@scalemule/news-publication 0.0.85 → 0.0.87

package/dist/article-workflow-client.cjs

@@ -358,6 +358,16 @@ var canonical2 = (v) => Array.isArray(v) ? v.map(canonical2) : v && typeof v ===
   Object.keys(v).sort().map((k) => [k, canonical2(v[k])])
 ) : v;
 var equal = (a, b) => JSON.stringify(canonical2(a)) === JSON.stringify(canonical2(b));
+var uuidIdentity = (value) => {
+  if (typeof value !== "string" || !/^(?:[0-9a-f]{32}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i.test(value)) return value;
+  return value.replaceAll("-", "").toLowerCase();
+};
+var comparableDocument = (document) => document && typeof document === "object" ? { ...document, ...Array.isArray(document.media) ? { media: document.media.map((media) => ({
+  ...media,
+  contribution_id: uuidIdentity(media.contribution_id),
+  file_id: uuidIdentity(media.file_id)
+})) } : {} } : document;
+var documentsEqual = (a, b) => equal(comparableDocument(a), comparableDocument(b));
 var digest2 = async (v) => [
   ...new Uint8Array(
     await crypto.subtle.digest(
@@ -512,7 +522,7 @@ async function runArticleEdit(t, input) {
           state.revisionId
         );
       const selected = currentRevision(record);
-      if (!selected || !equal(selected.document, state.document))
+      if (!selected || !documentsEqual(selected.document, state.document))
         throw new ArticleEditOperationError(
           "VERIFICATION_CONFLICT",
           stage,
@@ -580,7 +590,7 @@ async function runArticleEdit(t, input) {
         state.savedGeneration = saved.generation;
         await save("verify");
         record = await request(article + "/collaboration");
-        if (record.current_revision_id !== state.revisionId || !equal(currentRevision(record)?.document, state.document))
+        if (record.current_revision_id !== state.revisionId || !documentsEqual(currentRevision(record)?.document, state.document))
           throw new ArticleEditOperationError(
             "ARTICLE_CHANGED",
             stage,

package/dist/article-workflow-client.js

@@ -356,6 +356,16 @@ var canonical2 = (v) => Array.isArray(v) ? v.map(canonical2) : v && typeof v ===
   Object.keys(v).sort().map((k) => [k, canonical2(v[k])])
 ) : v;
 var equal = (a, b) => JSON.stringify(canonical2(a)) === JSON.stringify(canonical2(b));
+var uuidIdentity = (value) => {
+  if (typeof value !== "string" || !/^(?:[0-9a-f]{32}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i.test(value)) return value;
+  return value.replaceAll("-", "").toLowerCase();
+};
+var comparableDocument = (document) => document && typeof document === "object" ? { ...document, ...Array.isArray(document.media) ? { media: document.media.map((media) => ({
+  ...media,
+  contribution_id: uuidIdentity(media.contribution_id),
+  file_id: uuidIdentity(media.file_id)
+})) } : {} } : document;
+var documentsEqual = (a, b) => equal(comparableDocument(a), comparableDocument(b));
 var digest2 = async (v) => [
   ...new Uint8Array(
     await crypto.subtle.digest(
@@ -510,7 +520,7 @@ async function runArticleEdit(t, input) {
           state.revisionId
         );
       const selected = currentRevision(record);
-      if (!selected || !equal(selected.document, state.document))
+      if (!selected || !documentsEqual(selected.document, state.document))
         throw new ArticleEditOperationError(
           "VERIFICATION_CONFLICT",
           stage,
@@ -578,7 +588,7 @@ async function runArticleEdit(t, input) {
         state.savedGeneration = saved.generation;
         await save("verify");
         record = await request(article + "/collaboration");
-        if (record.current_revision_id !== state.revisionId || !equal(currentRevision(record)?.document, state.document))
+        if (record.current_revision_id !== state.revisionId || !documentsEqual(currentRevision(record)?.document, state.document))
           throw new ArticleEditOperationError(
             "ARTICLE_CHANGED",
             stage,

package/dist/reader-sso-client.cjs

@@ -376,7 +376,7 @@ function AccountLinkForm({
           /* @__PURE__ */ jsxRuntime.jsx("input", { type: "password", autoComplete: "current-password", required: true, minLength: 1, maxLength: 1024, value: password, onChange: (e) => setPassword(e.target.value) })
         ] }),
         mfaRequired && /* @__PURE__ */ jsxRuntime.jsxs("label", { children: [
-          "Authentication code",
+          "Verification code",
           /* @__PURE__ */ jsxRuntime.jsx("input", { type: "text", inputMode: "numeric", autoComplete: "one-time-code", required: true, maxLength: 32, value: code, onChange: (e) => setCode(e.target.value) })
         ] }),
         /* @__PURE__ */ jsxRuntime.jsx("button", { className: classNames.button, disabled: busy || !password || mfaRequired && !code, children: busy ? "Connecting\u2026" : "Connect and sign in" }),

package/dist/reader-sso-client.js

@@ -374,7 +374,7 @@ function AccountLinkForm({
           /* @__PURE__ */ jsx("input", { type: "password", autoComplete: "current-password", required: true, minLength: 1, maxLength: 1024, value: password, onChange: (e) => setPassword(e.target.value) })
         ] }),
         mfaRequired && /* @__PURE__ */ jsxs("label", { children: [
-          "Authentication code",
+          "Verification code",
           /* @__PURE__ */ jsx("input", { type: "text", inputMode: "numeric", autoComplete: "one-time-code", required: true, maxLength: 32, value: code, onChange: (e) => setCode(e.target.value) })
         ] }),
         /* @__PURE__ */ jsx("button", { className: classNames.button, disabled: busy || !password || mfaRequired && !code, children: busy ? "Connecting\u2026" : "Connect and sign in" }),

package/dist/reader-sso.cjs

@@ -34,7 +34,8 @@ function readerSsoCookieNames(prefix) {
     newsletter: `${prefix}-newsletter`,
     ssoChecked: `${prefix}-sso-checked`,
     signedOut: `${prefix}-signed-out`,
-    pending: `${prefix}-sso-pending`
+    pending: `${prefix}-sso-pending`,
+    linkCode: `${prefix}-link-code`
   };
 }
 var readerSsoCookieOptions = { httpOnly: true, secure: true, sameSite: "lax", path: "/" };
@@ -365,6 +366,35 @@ function linkFailureMessage(code) {
       return null;
   }
 }
+function linkEmailCodeFailure(code, response, cookieName) {
+  switch (code) {
+    case "LOGIN_CHALLENGE_REQUIRED": {
+      const body = response.body;
+      let token = "";
+      try {
+        const parsed = JSON.parse(typeof body?.error?.message === "string" ? body.error.message : "{}");
+        token = typeof parsed.challenge_token === "string" && parsed.challenge_token.length <= 256 ? parsed.challenge_token : "";
+      } catch {
+        token = "";
+      }
+      if (!token) return null;
+      return {
+        status: 401,
+        mfaRequired: true,
+        error: "We emailed a 6-digit code to your reader account's address. Enter it to finish connecting your sign-in.",
+        cookies: [{ name: cookieName, value: token, maxAge: 600 }]
+      };
+    }
+    case "LOGIN_CHALLENGE_INVALID":
+      return { status: 401, mfaRequired: true, error: "That code is incorrect or expired. Check the most recent email, or start over for a new code.", cookies: [] };
+    case "CHALLENGE_RATE_LIMITED":
+      return { status: 429, mfaRequired: true, error: "Please wait a minute before asking for another code.", cookies: [] };
+    case "LOGIN_CHALLENGE_LOCKED":
+      return { status: 429, error: "Too many incorrect codes. Reset your reader account password to continue.", cookies: [{ name: cookieName, value: "", maxAge: 0 }] };
+    default:
+      return null;
+  }
+}
 async function linkAccount(config, input) {
   const c = resolve(config);
   const challengeId = typeof input.challenge_id === "string" && CHALLENGE_ID.test(input.challenge_id) ? input.challenge_id : "";
@@ -378,9 +408,16 @@ async function linkAccount(config, input) {
   if (mfaCode && (mfaCode.length > 32 || !/^[A-Za-z0-9-]+$/.test(mfaCode))) {
     return { ok: false, status: 400, error: "Enter the code exactly as your authenticator app shows it.", cookies: [], mfaRequired: true };
   }
+  const emailChallenge = input.cookies(c.names.linkCode) || "";
+  const linkBody = emailChallenge && mfaCode ? { challenge_id: challengeId, password, challenge_token: emailChallenge, challenge_code: mfaCode } : { challenge_id: challengeId, password, ...mfaCode ? { mfa_code: mfaCode } : {} };
   try {
-    const response = await c.request("/v1/auth/oauth/ledvery/link", { method: "POST", body: { challenge_id: challengeId, password, ...mfaCode ? { mfa_code: mfaCode } : {} } });
+    const response = await c.request("/v1/auth/oauth/ledvery/link", { method: "POST", body: linkBody });
     if (failed(response)) {
+      const emailCode = linkEmailCodeFailure(errorCode(response), response, c.names.linkCode);
+      if (emailCode) {
+        emit(c, { name: "reader_signin_failed", properties: { reason: "mfa_required", mode: "interactive" } });
+        return { ok: false, ...emailCode };
+      }
       const specific = linkFailureMessage(errorCode(response));
       if (specific) {
         emit(c, { name: "reader_signin_failed", properties: { reason: specific.mfaRequired ? "mfa_required" : "link_invalid", mode: "interactive" } });
@@ -391,7 +428,7 @@ async function linkAccount(config, input) {
     }
     const session = issuedSession(response, c.now());
     const flow = { digest: "", subscribe: input.subscribe === true, expires: 0, returnTo: next, mode: "interactive", provider: void 0 };
-    const result = await establish(c, { session, flow, method: "link", cookies: [], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
+    const result = await establish(c, { session, flow, method: "link", cookies: emailChallenge ? [clear(c.names.linkCode)] : [], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
     if (result.kind === "signed-in") emit(c, { name: "reader_account_linked", properties: {} });
     return result.kind === "signed-in" ? { ok: true, switch: false, cookies: result.cookies, token: result.token, expiresAt: result.expiresAt, user: result.user, location: result.location } : { ok: true, switch: true, cookies: result.cookies, location: result.location };
   } catch {

package/dist/reader-sso.d.cts

@@ -23,6 +23,8 @@ type ReaderSsoCookieNames = {
     signedOut: string;
     /** A verified session waiting for the reader to choose between two accounts. */
     pending: string;
+    /** Linking onto an unconfirmed account: the platform's emailed-code challenge token (10 minutes). */
+    linkCode: string;
 };
 /** Cookie names derived from a `__Host-` prefix, e.g. `__Host-media` → `__Host-media-reader`. */
 declare function readerSsoCookieNames(prefix: string): ReaderSsoCookieNames;

package/dist/reader-sso.d.ts

@@ -23,6 +23,8 @@ type ReaderSsoCookieNames = {
     signedOut: string;
     /** A verified session waiting for the reader to choose between two accounts. */
     pending: string;
+    /** Linking onto an unconfirmed account: the platform's emailed-code challenge token (10 minutes). */
+    linkCode: string;
 };
 /** Cookie names derived from a `__Host-` prefix, e.g. `__Host-media` → `__Host-media-reader`. */
 declare function readerSsoCookieNames(prefix: string): ReaderSsoCookieNames;

package/dist/reader-sso.js

@@ -19,7 +19,8 @@ function readerSsoCookieNames(prefix) {
     newsletter: `${prefix}-newsletter`,
     ssoChecked: `${prefix}-sso-checked`,
     signedOut: `${prefix}-signed-out`,
-    pending: `${prefix}-sso-pending`
+    pending: `${prefix}-sso-pending`,
+    linkCode: `${prefix}-link-code`
   };
 }
 var readerSsoCookieOptions = { httpOnly: true, secure: true, sameSite: "lax", path: "/" };
@@ -350,6 +351,35 @@ function linkFailureMessage(code) {
       return null;
   }
 }
+function linkEmailCodeFailure(code, response, cookieName) {
+  switch (code) {
+    case "LOGIN_CHALLENGE_REQUIRED": {
+      const body = response.body;
+      let token = "";
+      try {
+        const parsed = JSON.parse(typeof body?.error?.message === "string" ? body.error.message : "{}");
+        token = typeof parsed.challenge_token === "string" && parsed.challenge_token.length <= 256 ? parsed.challenge_token : "";
+      } catch {
+        token = "";
+      }
+      if (!token) return null;
+      return {
+        status: 401,
+        mfaRequired: true,
+        error: "We emailed a 6-digit code to your reader account's address. Enter it to finish connecting your sign-in.",
+        cookies: [{ name: cookieName, value: token, maxAge: 600 }]
+      };
+    }
+    case "LOGIN_CHALLENGE_INVALID":
+      return { status: 401, mfaRequired: true, error: "That code is incorrect or expired. Check the most recent email, or start over for a new code.", cookies: [] };
+    case "CHALLENGE_RATE_LIMITED":
+      return { status: 429, mfaRequired: true, error: "Please wait a minute before asking for another code.", cookies: [] };
+    case "LOGIN_CHALLENGE_LOCKED":
+      return { status: 429, error: "Too many incorrect codes. Reset your reader account password to continue.", cookies: [{ name: cookieName, value: "", maxAge: 0 }] };
+    default:
+      return null;
+  }
+}
 async function linkAccount(config, input) {
   const c = resolve(config);
   const challengeId = typeof input.challenge_id === "string" && CHALLENGE_ID.test(input.challenge_id) ? input.challenge_id : "";
@@ -363,9 +393,16 @@ async function linkAccount(config, input) {
   if (mfaCode && (mfaCode.length > 32 || !/^[A-Za-z0-9-]+$/.test(mfaCode))) {
     return { ok: false, status: 400, error: "Enter the code exactly as your authenticator app shows it.", cookies: [], mfaRequired: true };
   }
+  const emailChallenge = input.cookies(c.names.linkCode) || "";
+  const linkBody = emailChallenge && mfaCode ? { challenge_id: challengeId, password, challenge_token: emailChallenge, challenge_code: mfaCode } : { challenge_id: challengeId, password, ...mfaCode ? { mfa_code: mfaCode } : {} };
   try {
-    const response = await c.request("/v1/auth/oauth/ledvery/link", { method: "POST", body: { challenge_id: challengeId, password, ...mfaCode ? { mfa_code: mfaCode } : {} } });
+    const response = await c.request("/v1/auth/oauth/ledvery/link", { method: "POST", body: linkBody });
     if (failed(response)) {
+      const emailCode = linkEmailCodeFailure(errorCode(response), response, c.names.linkCode);
+      if (emailCode) {
+        emit(c, { name: "reader_signin_failed", properties: { reason: "mfa_required", mode: "interactive" } });
+        return { ok: false, ...emailCode };
+      }
       const specific = linkFailureMessage(errorCode(response));
       if (specific) {
         emit(c, { name: "reader_signin_failed", properties: { reason: specific.mfaRequired ? "mfa_required" : "link_invalid", mode: "interactive" } });
@@ -376,7 +413,7 @@ async function linkAccount(config, input) {
     }
     const session = issuedSession(response, c.now());
     const flow = { digest: "", subscribe: input.subscribe === true, expires: 0, returnTo: next, mode: "interactive", provider: void 0 };
-    const result = await establish(c, { session, flow, method: "link", cookies: [], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
+    const result = await establish(c, { session, flow, method: "link", cookies: emailChallenge ? [clear(c.names.linkCode)] : [], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
     if (result.kind === "signed-in") emit(c, { name: "reader_account_linked", properties: {} });
     return result.kind === "signed-in" ? { ok: true, switch: false, cookies: result.cookies, token: result.token, expiresAt: result.expiresAt, user: result.user, location: result.location } : { ok: true, switch: true, cookies: result.cookies, location: result.location };
   } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalemule/news-publication",
-  "version": "0.0.85",
+  "version": "0.0.87",
   "description": "Shared server framework for ScaleMule local news publications. Walnut Creek Times is the broadsheet default; each paper supplies its own identity and feature flags.",
   "type": "module",
   "bin": {