider still knew the browser and
-      // answered with a code, no screen at all. Ending the provider session is
-      // what should make that impossible, and that call can be refused — so the
-      // door asks rather than assumes, until somebody signs in again.
+      // Somebody who has just signed out of this app did not ask to be walked
+      // straight back in: the provider still knows the browser and would answer
+      // with a code and no screen. So the door asks which account — the consent
+      // screen names the one Fidj recognises and offers another. It does not ask
+      // for a password: prompt=login told Fidj "this is not me" and ended the
+      // Fidj session along with the app's.
       url = await oidc.beginLogin(
         options.prompt || options.silent || !oidc.signedOutHere()
           ? options
-          : {...options, prompt: "login"},
+          : {...options, prompt: "consent"},
       );
     } catch (error) {
       providerWindow?.giveUp();
@@ -917,7 +920,7 @@ function wirePrivacy() {
         navigate("signin");
       }),
   );
-  element("terms")?.addEventListener(
+  element("accept-terms")?.addEventListener(
     "click",
     () =>
       void action(async () => {
@@ -1001,36 +1004,15 @@ function accountRows() {
 }
 
 function privacyBlock() {
-  const acceptedVersion = String((consent as Record<string, unknown>).termsVersion || "");
-  const agreementHref = `${config.apiEndpoint}/apps/${encodeURIComponent(config.appId)}/agreements/${encodeURIComponent(acceptedVersion)}`;
-  const agreementRow = consent.terms
-    ? `<div class="member-row"><div><strong>Service agreement</strong>${acceptedVersion ? `<a class="basis" href="${escape(agreementHref)}" target="_blank" rel="noopener noreferrer">Contract · agreement ${escape(acceptedVersion)} ↗</a>` : '<span class="basis">Contract</span>'}</div><small class="nosw">Part of the service. To stop it, leave the app.</small></div>`
-    : '<div class="member-row"><div><strong>Service agreement</strong><small>Not accepted yet — accept it or leave the app.</small></div><button id="terms" class="primary">Accept</button></div>';
-  const choices = optionalPurposes
-    .map(
-      (purpose) =>
-        `<label class="member-row" for="purpose-${purpose.key}"><div><strong>${escape(purpose.title)}</strong><small>${escape(purpose.description)}</small><span class="basis consent">Consent</span></div><span class="switch"><input type="checkbox" role="switch" id="purpose-${purpose.key}" data-purpose="${purpose.key}" ${consent[purpose.key] ? "checked" : ""}><span class="switch-state" aria-hidden="true">${consent[purpose.key] ? "On" : "Off"}</span></span></label>`,
-    )
-    .join("");
-  const entries = history.length
-    ? history
-        .slice()
-        .reverse()
-        .map(
-          (entry) =>
-            `<p>${escape(formatDate(entry.changedAt, "datetime"))} · ${escape(entry.type)} ${entry.granted ? "given" : "withdrawn"}</p>`,
-        )
-        .join("")
-    : "<p>No changes yet.</p>";
-  const leave = roles.includes("Owner")
-    ? "<small>You own this app: hand it over or delete it on Fidj before leaving.</small>"
-    : leaving
-      ? '<p>Your membership and what this app holds for you will be erased. Your other apps remain available.</p><button id="confirm-leave" class="danger">Leave &amp; erase</button><button id="cancel-leave">Keep my membership</button>'
-      : '<button id="leave" class="danger">Leave &amp; erase</button>';
-  return `<h2>Your membership</h2><div class="member-rows">${agreementRow}${choices}</div>
-  <details class="member-history"><summary>History</summary>${entries}</details>
-  <div class="member-actions"><button id="export">Export</button>${leave}</div>
-  <p class="leaving"><a href="${escape(config.dashboardUrl)}/#/my/gdpr" target="_blank" rel="noopener noreferrer">Open Fidj to manage every app you use ↗</a></p>`;
+  const version = String((consent as Record<string, unknown>).termsVersion || "");
+  return memberCard({
+    consent,
+    history,
+    agreementHref: `${config.apiEndpoint}/apps/${encodeURIComponent(config.appId)}/agreements/${encodeURIComponent(version)}`,
+    owner: roles.includes("Owner"),
+    leaving,
+    manageHref: `${config.dashboardUrl}/#/my/gdpr`,
+  });
 }
 
 // ------------------------------------------------ signing in, for the provider
@@ -1059,6 +1041,8 @@ type Interaction = {
   recognisedEmail?: string;
   // The passkey door's challenge, on the login step.
   passkey?: {ticket: string; options: unknown};
+  // The recognised person's agreement is on file at the version in force.
+  agreementAccepted?: boolean;
   action: string;
 };
 let interactionId = "";
@@ -1184,6 +1168,7 @@ function interactionScreen() {
     agreementHref: details.termsUri || undefined,
     recognisedEmail: details.recognisedEmail || undefined,
     passkey: details.passkey,
+    agreementAccepted: details.agreementAccepted,
     logoSrc: "./fidj-logo.png",
   })}`;
   bindOidcInteraction(root);

package/generators/app/templates/typescript/src/main.ts

@@ -1,5 +1,5 @@
 import {agreementRequired, agreementFromRefusal, signInErrorMessage, rememberSignIn, forgetSignIn, formatDate, type SigninShape} from "@ofidj/entry";
-import {acceptedAgreement, agreementScreen, bindAgreementScreen, bindPasswordReveal, providerEntry, showEmailEntry, showVersionBadge} from "@ofidj/entry/dom";
+import {acceptedAgreement, agreementScreen, memberCard, bindAgreementScreen, bindPasswordReveal, providerEntry, showEmailEntry, showVersionBadge} from "@ofidj/entry/dom";
 import {openProviderWindow, relayProviderAnswer, type ProviderWindow} from "@ofidj/entry/window";
 import { FidjNodeService, FidjOidcClient } from "@ofidj/node";
 import "@ofidj/entry/style.css";
@@ -224,18 +224,18 @@ function render() {
   ${
     view === "workspace"
       ? `<section class="workspace"><div><div class="section-heading"><h2>Your notes</h2><span>${notes.length} saved</span></div>${notes.length ? notes.map((note) => `<article class="card note"><small>${escape(formatDate(note.createdAt, "datetime"))}</small><h3>${escape(note.title)}</h3><p>${escape(note.body)}</p></article>`).join("") : `<article class="card empty"><span>✳</span><h3>Room for your next idea.</h3><p>Your saved notes will appear here. Only you can read your notes.</p></article>`}</div><form id="note" class="card"><p class="eyebrow">CAPTURE SOMETHING</p><h2>A fresh note</h2><p>${canWrite ? "You have permission to save notes." : "Ask your app owner for Editor access to save notes."}</p><label for="note-title">Title</label><input id="note-title" maxlength="120" required ${!canWrite ? "disabled" : ""}><label for="note-body">Your note</label><textarea id="note-body" rows="6" maxlength="5000" ${!canWrite ? "disabled" : ""}></textarea><button class="primary" type="submit" ${!canWrite ? "disabled" : ""}>Save note</button><small>Your notes are saved by this app and survive a server restart.</small></form></section>`
-      : `<section class="privacy-grid"><article class="card"><p class="eyebrow">ONLY ${escape(settings.title).toUpperCase()}</p><h2>Your choices in this app</h2><p>These preferences are independent of Fidj and your other apps.</p><div class="agreement"><strong>Service agreement</strong><span>${privacy?.consent.terms ? "Accepted" : "Not recorded"}</span>${!privacy?.consent.terms ? '<p>This starter uses a demo agreement. Accept it to record your choice.</p><button id="accept-terms">Accept demo agreement</button>' : "<p>Leaving this app withdraws its required agreement.</p>"}</div>${["analytics", "communications", "optionalData"].map((key, index) => `<label class="toggle"><span><strong>${["Analytics", "Communications", "Optional data"][index]}</strong><small>${["Help improve this app.", "Receive optional news and updates.", "Allow data beyond the essential service."][index]}</small></span><input type="checkbox" data-purpose="${key}" ${privacy?.consent[key] ? "checked" : ""}></label>`).join("")}<button id="export">Export</button></article><article class="card"><h2>Consent history</h2>${
-          privacy?.history.length
-            ? privacy.history
-                .slice()
-                .reverse()
-                .map(
-                  (entry) =>
-                    `<p><strong>${escape(entry.type)}</strong> · ${entry.granted ? "Accepted" : "Withdrawn"}<br><small>${escape(formatDate(entry.changedAt, "datetime"))}</small></p>`,
-                )
-                .join("")
-            : "<p>No changes yet.</p>"
-        }<hr><h2>Leave this app</h2><p>This removes your app membership and this starter’s notes. Your Fidj account and other memberships remain.</p>${session.roles.includes("Owner") ? "<p>As the app owner, resolve ownership before leaving.</p>" : leaving ? '<div role="alertdialog" aria-labelledby="leave-title"><h3 id="leave-title">Confirm departure</h3><p>Your membership, consent and notes in this app will be removed. Your Fidj account and other apps remain available.</p><button id="confirm-leave" class="danger">Leave &amp; erase</button><button id="cancel-leave">Keep my membership</button></div>' : '<button id="leave" class="danger">Leave &amp; erase</button>'}<p class="fineprint">Exports here include your Fidj membership and this starter’s notes. The registered app-data handler lets Fidj export and erase these notes too. If cleanup is pending, retry from My privacy on Fidj. Minimal completion receipts are retained; backups and unregistered systems are outside this operation.</p></article></section>`
+      : `<section class="card privacy-card">${memberCard({
+          consent: privacy?.consent || {},
+          history: privacy?.history || [],
+          agreementHref: privacy?.consent.termsVersion
+            ? `${settings.apiEndpoint}/apps/${encodeURIComponent(settings.appId)}/agreements/${encodeURIComponent(String(privacy.consent.termsVersion))}`
+            : undefined,
+          owner: session.roles.includes("Owner"),
+          leaving,
+          leaveScope:
+            "Your membership, your choices and your notes in this app will be erased. Your Fidj account and other apps remain available.",
+          manageHref: `${settings.dashboardUrl}/#/my/gdpr`,
+        })}</section>`
   }`
   }
   <footer>Built with Fidj · One identity. Separate choices for every app.</footer></main>`;
@@ -348,7 +348,7 @@ function render() {
       void action(async () => {
         await api("privacy", "PUT", { terms: true });
         await load();
-        notice = "Demo agreement accepted.";
+        notice = "Service agreement accepted.";
       }),
   );
   el("export")?.addEventListener(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ofidj/generator-fidj",
-  "version": "3.17.0",
+  "version": "3.18.1",
   "description": "Generate a TypeScript app with Fidj sign-in, live server-side roles and per-app privacy.",
   "homepage": "https://fidj.ovh",
   "bugs": {