@things-factory/auth-base 10.1.183 → 10.1.192

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.183",
+  "version": "10.1.192",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -35,9 +35,9 @@
     "@reduxjs/toolkit": "^2.2.5",
     "@simplewebauthn/browser": "^13.0.0",
     "@simplewebauthn/server": "^13.0.0",
-    "@things-factory/email-base": "^10.1.179",
+    "@things-factory/email-base": "^10.1.188",
     "@things-factory/env": "^10.1.149",
-    "@things-factory/shell": "^10.1.179",
+    "@things-factory/shell": "^10.1.188",
     "@things-factory/utils": "^10.1.179",
     "@types/webappsec-credential-management": "^0.6.9",
     "jsonwebtoken": "^9.0.0",
@@ -49,5 +49,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "c36684e0db8353f5f4523ed55111df3154bae19e"
+  "gitHead": "c44fe3ae4646dc4ffad7947785322acdb84c7374"
 }

package/tests/activate-page-case.test.ts

@@ -0,0 +1,53 @@
+import { loadCompiled } from './compiled'
+
+const { authenticate401Middleware } = loadCompiled('middlewares/authenticate-401-middleware')
+const { AuthError } = loadCompiled('errors/auth-error')
+const CODES = loadCompiled('constants/error-code')
+
+/**
+ * One page, `auth-activate`, answers a locked account and one not yet confirmed. It said "your
+ * account is not activated" to both: the reason was in `message`, and the page never read it. A
+ * locked person was not told why, nor that the unlock mail had already gone.
+ *
+ * The page tells the two apart by `errorCode`, so that is what this holds - for both cases.
+ */
+
+async function pageFor(errorCode: string) {
+  let rendered: any
+
+  const context: any = {
+    t: (key: string) => key,
+    method: 'GET',
+    header: { accept: 'text/html' },
+    path: '/',
+    originalUrl: '/',
+    query: {},
+    request: { body: {} },
+    render: async (view: string, options: any) => {
+      rendered = { view, ...options }
+    }
+  }
+
+  await authenticate401Middleware(context, async () => {
+    throw new AuthError({ errorCode, detail: { username: 'kim', email: 'kim@example.com' } })
+  })
+
+  return rendered
+}
+
+describe.each([CODES.USER_LOCKED, CODES.USER_NOT_ACTIVATED])('%s', errorCode => {
+  it('goes to the activate page with its code', async () => {
+    const page = await pageFor(errorCode)
+
+    expect(page.pageElement).toBe('auth-activate')
+    expect(page.data.errorCode).toBe(errorCode)
+  })
+})
+
+it('the page reads the locked code by the spelling the server sends', () => {
+  const { readFileSync } = require('fs')
+  const { join } = require('path')
+  const page = readFileSync(join(__dirname, '..', '..', 'auth-ui', 'client', 'entries', 'auth', 'activate.ts'), 'utf-8')
+
+  expect(page).toContain(`this.data?.errorCode === '${CODES.USER_LOCKED}'`)
+})

package/tests/mail-request-answers-db.test.ts

@@ -0,0 +1,139 @@
+const mockSentMail: any[] = []
+let mockMailFails = false
+
+jest.mock('@things-factory/email-base', () => ({
+  sendEmail: async (mail: any) => {
+    if (mockMailFails) throw new Error('smtp down')
+    mockSentMail.push(mail)
+  }
+}))
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { User } = loadCompiled('service/user/user')
+const { authPublicProcessRouter } = loadCompiled('router/auth-public-process-router')
+
+/**
+ * What the two "mail me" posts answer - forgot-password and resend-verification-email.
+ *
+ * Both set nothing when there was no account to mail, or when the mail did not go, so koa answered
+ * a bare 404 and the page showed "Not Found" - the same words for "no such address" and "the mail
+ * server is down". Now they give one answer whether or not the address has an account (another
+ * would tell anyone which addresses are registered), and fail only when a mail was due and did not
+ * go.
+ *
+ * The handler is taken from the router's own table, so the path is the one the page posts to.
+ */
+
+function handler(path: string) {
+  const layer = authPublicProcessRouter.stack.find((layer: any) => layer.path === path && layer.methods.includes('POST'))
+
+  return layer.stack[layer.stack.length - 1]
+}
+
+async function post(path: string, body: any) {
+  const context: any = {
+    t: (key: string) => key,
+    lng: 'en-US',
+    headers: {},
+    header: {},
+    request: { protocol: 'https', host: 'acme.example.com', body }
+  }
+
+  await handler(path)(context, async () => {})
+
+  return { status: context.status, body: context.body }
+}
+
+let domain: any
+
+async function person(email: string, status: string) {
+  const salt = User.generateSalt()
+
+  return await getRepository(User).save({
+    username: email.split('@')[0],
+    email,
+    name: 'Kim',
+    salt,
+    password: User.encode('Passw0rd!', salt),
+    status,
+    domains: [domain]
+  })
+}
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  domain = await getRepository(Domain).save({ name: 'plant-a', subdomain: 'plant-a' })
+  mockSentMail.length = 0
+  mockMailFails = false
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+describe('forgot-password', () => {
+  const PATH = '/auth/forgot-password'
+
+  it('mails a registered address', async () => {
+    await person('kim@example.com', 'activated')
+
+    expect(await post(PATH, { email: 'kim@example.com' })).toEqual({ status: 200, body: 'text.password reset email sent' })
+    expect(mockSentMail.map(mail => mail.receiver)).toEqual(['kim@example.com'])
+  })
+
+  it('answers an unknown address the same way, and mails nobody', async () => {
+    await person('kim@example.com', 'activated')
+
+    expect(await post(PATH, { email: 'nobody@example.com' })).toEqual({ status: 200, body: 'text.password reset email sent' })
+    expect(mockSentMail).toEqual([])
+  })
+
+  it('says so when the mail does not go', async () => {
+    await person('kim@example.com', 'activated')
+    mockMailFails = true
+
+    expect(await post(PATH, { email: 'kim@example.com' })).toEqual({ status: 503, body: 'error.mail could not be sent' })
+  })
+})
+
+describe('resend-verification-email', () => {
+  const PATH = '/auth/resend-verification-email'
+
+  it('mails an account waiting for confirmation', async () => {
+    await person('kim@example.com', 'inactive')
+
+    expect(await post(PATH, { email: 'kim@example.com' })).toEqual({ status: 200, body: 'text.verification email sent' })
+    expect(mockSentMail.map(mail => mail.receiver)).toEqual(['kim@example.com'])
+  })
+
+  it.each([
+    ['an unknown address', 'nobody@example.com'],
+    ['an account already confirmed', 'lee@example.com']
+  ])('answers %s the same way, and mails nobody', async (_, email) => {
+    await person('lee@example.com', 'activated')
+
+    expect(await post(PATH, { email })).toEqual({ status: 200, body: 'text.verification email sent' })
+    expect(mockSentMail).toEqual([])
+  })
+
+  it('mails nobody for a post without an address', async () => {
+    /* ⚠ TypeORM drops an undefined condition - this matched the first account and mailed it. */
+    await person('kim@example.com', 'inactive')
+
+    expect(await post(PATH, {})).toEqual({ status: 200, body: 'text.verification email sent' })
+    expect(mockSentMail).toEqual([])
+  })
+
+  it('says so when the mail does not go', async () => {
+    await person('kim@example.com', 'inactive')
+    mockMailFails = true
+
+    expect(await post(PATH, { email: 'kim@example.com' })).toEqual({ status: 503, body: 'error.mail could not be sent' })
+  })
+})

package/translations/en.json

@@ -7,6 +7,7 @@
   "error.email already exists": "email already used by another user",
   "error.failed to find x": "failed to find {x}",
   "error.invalid username": "invalid username: {username}",
+  "error.mail could not be sent": "the email could not be sent. try again in a moment.",
   "error.ownership required": "unauthorized! domain or system ownership required",
   "error.password should be supported": "initial password or default password should be supported",
   "error.password should match the rule": "password should match following rule. ${rule}",
@@ -211,7 +212,7 @@
   "text.invalid verification token": "invalid verification token",
   "text.invitation email sent": "invitation email sent",
   "text.password changed successfully": "password changed successfully",
-  "text.password reset email sent": "password reset email sent",
+  "text.password reset email sent": "if an account uses this address, a password reset email is on its way.",
   "text.password reset succeed": "password reset succeed",
   "text.pattern_atleast_1_digit": "at least 1 digit character",
   "text.pattern_atleast_1_lowercase": "at least 1 lowercase character",
@@ -226,7 +227,7 @@
   "text.user credential registered successfully": "device registration has been successfully completed. You can now use biometric authentication.",
   "text.user inactivated successfully": "user inactivated successfully",
   "text.user registered successfully": "user registered successfully. find your email to activate account",
-  "text.verification email sent": "verification email sent",
+  "text.verification email sent": "if an account at this address is waiting for confirmation, a verification email is on its way.",
   "privilege.description": "{name} {category}",
   "error.access-request-names-nothing": "an access request names a category and a privilege.",
   "error.access-request-unknown-privilege": "there is no privilege {privilege}.",

package/translations/es.json

@@ -7,6 +7,7 @@
   "error.email already exists": "el correo electrónico ya lo usa otro usuario",
   "error.failed to find x": "no se encontró {x}",
   "error.invalid username": "nombre de usuario no válido: {username}",
+  "error.mail could not be sent": "no se pudo enviar el correo. vuelva a intentarlo en un momento.",
   "error.ownership required": "¡no autorizado! se requiere la propiedad del dominio o del sistema",
   "error.password should be supported": "se debe proporcionar una contraseña inicial o una contraseña predeterminada",
   "error.password should match the rule": "la contraseña debe cumplir la siguiente regla. ${rule}",
@@ -211,7 +212,7 @@
   "text.invalid verification token": "token de verificación no válido",
   "text.invitation email sent": "correo de invitación enviado",
   "text.password changed successfully": "contraseña cambiada correctamente",
-  "text.password reset email sent": "correo de restablecimiento de contraseña enviado",
+  "text.password reset email sent": "si hay una cuenta con esta dirección, le enviamos un correo de restablecimiento de contraseña.",
   "text.password reset succeed": "contraseña restablecida correctamente",
   "text.pattern_atleast_1_digit": "al menos 1 dígito",
   "text.pattern_atleast_1_lowercase": "al menos 1 letra minúscula",
@@ -226,7 +227,7 @@
   "text.user credential registered successfully": "el registro del dispositivo se ha completado correctamente. Ya puede usar la autenticación biométrica.",
   "text.user inactivated successfully": "usuario desactivado correctamente",
   "text.user registered successfully": "usuario registrado correctamente. busque el correo electrónico para activar la cuenta",
-  "text.verification email sent": "correo de verificación enviado",
+  "text.verification email sent": "si una cuenta con esta dirección espera confirmación, le enviamos un correo de verificación.",
   "privilege.description": "{name} de {category}",
   "error.access-request-names-nothing": "una solicitud de acceso indica una categoría y un privilegio.",
   "error.access-request-unknown-privilege": "no existe el privilegio {privilege}.",

package/translations/ja.json

@@ -7,6 +7,7 @@
   "error.email already exists": "メールはすでに他のユーザーによって使用されています.",
   "error.failed to find x": "{x}が見つかりません.",
   "error.invalid username": "無効なユーザー名: {username}",
+  "error.mail could not be sent": "メールを送れませんでした. しばらくしてからもう一度お試しください.",
   "error.ownership required": "権限がありません。$t(term.domain)またはシステムの所有者権限が必要です。",
   "error.password should be supported": "初期パスワードまたはデフォルトパスワードがサポートされるべきです",
   "error.password should match the rule": "パスワードは次の規則を守らなければなりません. {rule}",
@@ -51,7 +52,7 @@
   "text.invalid verification token": "確認トークンが無効です.",
   "text.invitation email sent": "招待メールを送りました.",
   "text.password changed successfully": "パスワードが正常に変更されました.",
-  "text.password reset email sent": "パスワード リセットメールを送りました.",
+  "text.password reset email sent": "登録済みのアドレスであれば、パスワード リセットメールを送りました.",
   "text.password reset succeed": "パスワードが正常にリセットされました.",
   "text.pattern_atleast_1_digit": "少なくとも1つの数字",
   "text.pattern_atleast_1_lowercase": "少なくとも１つの小文字",
@@ -66,7 +67,7 @@
   "text.user credential registered successfully": "デバイスの登録が正常に完了しました。今後は生体認証を使用できます。",
   "text.user inactivated successfully": "ユーザーが正常に非アクティブ化されました.",
   "text.user registered successfully": "ユーザーが正常に登録されました. 確認メールでアカウントを有効にしてください.",
-  "text.verification email sent": "確認メールを送りました.",
+  "text.verification email sent": "確認待ちのアカウントのアドレスであれば、確認メールを送りました.",
   "privilege.allows.accounting.mutation": "伝票を起票・修正・締めできます。",
   "privilege.allows.accounting.query": "伝票と勘定残高を閲覧できます。",
   "privilege.allows.activity-instance.mutation": "業務を開始・引き継ぎ・完了・中断できます。",

package/translations/ko.json

@@ -7,6 +7,7 @@
   "error.email already exists": "이메일이 이미 사용되고 있습니다.",
   "error.failed to find x": "{x}을(를) 찾을 수 없습니다.",
   "error.invalid username": "유효하지 않은 사용자 이름: {username}",
+  "error.mail could not be sent": "메일을 보내지 못했습니다. 잠시 후 다시 시도하십시오.",
   "error.ownership required": "권한이 없습니다. $t(term.domain) 또는 시스템 소유자 권한이 필요합니다.",
   "error.password should be supported": "초기 비밀번호나 디폴트 비밀번호가 제공되어야 합니다.",
   "error.password should match the rule": "비밀번호는 다음 규칙을 지켜야 합니다. {rule}",
@@ -211,7 +212,7 @@
   "text.invalid verification token": "확인 토큰이 유효하지 않습니다.",
   "text.invitation email sent": "초대 이메일을 보냈습니다.",
   "text.password changed successfully": "비밀번호가 성공적으로 변경되었습니다.",
-  "text.password reset email sent": "비밀번호 재설정 이메일을 보냈습니다.",
+  "text.password reset email sent": "가입된 주소라면 비밀번호 재설정 메일을 보냈습니다.",
   "text.password reset succeed": "비밀번호 성공적으로 재설정되었습니다.",
   "text.pattern_atleast_1_digit": "최소 1개 숫자",
   "text.pattern_atleast_1_lowercase": "최소 1개 소문자",
@@ -226,7 +227,7 @@
   "text.user credential registered successfully": "기기 등록이 성공적으로 완료되었습니다. 이제 바이오메트릭 인증을 사용할 수 있습니다.",
   "text.user inactivated successfully": "사용자가 성공적으로 비활성화되었습니다.",
   "text.user registered successfully": "사용자가 성공적으로 등록되었습니다. 확인 이메일을 통해서 계정을 활성화하시기 바랍니다.",
-  "text.verification email sent": "확인 이메일을 보냈습니다.",
+  "text.verification email sent": "확인을 기다리는 계정의 주소라면 확인 메일을 보냈습니다.",
   "privilege.description": "{category} {name}",
   "error.access-request-names-nothing": "권한 요청에는 범주와 권한이 있어야 합니다.",
   "error.access-request-unknown-privilege": "{privilege} 권한이 없습니다.",

package/translations/ms.json

@@ -7,6 +7,7 @@
   "error.email already exists": "Emel telah digunakan oleh pengguna lain",
   "error.failed to find x": "Gagal mencari {x}",
   "error.invalid username": "Nama pengguna tidak sah: {username}",
+  "error.mail could not be sent": "E-mel tidak dapat dihantar. Cuba lagi sebentar lagi.",
   "error.ownership required": "tidak dibenarkan! kebenaran pemilik domain atau sistem diperlukan",
   "error.password should be supported": "kata laluan awal atau kata laluan lalai harus disokong",
   "error.password should match the rule": "Kata laluan harus mematuhi peraturan berikut. ${rule}",
@@ -51,7 +52,7 @@
   "text.invalid verification token": "Token pengesahan tidak sah",
   "text.invitation email sent": "E-mel jemputan telah dihantar",
   "text.password changed successfully": "Kata laluan berjaya diubah",
-  "text.password reset email sent": "E-mel reset kata laluan telah dihantar",
+  "text.password reset email sent": "Jika alamat ini didaftarkan, e-mel reset kata laluan telah dihantar",
   "text.password reset succeed": "Reset kata laluan berjaya",
   "text.pattern_atleast_1_digit": "Sekurang-kurangnya 1 aksara digit",
   "text.pattern_atleast_1_lowercase": "Sekurang-kurangnya 1 aksara kecil",
@@ -66,7 +67,7 @@
   "text.user credential registered successfully": "pendaftaran peranti berjaya diselesaikan. Kini anda boleh menggunakan pengesahan biometrik.",
   "text.user inactivated successfully": "Pengguna tidak aktif dengan berjaya",
   "text.user registered successfully": "Pengguna berjaya didaftarkan. Cari e-mel anda untuk mengaktifkan akaun",
-  "text.verification email sent": "E-mel pengesahan telah dihantar",
+  "text.verification email sent": "Jika akaun dengan alamat ini menunggu pengesahan, e-mel pengesahan telah dihantar",
   "privilege.allows.accounting.mutation": "boleh mengepos, membetulkan dan menutup baucar.",
   "privilege.allows.accounting.query": "boleh melihat baucar dan baki akaun.",
   "privilege.allows.activity-instance.mutation": "boleh memulakan, menyerahkan, dan menamatkan atau membatalkan kerja.",

package/translations/zh.json

@@ -7,6 +7,7 @@
   "error.email already exists": "电子邮件已被其他用户使用！",
   "error.failed to find x": "查询{x}失败！",
   "error.invalid username": "无效的用户名: {username}",
+  "error.mail could not be sent": "邮件未能发送。请稍后再试。",
   "error.ownership required": "没有权限。需要$t(term.domain)或系统所有者权限。",
   "error.password should be supported": "应支持初始密码或默认密码",
   "error.password should match the rule": "密码应符合以下规则。${rule}",
@@ -51,7 +52,7 @@
   "text.invalid verification token": "令牌无效。",
   "text.invitation email sent": "成功发送邀请电子邮件。",
   "text.password changed successfully": "密码更改成功。",
-  "text.password reset email sent": "已发送密码重置邮件。",
+  "text.password reset email sent": "如果该地址已注册，我们已发送密码重置邮件。",
   "text.password reset succeed": "密码重置成功。",
   "text.pattern_atleast_1_digit": "至少1位数字字符",
   "text.pattern_atleast_1_lowercase": "至少1个小写字母",
@@ -66,7 +67,7 @@
   "text.user credential registered successfully": "设备注册已成功完成。现在可以使用生物识别认证。",
   "text.user inactivated successfully": "用户已成功停用",
   "text.user registered successfully": "用户注册成功。 请查看电子邮件以激活帐户。",
-  "text.verification email sent": "验证邮件已发送",
+  "text.verification email sent": "如果该地址的账号正在等待验证，我们已发送验证邮件。",
   "privilege.allows.accounting.mutation": "可以过账、更正和结账凭证。",
   "privilege.allows.accounting.query": "可以查看凭证和科目余额。",
   "privilege.allows.activity-instance.mutation": "可以开始、移交、完成或中止工作。",