@ossy/users 3.11.0 → 3.12.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ossy/users",
   "description": "User domain - aggregate, events, and validators for the Ossy user model",
-  "version": "3.11.0",
+  "version": "3.12.0",
   "private": false,
   "type": "module",
   "main": "./src/index.js",
@@ -11,7 +11,8 @@
     "./server": "./src/server.js",
     "./update-email.flow.js": "./src/update-email.flow.js",
     "./update-profile-name.flow.js": "./src/update-profile-name.flow.js",
-    "./update-profile-details.schema.js": "./src/update-profile-details.schema.js"
+    "./update-profile-details.schema.js": "./src/update-profile-details.schema.js",
+    "./complete-user-name.schema.js": "./src/complete-user-name.schema.js"
   },
   "scripts": {
     "test": "NODE_OPTIONS=--experimental-vm-modules jest --verbose",
@@ -49,5 +50,5 @@
     "/src",
     "README.md"
   ],
-  "gitHead": "53ff8456920e09151c9d88df4a6c3ee958d811eb"
+  "gitHead": "c2650803219ad1831559b512848358d9550ffad2"
 }

package/src/CompleteUserName.jsx

@@ -0,0 +1,99 @@
+import React, { useMemo, useState } from 'react'
+import { View, Text, Button, Form, FieldFactory, FormStatus, useLocale } from '@ossy/design-system'
+import { useRouter } from '@ossy/router-react'
+import { Schema, contentValidator } from '@ossy/schema'
+import { useSdk } from '@ossy/sdk-react'
+import { SignOut } from '@ossy/authentication'
+import { metadata as UpdateUserDetails } from './update-details.action.js'
+import { metadata as CompleteUserNameAction } from './complete-user-name.action.js'
+import { metadata as CompleteUserNameForm } from './complete-user-name.form.js'
+import completeUserNameTemplate from './complete-user-name.schema.js'
+
+/**
+ * Blocks product UI until a signed-in user has a first and last name.
+ */
+export function CompleteUserName ({ onCompleted }) {
+  const { t } = useLocale()
+  const router = useRouter()
+  const sdk = useSdk()
+  const [saving, setSaving] = useState(false)
+  const [saveError, setSaveError] = useState(false)
+  const validate = useMemo(
+    () => contentValidator(
+      Schema.of({ schemas: [completeUserNameTemplate] }),
+      completeUserNameTemplate,
+    ),
+    [],
+  )
+
+  const signOff = () => {
+    const home = router.getHref('@home') || '/'
+    const redirect = encodeURIComponent(home)
+    window.location.href = `/api/v0/users/sign-off?redirect=${redirect}`
+  }
+
+  const saveName = (data) => {
+    setSaving(true)
+    setSaveError(false)
+    sdk.invoke(UpdateUserDetails, {
+      firstName: data.firstName,
+      lastName: data.lastName,
+    })
+      .then(() => onCompleted?.())
+      .catch(() => setSaveError(true))
+      .finally(() => setSaving(false))
+  }
+
+  return (
+    <View
+      layout="off-center-s"
+      inset="s"
+      surface="base"
+      style={{ height: '100%', minHeight: '100%' }}
+      data-flow-stage="complete-user-name"
+    >
+      <View inset="s" roundness="l" surface="primary" data-region="content" gap="l">
+        <Form
+          id={CompleteUserNameForm.id}
+          schemaId={CompleteUserNameForm.schemaId}
+          fields={completeUserNameTemplate.fields}
+          defaultData={{}}
+          onSubmit={saveName}
+          validate={validate}
+          status={saving ? [FormStatus.Submitting] : []}
+          gap="l"
+        >
+          <View gap="s">
+            <Text as="h1" variant="heading-tertiary" text="users.completeName.title" />
+            <Text text="users.completeName.description" />
+          </View>
+          {saveError && (
+            <View gap="xs" data-flow-stage="complete-user-name-error">
+              <Text as="h2" variant="heading-quaternary">
+                {t('users.completeName.errorTitle')}
+              </Text>
+              <Text>
+                {t('users.completeName.errorBody')}
+              </Text>
+            </View>
+          )}
+          <FieldFactory />
+          <View layout="row" gap="s" justifyContent="flex-end">
+            <Button
+              {...SignOut}
+              variant="link"
+              disabled={saving}
+              onClick={signOff}
+            />
+            <Button
+              {...CompleteUserNameAction}
+              type="submit"
+              variant="cta"
+              disabled={saving}
+            />
+          </View>
+        </Form>
+      </View>
+    </View>
+  )
+}

package/src/complete-user-name.action.js

@@ -0,0 +1,7 @@
+/** Client-only — submits the signed-in display-name completion form. */
+export const metadata = {
+  id: '@ossy/users/actions/complete-user-name',
+  access: 'authenticated',
+  icon: 'check',
+  label: '@ossy/users/actions/complete-user-name.label',
+}

package/src/complete-user-name.form.js

@@ -0,0 +1,5 @@
+export const metadata = {
+  id: '@ossy/users/form/complete-user-name',
+  schemaId: '@ossy/users/schema/complete-user-name',
+  label: '@ossy/users/form/complete-user-name.label',
+}

package/src/complete-user-name.schema.js

@@ -0,0 +1,10 @@
+/** Required first/last name for signed-in users who were created email-only. */
+export default {
+  id: '@ossy/users/schema/complete-user-name',
+  name: 'Complete user name',
+  icon: 'user',
+  fields: [
+    { name: 'firstName', type: 'text', required: true },
+    { name: 'lastName', type: 'text', required: true },
+  ],
+}

package/src/en.translations.json

@@ -37,5 +37,14 @@
   "users.verifyEmailChange.profileButton": "Back to profile",
   "users.emailChanged.subject": "Your Ossy email was changed",
   "users.emailChanged.title": "Email address updated",
-  "users.emailChanged.body": "The email address on your Ossy account was changed. If you did not make this change, contact support."
+  "users.emailChanged.body": "The email address on your Ossy account was changed. If you did not make this change, contact support.",
+  "@ossy/users/actions/complete-user-name.label": "Continue",
+  "@ossy/users/actions/complete-user-name.description": "Save first and last name for the signed-in user",
+  "@ossy/users/form/complete-user-name.label": "Your name",
+  "@ossy/users/schema/complete-user-name.firstName.label": "First name",
+  "@ossy/users/schema/complete-user-name.lastName.label": "Last name",
+  "users.completeName.title": "What's your name?",
+  "users.completeName.description": "We use this on your profile and when you work with others.",
+  "users.completeName.errorTitle": "Could not save name",
+  "users.completeName.errorBody": "Something went wrong. Try again in a moment."
 }

package/src/index.js

@@ -7,7 +7,11 @@ export { metadata as ConfirmEmailChange } from './confirm-email-change.action.js
 export { metadata as EditProfileDetails } from './edit-profile-details.action.js'
 export { metadata as SaveProfileDetails } from './save-profile-details.action.js'
 export { metadata as UpdateProfileDetailsForm } from './update-profile-details.form.js'
+export { metadata as CompleteUserName } from './complete-user-name.action.js'
+export { metadata as CompleteUserNameForm } from './complete-user-name.form.js'
 export { metadata as GetCurrentUserHistory } from './get-current-user-history.action.js'
 export { metadata as JoinWorkspace } from './join-workspace.action.js'
 export { metadata as LeaveWorkspace } from './leave-workspace.action.js'
 export { VerifyEmailChange } from './VerifyEmailChange.jsx'
+export { CompleteUserName as CompleteUserNamePrompt } from './CompleteUserName.jsx'
+export { outstandingUserRequirements, userNeedsDisplayName } from './user-requirements.js'

package/src/sv.translations.json

@@ -37,5 +37,14 @@
   "users.verifyEmailChange.profileButton": "Tillbaka till profil",
   "users.emailChanged.subject": "Din Ossy-e-post har ändrats",
   "users.emailChanged.title": "E-postadress uppdaterad",
-  "users.emailChanged.body": "E-postadressen på ditt Ossy-konto har ändrats. Om du inte gjorde ändringen, kontakta support."
+  "users.emailChanged.body": "E-postadressen på ditt Ossy-konto har ändrats. Om du inte gjorde ändringen, kontakta support.",
+  "@ossy/users/actions/complete-user-name.label": "Fortsätt",
+  "@ossy/users/actions/complete-user-name.description": "Spara för- och efternamn för den inloggade användaren",
+  "@ossy/users/form/complete-user-name.label": "Ditt namn",
+  "@ossy/users/schema/complete-user-name.firstName.label": "Förnamn",
+  "@ossy/users/schema/complete-user-name.lastName.label": "Efternamn",
+  "users.completeName.title": "Vad heter du?",
+  "users.completeName.description": "Vi använder namnet på din profil och när du arbetar med andra.",
+  "users.completeName.errorTitle": "Kunde inte spara namnet",
+  "users.completeName.errorBody": "Något gick fel. Försök igen om en stund."
 }

package/src/user-requirements.js

@@ -0,0 +1,26 @@
+/**
+ * Ordered product gates for a signed-in user. Name first; later entries can
+ * include a required user-agreement version without changing the shell.
+ *
+ * @param {{ firstName?: string, lastName?: string } | null | undefined} user
+ * @returns {string[]}
+ */
+export function outstandingUserRequirements (user) {
+  if (!user) return []
+  const requirements = []
+  if (userNeedsDisplayName(user)) requirements.push('name')
+  return requirements
+}
+
+/**
+ * True when a signed-in user is missing a trimmed first or last name.
+ *
+ * @param {{ firstName?: string, lastName?: string } | null | undefined} user
+ * @returns {boolean}
+ */
+export function userNeedsDisplayName (user) {
+  if (!user) return false
+  const firstName = typeof user.firstName === 'string' ? user.firstName.trim() : ''
+  const lastName = typeof user.lastName === 'string' ? user.lastName.trim() : ''
+  return !firstName || !lastName
+}

package/src/user-requirements.spec.js

@@ -0,0 +1,29 @@
+import { describe, expect, it } from '@jest/globals'
+import { outstandingUserRequirements, userNeedsDisplayName } from './user-requirements.js'
+
+describe('userNeedsDisplayName', () => {
+  it('is false for anonymous or missing user', () => {
+    expect(userNeedsDisplayName(undefined)).toBe(false)
+    expect(userNeedsDisplayName(null)).toBe(false)
+  })
+
+  it('requires both trimmed first and last name', () => {
+    expect(userNeedsDisplayName({})).toBe(true)
+    expect(userNeedsDisplayName({ firstName: 'Ada' })).toBe(true)
+    expect(userNeedsDisplayName({ lastName: 'Lovelace' })).toBe(true)
+    expect(userNeedsDisplayName({ firstName: '  ', lastName: 'Lovelace' })).toBe(true)
+    expect(userNeedsDisplayName({ firstName: 'Ada', lastName: '  ' })).toBe(true)
+    expect(userNeedsDisplayName({ firstName: 'Ada', lastName: 'Lovelace' })).toBe(false)
+  })
+})
+
+describe('outstandingUserRequirements', () => {
+  it('returns no gates for anonymous users', () => {
+    expect(outstandingUserRequirements(undefined)).toEqual([])
+  })
+
+  it('lists name first when the display name is missing', () => {
+    expect(outstandingUserRequirements({ firstName: '', lastName: '' })).toEqual(['name'])
+    expect(outstandingUserRequirements({ firstName: 'Ada', lastName: 'Lovelace' })).toEqual([])
+  })
+})

package/src/users.integration.spec.js

@@ -221,6 +221,130 @@ describe('[authentication/actions/request-sign-in]', () => {
 
 })
 
+describe('[authentication/actions/verify-sign-in]', () => {
+
+  describe('given email + code from request-sign-in', () => {
+    it('must return a WebAuth session and set an auth cookie via POST /actions', async () => {
+      const email = casual.email
+
+      await TestUtil.AssertActionResponse({
+        actionId: '@ossy/authentication/actions/sign-up',
+        body: TestUtil.signUpBody({ email }),
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true },
+      })
+
+      await TestUtil.AssertActionResponse({
+        actionId: '@ossy/authentication/actions/request-sign-in',
+        payload: { email },
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true },
+      })
+
+      const createdEvent = await TestUtil.GetEvent({
+        type: USER_SCHEMA,
+        event: 'Created',
+        'payload.email': email,
+      })
+
+      const code = await TestUtil.getLatestVerificationCodeForSubject(createdEvent.resourceId)
+
+      const response = await TestUtil.InvokeAction({
+        actionId: '@ossy/authentication/actions/verify-sign-in',
+        payload: { email, code },
+      })
+
+      const body = await response.json()
+      const signInVerifiedEvent = await TestUtil.GetEvent({
+        type: USER_SCHEMA,
+        resourceId: createdEvent.resourceId,
+        event: 'SignInVerified',
+      })
+
+      expect(response.status).toBe(200)
+      expect(body).toMatchObject({ sub: createdEvent.resourceId, token: expect.any(String) })
+      expect(!!signInVerifiedEvent).toBe(true)
+      expect(getSetCookieHeader(response).includes(signInVerifiedEvent.payload.token)).toEqual(true)
+    })
+
+    it('must reject reuse of the same code with 401', async () => {
+      const email = casual.email
+
+      await TestUtil.AssertActionResponse({
+        actionId: '@ossy/authentication/actions/sign-up',
+        body: TestUtil.signUpBody({ email }),
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true },
+      })
+
+      await TestUtil.AssertActionResponse({
+        actionId: '@ossy/authentication/actions/request-sign-in',
+        payload: { email },
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true },
+      })
+
+      const createdEvent = await TestUtil.GetEvent({
+        type: USER_SCHEMA,
+        event: 'Created',
+        'payload.email': email,
+      })
+
+      const code = await TestUtil.getLatestVerificationCodeForSubject(createdEvent.resourceId)
+
+      const first = await TestUtil.InvokeAction({
+        actionId: '@ossy/authentication/actions/verify-sign-in',
+        payload: { email, code },
+      })
+      expect(first.status).toBe(200)
+
+      const second = await TestUtil.InvokeAction({
+        actionId: '@ossy/authentication/actions/verify-sign-in',
+        payload: { email, code },
+      })
+      expect(second.status).toBe(401)
+    })
+
+    it('must reject the magic link JWT after sign-in via code with 401', async () => {
+      const email = casual.email
+
+      await TestUtil.AssertActionResponse({
+        actionId: '@ossy/authentication/actions/sign-up',
+        body: TestUtil.signUpBody({ email }),
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true },
+      })
+
+      await TestUtil.AssertActionResponse({
+        actionId: '@ossy/authentication/actions/request-sign-in',
+        payload: { email },
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true },
+      })
+
+      const createdEvent = await TestUtil.GetEvent({
+        type: USER_SCHEMA,
+        event: 'Created',
+        'payload.email': email,
+      })
+
+      const code = await TestUtil.getLatestVerificationCodeForSubject(createdEvent.resourceId)
+      const verificationJwt = await TestUtil.getLatestVerificationJwtForSubject(createdEvent.resourceId)
+
+      const codeResponse = await TestUtil.InvokeAction({
+        actionId: '@ossy/authentication/actions/verify-sign-in',
+        payload: { email, code },
+      })
+      expect(codeResponse.status).toBe(200)
+
+      const linkResponse = await fetch(
+        `${getApiTestBaseUrl()}/users/verify-sign-in?token=${verificationJwt}`,
+        { method: 'GET' },
+      )
+      expect(linkResponse.status).toBe(401)
+    })
+  })
+
 describe('[/users/verify-sign-in][GET]', () => {
 
   describe('given a valid token created from a Created event', () => {
@@ -333,6 +457,13 @@ describe('[/users/verify-sign-in][GET]', () => {
       }))
     })
 
+    it('must return 400 when email+code are provided without a token (codes are POST-only)', () => TestUtil.AssertResponse({
+      endpoint: '/users/verify-sign-in?email=test@example.com&code=123456',
+      method: 'GET',
+      expectedResponseStatus: 400,
+      expectedResponseBody: '',
+    }))
+
   })
 
 })