@skroz/profile-api 1.0.17 → 1.0.19

package/dist/oauth/AppleOauth.d.ts

@@ -7,6 +7,7 @@ interface AppleOauthConfig {
 }
 export declare class AppleOauth implements OAuthProvider {
     private config;
+    readonly trustedEmail = true;
     constructor(config: AppleOauthConfig);
     exchangeCode(code: string): Promise<OAuthProfile>;
 }

package/dist/oauth/AppleOauth.js

@@ -47,6 +47,9 @@ function decodeJwtPayload(token) {
 class AppleOauth {
     constructor(config) {
         this.config = config;
+        // Apple provides email only on first authorization. On subsequent logins email will be null,
+        // so confirmation flags are only set when email is actually present in the profile.
+        this.trustedEmail = true;
     }
     exchangeCode(code) {
         return __awaiter(this, void 0, void 0, function* () {

package/dist/oauth/GoogleOauth.d.ts

@@ -6,6 +6,7 @@ interface GoogleOauthConfig {
 }
 export declare class GoogleOauth implements OAuthProvider {
     private config;
+    readonly trustedEmail = true;
     constructor(config: GoogleOauthConfig);
     exchangeCode(code: string): Promise<OAuthProfile>;
 }

package/dist/oauth/GoogleOauth.js

@@ -17,6 +17,7 @@ const isomorphic_unfetch_1 = __importDefault(require("isomorphic-unfetch"));
 class GoogleOauth {
     constructor(config) {
         this.config = config;
+        this.trustedEmail = true;
     }
     exchangeCode(code) {
         return __awaiter(this, void 0, void 0, function* () {

package/dist/oauth/MailOauth.d.ts

@@ -6,6 +6,7 @@ interface MailOauthConfig {
 }
 export declare class MailOauth implements OAuthProvider {
     private config;
+    readonly trustedEmail = true;
     constructor(config: MailOauthConfig);
     exchangeCode(code: string): Promise<OAuthProfile>;
 }

package/dist/oauth/MailOauth.js

@@ -18,6 +18,7 @@ const crypto_1 = __importDefault(require("crypto"));
 class MailOauth {
     constructor(config) {
         this.config = config;
+        this.trustedEmail = true;
     }
     exchangeCode(code) {
         return __awaiter(this, void 0, void 0, function* () {

package/dist/oauth/OAuthProvider.d.ts

@@ -6,4 +6,12 @@ export interface OAuthProfile {
 }
 export interface OAuthProvider {
     exchangeCode(code: string): Promise<OAuthProfile>;
+    /**
+     * Whether this provider verifies the user's email address.
+     * When true, isEmailConfirmed and isEmailNotificationEnabled are automatically
+     * set to true upon login/registration via this provider.
+     *
+     * Set to false for providers that do not supply a verified email (e.g. Telegram).
+     */
+    readonly trustedEmail: boolean;
 }

package/dist/oauth/VKOauth.d.ts

@@ -6,6 +6,7 @@ interface VKOauthConfig {
 }
 export declare class VKOauth implements OAuthProvider {
     private config;
+    readonly trustedEmail = true;
     constructor(config: VKOauthConfig);
     exchangeCode(code: string): Promise<OAuthProfile>;
 }

package/dist/oauth/VKOauth.js

@@ -17,6 +17,9 @@ const isomorphic_unfetch_1 = __importDefault(require("isomorphic-unfetch"));
 class VKOauth {
     constructor(config) {
         this.config = config;
+        // VK returns email only if the user has a confirmed email in their account and grants access.
+        // If email is absent, trustedEmail guard in the resolver prevents setting confirmation flags.
+        this.trustedEmail = true;
     }
     exchangeCode(code) {
         return __awaiter(this, void 0, void 0, function* () {

package/dist/oauth/YandexOauth.d.ts

@@ -5,6 +5,7 @@ interface YandexOauthConfig {
 }
 export declare class YandexOauth implements OAuthProvider {
     private config;
+    readonly trustedEmail = true;
     constructor(config: YandexOauthConfig);
     exchangeCode(code: string): Promise<OAuthProfile>;
 }

package/dist/oauth/YandexOauth.js

@@ -17,6 +17,7 @@ const isomorphic_unfetch_1 = __importDefault(require("isomorphic-unfetch"));
 class YandexOauth {
     constructor(config) {
         this.config = config;
+        this.trustedEmail = true;
     }
     exchangeCode(code) {
         return __awaiter(this, void 0, void 0, function* () {

package/dist/resolvers/ProfileResolver.js

@@ -56,9 +56,11 @@ function createProfileResolver(deps) {
                 if (!user)
                     throw new type_graphql_1.UnauthorizedError();
                 const service = getAuthService(ctx);
-                const isOldPasswordOk = yield service.verifyPassword(user.password, input.oldPassword);
-                if (!isOldPasswordOk)
-                    throw new Error(t('validation:updatePassword.wrongPassword'));
+                if (!user.isTempPassword) {
+                    const isOldPasswordOk = yield service.verifyPassword(user.password, input.oldPassword);
+                    if (!isOldPasswordOk)
+                        throw new Error(t('validation:updatePassword.wrongPassword'));
+                }
                 user.password = yield service.hashPassword(input.password);
                 user.isTempPassword = false;
                 yield user.save();

package/dist/resolvers/createOauthResolver.js

@@ -114,6 +114,12 @@ function createOauthResolver(deps) {
                         yield service.db.updateUserProviderId(user.id, input.provider, profile.providerId);
                         isNew = true;
                     }
+                    // Auto-confirm email for trusted providers when email is present
+                    if (provider.trustedEmail && profile.email && (!user.isEmailConfirmed || !user.isEmailNotificationEnabled)) {
+                        user.isEmailConfirmed = true;
+                        user.isEmailNotificationEnabled = true;
+                        yield user.save();
+                    }
                 }
                 if (user.isBanned)
                     throw new Error('User is banned');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skroz/profile-api",
-  "version": "1.0.17",
+  "version": "1.0.19",
   "license": "MIT",
   "repository": "git@gitlab.com:skroz/libs/utils.git",
   "main": "dist/index.js",
@@ -44,5 +44,5 @@
     "type-graphql": "^1.1.1",
     "typeorm": "^0.2.45"
   },
-  "gitHead": "f3b755fdd93c8da958f3d94da50d2393fafdfdc5"
+  "gitHead": "ad9d511d8f623ad1a5d3a6a83e016c4b12d4f211"
 }

package/src/oauth/AppleOauth.ts

@@ -43,6 +43,10 @@ function decodeJwtPayload(token: string): Record<string, any> {
 }
 
 export class AppleOauth implements OAuthProvider {
+  // Apple provides email only on first authorization. On subsequent logins email will be null,
+  // so confirmation flags are only set when email is actually present in the profile.
+  readonly trustedEmail = true;
+
   constructor(private config: AppleOauthConfig) {}
 
   async exchangeCode(code: string): Promise<OAuthProfile> {

package/src/oauth/GoogleOauth.ts

@@ -8,6 +8,8 @@ interface GoogleOauthConfig {
 }
 
 export class GoogleOauth implements OAuthProvider {
+  readonly trustedEmail = true;
+
   constructor(private config: GoogleOauthConfig) {}
 
   async exchangeCode(code: string): Promise<OAuthProfile> {

package/src/oauth/MailOauth.ts

@@ -9,6 +9,8 @@ interface MailOauthConfig {
 }
 
 export class MailOauth implements OAuthProvider {
+  readonly trustedEmail = true;
+
   constructor(private config: MailOauthConfig) {}
 
   async exchangeCode(code: string): Promise<OAuthProfile> {

package/src/oauth/OAuthProvider.ts

@@ -7,4 +7,12 @@ export interface OAuthProfile {
 
 export interface OAuthProvider {
   exchangeCode(code: string): Promise<OAuthProfile>;
+  /**
+   * Whether this provider verifies the user's email address.
+   * When true, isEmailConfirmed and isEmailNotificationEnabled are automatically
+   * set to true upon login/registration via this provider.
+   *
+   * Set to false for providers that do not supply a verified email (e.g. Telegram).
+   */
+  readonly trustedEmail: boolean;
 }

package/src/oauth/VKOauth.ts

@@ -8,6 +8,10 @@ interface VKOauthConfig {
 }
 
 export class VKOauth implements OAuthProvider {
+  // VK returns email only if the user has a confirmed email in their account and grants access.
+  // If email is absent, trustedEmail guard in the resolver prevents setting confirmation flags.
+  readonly trustedEmail = true;
+
   constructor(private config: VKOauthConfig) {}
 
   async exchangeCode(code: string): Promise<OAuthProfile> {

package/src/oauth/YandexOauth.ts

@@ -7,6 +7,8 @@ interface YandexOauthConfig {
 }
 
 export class YandexOauth implements OAuthProvider {
+  readonly trustedEmail = true;
+
   constructor(private config: YandexOauthConfig) {}
 
   async exchangeCode(code: string): Promise<OAuthProfile> {

package/src/resolvers/ProfileResolver.ts

@@ -80,12 +80,14 @@ export function createProfileResolver<
       if (!user) throw new UnauthorizedError();
 
       const service = getAuthService(ctx);
-      const isOldPasswordOk = await service.verifyPassword(
-        user.password!,
-        input.oldPassword
-      );
-      if (!isOldPasswordOk)
-        throw new Error(t('validation:updatePassword.wrongPassword'));
+      if (!user.isTempPassword) {
+        const isOldPasswordOk = await service.verifyPassword(
+          user.password!,
+          input.oldPassword
+        );
+        if (!isOldPasswordOk)
+          throw new Error(t('validation:updatePassword.wrongPassword'));
+      }
 
       user.password = await service.hashPassword(input.password);
       user.isTempPassword = false;

package/src/resolvers/createOauthResolver.ts

@@ -114,6 +114,13 @@ export function createOauthResolver<
           await service.db.updateUserProviderId(user.id, input.provider, profile.providerId);
           isNew = true;
         }
+
+        // Auto-confirm email for trusted providers when email is present
+        if (provider.trustedEmail && profile.email && (!user.isEmailConfirmed || !user.isEmailNotificationEnabled)) {
+          user.isEmailConfirmed = true;
+          user.isEmailNotificationEnabled = true;
+          await user.save();
+        }
       }
 
       if (user.isBanned) throw new Error('User is banned');