@tapflowio/relay 0.25.0 → 0.26.1

package/dist/api/auth.js

@@ -1,6 +1,7 @@
 import { getDb } from '../db.js';
 import { makePasswordHash, verifyPassword, isInitialized, createAdminAccount } from '../lib/adminAccount.js';
-import { signJwt, requireAuth } from '../middleware/auth.js';
+import { sessionCookie, requireAuth } from '../middleware/auth.js';
+import { normalizeEmail, EMAIL_KEY_SQL } from '../lib/email.js';
 import { json, readJson } from '../router.js';
 import { config } from '../lib/config.js';
 import { resolveRequestClient } from '../lib/clientAddress.js';
@@ -15,25 +16,40 @@ export async function handleLogin(req, res, trustedProxies = config.local.truste
     const body = await readJson(req);
     if (!body.email || !body.password)
         return json(res, 400, { error: 'email and password required' });
-    const key = `${resolveRequestClient(req, trustedProxies).addr}|${body.email.toLowerCase()}`;
+    const key = `${resolveRequestClient(req, trustedProxies).addr}|${normalizeEmail(body.email)}`;
     const gate = limiter.check(key);
     if (!gate.allowed) {
         res.writeHead(429, { 'Content-Type': 'application/json', 'Retry-After': String(Math.ceil(gate.retryAfterMs / 1000)) });
         res.end(JSON.stringify({ error: 'Too many attempts. Try again later.' }));
         return;
     }
-    const db = getDb();
-    const user = db.prepare('SELECT id, email, role, password_hash FROM users WHERE email = ?').get(body.email);
+    const user = findLoginUser(body.email);
     if (!user || !user.password_hash || !verifyPassword(body.password, user.password_hash)) {
         limiter.recordFailure(key);
         return json(res, 401, { error: 'Invalid credentials' });
     }
     limiter.reset(key);
-    const token = signJwt({ userId: user.id, email: user.email, role: user.role });
-    const cookie = `tapflow_token=${token}; HttpOnly; Path=/; SameSite=Lax; Max-Age=${7 * 24 * 3600}`;
+    const cookie = sessionCookie({ userId: user.id, email: user.email, role: user.role });
     res.writeHead(200, { 'Content-Type': 'application/json', 'Set-Cookie': cookie });
     res.end(JSON.stringify({ ok: true, role: user.role }));
 }
+/**
+ * The account an address signs in to. The address exactly as typed comes first, so each row of a pair
+ * migration 014 had to leave alone (two addresses that normalize to the same one) still signs in by its
+ * own address — tried second, `alice@x.com` would shadow `Alice@x.com` for good. Then the normalized
+ * form, which migration 014 and every write since store; then a normalized comparison that must be
+ * unambiguous, so an address matching both rows of a pair signs in to neither.
+ */
+function findLoginUser(email) {
+    const db = getDb();
+    const byExact = db.prepare('SELECT id, email, role, password_hash FROM users WHERE email = ?');
+    const found = byExact.get(email) ?? byExact.get(normalizeEmail(email));
+    if (found)
+        return found;
+    const byKey = db.prepare(`SELECT id, email, role, password_hash FROM users WHERE ${EMAIL_KEY_SQL} = ?`)
+        .all(normalizeEmail(email));
+    return byKey.length === 1 ? byKey[0] : undefined;
+}
 export function handleMe(req, res) {
     const auth = requireAuth(req, res);
     if (!auth)
@@ -45,7 +61,7 @@ export function handleMe(req, res) {
     const displayName = user.display_name ?? user.email.split('@')[0];
     json(res, 200, { id: user.id, email: user.email, displayName, avatarUrl: user.avatar_url, role: user.role });
 }
-export async function handleChangePassword(req, res) {
+export async function handleChangePassword(req, res, onAuthChanged = () => { }) {
     const auth = requireAuth(req, res);
     if (!auth)
         return;
@@ -61,7 +77,11 @@ export async function handleChangePassword(req, res) {
     if (!verifyPassword(body.currentPassword, user.password_hash))
         return json(res, 401, { error: 'Incorrect current password' });
     db.prepare('UPDATE users SET password_hash = ? WHERE id = ?').run(makePasswordHash(body.newPassword), auth.userId);
-    json(res, 200, { ok: true });
+    // The new hash ends every session issued under the old one, this browser's included — so this browser
+    // gets a fresh cookie, and the others (a stolen one among them) are signed out. Open sockets follow.
+    onAuthChanged({ userId: auth.userId, scope: 'sessions' });
+    res.writeHead(200, { 'Content-Type': 'application/json', 'Set-Cookie': sessionCookie(auth) });
+    res.end(JSON.stringify({ ok: true }));
 }
 export function handleLogout(_req, res) {
     res.writeHead(200, {

package/dist/api/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/api/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAC5G,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAE,iBAAiB,EAAoB,MAAM,4BAA4B,CAAA;AAEhF,+CAA+C;AAC/C,MAAM,YAAY,GAAG,iBAAiB,EAAE,CAAA;AAExC,mGAAmG;AACnG,iGAAiG;AACjG,0EAA0E;AAC1E,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAG5G,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAyB,EACzB,GAAwB,EACxB,iBAA2B,MAAM,CAAC,KAAK,CAAC,cAAc,EACtD,UAAuB,YAAY;IAEnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAsC,GAAG,CAAC,CAAA;IACrE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAA;IAElG,MAAM,GAAG,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAA;IAC3F,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,CAAA;QACtH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC,CAAA;QACzE,OAAM;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB,kEAAkE,CACnE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAA0F,CAAA;IAE1G,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACvF,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;QAC1B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAElB,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9E,MAAM,MAAM,GAAG,iBAAiB,KAAK,6CAA6C,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAA;IACjG,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAA;IAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAyB,EAAE,GAAwB;IAC1E,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,0EAA0E,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CACF,CAAA;IAEjH,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACjE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;AAC9G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAyB,EAAE,GAAwB;IAC5F,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAmD,GAAG,CAAC,CAAA;IAClF,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC,CAAA;IAC5H,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAA;IAE3G,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAiD,CAAA;IACxI,IAAI,CAAC,IAAI,EAAE,aAAa;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC7E,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAA;IAE7H,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAClH,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAA0B,EAAE,GAAwB;IAC/E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,kBAAkB;QAClC,YAAY,EAAE,6CAA6C;KAC5D,CAAC,CAAA;IACF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;AACvC,CAAC;AAED,qGAAqG;AACrG,mFAAmF;AACnF,SAAS,aAAa,CAAC,GAAyB,EAAE,cAAwB;IACxE,OAAO,oBAAoB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,OAAO,CAAA;AAC1D,CAAC;AAED,qGAAqG;AACrG,kGAAkG;AAClG,MAAM,UAAU,gBAAgB,CAAC,GAAyB,EAAE,GAAwB,EAAE,iBAA2B,MAAM,CAAC,KAAK,CAAC,cAAc;IAC1I,MAAM,WAAW,GAAG,aAAa,EAAE,CAAA;IACnC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,WAAW,IAAI,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC,CAAA;AACpG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAyB,EAAE,GAAwB,EAAE,iBAA2B,MAAM,CAAC,KAAK,CAAC,cAAc;IAC1I,+DAA+D;IAC/D,uEAAuE;IACvE,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4FAA4F,EAAE,CAAC,CAAA;IAChI,CAAC;IAED,6FAA6F;IAC7F,wCAAwC;IACxC,IAAI,aAAa,EAAE;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAE5E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAsC,GAAG,CAAC,CAAA;IACrE,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC5D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,gBAAgB,CAAC,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAA;QACtF,KAAK,oBAAoB,CAAC,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAA;QACrG,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9C,iGAAiG;QACjG,iGAAiG;QACjG,8EAA8E;QAC9E,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,WAAW,GAAU,MAAM,CAAA;YACjC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/api/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAC5G,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAE7C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAE,iBAAiB,EAAoB,MAAM,4BAA4B,CAAA;AAEhF,+CAA+C;AAC/C,MAAM,YAAY,GAAG,iBAAiB,EAAE,CAAA;AAExC,mGAAmG;AACnG,iGAAiG;AACjG,0EAA0E;AAC1E,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAG5G,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAyB,EACzB,GAAwB,EACxB,iBAA2B,MAAM,CAAC,KAAK,CAAC,cAAc,EACtD,UAAuB,YAAY;IAEnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAsC,GAAG,CAAC,CAAA;IACrE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAA;IAElG,MAAM,GAAG,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAA;IAC7F,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,CAAA;QACtH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC,CAAA;QACzE,OAAM;IACR,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAEtC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACvF,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;QAC1B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAElB,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IACrF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAA;IAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AACxD,CAAC;AAID;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,kEAAkE,CAAC,CAAA;IAC9F,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAA;IACtE,IAAI,KAAK;QAAE,OAAO,KAAiB,CAAA;IACnC,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,0DAA0D,aAAa,MAAM,CAAC;SACpG,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAe,CAAA;IAC3C,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAyB,EAAE,GAAwB;IAC1E,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,0EAA0E,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CACF,CAAA;IAEjH,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACjE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;AAC9G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAyB,EACzB,GAAwB,EACxB,gBAAiD,GAAG,EAAE,GAAE,CAAC;IAEzD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAmD,GAAG,CAAC,CAAA;IAClF,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC,CAAA;IAC5H,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAA;IAE3G,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAiD,CAAA;IACxI,IAAI,CAAC,IAAI,EAAE,aAAa;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC7E,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAA;IAE7H,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAClH,sGAAsG;IACtG,qGAAqG;IACrG,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAA;IACzD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC7F,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;AACvC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAA0B,EAAE,GAAwB;IAC/E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,kBAAkB;QAClC,YAAY,EAAE,6CAA6C;KAC5D,CAAC,CAAA;IACF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;AACvC,CAAC;AAED,qGAAqG;AACrG,mFAAmF;AACnF,SAAS,aAAa,CAAC,GAAyB,EAAE,cAAwB;IACxE,OAAO,oBAAoB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,OAAO,CAAA;AAC1D,CAAC;AAED,qGAAqG;AACrG,kGAAkG;AAClG,MAAM,UAAU,gBAAgB,CAAC,GAAyB,EAAE,GAAwB,EAAE,iBAA2B,MAAM,CAAC,KAAK,CAAC,cAAc;IAC1I,MAAM,WAAW,GAAG,aAAa,EAAE,CAAA;IACnC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,WAAW,IAAI,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC,CAAA;AACpG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAyB,EAAE,GAAwB,EAAE,iBAA2B,MAAM,CAAC,KAAK,CAAC,cAAc;IAC1I,+DAA+D;IAC/D,uEAAuE;IACvE,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4FAA4F,EAAE,CAAC,CAAA;IAChI,CAAC;IAED,6FAA6F;IAC7F,wCAAwC;IACxC,IAAI,aAAa,EAAE;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAE5E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAsC,GAAG,CAAC,CAAA;IACrE,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC5D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,gBAAgB,CAAC,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAA;QACtF,KAAK,oBAAoB,CAAC,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAA;QACrG,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9C,iGAAiG;QACjG,iGAAiG;QACjG,8EAA8E;QAC9E,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,WAAW,GAAU,MAAM,CAAA;YACjC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/api/invitations.d.ts

@@ -1,4 +1,6 @@
 import http from 'http';
 export declare function handleVerify(req: http.IncomingMessage, res: http.ServerResponse): void;
-export declare function handleAccept(req: http.IncomingMessage, res: http.ServerResponse, uploadsDir: string, onAuthChanged?: () => void): void;
+export declare function handleAccept(req: http.IncomingMessage, res: http.ServerResponse, uploadsDir: string): void;
+/** Whether an address already belongs to a member, however it was capitalized or spaced when stored. */
+export declare function isMemberEmail(email: string): boolean;
 //# sourceMappingURL=invitations.d.ts.map

package/dist/api/invitations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invitations.d.ts","sourceRoot":"","sources":["../../src/api/invitations.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAUvB,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAYtF;AAED,wBAAgB,YAAY,CAC1B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,UAAU,EAAE,MAAM,EAClB,aAAa,GAAE,MAAM,IAAe,GACnC,IAAI,CA+EN"}
+{"version":3,"file":"invitations.d.ts","sourceRoot":"","sources":["../../src/api/invitations.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAWvB,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAYtF;AAED,wBAAgB,YAAY,CAC1B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,UAAU,EAAE,MAAM,GACjB,IAAI,CAwEN;AAED,wGAAwG;AACxG,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD"}

package/dist/api/invitations.js

@@ -3,7 +3,8 @@ import path from 'path';
 import crypto from 'crypto';
 import busboy from 'busboy';
 import { getDb } from '../db.js';
-import { signJwt } from '../middleware/auth.js';
+import { sessionCookie } from '../middleware/auth.js';
+import { normalizeEmail, EMAIL_KEY_SQL, SYNTHETIC_EMAIL_DOMAIN } from '../lib/email.js';
 import { makePasswordHash } from './auth.js';
 import { json } from '../router.js';
 export function handleVerify(req, res) {
@@ -19,7 +20,7 @@ export function handleVerify(req, res) {
         return json(res, 410, { error: 'Invitation expired or not found' });
     json(res, 200, { role: inv.role });
 }
-export function handleAccept(req, res, uploadsDir, onAuthChanged = () => { }) {
+export function handleAccept(req, res, uploadsDir) {
     const bb = busboy({ headers: req.headers, limits: { fileSize: 2 * 1024 * 1024 } });
     const fields = {};
     let fileBuffer = null;
@@ -62,19 +63,15 @@ export function handleAccept(req, res, uploadsDir, onAuthChanged = () => { }) {
             return json(res, 410, { error: 'Invitation expired or not found' });
         const passwordHash = makePasswordHash(password);
         const displayName = fields.display_name?.trim() || (inv.email?.split('@')[0] ?? 'User');
-        let userId;
-        const existing = inv.email
-            ? db.prepare('SELECT id FROM users WHERE email = ?').get(inv.email)
-            : undefined;
-        if (existing) {
-            db.prepare('UPDATE users SET password_hash = ?, role = ?, display_name = ? WHERE id = ?')
-                .run(passwordHash, inv.role, displayName, existing.id);
-            userId = existing.id;
-        }
-        else {
-            const result = db.prepare('INSERT INTO users (email, role, password_hash, display_name) VALUES (?, ?, ?, ?)').run(inv.email ?? `user_${crypto.randomBytes(4).toString('hex')}@tapflow.local`, inv.role, passwordHash, displayName);
-            userId = result.lastInsertRowid;
+        // An invitation creates an account; it never changes one. Accepting for an address that already
+        // has an account used to overwrite that account's password, role and name — an invite link worked
+        // as a password reset nobody approved. The address may have joined since the invitation was made,
+        // so this is checked here as well as when inviting.
+        if (inv.email && isMemberEmail(inv.email)) {
+            return json(res, 409, { error: 'This email already has an account. Sign in instead.' });
         }
+        const result = db.prepare('INSERT INTO users (email, role, password_hash, display_name) VALUES (?, ?, ?, ?)').run(inv.email ? normalizeEmail(inv.email) : `user_${crypto.randomBytes(4).toString('hex')}${SYNTHETIC_EMAIL_DOMAIN}`, inv.role, passwordHash, displayName);
+        const userId = result.lastInsertRowid;
         if (fileBuffer && fileMime) {
             const ext = fileMime === 'image/png' ? '.png' : '.jpg';
             const avatarPath = path.join(uploadsDir, 'avatars', `user-${userId}${ext}`);
@@ -83,17 +80,16 @@ export function handleAccept(req, res, uploadsDir, onAuthChanged = () => { }) {
             db.prepare('UPDATE users SET avatar_url = ? WHERE id = ?').run(`/uploads/avatars/user-${userId}${ext}`, userId);
         }
         db.prepare("UPDATE invitations SET used_at = datetime('now') WHERE id = ?").run(inv.id);
-        // Accepting for an email that already has an account overwrites its role, which can take an
-        // Admin's agent authority away from sockets already open.
-        if (existing)
-            onAuthChanged();
         const user = db.prepare('SELECT email, role FROM users WHERE id = ?').get(userId);
-        const jwtToken = signJwt({ userId, email: user.email, role: user.role });
-        const cookie = `tapflow_token=${jwtToken}; HttpOnly; Path=/; SameSite=Lax; Max-Age=${7 * 24 * 3600}`;
+        const cookie = sessionCookie({ userId, email: user.email, role: user.role });
         res.writeHead(200, { 'Content-Type': 'application/json', 'Set-Cookie': cookie });
         res.end(JSON.stringify({ ok: true }));
     });
     bb.on('error', () => json(res, 500, { error: 'Failed to process request' }));
     req.pipe(bb);
 }
+/** Whether an address already belongs to a member, however it was capitalized or spaced when stored. */
+export function isMemberEmail(email) {
+    return getDb().prepare(`SELECT 1 FROM users WHERE ${EMAIL_KEY_SQL} = ?`).get(normalizeEmail(email)) !== undefined;
+}
 //# sourceMappingURL=invitations.js.map

package/dist/api/invitations.js.map

@@ -1 +1 @@
-{"version":3,"file":"invitations.js","sourceRoot":"","sources":["../../src/api/invitations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AAEnC,MAAM,UAAU,YAAY,CAAC,GAAyB,EAAE,GAAwB;IAC9E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3E,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAE9D,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;;GAGtB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAiC,CAAA;IAE7C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAA;IAC7E,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;AACpC,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,GAAyB,EACzB,GAAwB,EACxB,UAAkB,EAClB,gBAA4B,GAAG,EAAE,GAAE,CAAC;IAEpC,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,CAAA;IAClF,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,IAAI,UAAU,GAAkB,IAAI,CAAA;IACpC,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAA,CAAC,CAAC,CAAC,CAAA;IAErD,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC3C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAAC,OAAM;QAAC,CAAC;QACjE,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QACxB,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YAC9B,IAAI,IAAI,CAAC,CAAC,MAAM,CAAA;YAChB,IAAI,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;;gBACtC,SAAS,GAAG,IAAI,CAAA;QACvB,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;YAAE,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;IAChF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACnB,IAAI,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAA;QAErE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;QAClC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAA;QACxF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAA;QAEnG,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;QAClB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;;KAGtB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAmE,CAAA;QAE/E,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAA;QAE7E,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;QAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAA;QAEvF,IAAI,MAAc,CAAA;QAClB,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK;YACxB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAA+B;YACjG,CAAC,CAAC,SAAS,CAAA;QAEb,IAAI,QAAQ,EAAE,CAAC;YACb,EAAE,CAAC,OAAO,CAAC,6EAA6E,CAAC;iBACtF,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAA;YACxD,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAA;QACtB,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB,kFAAkF,CACnF,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,QAAQ,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC,CAAA;YACtH,MAAM,GAAG,MAAM,CAAC,eAAyB,CAAA;QAC3C,CAAC;QAED,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;YACtD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,MAAM,GAAG,GAAG,EAAE,CAAC,CAAA;YAC3E,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAC3D,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;YACxC,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,yBAAyB,MAAM,GAAG,GAAG,EAAE,EAAE,MAAM,CAAC,CAAA;QACjH,CAAC;QAED,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACvF,4FAA4F;QAC5F,0DAA0D;QAC1D,IAAI,QAAQ;YAAE,aAAa,EAAE,CAAA;QAE7B,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,CAAC,MAAM,CAAoC,CAAA;QACpH,MAAM,QAAQ,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QACxE,MAAM,MAAM,GAAG,iBAAiB,QAAQ,6CAA6C,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAA;QACpG,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAA;QAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAA;IAC5E,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACd,CAAC"}
+{"version":3,"file":"invitations.js","sourceRoot":"","sources":["../../src/api/invitations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AACvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AAEnC,MAAM,UAAU,YAAY,CAAC,GAAyB,EAAE,GAAwB;IAC9E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3E,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAE9D,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;;GAGtB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAiC,CAAA;IAE7C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAA;IAC7E,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;AACpC,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,GAAyB,EACzB,GAAwB,EACxB,UAAkB;IAElB,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,CAAA;IAClF,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,IAAI,UAAU,GAAkB,IAAI,CAAA;IACpC,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAA,CAAC,CAAC,CAAC,CAAA;IAErD,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC3C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAAC,OAAM;QAAC,CAAC;QACjE,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QACxB,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YAC9B,IAAI,IAAI,CAAC,CAAC,MAAM,CAAA;YAChB,IAAI,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;;gBACtC,SAAS,GAAG,IAAI,CAAA;QACvB,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;YAAE,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;IAChF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACnB,IAAI,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAA;QAErE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;QAClC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAA;QACxF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAA;QAEnG,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;QAClB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;;KAGtB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAmE,CAAA;QAE/E,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAA;QAE7E,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;QAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAA;QAEvF,gGAAgG;QAChG,kGAAkG;QAClG,kGAAkG;QAClG,oDAAoD;QACpD,IAAI,GAAG,CAAC,KAAK,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qDAAqD,EAAE,CAAC,CAAA;QACzF,CAAC;QAED,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB,kFAAkF,CACnF,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,sBAAsB,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC,CAAA;QAC5J,MAAM,MAAM,GAAG,MAAM,CAAC,eAAyB,CAAA;QAE/C,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;YACtD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,MAAM,GAAG,GAAG,EAAE,CAAC,CAAA;YAC3E,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAC3D,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;YACxC,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,yBAAyB,MAAM,GAAG,GAAG,EAAE,EAAE,MAAM,CAAC,CAAA;QACjH,CAAC;QAED,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAEvF,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,CAAC,MAAM,CAAoC,CAAA;QACpH,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QAC5E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAA;QAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAA;IAC5E,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACd,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,KAAK,EAAE,CAAC,OAAO,CAAC,6BAA6B,aAAa,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,SAAS,CAAA;AACnH,CAAC"}

package/dist/api/passwordReset.d.ts

@@ -1,10 +1,22 @@
 import http from 'http';
+import type { AuthChange } from '../lib/connectionAuth.js';
 import { type TapflowConfig } from '../lib/config.js';
 import { type TunnelRuntime } from '../lib/publicUrl.js';
 export declare function buildPasswordResetUrl(token: string, cfg: Pick<TapflowConfig, 'tunnel' | 'relay' | 'local'>, tunnel?: TunnelRuntime): string;
 export declare function passwordResetLinkWarning(url: string): string | null;
-export declare function sendPasswordResetEmail(userId: number, tunnel?: TunnelRuntime): Promise<boolean>;
+/**
+ * Issues a reset link for a member and mails it when mail can reach them. Returns the token either way:
+ * the Admin who asked also gets the link, as with an invitation, so an install without SMTP can still
+ * reset a password.
+ *
+ * Only the newest link works. The earlier unused ones are spent here, so a link sent to the wrong place
+ * is dead as soon as the Admin makes another.
+ */
+export declare function issuePasswordReset(userId: number, tunnel?: TunnelRuntime): Promise<{
+    token: string;
+    emailSent: boolean;
+} | null>;
 export declare function handleVerifyReset(req: http.IncomingMessage, res: http.ServerResponse): void;
-export declare function handleDoReset(req: http.IncomingMessage, res: http.ServerResponse): Promise<void>;
+export declare function handleDoReset(req: http.IncomingMessage, res: http.ServerResponse, onAuthChanged?: (affected?: AuthChange) => void): Promise<void>;
 export declare function handleSendMemberReset(req: http.IncomingMessage, res: http.ServerResponse, params: Record<string, string>, tunnel?: TunnelRuntime): Promise<void>;
 //# sourceMappingURL=passwordReset.d.ts.map

package/dist/api/passwordReset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passwordReset.d.ts","sourceRoot":"","sources":["../../src/api/passwordReset.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAQvB,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAO5E,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC,EACtD,MAAM,CAAC,EAAE,aAAa,GACrB,MAAM,CAER;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEnE;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAqBrG;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAY3F;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBtG;AAED,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAWf"}
+{"version":3,"file":"passwordReset.d.ts","sourceRoot":"","sources":["../../src/api/passwordReset.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAQvB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAA0D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAQhH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC,EACtD,MAAM,CAAC,EAAE,aAAa,GACrB,MAAM,CAER;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEnE;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CA4BvD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAY3F;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,aAAa,GAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,KAAK,IAAe,GACxD,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAiBf"}

package/dist/api/passwordReset.js

@@ -6,7 +6,8 @@ import { makePasswordHash } from './auth.js';
 import { sendMail } from '../lib/mailer.js';
 import { json, readJson } from '../router.js';
 import { config } from '../lib/config.js';
-import { buildInviteBaseUrl } from '../lib/publicUrl.js';
+import { buildInviteBaseUrl, forTeammates, resolvePublicBaseUrl } from '../lib/publicUrl.js';
+import { SYNTHETIC_EMAIL_DOMAIN } from '../lib/email.js';
 const logger = createLogger('relay:password-reset');
 const INSECURE_RESET_LINK_WARNING = 'Password-reset email uses insecure HTTP. Reset tokens may be exposed in transit; configure HTTPS with tunnel.publicUrl or relay.url.';
 let warnedInsecureResetLink = false;
@@ -16,14 +17,29 @@ export function buildPasswordResetUrl(token, cfg, tunnel) {
 export function passwordResetLinkWarning(url) {
     return /^https:\/\//i.test(url) ? null : INSECURE_RESET_LINK_WARNING;
 }
-export async function sendPasswordResetEmail(userId, tunnel) {
+/**
+ * Issues a reset link for a member and mails it when mail can reach them. Returns the token either way:
+ * the Admin who asked also gets the link, as with an invitation, so an install without SMTP can still
+ * reset a password.
+ *
+ * Only the newest link works. The earlier unused ones are spent here, so a link sent to the wrong place
+ * is dead as soon as the Admin makes another.
+ */
+export async function issuePasswordReset(userId, tunnel) {
     const db = getDb();
     const user = db.prepare('SELECT id, email FROM users WHERE id = ?').get(userId);
     if (!user)
-        return false;
+        return null;
     const token = crypto.randomBytes(32).toString('hex');
     const expiresAt = new Date(Date.now() + 2 * 60 * 60 * 1000).toISOString();
-    db.prepare('INSERT INTO password_reset_tokens (user_id, token, expires_at) VALUES (?, ?, ?)').run(userId, token, expiresAt);
+    db.transaction(() => {
+        db.prepare("UPDATE password_reset_tokens SET used_at = datetime('now') WHERE user_id = ? AND used_at IS NULL").run(userId);
+        db.prepare('INSERT INTO password_reset_tokens (user_id, token, expires_at) VALUES (?, ?, ?)').run(userId, token, expiresAt);
+    })();
+    // A member invited without an email has a made-up `@tapflow.local` address. An SMTP server may well
+    // accept mail for it, which would report "sent" for a message nobody can receive.
+    if (user.email.endsWith(SYNTHETIC_EMAIL_DOMAIN))
+        return { token, emailSent: false };
     const link = buildPasswordResetUrl(token, config, tunnel);
     const warning = passwordResetLinkWarning(link);
     if (warning !== null && !warnedInsecureResetLink) {
@@ -33,7 +49,7 @@ export async function sendPasswordResetEmail(userId, tunnel) {
     const html = `<p>A password reset was requested for your tapflow account.</p>
 <p><a href="${link}">Reset your password</a></p>
 <p>This link expires in 2 hours. If you did not request this, ignore this email.</p>`;
-    return sendMail(user.email, 'Reset your tapflow password', html);
+    return { token, emailSent: await sendMail(user.email, 'Reset your tapflow password', html) };
 }
 export function handleVerifyReset(req, res) {
     const token = new URL(req.url ?? '/', 'http://x').searchParams.get('token');
@@ -48,7 +64,7 @@ export function handleVerifyReset(req, res) {
         return json(res, 410, { error: 'Token expired or not found' });
     json(res, 200, { ok: true });
 }
-export async function handleDoReset(req, res) {
+export async function handleDoReset(req, res, onAuthChanged = () => { }) {
     const body = await readJson(req);
     if (!body.token || !body.password)
         return json(res, 400, { error: 'token and password required' });
@@ -61,8 +77,20 @@ export async function handleDoReset(req, res) {
   `).get(body.token);
     if (!row)
         return json(res, 410, { error: 'Token expired or not found' });
-    db.prepare('UPDATE users SET password_hash = ? WHERE id = ?').run(makePasswordHash(body.password), row.user_id);
-    db.prepare("UPDATE password_reset_tokens SET used_at = datetime('now') WHERE id = ?").run(row.id);
+    db.transaction(() => {
+        db.prepare('UPDATE users SET password_hash = ? WHERE id = ?').run(makePasswordHash(body.password), row.user_id);
+        // Every outstanding link for this user, not only the one used: the password they unlock is gone.
+        db.prepare("UPDATE password_reset_tokens SET used_at = datetime('now') WHERE user_id = ? AND used_at IS NULL").run(row.user_id);
+        // A reset is how an account is recovered, and whoever held it may have minted tokens that a new
+        // password alone would leave working. So a reset revokes all of them, CI and agent tokens included;
+        // the owner issues new ones. A self-service change does not: it needs the current password, and
+        // revoking there would break the owner's own CI without warning.
+        db.prepare('DELETE FROM personal_access_tokens WHERE user_id = ?').run(row.user_id);
+    })();
+    // The new hash has already ended the user's sessions (`passwordVersion`) and the tokens are gone;
+    // this closes their open sockets, token-authenticated agents included, now rather than on the next
+    // heartbeat.
+    onAuthChanged({ userId: row.user_id });
     json(res, 200, { ok: true });
 }
 export async function handleSendMemberReset(req, res, params, tunnel) {
@@ -73,7 +101,14 @@ export async function handleSendMemberReset(req, res, params, tunnel) {
     const member = db.prepare('SELECT id FROM users WHERE id = ?').get(params.id);
     if (!member)
         return json(res, 404, { error: 'Member not found' });
-    const emailSent = await sendPasswordResetEmail(member.id, tunnel);
-    json(res, 200, { ok: true, emailSent });
+    const issued = await issuePasswordReset(member.id, tunnel);
+    if (!issued)
+        return json(res, 404, { error: 'Member not found' });
+    // The same rule as an invitation's `inviteUrl` (#788): null when the only address is a loopback one,
+    // and the dashboard builds the link from the browser's origin with `token` instead.
+    const resetUrl = forTeammates(resolvePublicBaseUrl(config, tunnel)) === null
+        ? null
+        : buildPasswordResetUrl(issued.token, config, tunnel);
+    json(res, 200, { ok: true, emailSent: issued.emailSent, token: issued.token, resetUrl });
 }
 //# sourceMappingURL=passwordReset.js.map

package/dist/api/passwordReset.js.map

@@ -1 +1 @@
-{"version":3,"file":"passwordReset.js","sourceRoot":"","sources":["../../src/api/passwordReset.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAsB,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAsB,MAAM,qBAAqB,CAAA;AAE5E,MAAM,MAAM,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAA;AACnD,MAAM,2BAA2B,GAC/B,sIAAsI,CAAA;AACxI,IAAI,uBAAuB,GAAG,KAAK,CAAA;AAEnC,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,GAAsD,EACtD,MAAsB;IAEtB,OAAO,GAAG,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,yBAAyB,KAAK,EAAE,CAAA;AAC3E,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B,CAAA;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAAc,EAAE,MAAsB;IACjF,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,GAAG,CAAC,MAAM,CAA8C,CAAA;IAC5H,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEvB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;IAEzE,EAAE,CAAC,OAAO,CAAC,iFAAiF,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;IAE3H,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IACzD,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;IAC9C,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACpB,uBAAuB,GAAG,IAAI,CAAA;IAChC,CAAC;IACD,MAAM,IAAI,GAAG;cACD,IAAI;qFACmE,CAAA;IAEnF,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,6BAA6B,EAAE,IAAI,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAyB,EAAE,GAAwB;IACnF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3E,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAE9D,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;;GAGtB,CAAC,CAAC,GAAG,CAAC,KAAK,CAA+B,CAAA;IAE3C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAA;IACxE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAyB,EAAE,GAAwB;IACrF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAsC,GAAG,CAAC,CAAA;IACrE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAA;IAClG,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAA;IAExG,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;;GAGtB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAgD,CAAA;IAEjE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAA;IAExE,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAC/G,EAAE,CAAC,OAAO,CAAC,yEAAyE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAEjG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAyB,EACzB,GAAwB,EACxB,MAA8B,EAC9B,MAAsB;IAEtB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAA+B,CAAA;IAC3G,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAEjE,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IAEjE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;AACzC,CAAC"}
+{"version":3,"file":"passwordReset.js","sourceRoot":"","sources":["../../src/api/passwordReset.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAE7C,OAAO,EAAE,MAAM,EAAsB,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,oBAAoB,EAAsB,MAAM,qBAAqB,CAAA;AAChH,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AAExD,MAAM,MAAM,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAA;AACnD,MAAM,2BAA2B,GAC/B,sIAAsI,CAAA;AACxI,IAAI,uBAAuB,GAAG,KAAK,CAAA;AAEnC,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,GAAsD,EACtD,MAAsB;IAEtB,OAAO,GAAG,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,yBAAyB,KAAK,EAAE,CAAA;AAC3E,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B,CAAA;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,MAAsB;IAEtB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,GAAG,CAAC,MAAM,CAA8C,CAAA;IAC5H,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAEtB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;IAEzE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QAClB,EAAE,CAAC,OAAO,CAAC,kGAAkG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC1H,EAAE,CAAC,OAAO,CAAC,iFAAiF,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;IAC7H,CAAC,CAAC,EAAE,CAAA;IAEJ,oGAAoG;IACpG,kFAAkF;IAClF,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IAEnF,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IACzD,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;IAC9C,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACpB,uBAAuB,GAAG,IAAI,CAAA;IAChC,CAAC;IACD,MAAM,IAAI,GAAG;cACD,IAAI;qFACmE,CAAA;IAEnF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,6BAA6B,EAAE,IAAI,CAAC,EAAE,CAAA;AAC9F,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAyB,EAAE,GAAwB;IACnF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3E,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAE9D,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;;GAGtB,CAAC,CAAC,GAAG,CAAC,KAAK,CAA+B,CAAA;IAE3C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAA;IACxE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAyB,EACzB,GAAwB,EACxB,gBAAiD,GAAG,EAAE,GAAE,CAAC;IAEzD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAsC,GAAG,CAAC,CAAA;IACrE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAA;IAClG,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAA;IAExG,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;;GAGtB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAgD,CAAA;IAEjE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAA;IAExE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QAClB,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;QAC/G,iGAAiG;QACjG,EAAE,CAAC,OAAO,CAAC,kGAAkG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC/H,gGAAgG;QAChG,oGAAoG;QACpG,gGAAgG;QAChG,iEAAiE;QACjE,EAAE,CAAC,OAAO,CAAC,sDAAsD,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACrF,CAAC,CAAC,EAAE,CAAA;IACJ,kGAAkG;IAClG,mGAAmG;IACnG,aAAa;IACb,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;IAEtC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAyB,EACzB,GAAwB,EACxB,MAA8B,EAC9B,MAAsB;IAEtB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAA+B,CAAA;IAC3G,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAEjE,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAEjE,qGAAqG;IACrG,oFAAoF;IACpF,MAAM,QAAQ,GAAG,YAAY,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI;QAC1E,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IACvD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;AAC1F,CAAC"}

package/dist/api/team.d.ts

@@ -1,7 +1,8 @@
 import http from 'http';
+import type { AuthChange } from '../lib/connectionAuth.js';
 import { type TunnelRuntime } from '../lib/publicUrl.js';
 export declare function handleListMembers(req: http.IncomingMessage, res: http.ServerResponse): void;
 export declare function handleInvite(req: http.IncomingMessage, res: http.ServerResponse, tunnel?: TunnelRuntime): Promise<void>;
-export declare function handleUpdateMember(req: http.IncomingMessage, res: http.ServerResponse, params: Record<string, string>, onAuthChanged?: () => void): Promise<void>;
-export declare function handleDeleteMember(req: http.IncomingMessage, res: http.ServerResponse, params: Record<string, string>, onAuthChanged?: () => void): void;
+export declare function handleUpdateMember(req: http.IncomingMessage, res: http.ServerResponse, params: Record<string, string>, onAuthChanged?: (affected?: AuthChange) => void): Promise<void>;
+export declare function handleDeleteMember(req: http.IncomingMessage, res: http.ServerResponse, params: Record<string, string>, onAuthChanged?: (affected?: AuthChange) => void): void;
 //# sourceMappingURL=team.d.ts.map

package/dist/api/team.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"team.d.ts","sourceRoot":"","sources":["../../src/api/team.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAOvB,OAAO,EAA0D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEhH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAS3F;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA8B7H;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,aAAa,GAAE,MAAM,IAAe,GACnC,OAAO,CAAC,IAAI,CAAC,CAef;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,aAAa,GAAE,MAAM,IAAe,GACnC,IAAI,CAcN"}
+{"version":3,"file":"team.d.ts","sourceRoot":"","sources":["../../src/api/team.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAKvB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAK1D,OAAO,EAA0D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEhH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAS3F;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAiC7H;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,aAAa,GAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,KAAK,IAAe,GACxD,OAAO,CAAC,IAAI,CAAC,CAef;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,aAAa,GAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,KAAK,IAAe,GACxD,IAAI,CAcN"}

package/dist/api/team.js

@@ -4,6 +4,8 @@ import { requireRole } from '../middleware/auth.js';
 import { json, readJson } from '../router.js';
 import { sendMail } from '../lib/mailer.js';
 import { config } from '../lib/config.js';
+import { normalizeEmail } from '../lib/email.js';
+import { isMemberEmail } from './invitations.js';
 import { buildInviteBaseUrl, forTeammates, resolvePublicBaseUrl } from '../lib/publicUrl.js';
 export function handleListMembers(req, res) {
     const auth = requireRole(req, res, ['Admin']);
@@ -18,6 +20,10 @@ export async function handleInvite(req, res, tunnel) {
     if (!auth)
         return;
     const body = await readJson(req);
+    const email = body.email ? normalizeEmail(body.email) : '';
+    // Inviting a member would only produce a link that is refused on accept.
+    if (email && isMemberEmail(email))
+        return json(res, 409, { error: 'Already a member' });
     const role = ['Admin', 'Developer', 'QA', 'Viewer'].includes(body.role ?? '')
         ? body.role
         : 'QA';
@@ -25,17 +31,17 @@ export async function handleInvite(req, res, tunnel) {
     const expiresAt = new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString();
     const db = getDb();
     db.prepare('INSERT INTO invitations (token, email, role, expires_at) VALUES (?, ?, ?, ?)')
-        .run(token, body.email ?? null, role, expiresAt);
+        .run(token, email || null, role, expiresAt);
     // The dashboard copies the same link the mail carries (#788). It gets null when the only address is
     // the mail's localhost fallback or a loopback relay.url, and builds from the browser's origin instead.
     const inviteUrl = `${buildInviteBaseUrl(config, tunnel)}/invite?token=${token}`;
     const offered = forTeammates(resolvePublicBaseUrl(config, tunnel)) === null ? null : inviteUrl;
     let emailSent = false;
-    if (body.email) {
+    if (email) {
         const html = `<p>You've been invited to join tapflow as <strong>${role}</strong>.</p>
 <p><a href="${inviteUrl}">Accept invitation</a></p>
 <p>This link expires in 7 days.</p>`;
-        emailSent = await sendMail(body.email, 'You have been invited to tapflow', html);
+        emailSent = await sendMail(email, 'You have been invited to tapflow', html);
     }
     json(res, 201, { token, emailSent, inviteUrl: offered });
 }
@@ -52,7 +58,7 @@ export async function handleUpdateMember(req, res, params, onAuthChanged = () =>
     if (result.changes === 0)
         return json(res, 404, { error: 'Member not found' });
     // A demoted Admin's agent tokens stop working now, including on sockets already open.
-    onAuthChanged();
+    onAuthChanged({ userId: Number(params.id) });
     json(res, 200, { ok: true });
 }
 export function handleDeleteMember(req, res, params, onAuthChanged = () => { }) {
@@ -67,7 +73,7 @@ export function handleDeleteMember(req, res, params, onAuthChanged = () => { })
     if (result.changes === 0)
         return json(res, 404, { error: 'Member not found' });
     // Their cookie and PATs (cascaded) stop working on HTTP at once; this closes their open sockets too.
-    onAuthChanged();
+    onAuthChanged({ userId: Number(params.id) });
     json(res, 204, null);
 }
 //# sourceMappingURL=team.js.map

package/dist/api/team.js.map

@@ -1 +1 @@
-{"version":3,"file":"team.js","sourceRoot":"","sources":["../../src/api/team.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,oBAAoB,EAAsB,MAAM,qBAAqB,CAAA;AAEhH,MAAM,UAAU,iBAAiB,CAAC,GAAyB,EAAE,GAAwB;IACnF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CACxB,mFAAmF,CACpF,CAAC,GAAG,EAAE,CAAA;IACP,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAyB,EAAE,GAAwB,EAAE,MAAsB;IAC5G,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAoC,GAAG,CAAC,CAAA;IACnE,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC,IAAK;QACZ,CAAC,CAAC,IAAI,CAAA;IAER,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;IAE3E,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,EAAE,CAAC,OAAO,CAAC,8EAA8E,CAAC;SACvF,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IAElD,oGAAoG;IACpG,uGAAuG;IACvG,MAAM,SAAS,GAAG,GAAG,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,EAAE,CAAA;IAC/E,MAAM,OAAO,GAAG,YAAY,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IAE9F,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,qDAAqD,IAAI;cAC5D,SAAS;oCACa,CAAA;QAChC,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,kCAAkC,EAAE,IAAI,CAAC,CAAA;IAClF,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAA;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAyB,EACzB,GAAwB,EACxB,MAA8B,EAC9B,gBAA4B,GAAG,EAAE,GAAE,CAAC;IAEpC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAoB,GAAG,CAAC,CAAA;IACnD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAA;IACzD,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;IAC7F,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC9E,sFAAsF;IACtF,aAAa,EAAE,CAAA;IACf,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,GAAyB,EACzB,GAAwB,EACxB,MAA8B,EAC9B,gBAA4B,GAAG,EAAE,GAAE,CAAC;IAEpC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC1E,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC9E,qGAAqG;IACrG,aAAa,EAAE,CAAA;IACf,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AACtB,CAAC"}
+{"version":3,"file":"team.js","sourceRoot":"","sources":["../../src/api/team.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAE7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,oBAAoB,EAAsB,MAAM,qBAAqB,CAAA;AAEhH,MAAM,UAAU,iBAAiB,CAAC,GAAyB,EAAE,GAAwB;IACnF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CACxB,mFAAmF,CACpF,CAAC,GAAG,EAAE,CAAA;IACP,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAyB,EAAE,GAAwB,EAAE,MAAsB;IAC5G,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAoC,GAAG,CAAC,CAAA;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,yEAAyE;IACzE,IAAI,KAAK,IAAI,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;IACvF,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC,IAAK;QACZ,CAAC,CAAC,IAAI,CAAA;IAER,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;IAE3E,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,EAAE,CAAC,OAAO,CAAC,8EAA8E,CAAC;SACvF,GAAG,CAAC,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IAE7C,oGAAoG;IACpG,uGAAuG;IACvG,MAAM,SAAS,GAAG,GAAG,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,EAAE,CAAA;IAC/E,MAAM,OAAO,GAAG,YAAY,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IAE9F,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,GAAG,qDAAqD,IAAI;cAC5D,SAAS;oCACa,CAAA;QAChC,SAAS,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,kCAAkC,EAAE,IAAI,CAAC,CAAA;IAC7E,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAA;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAyB,EACzB,GAAwB,EACxB,MAA8B,EAC9B,gBAAiD,GAAG,EAAE,GAAE,CAAC;IAEzD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAoB,GAAG,CAAC,CAAA;IACnD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAA;IACzD,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;IAC7F,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC9E,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IAC5C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,GAAyB,EACzB,GAAwB,EACxB,MAA8B,EAC9B,gBAAiD,GAAG,EAAE,GAAE,CAAC;IAEzD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC1E,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC9E,qGAAqG;IACrG,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IAC5C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AACtB,CAAC"}

package/dist/api/tokens.d.ts

@@ -1,5 +1,6 @@
 import http from 'http';
+import { type AuthChange } from '../lib/connectionAuth.js';
 export declare function handleListTokens(req: http.IncomingMessage, res: http.ServerResponse): void;
 export declare function handleCreateToken(req: http.IncomingMessage, res: http.ServerResponse): Promise<void>;
-export declare function handleRevokeToken(req: http.IncomingMessage, res: http.ServerResponse, params: Record<string, string>, onAuthChanged?: () => void): void;
+export declare function handleRevokeToken(req: http.IncomingMessage, res: http.ServerResponse, params: Record<string, string>, onAuthChanged?: (affected?: AuthChange) => void): void;
 //# sourceMappingURL=tokens.d.ts.map

package/dist/api/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/api/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAUvB,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAS1F;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA6C1G;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,aAAa,GAAE,MAAM,IAAe,GACnC,IAAI,CAaN"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/api/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAKvB,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAKvE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAS1F;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAkD1G;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,aAAa,GAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,KAAK,IAAe,GACxD,IAAI,CAaN"}

package/dist/api/tokens.js

@@ -14,10 +14,16 @@ export function handleListTokens(req, res) {
     json(res, 200, tokens);
 }
 export async function handleCreateToken(req, res) {
+    if (!requireAuth(req, res))
+        return;
+    const body = await readJson(req);
+    // Checked again once the body is in: a request can hold its body back for as long as it likes, and a
+    // password reset that commits meanwhile revokes every token of the account and ends its sessions. A
+    // token minted from the check made before the wait would outlive that reset. From here to the INSERT
+    // nothing awaits, so no reset can land between this check and the write.
     const auth = requireAuth(req, res);
     if (!auth)
         return;
-    const body = await readJson(req);
     if (!body.name?.trim())
         return json(res, 400, { error: 'name required' });
     const scopes = (body.scope?.trim() || DEFAULT_SCOPE).split(',').map((s) => s.trim());
@@ -63,7 +69,7 @@ export function handleRevokeToken(req, res, params, onAuthChanged = () => { }) {
     if (result.changes === 0)
         return json(res, 404, { error: 'Token not found' });
     // Closes the sockets that were opened with it.
-    onAuthChanged();
+    onAuthChanged({ userId: auth.userId, scope: 'token', patId: Number(params.id) });
     json(res, 204, null);
 }
 //# sourceMappingURL=tokens.js.map

package/dist/api/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/api/tokens.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAEtD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAA;AACrE,MAAM,aAAa,GAAG,mBAAmB,CAAA;AAEzC,MAAM,UAAU,gBAAgB,CAAC,GAAyB,EAAE,GAAwB;IAClF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB,qIAAqI,CACtI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAClB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAyB,EAAE,GAAwB;IACzF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA8D,GAAG,CAAC,CAAA;IAC7F,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAA;IAEzE,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACpF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,2BAA2B,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IAC/F,CAAC;IACD,8DAA8D;IAC9D,qFAAqF;IACrF,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAC1C,IAAI,IAAI,KAAK,IAAI;YAAE,OAAM;QACzB,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,WAAW,iCAAiC,EAAE,CAAC,CAAA;QACpF,CAAC;IACH,CAAC;IAED,4GAA4G;IAC5G,sHAAsH;IACtH,gHAAgH;IAChH,uGAAuG;IACvG,MAAM,GAAG,GAAY,IAAI,CAAC,eAAe,CAAA;IACzC,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG;YAC/B,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC5D,CAAC,CAAC,GAAG,CAAA;IACP,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAChF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;QACxF,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qHAAqH,EAAE,CAAC,CAAA;IACzJ,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IACrE,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACnC,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAEhE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,EAAE,CAAC,OAAO,CACR,0GAA0G,CAC3G,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAA;IAE5E,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;AACrC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,GAAyB,EACzB,GAAwB,EACxB,MAA8B,EAC9B,gBAA4B,GAAG,EAAE,GAAE,CAAC;IAEpC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB,iEAAiE,CAClE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAE7B,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC7E,+CAA+C;IAC/C,aAAa,EAAE,CAAA;IACf,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AACtB,CAAC"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/api/tokens.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAmB,MAAM,0BAA0B,CAAA;AAEvE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAA;AACrE,MAAM,aAAa,GAAG,mBAAmB,CAAA;AAEzC,MAAM,UAAU,gBAAgB,CAAC,GAAyB,EAAE,GAAwB;IAClF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB,qIAAqI,CACtI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAClB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAyB,EAAE,GAAwB;IACzF,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IAElC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA8D,GAAG,CAAC,CAAA;IAC7F,qGAAqG;IACrG,oGAAoG;IACpG,qGAAqG;IACrG,yEAAyE;IACzE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAM;IACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAA;IAEzE,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACpF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,2BAA2B,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IAC/F,CAAC;IACD,8DAA8D;IAC9D,qFAAqF;IACrF,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAC1C,IAAI,IAAI,KAAK,IAAI;YAAE,OAAM;QACzB,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,WAAW,iCAAiC,EAAE,CAAC,CAAA;QACpF,CAAC;IACH,CAAC;IAED,4GAA4G;IAC5G,sHAAsH;IACtH,gHAAgH;IAChH,uGAAuG;IACvG,MAAM,GAAG,GAAY,IAAI,CAAC,eAAe,CAAA;IACzC,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG;YAC/B,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC5D,CAAC,CAAC,GAAG,CAAA;IACP,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAChF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;QACxF,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qHAAqH,EAAE,CAAC,CAAA;IACzJ,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IACrE,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACnC,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAEhE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,EAAE,CAAC,OAAO,CACR,0GAA0G,CAC3G,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAA;IAE5E,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;AACrC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,GAAyB,EACzB,GAAwB,EACxB,MAA8B,EAC9B,gBAAiD,GAAG,EAAE,GAAE,CAAC;IAEzD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB,iEAAiE,CAClE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAE7B,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC7E,+CAA+C;IAC/C,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IAChF,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AACtB,CAAC"}

package/dist/lib/adminAccount.d.ts

@@ -5,11 +5,6 @@ export declare function verifyPassword(password: string, stored: string): boolea
  *
  * Shared so the two bootstrap paths cannot disagree about what "already initialized" means.
  *
- * They are not identical in every respect: the boot path trims `TAPFLOW_ADMIN_EMAIL` and the HTTP
- * one stores `body.email` as sent, so the same address with surrounding whitespace produces two
- * different rows and the HTTP one never matches `handleLogin`'s `WHERE email = ?`. Normalising
- * inside this function would change what a shipped endpoint stores, so it is a decision rather than
- * a fix here — tracked separately.
  */
 export declare function isInitialized(): boolean;
 /** Why `createAdminAccount` refused, or `ok`. The caller turns this into an HTTP status or a log line. */

package/dist/lib/adminAccount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adminAccount.d.ts","sourceRoot":"","sources":["../../src/lib/adminAccount.ts"],"names":[],"mappings":"AAgBA,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIzD;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAQxE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAGvC;AAED,0GAA0G;AAC1G,MAAM,MAAM,iBAAiB,GAAG,IAAI,GAAG,gBAAgB,GAAG,oBAAoB,CAAA;AAE9E;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CAOrF"}
+{"version":3,"file":"adminAccount.d.ts","sourceRoot":"","sources":["../../src/lib/adminAccount.ts"],"names":[],"mappings":"AAiBA,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIzD;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAQxE;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAGvC;AAED,0GAA0G;AAC1G,MAAM,MAAM,iBAAiB,GAAG,IAAI,GAAG,gBAAgB,GAAG,oBAAoB,CAAA;AAE9E;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CAUrF"}

package/dist/lib/adminAccount.js

@@ -1,5 +1,6 @@
 import crypto from 'crypto';
 import { getDb } from '../db.js';
+import { normalizeEmail } from './email.js';
 // The first-owner rules, and the password hashing they need.
 //
 // **Why this is in `lib/` and not beside the HTTP handlers.** Two callers need it: `api/auth.ts`
@@ -32,11 +33,6 @@ export function verifyPassword(password, stored) {
  *
  * Shared so the two bootstrap paths cannot disagree about what "already initialized" means.
  *
- * They are not identical in every respect: the boot path trims `TAPFLOW_ADMIN_EMAIL` and the HTTP
- * one stores `body.email` as sent, so the same address with surrounding whitespace produces two
- * different rows and the HTTP one never matches `handleLogin`'s `WHERE email = ?`. Normalising
- * inside this function would change what a shipped endpoint stores, so it is a decision rather than
- * a fix here — tracked separately.
  */
 export function isInitialized() {
     const { n } = getDb().prepare('SELECT COUNT(*) as n FROM users').get();
@@ -49,13 +45,16 @@ export function isInitialized() {
  * differently: 403 over HTTP, a silent no-op on every restart at boot.
  */
 export function createAdminAccount(email, password) {
-    if (!email || !password)
+    // Normalized here rather than by each caller, so the boot path and `POST /auth/init` store the same
+    // value for the same address (#715).
+    const stored = email ? normalizeEmail(email) : '';
+    if (!stored || !password)
         return 'missing-fields';
     if (password.length < 8)
         return 'password-too-short';
     getDb()
         .prepare('INSERT INTO users (email, display_name, role, password_hash) VALUES (?, ?, ?, ?)')
-        .run(email, 'Admin', 'Admin', makePasswordHash(password));
+        .run(stored, 'Admin', 'Admin', makePasswordHash(password));
     return 'ok';
 }
 //# sourceMappingURL=adminAccount.js.map