@portaidentity/server 1.10.0 → 1.11.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +33 -0
- package/dist/auth/email-service.d.ts +7 -1
- package/dist/auth/email-service.d.ts.map +1 -1
- package/dist/auth/email-service.js +1 -0
- package/dist/auth/email-service.js.map +1 -1
- package/dist/auth/index.d.ts +1 -1
- package/dist/auth/index.d.ts.map +1 -1
- package/dist/auth/index.js +1 -1
- package/dist/auth/index.js.map +1 -1
- package/dist/auth/token-repository.d.ts +83 -32
- package/dist/auth/token-repository.d.ts.map +1 -1
- package/dist/auth/token-repository.js +138 -47
- package/dist/auth/token-repository.js.map +1 -1
- package/dist/cli/commands/init.d.ts.map +1 -1
- package/dist/cli/commands/init.js +10 -6
- package/dist/cli/commands/init.js.map +1 -1
- package/dist/index.js +2 -1
- package/dist/index.js.map +1 -1
- package/dist/organizations/slugs.d.ts.map +1 -1
- package/dist/organizations/slugs.js +1 -0
- package/dist/organizations/slugs.js.map +1 -1
- package/dist/routes/invitation.d.ts.map +1 -1
- package/dist/routes/invitation.js +95 -68
- package/dist/routes/invitation.js.map +1 -1
- package/dist/routes/users.d.ts.map +1 -1
- package/dist/routes/users.js +39 -24
- package/dist/routes/users.js.map +1 -1
- package/dist/users/gdpr.d.ts +2 -2
- package/dist/users/gdpr.js +6 -6
- package/dist/users/gdpr.js.map +1 -1
- package/dist/users/index.d.ts +2 -0
- package/dist/users/index.d.ts.map +1 -1
- package/dist/users/index.js +2 -0
- package/dist/users/index.js.map +1 -1
- package/dist/users/invitation-service.d.ts +38 -0
- package/dist/users/invitation-service.d.ts.map +1 -0
- package/dist/users/invitation-service.js +97 -0
- package/dist/users/invitation-service.js.map +1 -0
- package/dist/users/repository.d.ts +29 -0
- package/dist/users/repository.d.ts.map +1 -1
- package/dist/users/repository.js +41 -12
- package/dist/users/repository.js.map +1 -1
- package/dist/users/service.d.ts.map +1 -1
- package/dist/users/service.js +1 -0
- package/dist/users/service.js.map +1 -1
- package/dist/version.d.ts +9 -0
- package/dist/version.d.ts.map +1 -0
- package/dist/version.js +9 -0
- package/dist/version.js.map +1 -0
- package/locales/default/en/invitation.json +4 -0
- package/migrations/033_invitation_deferred_user_creation.sql +60 -0
- package/package.json +2 -2
- package/templates/default/pages/confirm-invite.hbs +7 -0
|
@@ -263,13 +263,15 @@ export const initCommand = {
|
|
|
263
263
|
console.log(` ✅ Role: ${role.name} (${role.slug}) — ${rolePermissionIds.length} permissions`);
|
|
264
264
|
}
|
|
265
265
|
// -----------------------------------------------------------------
|
|
266
|
-
// Step 7: Create the admin
|
|
266
|
+
// Step 7: Create the shared admin native client (public, Auth Code + PKCE)
|
|
267
267
|
// -----------------------------------------------------------------
|
|
268
|
-
// The client is public (no secret) because
|
|
269
|
-
// store secrets. PKCE provides security for the authorization code
|
|
270
|
-
// exchange. The redirect URIs use loopback addresses — per RFC 8252
|
|
271
|
-
//
|
|
272
|
-
//
|
|
268
|
+
// The client is public (no secret) because loopback applications cannot
|
|
269
|
+
// safely store secrets. PKCE provides security for the authorization code
|
|
270
|
+
// exchange. The redirect URIs use loopback addresses — per RFC 8252 §7.3,
|
|
271
|
+
// node-oidc-provider allows flexible port matching for native app clients
|
|
272
|
+
// using loopback redirect URIs. Both loopback consumers share this client:
|
|
273
|
+
// the `porta` CLI (temporary /callback server) and the Porta Console
|
|
274
|
+
// (fixed /api/oidc/callback route).
|
|
273
275
|
const { client: adminClient } = await createClient({
|
|
274
276
|
organizationId: superAdminOrg.id,
|
|
275
277
|
applicationId: adminApp.id,
|
|
@@ -280,6 +282,8 @@ export const initCommand = {
|
|
|
280
282
|
'http://127.0.0.1/callback',
|
|
281
283
|
'http://localhost/callback',
|
|
282
284
|
'http://127.0.0.1/auth/callback',
|
|
285
|
+
'http://127.0.0.1/api/oidc/callback',
|
|
286
|
+
'http://localhost/api/oidc/callback',
|
|
283
287
|
],
|
|
284
288
|
postLogoutRedirectUris: ['http://127.0.0.1'],
|
|
285
289
|
grantTypes: ['authorization_code', 'refresh_token'],
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/cli/commands/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,GAChB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAc9E,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CAAC,IAAY;IAC9C,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,iBAAiB,MAAM,IAAI,QAAQ,YAAY,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,GAAW,EAAE,MAAc;IAC3C,IAAI,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,uBAAuB,CAAC,IAAiB;IAMtD,2CAA2C;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC;IAE7E,IAAI,QAAgB,CAAC;IACrB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,mEAAmE;QACnE,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,+CAA+C;QAC/C,QAAQ,GAAG,MAAM,cAAc,CAAC,YAAY,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,oBAAoB,CAAC,CAAC;QAC7D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,OAAe,EACf,OAAe,EACf,OAAe,EACf,WAAmB,EACnB,UAAkB,EAClB,QAAgB,EAChB,SAAiB,EACjB,eAAuB;IAEvB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,+BAA+B;IAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,CAAC,GAAG,OAAO,KAAK,OAAO,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,CAAC,gBAAgB,OAAO,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,CAAC,GAAG,QAAQ,KAAK,eAAe,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACjG,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,CAAC,GAAG,SAAS,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;AAClF,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAA8C;IACpE,OAAO,EAAE,MAAM;IACf,QAAQ,EAAE,2EAA2E;IACrF,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,OAAO,EAAE;QACf,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,0BAA0B;KACrC,CAAC;SACD,MAAM,CAAC,YAAY,EAAE;QACpB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,uBAAuB;KAClC,CAAC;SACD,MAAM,CAAC,aAAa,EAAE;QACrB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,sBAAsB;KACjC,CAAC;SACD,MAAM,CAAC,UAAU,EAAE;QAClB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,8DAA8D;KACzE,CAAC;IAEN,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,MAAM,iBAAiB,CAAC,KAAK,IAAI,EAAE;YACjC,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;gBACnC,gEAAgE;gBAChE,6DAA6D;gBAC7D,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAC;gBACzF,MAAM,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,GAC/C,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;gBAC9C,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;gBAChE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,GACnD,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;gBACvC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;gBACrE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;gBACjF,MAAM,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,GAClD,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;gBACnD,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;gBACxE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;gBAE1D,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;gBAEvC,oEAAoE;gBACpE,oEAAoE;gBACpE,oEAAoE;gBACpE,MAAM,aAAa,GAAG,MAAM,0BAA0B,EAAE,CAAC;gBACzD,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;gBACvF,CAAC;gBAED,oEAAoE;gBACpE,uDAAuD;gBACvD,oEAAoE;gBACpE,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;gBAC9D,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAC/B,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;gBAC/E,CAAC;gBACD,IAAI,WAAW,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBAC9B,kEAAkE;oBAClE,+DAA+D;oBAC/D,0CAA0C;oBAC1C,MAAM,SAAS,GAAG,MAAM,OAAO,CAC7B,mGAAmG,EACnG,KAAK,CACN,CAAC;oBACF,IAAI,SAAS,EAAE,CAAC;wBACd,IAAI,CAAC,4CAA4C,CAAC,CAAC;oBACrD,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,iBAAiB,CAAC,CAAC;oBAC1B,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,oEAAoE;gBACpE,oDAAoD;gBACpD,oEAAoE;gBACpE,MAAM,iBAAiB,EAAE,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;gBAEzC,oEAAoE;gBACpE,uCAAuC;gBACvC,oEAAoE;gBACpE,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;oBACvC,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,aAAa;oBACnB,WAAW,EACT,iFAAiF;iBACpF,CAAC,CAAC;gBACH,OAAO,CAAC,GAAG,CAAC,4BAA4B,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;gBAE5E,oEAAoE;gBACpE,qEAAqE;gBACrE,oEAAoE;gBACpE,0DAA0D;gBAC1D,uEAAuE;gBACvE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,uBAAuB;gBAC1E,KAAK,MAAM,QAAQ,IAAI,qBAAqB,EAAE,CAAC;oBAC7C,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;wBACxC,aAAa,EAAE,QAAQ,CAAC,EAAE;wBAC1B,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,mBAAmB,CAAC,QAAQ,CAAC;wBACnC,WAAW,EAAE,0BAA0B,CAAC,QAAQ,CAAC;qBAClD,CAAC,CAAC;oBACH,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;gBAC/C,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,OAAO,eAAe,CAAC,IAAI,+BAA+B,CAAC,CAAC;gBAExE,oEAAoE;gBACpE,0DAA0D;gBAC1D,oEAAoE;gBACpE,6DAA6D;gBAC7D,qEAAqE;gBACrE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,iBAAiB;gBACjE,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;oBACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC;wBAC5B,aAAa,EAAE,QAAQ,CAAC,EAAE;wBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,WAAW,EAAE,OAAO,CAAC,WAAW;qBACjC,CAAC,CAAC;oBACH,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;oBAExC,wDAAwD;oBACxD,MAAM,iBAAiB,GAAG,OAAO,CAAC,WAAW;yBAC1C,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;yBAChD,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;oBAElD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACjC,MAAM,uBAAuB,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;oBACzE,CAAC;oBAED,OAAO,CAAC,GAAG,CACT,aAAa,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,OAAO,iBAAiB,CAAC,MAAM,cAAc,CAClF,CAAC;gBACJ,CAAC;gBAED,oEAAoE;gBACpE,
|
|
1
|
+
{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/cli/commands/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,GAChB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAc9E,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CAAC,IAAY;IAC9C,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,iBAAiB,MAAM,IAAI,QAAQ,YAAY,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,GAAW,EAAE,MAAc;IAC3C,IAAI,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,uBAAuB,CAAC,IAAiB;IAMtD,2CAA2C;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC;IAE7E,IAAI,QAAgB,CAAC;IACrB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,mEAAmE;QACnE,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,+CAA+C;QAC/C,QAAQ,GAAG,MAAM,cAAc,CAAC,YAAY,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,oBAAoB,CAAC,CAAC;QAC7D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,OAAe,EACf,OAAe,EACf,OAAe,EACf,WAAmB,EACnB,UAAkB,EAClB,QAAgB,EAChB,SAAiB,EACjB,eAAuB;IAEvB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,+BAA+B;IAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,CAAC,GAAG,OAAO,KAAK,OAAO,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,CAAC,gBAAgB,OAAO,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,CAAC,GAAG,QAAQ,KAAK,eAAe,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACjG,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,CAAC,GAAG,SAAS,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;AAClF,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAA8C;IACpE,OAAO,EAAE,MAAM;IACf,QAAQ,EAAE,2EAA2E;IACrF,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,OAAO,EAAE;QACf,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,0BAA0B;KACrC,CAAC;SACD,MAAM,CAAC,YAAY,EAAE;QACpB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,uBAAuB;KAClC,CAAC;SACD,MAAM,CAAC,aAAa,EAAE;QACrB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,sBAAsB;KACjC,CAAC;SACD,MAAM,CAAC,UAAU,EAAE;QAClB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,8DAA8D;KACzE,CAAC;IAEN,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,MAAM,iBAAiB,CAAC,KAAK,IAAI,EAAE;YACjC,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;gBACnC,gEAAgE;gBAChE,6DAA6D;gBAC7D,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAC;gBACzF,MAAM,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,GAC/C,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;gBAC9C,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;gBAChE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,GACnD,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;gBACvC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;gBACrE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;gBACjF,MAAM,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,GAClD,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;gBACnD,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;gBACxE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;gBAE1D,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;gBAEvC,oEAAoE;gBACpE,oEAAoE;gBACpE,oEAAoE;gBACpE,MAAM,aAAa,GAAG,MAAM,0BAA0B,EAAE,CAAC;gBACzD,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;gBACvF,CAAC;gBAED,oEAAoE;gBACpE,uDAAuD;gBACvD,oEAAoE;gBACpE,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;gBAC9D,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAC/B,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;gBAC/E,CAAC;gBACD,IAAI,WAAW,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBAC9B,kEAAkE;oBAClE,+DAA+D;oBAC/D,0CAA0C;oBAC1C,MAAM,SAAS,GAAG,MAAM,OAAO,CAC7B,mGAAmG,EACnG,KAAK,CACN,CAAC;oBACF,IAAI,SAAS,EAAE,CAAC;wBACd,IAAI,CAAC,4CAA4C,CAAC,CAAC;oBACrD,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,iBAAiB,CAAC,CAAC;oBAC1B,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,oEAAoE;gBACpE,oDAAoD;gBACpD,oEAAoE;gBACpE,MAAM,iBAAiB,EAAE,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;gBAEzC,oEAAoE;gBACpE,uCAAuC;gBACvC,oEAAoE;gBACpE,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;oBACvC,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,aAAa;oBACnB,WAAW,EACT,iFAAiF;iBACpF,CAAC,CAAC;gBACH,OAAO,CAAC,GAAG,CAAC,4BAA4B,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;gBAE5E,oEAAoE;gBACpE,qEAAqE;gBACrE,oEAAoE;gBACpE,0DAA0D;gBAC1D,uEAAuE;gBACvE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,uBAAuB;gBAC1E,KAAK,MAAM,QAAQ,IAAI,qBAAqB,EAAE,CAAC;oBAC7C,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;wBACxC,aAAa,EAAE,QAAQ,CAAC,EAAE;wBAC1B,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,mBAAmB,CAAC,QAAQ,CAAC;wBACnC,WAAW,EAAE,0BAA0B,CAAC,QAAQ,CAAC;qBAClD,CAAC,CAAC;oBACH,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;gBAC/C,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,OAAO,eAAe,CAAC,IAAI,+BAA+B,CAAC,CAAC;gBAExE,oEAAoE;gBACpE,0DAA0D;gBAC1D,oEAAoE;gBACpE,6DAA6D;gBAC7D,qEAAqE;gBACrE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,iBAAiB;gBACjE,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;oBACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC;wBAC5B,aAAa,EAAE,QAAQ,CAAC,EAAE;wBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,WAAW,EAAE,OAAO,CAAC,WAAW;qBACjC,CAAC,CAAC;oBACH,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;oBAExC,wDAAwD;oBACxD,MAAM,iBAAiB,GAAG,OAAO,CAAC,WAAW;yBAC1C,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;yBAChD,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;oBAElD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACjC,MAAM,uBAAuB,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;oBACzE,CAAC;oBAED,OAAO,CAAC,GAAG,CACT,aAAa,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,OAAO,iBAAiB,CAAC,MAAM,cAAc,CAClF,CAAC;gBACJ,CAAC;gBAED,oEAAoE;gBACpE,2EAA2E;gBAC3E,oEAAoE;gBACpE,wEAAwE;gBACxE,0EAA0E;gBAC1E,0EAA0E;gBAC1E,0EAA0E;gBAC1E,2EAA2E;gBAC3E,qEAAqE;gBACrE,oCAAoC;gBACpC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,YAAY,CAAC;oBACjD,cAAc,EAAE,aAAa,CAAC,EAAE;oBAChC,aAAa,EAAE,QAAQ,CAAC,EAAE;oBAC1B,UAAU,EAAE,iBAAiB;oBAC7B,UAAU,EAAE,QAAQ;oBACpB,eAAe,EAAE,QAAQ;oBACzB,YAAY,EAAE;wBACZ,2BAA2B;wBAC3B,2BAA2B;wBAC3B,gCAAgC;wBAChC,oCAAoC;wBACpC,oCAAoC;qBACrC;oBACD,sBAAsB,EAAE,CAAC,kBAAkB,CAAC;oBAC5C,UAAU,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;oBACnD,KAAK,EAAE,qCAAqC;oBAC5C,WAAW,EAAE,IAAI;iBAClB,CAAC,CAAC;gBACH,OAAO,CAAC,GAAG,CAAC,uBAAuB,WAAW,CAAC,UAAU,KAAK,WAAW,CAAC,QAAQ,GAAG,CAAC,CAAC;gBAEvF,oEAAoE;gBACpE,iEAAiE;gBACjE,oEAAoE;gBACpE,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC;gBAExD,oEAAoE;gBACpE,gEAAgE;gBAChE,oEAAoE;gBACpE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC;oBACjC,cAAc,EAAE,aAAa,CAAC,EAAE;oBAChC,KAAK,EAAE,WAAW,CAAC,KAAK;oBACxB,SAAS,EAAE,WAAW,CAAC,SAAS;oBAChC,UAAU,EAAE,WAAW,CAAC,UAAU;oBAClC,QAAQ,EAAE,WAAW,CAAC,QAAQ;iBAC/B,CAAC,CAAC;gBACH,OAAO,CAAC,GAAG,CAAC,qBAAqB,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;gBAEpD,oEAAoE;gBACpE,iDAAiD;gBACjD,oEAAoE;gBACpE,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAClC,MAAM,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBACnC,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBAElC,oEAAoE;gBACpE,kEAAkE;gBAClE,oEAAoE;gBACpE,MAAM,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;gBAE5C,oEAAoE;gBACpE,mDAAmD;gBACnD,oEAAoE;gBACpE,MAAM,gBAAgB,GAAG,YAAY,CAAC,GAAG,CAAC,sBAAsB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBACnF,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBACvE,CAAC;gBACD,MAAM,iBAAiB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC1F,OAAO,CAAC,GAAG,CAAC,aAAa,sBAAsB,CAAC,WAAW,CAAC,IAAI,oBAAoB,CAAC,CAAC;gBAEtF,oEAAoE;gBACpE,sDAAsD;gBACtD,oEAAoE;gBACpE,6DAA6D;gBAC7D,iEAAiE;gBACjE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,KAAK,CACd;;0FAEgF,EAChF;oBACE,uBAAuB;oBACvB,SAAS,CAAC,EAAE;oBACZ,2DAA2D;iBAC5D,CACF,CAAC;gBACF,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;gBAE/D,oEAAoE;gBACpE,qCAAqC;gBACrC,oEAAoE;gBACpE,eAAe,CACb,aAAa,CAAC,IAAI,EAClB,aAAa,CAAC,IAAI,EAClB,QAAQ,CAAC,IAAI,EACb,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,KAAK,EACjB,sBAAsB,CAAC,WAAW,CAAC,IAAI,EACvC,YAAY,CAAC,IAAI,EACjB,eAAe,CAAC,IAAI,CACrB,CAAC;gBAEF,OAAO,CAAC,gCAAgC,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;CACF,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -13,6 +13,7 @@
|
|
|
13
13
|
import { createApp } from './server.js';
|
|
14
14
|
import { config } from './config/index.js';
|
|
15
15
|
import { logger } from './lib/logger.js';
|
|
16
|
+
import { SERVER_VERSION } from './version.js';
|
|
16
17
|
import { connectDatabase, disconnectDatabase } from './lib/database.js';
|
|
17
18
|
import { connectRedis, disconnectRedis } from './lib/redis.js';
|
|
18
19
|
import { SigningKeyCryptoError } from './lib/signing-key-crypto.js';
|
|
@@ -49,7 +50,7 @@ async function main() {
|
|
|
49
50
|
const app = createApp(oidcProvider);
|
|
50
51
|
const server = app.listen(config.port, config.host, () => {
|
|
51
52
|
startAccountRecoveryWorker(oidcProvider);
|
|
52
|
-
logger.info({ port: config.port, host: config.host }, 'Server started');
|
|
53
|
+
logger.info({ version: SERVER_VERSION, port: config.port, host: config.host }, 'Server started');
|
|
53
54
|
});
|
|
54
55
|
attachTransportDecisionHandler(server);
|
|
55
56
|
// Step 7: Graceful shutdown — close connections in reverse order
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAElF,KAAK,UAAU,IAAI;IACjB,6CAA6C;IAC7C,MAAM,eAAe,EAAE,CAAC;IACxB,MAAM,YAAY,EAAE,CAAC;IAErB,uEAAuE;IACvE,qDAAqD;IACrD,MAAM,QAAQ,EAAE,CAAC;IACjB,4BAA4B,EAAE,CAAC;IAC/B,MAAM,kBAAkB,EAAE,CAAC;IAE3B,8FAA8F;IAC9F,sEAAsE;IACtE,MAAM,2BAA2B,EAAE,CAAC;IAEpC,gEAAgE;IAChE,uEAAuE;IACvE,2CAA2C;IAC3C,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAEvC,oEAAoE;IACpE,+DAA+D;IAC/D,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAEtC,kEAAkE;IAClE,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAE7D,sEAAsE;IACtE,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACvD,0BAA0B,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAElF,KAAK,UAAU,IAAI;IACjB,6CAA6C;IAC7C,MAAM,eAAe,EAAE,CAAC;IACxB,MAAM,YAAY,EAAE,CAAC;IAErB,uEAAuE;IACvE,qDAAqD;IACrD,MAAM,QAAQ,EAAE,CAAC;IACjB,4BAA4B,EAAE,CAAC;IAC/B,MAAM,kBAAkB,EAAE,CAAC;IAE3B,8FAA8F;IAC9F,sEAAsE;IACtE,MAAM,2BAA2B,EAAE,CAAC;IAEpC,gEAAgE;IAChE,uEAAuE;IACvE,2CAA2C;IAC3C,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAEvC,oEAAoE;IACpE,+DAA+D;IAC/D,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAEtC,kEAAkE;IAClE,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAE7D,sEAAsE;IACtE,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACvD,0BAA0B,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CACT,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EACjE,gBAAgB,CACjB,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAEvC,iEAAiE;IACjE,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;QACxC,IAAI,eAAe;YAAE,OAAO;QAC5B,eAAe,GAAG,IAAI,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;YACjC,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,UAAU,CAAC,KAAK,EAAE,CAAC;QAEnB,IAAI,CAAC;YACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC/D,CAAC,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,yBAAyB,EAAE,CAAC;YACxD,IAAI,CAAC,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACtF,MAAM,kBAAkB,EAAE,CAAC;YAC3B,MAAM,eAAe,EAAE,CAAC;YACxB,YAAY,CAAC,UAAU,CAAC,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,0BAA0B,CAAC,CAAC;YAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"slugs.d.ts","sourceRoot":"","sources":["../../src/organizations/slugs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,
|
|
1
|
+
{"version":3,"file":"slugs.d.ts","sourceRoot":"","sources":["../../src/organizations/slugs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CA+B7C,CAAC;AAiBH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBjD;AAMD,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CA2B/D"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"slugs.js","sourceRoot":"","sources":["../../src/organizations/slugs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IACzD,gBAAgB;IAChB,OAAO;IACP,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,aAAa;IAEb,qBAAqB;IACrB,OAAO;IACP,QAAQ;IACR,UAAU;IACV,UAAU;IACV,QAAQ;IACR,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IAEN,oBAAoB;IACpB,QAAQ;IACR,WAAW;IACX,UAAU;IACV,SAAS;
|
|
1
|
+
{"version":3,"file":"slugs.js","sourceRoot":"","sources":["../../src/organizations/slugs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IACzD,gBAAgB;IAChB,OAAO;IACP,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,aAAa;IAEb,qBAAqB;IACrB,OAAO;IACP,QAAQ;IACR,UAAU;IACV,UAAU;IACV,QAAQ;IACR,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IAEN,oBAAoB;IACpB,QAAQ;IACR,WAAW;IACX,UAAU;IACV,SAAS;IACT,KAAK,EAAE,iCAAiC;IAExC,mBAAmB;IACnB,aAAa;IACb,YAAY;IACZ,aAAa;CACd,CAAC,CAAC;AAEH,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,GAAG,mCAAmC,CAAC;AAEvD,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI;SACd,WAAW,EAAE;QACd,qEAAqE;SACpE,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;QAC5B,oDAAoD;SACnD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;QACpB,sCAAsC;SACrC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAE3B,iFAAiF;IACjF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC/C,CAAC;AAYD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,uBAAuB;IACvB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACzE,CAAC;IAED,uBAAuB;IACvB,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;IAC1E,CAAC;IAED,8EAA8E;IAC9E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EACH,kEAAkE;gBAClE,uCAAuC;SAC1C,CAAC;IACJ,CAAC;IAED,uBAAuB;IACvB,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,IAAI,kCAAkC,EAAE,CAAC;IACpF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"invitation.d.ts","sourceRoot":"","sources":["../../src/routes/invitation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"invitation.d.ts","sourceRoot":"","sources":["../../src/routes/invitation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAiEjC;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAmB/C"}
|
|
@@ -23,12 +23,13 @@ import Router from '@koa/router';
|
|
|
23
23
|
import { tenantResolver } from '../middleware/tenant-resolver.js';
|
|
24
24
|
import { generateCsrfToken, verifyCsrfToken, setCsrfCookie, getCsrfFromCookie, } from '../auth/csrf.js';
|
|
25
25
|
import { hashToken } from '../auth/tokens.js';
|
|
26
|
-
import { findValidInvitationToken
|
|
26
|
+
import { findValidInvitationToken } from '../auth/token-repository.js';
|
|
27
27
|
import { getPool } from '../lib/database.js';
|
|
28
28
|
import { resolveLocale, getTranslationFunction } from '../auth/i18n.js';
|
|
29
29
|
import { renderPage } from '../auth/template-engine.js';
|
|
30
30
|
import { resolveEffectiveBranding } from '../auth/effective-branding.js';
|
|
31
|
-
import {
|
|
31
|
+
import { getUserByEmail } from '../users/service.js';
|
|
32
|
+
import { acceptInvitation } from '../users/invitation-service.js';
|
|
32
33
|
import { validatePassword } from '../users/password.js';
|
|
33
34
|
import { writeAuditLog } from '../lib/audit-log.js';
|
|
34
35
|
import { logger } from '../lib/logger.js';
|
|
@@ -80,10 +81,45 @@ export function createInvitationRouter() {
|
|
|
80
81
|
// Route handlers
|
|
81
82
|
// ---------------------------------------------------------------------------
|
|
82
83
|
/**
|
|
83
|
-
*
|
|
84
|
+
* Render the generic expired page and record the rejection.
|
|
84
85
|
*
|
|
85
|
-
*
|
|
86
|
-
*
|
|
86
|
+
* Every rejection cause — unknown, expired, used, foreign-tenant, or email-conflict — uses this
|
|
87
|
+
* identical page and audit so an attacker cannot distinguish them.
|
|
88
|
+
*
|
|
89
|
+
* @param ctx - Koa context
|
|
90
|
+
* @param org - Organization for branding
|
|
91
|
+
* @param locale - Resolved locale
|
|
92
|
+
* @param t - Translation function
|
|
93
|
+
*/
|
|
94
|
+
async function renderExpiredInvite(ctx, org, locale, t) {
|
|
95
|
+
writeAuditLog({
|
|
96
|
+
organizationId: org.id,
|
|
97
|
+
eventType: 'user.invite.failed',
|
|
98
|
+
eventCategory: 'security',
|
|
99
|
+
description: 'Invitation acceptance failed: invalid or expired token',
|
|
100
|
+
ipAddress: ctx.ip,
|
|
101
|
+
});
|
|
102
|
+
const csrfToken = generateCsrfToken();
|
|
103
|
+
setCsrfCookie(ctx, csrfToken);
|
|
104
|
+
const context = {
|
|
105
|
+
branding: await resolveEffectiveBranding(org),
|
|
106
|
+
locale,
|
|
107
|
+
t,
|
|
108
|
+
csrfToken,
|
|
109
|
+
orgSlug: org.slug,
|
|
110
|
+
};
|
|
111
|
+
await renderAndRespond(ctx, 'invite-expired', context, 400);
|
|
112
|
+
}
|
|
113
|
+
/** Read the inviter display name from an invitation's details, when present. */
|
|
114
|
+
function readInviterName(record) {
|
|
115
|
+
const name = record.details?.inviterName;
|
|
116
|
+
return typeof name === 'string' ? name : undefined;
|
|
117
|
+
}
|
|
118
|
+
/**
|
|
119
|
+
* Show the invitation confirmation page or password form.
|
|
120
|
+
*
|
|
121
|
+
* The email link is non-mutating: it validates the invitation and renders a confirmation page. The
|
|
122
|
+
* password form is shown only when `?step=password` is present. No token is consumed on GET.
|
|
87
123
|
*
|
|
88
124
|
* @param ctx - Koa context with organization state
|
|
89
125
|
*/
|
|
@@ -92,42 +128,42 @@ async function showAcceptInvite(ctx) {
|
|
|
92
128
|
const tokenPlaintext = ctx.params.token;
|
|
93
129
|
const locale = await resolveLocale(undefined, ctx.get('Accept-Language') || undefined, org.defaultLocale);
|
|
94
130
|
const t = getTranslationFunction(locale, org.slug);
|
|
95
|
-
// Validate the invitation token
|
|
131
|
+
// Validate the invitation token; a foreign tenant resolves nothing.
|
|
96
132
|
const tokenHash = hashToken(tokenPlaintext);
|
|
97
133
|
const tokenRecord = await findValidInvitationToken(tokenHash, org.id);
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
const csrfToken = generateCsrfToken();
|
|
108
|
-
setCsrfCookie(ctx, csrfToken);
|
|
134
|
+
// An address that already has an account is rejected with the same generic page.
|
|
135
|
+
if (!tokenRecord || (await getUserByEmail(org.id, tokenRecord.email))) {
|
|
136
|
+
await renderExpiredInvite(ctx, org, locale, t);
|
|
137
|
+
return;
|
|
138
|
+
}
|
|
139
|
+
const branding = await resolveEffectiveBranding(org);
|
|
140
|
+
const csrfToken = generateCsrfToken();
|
|
141
|
+
setCsrfCookie(ctx, csrfToken);
|
|
142
|
+
if (ctx.query.step === 'password') {
|
|
109
143
|
const context = {
|
|
110
|
-
branding
|
|
144
|
+
branding,
|
|
111
145
|
locale,
|
|
112
146
|
t,
|
|
113
147
|
csrfToken,
|
|
114
148
|
orgSlug: org.slug,
|
|
149
|
+
orgName: branding.companyName,
|
|
150
|
+
token: tokenPlaintext,
|
|
151
|
+
email: tokenRecord.email,
|
|
115
152
|
};
|
|
116
|
-
await renderAndRespond(ctx, 'invite
|
|
153
|
+
await renderAndRespond(ctx, 'accept-invite', context);
|
|
117
154
|
return;
|
|
118
155
|
}
|
|
119
|
-
// Token is valid — show the accept invite form
|
|
120
|
-
const csrfToken = generateCsrfToken();
|
|
121
|
-
setCsrfCookie(ctx, csrfToken);
|
|
122
156
|
const context = {
|
|
123
|
-
branding
|
|
157
|
+
branding,
|
|
124
158
|
locale,
|
|
125
159
|
t,
|
|
126
160
|
csrfToken,
|
|
127
161
|
orgSlug: org.slug,
|
|
162
|
+
orgName: branding.companyName,
|
|
128
163
|
token: tokenPlaintext,
|
|
164
|
+
inviterName: readInviterName(tokenRecord),
|
|
129
165
|
};
|
|
130
|
-
await renderAndRespond(ctx, '
|
|
166
|
+
await renderAndRespond(ctx, 'confirm-invite', context);
|
|
131
167
|
}
|
|
132
168
|
/**
|
|
133
169
|
* Process an invitation acceptance form submission.
|
|
@@ -135,11 +171,10 @@ async function showAcceptInvite(ctx) {
|
|
|
135
171
|
* 1. Verify CSRF token
|
|
136
172
|
* 2. Re-validate the invitation token
|
|
137
173
|
* 3. Validate password and confirm match
|
|
138
|
-
* 4.
|
|
139
|
-
* 5.
|
|
140
|
-
* 6.
|
|
141
|
-
* 7.
|
|
142
|
-
* 8. Render success page
|
|
174
|
+
* 4. Create the account and consume the invitation via `acceptInvitation`
|
|
175
|
+
* 5. Apply pre-assigned roles and claims (best-effort)
|
|
176
|
+
* 6. Audit log the acceptance
|
|
177
|
+
* 7. Render success page
|
|
143
178
|
*
|
|
144
179
|
* @param ctx - Koa context with organization state
|
|
145
180
|
*/
|
|
@@ -156,57 +191,44 @@ async function processAcceptInvite(ctx) {
|
|
|
156
191
|
// Step 1: Verify CSRF token (cookie vs form field)
|
|
157
192
|
if (!verifyCsrfToken(storedCsrf, submittedCsrf)) {
|
|
158
193
|
logger.warn('CSRF token mismatch on accept-invite');
|
|
159
|
-
await renderInviteFormWithError(ctx, org, locale, t, tokenPlaintext, t('errors.csrf_invalid'), 403);
|
|
194
|
+
await renderInviteFormWithError(ctx, org, locale, t, tokenPlaintext, t('errors.csrf_invalid'), undefined, 403);
|
|
160
195
|
return;
|
|
161
196
|
}
|
|
162
197
|
// Step 2: Re-validate the invitation token
|
|
163
198
|
const tokenHash = hashToken(tokenPlaintext);
|
|
164
199
|
const tokenRecord = await findValidInvitationToken(tokenHash, org.id);
|
|
165
200
|
if (!tokenRecord) {
|
|
166
|
-
|
|
167
|
-
writeAuditLog({
|
|
168
|
-
organizationId: org.id,
|
|
169
|
-
eventType: 'user.invite.failed',
|
|
170
|
-
eventCategory: 'security',
|
|
171
|
-
description: 'Invitation acceptance failed: invalid or expired token',
|
|
172
|
-
ipAddress: ctx.ip,
|
|
173
|
-
});
|
|
174
|
-
const csrfToken = generateCsrfToken();
|
|
175
|
-
setCsrfCookie(ctx, csrfToken);
|
|
176
|
-
const context = {
|
|
177
|
-
branding: await resolveEffectiveBranding(org),
|
|
178
|
-
locale,
|
|
179
|
-
t,
|
|
180
|
-
csrfToken,
|
|
181
|
-
orgSlug: org.slug,
|
|
182
|
-
};
|
|
183
|
-
await renderAndRespond(ctx, 'invite-expired', context, 400);
|
|
201
|
+
await renderExpiredInvite(ctx, org, locale, t);
|
|
184
202
|
return;
|
|
185
203
|
}
|
|
186
204
|
// Step 3: Validate passwords match
|
|
187
205
|
if (password !== confirmPassword) {
|
|
188
|
-
await renderInviteFormWithError(ctx, org, locale, t, tokenPlaintext, t('invitation.error_password_mismatch'));
|
|
206
|
+
await renderInviteFormWithError(ctx, org, locale, t, tokenPlaintext, t('invitation.error_password_mismatch'), tokenRecord.email);
|
|
189
207
|
return;
|
|
190
208
|
}
|
|
191
|
-
// Step
|
|
209
|
+
// Step 3b: Validate password strength (NIST SP 800-63B)
|
|
192
210
|
const validation = validatePassword(password);
|
|
193
211
|
if (!validation.isValid) {
|
|
194
|
-
await renderInviteFormWithError(ctx, org, locale, t, tokenPlaintext, validation.error);
|
|
212
|
+
await renderInviteFormWithError(ctx, org, locale, t, tokenPlaintext, validation.error, tokenRecord.email);
|
|
195
213
|
return;
|
|
196
214
|
}
|
|
197
215
|
try {
|
|
198
|
-
// Step
|
|
199
|
-
await
|
|
200
|
-
|
|
201
|
-
|
|
202
|
-
|
|
203
|
-
|
|
204
|
-
|
|
205
|
-
|
|
206
|
-
|
|
216
|
+
// Step 4: Create the account and consume the invitation atomically
|
|
217
|
+
const accepted = await acceptInvitation({
|
|
218
|
+
tokenHash,
|
|
219
|
+
organizationId: org.id,
|
|
220
|
+
password,
|
|
221
|
+
});
|
|
222
|
+
if (!accepted) {
|
|
223
|
+
await renderExpiredInvite(ctx, org, locale, t);
|
|
224
|
+
return;
|
|
225
|
+
}
|
|
226
|
+
// Step 5: Apply pre-assigned roles and claims from invitation details
|
|
227
|
+
await applyPreAssignments(tokenRecord, org.id, accepted.userId);
|
|
228
|
+
// Step 6: Audit log
|
|
207
229
|
writeAuditLog({
|
|
208
230
|
organizationId: org.id,
|
|
209
|
-
userId:
|
|
231
|
+
userId: accepted.userId,
|
|
210
232
|
eventType: 'user.invite.accepted',
|
|
211
233
|
eventCategory: 'authentication',
|
|
212
234
|
description: 'Invitation accepted — account set up successfully',
|
|
@@ -216,11 +238,12 @@ async function processAcceptInvite(ctx) {
|
|
|
216
238
|
preAssignedClaims: tokenRecord.details?.claims?.length ?? 0,
|
|
217
239
|
},
|
|
218
240
|
});
|
|
219
|
-
// Step
|
|
241
|
+
// Step 7: Render success page
|
|
242
|
+
const branding = await resolveEffectiveBranding(org);
|
|
220
243
|
const csrfToken = generateCsrfToken();
|
|
221
244
|
setCsrfCookie(ctx, csrfToken);
|
|
222
245
|
const context = {
|
|
223
|
-
branding
|
|
246
|
+
branding,
|
|
224
247
|
locale,
|
|
225
248
|
t,
|
|
226
249
|
csrfToken,
|
|
@@ -231,7 +254,7 @@ async function processAcceptInvite(ctx) {
|
|
|
231
254
|
}
|
|
232
255
|
catch {
|
|
233
256
|
logger.error({ event: 'invitation-acceptance-failed' }, 'Invitation acceptance processing failed');
|
|
234
|
-
await renderInviteFormWithError(ctx, org, locale, t, tokenPlaintext, t('errors.generic'));
|
|
257
|
+
await renderInviteFormWithError(ctx, org, locale, t, tokenPlaintext, t('errors.generic'), tokenRecord.email);
|
|
235
258
|
}
|
|
236
259
|
}
|
|
237
260
|
// ---------------------------------------------------------------------------
|
|
@@ -246,18 +269,22 @@ async function processAcceptInvite(ctx) {
|
|
|
246
269
|
* @param t - Translation function
|
|
247
270
|
* @param token - Invitation token (to re-embed in the form)
|
|
248
271
|
* @param errorMessage - Error message to display
|
|
272
|
+
* @param email - Invited address to keep pre-filled in the form
|
|
249
273
|
* @param statusCode - HTTP status code (default: 200)
|
|
250
274
|
*/
|
|
251
|
-
async function renderInviteFormWithError(ctx, org, locale, t, token, errorMessage, statusCode = 200) {
|
|
275
|
+
async function renderInviteFormWithError(ctx, org, locale, t, token, errorMessage, email, statusCode = 200) {
|
|
276
|
+
const branding = await resolveEffectiveBranding(org);
|
|
252
277
|
const csrfToken = generateCsrfToken();
|
|
253
278
|
setCsrfCookie(ctx, csrfToken);
|
|
254
279
|
const context = {
|
|
255
|
-
branding
|
|
280
|
+
branding,
|
|
256
281
|
locale,
|
|
257
282
|
t,
|
|
258
283
|
csrfToken,
|
|
259
284
|
orgSlug: org.slug,
|
|
260
285
|
token,
|
|
286
|
+
email,
|
|
287
|
+
orgName: branding.companyName,
|
|
261
288
|
flash: { error: errorMessage },
|
|
262
289
|
};
|
|
263
290
|
await renderAndRespond(ctx, 'accept-invite', context, statusCode);
|
|
@@ -275,12 +302,12 @@ async function renderInviteFormWithError(ctx, org, locale, t, token, errorMessag
|
|
|
275
302
|
*
|
|
276
303
|
* @param tokenRecord - The invitation token record with details
|
|
277
304
|
* @param orgId - Organization ID for audit logging
|
|
305
|
+
* @param userId - Newly created account id that receives the pre-assignments
|
|
278
306
|
*/
|
|
279
|
-
async function applyPreAssignments(tokenRecord, orgId) {
|
|
307
|
+
async function applyPreAssignments(tokenRecord, orgId, userId) {
|
|
280
308
|
if (!tokenRecord.details)
|
|
281
309
|
return;
|
|
282
310
|
const pool = getPool();
|
|
283
|
-
const userId = tokenRecord.userId;
|
|
284
311
|
const roles = tokenRecord.details.roles;
|
|
285
312
|
const claims = tokenRecord.details.claims;
|
|
286
313
|
// Apply role pre-assignments
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"invitation.js","sourceRoot":"","sources":["../../src/routes/invitation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,
|
|
1
|
+
{"version":3,"file":"invitation.js","sourceRoot":"","sources":["../../src/routes/invitation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAe1C,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;GAOG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAAY,EACZ,QAAgB,EAChB,OAAwB,EACxB,UAAU,GAAG,GAAG;IAEhB,GAAG,CAAC,KAAK,CAAC,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC/D,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC;IACxB,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;IACvB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;IAE5B,sFAAsF;IACtF,gFAAgF;IAChF,2EAA2E;IAC3E,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IAEjC,oEAAoE;IACpE,MAAM,CAAC,GAAG,CAAC,qCAAqC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACvE,MAAM,gBAAgB,CAAC,GAAkB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,mBAAmB,CAAC,GAAkB,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAY,EACZ,GAAiB,EACjB,MAAc,EACd,CAA6D;IAE7D,aAAa,CAAC;QACZ,cAAc,EAAE,GAAG,CAAC,EAAE;QACtB,SAAS,EAAE,oBAAoB;QAC/B,aAAa,EAAE,UAAU;QACzB,WAAW,EAAE,wDAAwD;QACrE,SAAS,EAAE,GAAG,CAAC,EAAE;KAClB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAoB;QAC/B,QAAQ,EAAE,MAAM,wBAAwB,CAAC,GAAG,CAAC;QAC7C,MAAM;QACN,CAAC;QACD,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,IAAI;KAClB,CAAC;IAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,MAA6B;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC;IACzC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAgB;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;IACnC,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;IAExC,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;IACF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEnD,oEAAoE;IACpE,MAAM,SAAS,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAEtE,iFAAiF;IACjF,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAE9B,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,OAAO,GAAoB;YAC/B,QAAQ;YACR,MAAM;YACN,CAAC;YACD,SAAS;YACT,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,OAAO,EAAE,QAAQ,CAAC,WAAW;YAC7B,KAAK,EAAE,cAAc;YACrB,KAAK,EAAE,WAAW,CAAC,KAAK;SACzB,CAAC;QACF,MAAM,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAoB;QAC/B,QAAQ;QACR,MAAM;QACN,CAAC;QACD,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,OAAO,EAAE,QAAQ,CAAC,WAAW;QAC7B,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,eAAe,CAAC,WAAW,CAAC;KAC1C,CAAC;IACF,MAAM,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,mBAAmB,CAAC,GAAgB;IACjD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;IACnC,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA8B,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;IACnD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAEhD,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;IACF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEnD,mDAAmD;IACnD,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QACpD,MAAM,yBAAyB,CAC7B,GAAG,EACH,GAAG,EACH,MAAM,EACN,CAAC,EACD,cAAc,EACd,CAAC,CAAC,qBAAqB,CAAC,EACxB,SAAS,EACT,GAAG,CACJ,CAAC;QACF,OAAO;IACT,CAAC;IAED,2CAA2C;IAC3C,MAAM,SAAS,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAEtE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,mCAAmC;IACnC,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,yBAAyB,CAC7B,GAAG,EACH,GAAG,EACH,MAAM,EACN,CAAC,EACD,cAAc,EACd,CAAC,CAAC,oCAAoC,CAAC,EACvC,WAAW,CAAC,KAAK,CAClB,CAAC;QACF,OAAO;IACT,CAAC;IAED,wDAAwD;IACxD,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,yBAAyB,CAC7B,GAAG,EACH,GAAG,EACH,MAAM,EACN,CAAC,EACD,cAAc,EACd,UAAU,CAAC,KAAM,EACjB,WAAW,CAAC,KAAK,CAClB,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,mEAAmE;QACnE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC;YACtC,SAAS;YACT,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,QAAQ;SACT,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QAED,sEAAsE;QACtE,MAAM,mBAAmB,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEhE,oBAAoB;QACpB,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,SAAS,EAAE,sBAAsB;YACjC,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,mDAAmD;YAChE,SAAS,EAAE,GAAG,CAAC,EAAE;YACjB,QAAQ,EAAE;gBACR,gBAAgB,EAAG,WAAW,CAAC,OAAO,EAAE,KAA+B,EAAE,MAAM,IAAI,CAAC;gBACpF,iBAAiB,EAAG,WAAW,CAAC,OAAO,EAAE,MAAgC,EAAE,MAAM,IAAI,CAAC;aACvF;SACF,CAAC,CAAC;QAEH,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAoB;YAC/B,QAAQ;YACR,MAAM;YACN,CAAC;YACD,SAAS;YACT,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,oBAAoB,CAAC,EAAE;SAC5C,CAAC;QAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CACV,EAAE,KAAK,EAAE,8BAA8B,EAAE,EACzC,yCAAyC,CAC1C,CAAC;QACF,MAAM,yBAAyB,CAC7B,GAAG,EACH,GAAG,EACH,MAAM,EACN,CAAC,EACD,cAAc,EACd,CAAC,CAAC,gBAAgB,CAAC,EACnB,WAAW,CAAC,KAAK,CAClB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,wCAAwC;AACxC,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,yBAAyB,CACtC,GAAY,EACZ,GAAiB,EACjB,MAAc,EACd,CAA6D,EAC7D,KAAa,EACb,YAAoB,EACpB,KAAc,EACd,UAAU,GAAG,GAAG;IAEhB,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAoB;QAC/B,QAAQ;QACR,MAAM;QACN,CAAC;QACD,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,KAAK;QACL,KAAK;QACL,OAAO,EAAE,QAAQ,CAAC,WAAW;QAC7B,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;KAC/B,CAAC;IAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AACpE,CAAC;AAmBD;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,mBAAmB,CAChC,WAAkC,EAClC,KAAa,EACb,MAAc;IAEd,IAAI,CAAC,WAAW,CAAC,OAAO;QAAE,OAAO;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,KAAwC,CAAC;IAC3E,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,MAA0C,CAAC;IAE9E,6BAA6B;IAC7B,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,wDAAwD;gBACxD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAChC,4DAA4D,EAC5D,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAClC,CAAC;gBACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAChC,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,6BAA6B,EAAE,EACxC,wCAAwC,CACzC,CAAC;oBACF,SAAS;gBACX,CAAC;gBAED,oEAAoE;gBACpE,MAAM,IAAI,CAAC,KAAK,CACd;;qDAE2C,EAC3C,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CACtB,CAAC;gBAEF,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,oCAAoC,CAAC,CAAC;YAC3F,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,mCAAmC,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,uCAAuC;gBACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,+EAA+E,EAC/E,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,CAC/C,CAAC;gBACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC/B,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,8BAA8B,EAAE,EACzC,yCAAyC,CAC1C,CAAC;oBACF,SAAS;gBACX,CAAC;gBAED,0BAA0B;gBAC1B,MAAM,IAAI,CAAC,KAAK,CACd;;gFAEsE,EACtE,CAAC,MAAM,EAAE,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAC/D,CAAC;gBAEF,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,qCAAqC,CAAC,CAAC;YAC7F,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,oCAAoC,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,aAAa,CAAC;YACZ,cAAc,EAAE,KAAK;YACrB,MAAM;YACN,SAAS,EAAE,qCAAqC;YAChD,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,4BAA4B,KAAK,EAAE,MAAM,IAAI,CAAC,WAAW,MAAM,EAAE,MAAM,IAAI,CAAC,SAAS;YAClG,QAAQ,EAAE;gBACR,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;gBACxC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE;aACtD;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/routes/users.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AA0KjC;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,
|
|
1
|
+
{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/routes/users.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AA0KjC;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAybzC;AAoHD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAkHnD"}
|
package/dist/routes/users.js
CHANGED
|
@@ -28,7 +28,7 @@
|
|
|
28
28
|
import Router from '@koa/router';
|
|
29
29
|
import { z } from 'zod';
|
|
30
30
|
import { renderInvitationEmail, sendInvitationEmail } from '../auth/email-service.js';
|
|
31
|
-
import {
|
|
31
|
+
import { InvitationConflictError, replaceInvitation } from '../auth/token-repository.js';
|
|
32
32
|
import { generateToken } from '../auth/tokens.js';
|
|
33
33
|
import { config } from '../config/index.js';
|
|
34
34
|
import { ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
|
|
@@ -195,6 +195,7 @@ export function createUserRouter() {
|
|
|
195
195
|
organizationId: ctx.params.orgId,
|
|
196
196
|
...body,
|
|
197
197
|
});
|
|
198
|
+
setETagHeader(ctx, 'user', user.id, user.updatedAt);
|
|
198
199
|
ctx.status = 201;
|
|
199
200
|
ctx.body = { data: user };
|
|
200
201
|
}
|
|
@@ -365,10 +366,10 @@ export function createUserRouter() {
|
|
|
365
366
|
// POST /invite — Invite a new user
|
|
366
367
|
//
|
|
367
368
|
// Enhanced invitation with optional personal message, role/claim
|
|
368
|
-
// pre-assignment, and inviter tracking.
|
|
369
|
-
//
|
|
370
|
-
//
|
|
371
|
-
//
|
|
369
|
+
// pre-assignment, and inviter tracking. Stores an email/organization-keyed
|
|
370
|
+
// invitation token and sends the invitation email. No account is created
|
|
371
|
+
// until the recipient accepts. Existing organization email addresses are
|
|
372
|
+
// rejected instead of silently resending an invitation.
|
|
372
373
|
// -------------------------------------------------------------------------
|
|
373
374
|
router.post('/invite', requirePermission(ADMIN_PERMISSIONS.USER_INVITE), async (ctx) => {
|
|
374
375
|
try {
|
|
@@ -396,12 +397,6 @@ export function createUserRouter() {
|
|
|
396
397
|
ctx.body = { error: 'User already exists in this organization' };
|
|
397
398
|
return;
|
|
398
399
|
}
|
|
399
|
-
const user = await userService.createUser({
|
|
400
|
-
organizationId: orgId,
|
|
401
|
-
email: body.email,
|
|
402
|
-
givenName: body.givenName,
|
|
403
|
-
familyName: body.familyName,
|
|
404
|
-
});
|
|
405
400
|
// Generate a new invitation token
|
|
406
401
|
const { plaintext, hash } = generateToken();
|
|
407
402
|
// Existing invitations keep their absolute expiry; this policy applies to the new token only.
|
|
@@ -422,31 +417,53 @@ export function createUserRouter() {
|
|
|
422
417
|
if (body.claims?.length)
|
|
423
418
|
details.claims = body.claims;
|
|
424
419
|
details.inviterName = inviterName;
|
|
425
|
-
|
|
420
|
+
// Replace any live invitation for this address, creating no account.
|
|
421
|
+
let invitationId;
|
|
422
|
+
try {
|
|
423
|
+
const invitation = await replaceInvitation({
|
|
424
|
+
organizationId: orgId,
|
|
425
|
+
email: body.email,
|
|
426
|
+
tokenHash: hash,
|
|
427
|
+
expiresAt,
|
|
428
|
+
givenName: body.givenName ?? null,
|
|
429
|
+
familyName: body.familyName ?? null,
|
|
430
|
+
locale: body.locale ?? null,
|
|
431
|
+
details: Object.keys(details).length > 0 ? details : null,
|
|
432
|
+
invitedBy: adminUser.id,
|
|
433
|
+
});
|
|
434
|
+
invitationId = invitation.id;
|
|
435
|
+
}
|
|
436
|
+
catch (error) {
|
|
437
|
+
if (error instanceof InvitationConflictError) {
|
|
438
|
+
ctx.status = 409;
|
|
439
|
+
ctx.body = { error: 'A live invitation already exists for this email' };
|
|
440
|
+
return;
|
|
441
|
+
}
|
|
442
|
+
throw error;
|
|
443
|
+
}
|
|
426
444
|
// Build the invitation URL. Prefix the trusted, configured issuerBaseUrl
|
|
427
445
|
// (never a request header) so the email link is absolute and includes
|
|
428
446
|
// the server origin — matching the password-reset / magic-link pattern.
|
|
429
447
|
const inviteUrl = `${config.issuerBaseUrl}/${org.slug}/auth/accept-invite/${plaintext}`;
|
|
430
448
|
// Send the invitation email
|
|
431
|
-
const emailOptions = {};
|
|
449
|
+
const emailOptions = { invitationId };
|
|
432
450
|
if (body.personalMessage)
|
|
433
451
|
emailOptions.personalMessage = body.personalMessage;
|
|
434
452
|
emailOptions.inviterName = inviterName;
|
|
435
453
|
await afterDatabaseCommit(() => sendInvitationEmail({
|
|
436
|
-
|
|
437
|
-
|
|
438
|
-
|
|
439
|
-
familyName: user.familyName,
|
|
454
|
+
email: body.email,
|
|
455
|
+
givenName: body.givenName ?? null,
|
|
456
|
+
familyName: body.familyName ?? null,
|
|
440
457
|
}, org, inviteUrl, body.locale ?? org.defaultLocale ?? 'en', emailOptions));
|
|
441
|
-
// Audit log the invitation
|
|
458
|
+
// Audit log the invitation. No account exists yet, so no user id is recorded.
|
|
442
459
|
writeAuditLog({
|
|
443
460
|
organizationId: orgId,
|
|
444
|
-
userId: user.id,
|
|
445
461
|
actorId: adminUser.id,
|
|
446
462
|
eventType: 'user.invited',
|
|
447
463
|
eventCategory: 'admin',
|
|
448
464
|
description: 'User invitation created',
|
|
449
465
|
metadata: {
|
|
466
|
+
invitationId,
|
|
450
467
|
hasPersonalMessage: !!body.personalMessage,
|
|
451
468
|
preAssignedRoles: body.roles?.length ?? 0,
|
|
452
469
|
preAssignedClaims: body.claims?.length ?? 0,
|
|
@@ -455,9 +472,8 @@ export function createUserRouter() {
|
|
|
455
472
|
ctx.status = 201;
|
|
456
473
|
ctx.body = {
|
|
457
474
|
data: {
|
|
458
|
-
|
|
459
|
-
email:
|
|
460
|
-
created: true,
|
|
475
|
+
invitationId,
|
|
476
|
+
email: body.email,
|
|
461
477
|
invitationSent: true,
|
|
462
478
|
expiresAt: expiresAt.toISOString(),
|
|
463
479
|
},
|
|
@@ -490,9 +506,8 @@ export function createUserRouter() {
|
|
|
490
506
|
? `${adminUser.givenName} ${adminUser.familyName}`
|
|
491
507
|
: adminUser.givenName
|
|
492
508
|
: (adminUser.email ?? 'Admin');
|
|
493
|
-
// Build a mock
|
|
509
|
+
// Build a mock recipient for the preview; no account exists for a pending invitation.
|
|
494
510
|
const previewUser = {
|
|
495
|
-
id: '00000000-0000-0000-0000-000000000000',
|
|
496
511
|
email: body.email,
|
|
497
512
|
givenName: body.givenName ?? null,
|
|
498
513
|
familyName: body.familyName ?? null,
|