@things-factory/auth-base 10.1.188 → 10.1.192

package/dist-server/controllers/verification.d.ts

@@ -9,4 +9,8 @@ export declare function sendVerificationEmail({ user, context }: {
     context: any;
 }): Promise<boolean>;
 export declare function verify(token: any): Promise<void>;
-export declare function resendVerificationEmail(email: any, context: any): Promise<boolean>;
+/**
+ * `'not-due'` when no account at this address waits for confirmation, so the route can answer it
+ * the way it answers a sent mail. `'failed'` only when a mail was due and did not go.
+ */
+export declare function resendVerificationEmail(email: any, context: any): Promise<'sent' | 'not-due' | 'failed'>;

package/dist-server/controllers/verification.js

@@ -66,19 +66,24 @@ async function verify(token) {
     await (0, shell_1.getRepository)(user_js_1.User).save(userInfo);
     await (0, find_verification_token_js_1.consumeVerificationToken)(verification);
 }
+/**
+ * `'not-due'` when no account at this address waits for confirmation, so the route can answer it
+ * the way it answers a sent mail. `'failed'` only when a mail was due and did not go.
+ */
 async function resendVerificationEmail(email, context) {
+    /* TypeORM drops an undefined condition from `where` - without this, a post with no address
+       matched the first account in the table and mailed it. */
+    if (!email)
+        return 'not-due';
     var user = await (0, shell_1.getRepository)(user_js_1.User).findOne({
         where: {
             email
         }
     });
     if (!user)
-        return false;
+        return 'not-due';
     if (user.status == user_js_1.UserStatus.ACTIVATED)
-        return false;
-    return await sendVerificationEmail({
-        user,
-        context
-    });
+        return 'not-due';
+    return (await sendVerificationEmail({ user, context })) ? 'sent' : 'failed';
 }
 //# sourceMappingURL=verification.js.map

package/dist-server/controllers/verification.js.map

@@ -1 +1 @@
-{"version":3,"file":"verification.js","sourceRoot":"","sources":["../../server/controllers/verification.ts"],"names":[],"mappings":";;;AAmBA,sDAsBC;AAED,wBA4BC;AAED,0DAcC;AAvFD,2DAAsD;AACtD,iDAAqD;AAErD,2DAAmD;AACnD,qDAA0D;AAC1D,+FAA2F;AAC3F,8EAA6E;AAC7E,kEAAyD;AACzD,mFAAwG;AACxG,mFAA0E;AAC1E,mFAA0E;AAE1E;;;;GAIG;AACU,QAAA,iBAAiB,GAAG,cAAc,CAAA;AAExC,KAAK,UAAU,qBAAqB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;IAC3D,IAAI,CAAC;QACH,IAAI,KAAK,GAAG,IAAA,kDAAqB,GAAE,CAAA;QACnC,IAAI,WAAW,GAAG,MAAM,IAAA,kDAAqB,EAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAE7D,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,UAAU,GAAG,GAAG,IAAA,gCAAY,EAAC,yBAAiB,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAA;YACvE,MAAM,IAAA,sBAAS,EAAC;gBACd,QAAQ,EAAE,IAAI,CAAC,KAAK;gBACpB,OAAO,EAAE,mBAAmB;gBAC5B,OAAO,EAAE,IAAA,gDAAwB,EAAC;oBAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,SAAS,EAAE,UAAU;iBACtB,CAAC;aACH,CAAC,CAAA;YAEF,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,MAAM,CAAC,KAAK;IAChC,qGAAqG;IACrG,IAAI,YAAY,GAAG,MAAM,IAAA,sDAAyB,EAAC,KAAK,EAAE,6CAAqB,CAAC,UAAU,CAAC,CAAA;IAE3F,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,yBAAS,CAAC;YAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,kBAAkB;SACpD,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAA;IAC/E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,yBAAS,CAAC;YAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,kBAAkB;SACpD,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,oBAAU,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,IAAI,oBAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,yBAAS,CAAC;YAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,kBAAkB;SACpD,CAAC,CAAA;IACJ,CAAC;IAED,QAAQ,CAAC,MAAM,GAAG,oBAAU,CAAC,SAAS,CAAA;IACtC,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAA;IAEtB,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACxC,MAAM,IAAA,qDAAwB,EAAC,YAAY,CAAC,CAAA;AAC9C,CAAC;AAEM,KAAK,UAAU,uBAAuB,CAAC,KAAK,EAAE,OAAO;IAC1D,IAAI,IAAI,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;QAC3C,KAAK,EAAE;YACL,KAAK;SACN;KACF,CAAC,CAAA;IAEF,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,IAAI,CAAC,MAAM,IAAI,oBAAU,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAErD,OAAO,MAAM,qBAAqB,CAAC;QACjC,IAAI;QACJ,OAAO;KACR,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { sendEmail } from '@things-factory/email-base'\nimport { getRepository } from '@things-factory/shell'\n\nimport { AuthError } from '../errors/auth-error.js'\nimport { User, UserStatus } from '../service/user/user.js'\nimport { VerificationTokenType } from '../service/verification-token/verification-token.js'\nimport { getVerificationEmailForm } from '../templates/verification-email.js'\nimport { buildAuthURL } from '../utils/build-auth-url.js'\nimport { consumeVerificationToken, findLiveVerificationToken } from './utils/find-verification-token.js'\nimport { makeVerificationToken } from './utils/make-verification-token.js'\nimport { saveVerificationToken } from './utils/save-verification-token.js'\n\n/**\n * The page the mail links to. The token rides after `#`, so the browser never sends it — not to our\n * access log, not to a proxy's. The page reads it and posts it. `tests/invitation-route.test.ts`\n * holds this against the router's table.\n */\nexport const VERIFY_EMAIL_PATH = '/auth/verify'\n\nexport async function sendVerificationEmail({ user, context }) {\n  try {\n    var token = makeVerificationToken()\n    var verifaction = await saveVerificationToken(user.id, token)\n\n    if (verifaction) {\n      var serviceUrl = `${buildAuthURL(VERIFY_EMAIL_PATH, context)}#${token}`\n      await sendEmail({\n        receiver: user.email,\n        subject: 'Verify your email',\n        content: getVerificationEmailForm({\n          username: user.username,\n          name: user.name,\n          verifyUrl: serviceUrl\n        })\n      })\n\n      return true\n    }\n  } catch (e) {\n    return false\n  }\n}\n\nexport async function verify(token) {\n  /* Activation only. This read the token alone, so a reset or unlock link confirmed an address too. */\n  var verification = await findLiveVerificationToken(token, VerificationTokenType.ACTIVATION)\n\n  if (!verification) {\n    throw new AuthError({\n      errorCode: AuthError.ERROR_CODES.VERIFICATION_ERROR\n    })\n  }\n\n  var userInfo = await getRepository(User).findOneBy({ id: verification.userId })\n  if (!userInfo) {\n    throw new AuthError({\n      errorCode: AuthError.ERROR_CODES.VERIFICATION_ERROR\n    })\n  }\n\n  if (!(userInfo.status == UserStatus.INACTIVE || userInfo.status == UserStatus.LOCKED)) {\n    throw new AuthError({\n      errorCode: AuthError.ERROR_CODES.VERIFICATION_ERROR\n    })\n  }\n\n  userInfo.status = UserStatus.ACTIVATED\n  userInfo.failCount = 0\n\n  await getRepository(User).save(userInfo)\n  await consumeVerificationToken(verification)\n}\n\nexport async function resendVerificationEmail(email, context) {\n  var user = await getRepository(User).findOne({\n    where: {\n      email\n    }\n  })\n\n  if (!user) return false\n  if (user.status == UserStatus.ACTIVATED) return false\n\n  return await sendVerificationEmail({\n    user,\n    context\n  })\n}\n"]}
+{"version":3,"file":"verification.js","sourceRoot":"","sources":["../../server/controllers/verification.ts"],"names":[],"mappings":";;;AAmBA,sDAsBC;AAED,wBA4BC;AAMD,0DAeC;AA5FD,2DAAsD;AACtD,iDAAqD;AAErD,2DAAmD;AACnD,qDAA0D;AAC1D,+FAA2F;AAC3F,8EAA6E;AAC7E,kEAAyD;AACzD,mFAAwG;AACxG,mFAA0E;AAC1E,mFAA0E;AAE1E;;;;GAIG;AACU,QAAA,iBAAiB,GAAG,cAAc,CAAA;AAExC,KAAK,UAAU,qBAAqB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;IAC3D,IAAI,CAAC;QACH,IAAI,KAAK,GAAG,IAAA,kDAAqB,GAAE,CAAA;QACnC,IAAI,WAAW,GAAG,MAAM,IAAA,kDAAqB,EAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAE7D,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,UAAU,GAAG,GAAG,IAAA,gCAAY,EAAC,yBAAiB,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAA;YACvE,MAAM,IAAA,sBAAS,EAAC;gBACd,QAAQ,EAAE,IAAI,CAAC,KAAK;gBACpB,OAAO,EAAE,mBAAmB;gBAC5B,OAAO,EAAE,IAAA,gDAAwB,EAAC;oBAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,SAAS,EAAE,UAAU;iBACtB,CAAC;aACH,CAAC,CAAA;YAEF,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,MAAM,CAAC,KAAK;IAChC,qGAAqG;IACrG,IAAI,YAAY,GAAG,MAAM,IAAA,sDAAyB,EAAC,KAAK,EAAE,6CAAqB,CAAC,UAAU,CAAC,CAAA;IAE3F,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,yBAAS,CAAC;YAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,kBAAkB;SACpD,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAA;IAC/E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,yBAAS,CAAC;YAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,kBAAkB;SACpD,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,oBAAU,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,IAAI,oBAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,yBAAS,CAAC;YAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,kBAAkB;SACpD,CAAC,CAAA;IACJ,CAAC;IAED,QAAQ,CAAC,MAAM,GAAG,oBAAU,CAAC,SAAS,CAAA;IACtC,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAA;IAEtB,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACxC,MAAM,IAAA,qDAAwB,EAAC,YAAY,CAAC,CAAA;AAC9C,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,uBAAuB,CAAC,KAAK,EAAE,OAAO;IAC1D;+DAC2D;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAE5B,IAAI,IAAI,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;QAC3C,KAAK,EAAE;YACL,KAAK;SACN;KACF,CAAC,CAAA;IAEF,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAA;IAC3B,IAAI,IAAI,CAAC,MAAM,IAAI,oBAAU,CAAC,SAAS;QAAE,OAAO,SAAS,CAAA;IAEzD,OAAO,CAAC,MAAM,qBAAqB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC7E,CAAC","sourcesContent":["import { sendEmail } from '@things-factory/email-base'\nimport { getRepository } from '@things-factory/shell'\n\nimport { AuthError } from '../errors/auth-error.js'\nimport { User, UserStatus } from '../service/user/user.js'\nimport { VerificationTokenType } from '../service/verification-token/verification-token.js'\nimport { getVerificationEmailForm } from '../templates/verification-email.js'\nimport { buildAuthURL } from '../utils/build-auth-url.js'\nimport { consumeVerificationToken, findLiveVerificationToken } from './utils/find-verification-token.js'\nimport { makeVerificationToken } from './utils/make-verification-token.js'\nimport { saveVerificationToken } from './utils/save-verification-token.js'\n\n/**\n * The page the mail links to. The token rides after `#`, so the browser never sends it — not to our\n * access log, not to a proxy's. The page reads it and posts it. `tests/invitation-route.test.ts`\n * holds this against the router's table.\n */\nexport const VERIFY_EMAIL_PATH = '/auth/verify'\n\nexport async function sendVerificationEmail({ user, context }) {\n  try {\n    var token = makeVerificationToken()\n    var verifaction = await saveVerificationToken(user.id, token)\n\n    if (verifaction) {\n      var serviceUrl = `${buildAuthURL(VERIFY_EMAIL_PATH, context)}#${token}`\n      await sendEmail({\n        receiver: user.email,\n        subject: 'Verify your email',\n        content: getVerificationEmailForm({\n          username: user.username,\n          name: user.name,\n          verifyUrl: serviceUrl\n        })\n      })\n\n      return true\n    }\n  } catch (e) {\n    return false\n  }\n}\n\nexport async function verify(token) {\n  /* Activation only. This read the token alone, so a reset or unlock link confirmed an address too. */\n  var verification = await findLiveVerificationToken(token, VerificationTokenType.ACTIVATION)\n\n  if (!verification) {\n    throw new AuthError({\n      errorCode: AuthError.ERROR_CODES.VERIFICATION_ERROR\n    })\n  }\n\n  var userInfo = await getRepository(User).findOneBy({ id: verification.userId })\n  if (!userInfo) {\n    throw new AuthError({\n      errorCode: AuthError.ERROR_CODES.VERIFICATION_ERROR\n    })\n  }\n\n  if (!(userInfo.status == UserStatus.INACTIVE || userInfo.status == UserStatus.LOCKED)) {\n    throw new AuthError({\n      errorCode: AuthError.ERROR_CODES.VERIFICATION_ERROR\n    })\n  }\n\n  userInfo.status = UserStatus.ACTIVATED\n  userInfo.failCount = 0\n\n  await getRepository(User).save(userInfo)\n  await consumeVerificationToken(verification)\n}\n\n/**\n * `'not-due'` when no account at this address waits for confirmation, so the route can answer it\n * the way it answers a sent mail. `'failed'` only when a mail was due and did not go.\n */\nexport async function resendVerificationEmail(email, context): Promise<'sent' | 'not-due' | 'failed'> {\n  /* TypeORM drops an undefined condition from `where` - without this, a post with no address\n     matched the first account in the table and mailed it. */\n  if (!email) return 'not-due'\n\n  var user = await getRepository(User).findOne({\n    where: {\n      email\n    }\n  })\n\n  if (!user) return 'not-due'\n  if (user.status == UserStatus.ACTIVATED) return 'not-due'\n\n  return (await sendVerificationEmail({ user, context })) ? 'sent' : 'failed'\n}\n"]}

package/dist-server/middlewares/authenticate-401-middleware.js

@@ -52,6 +52,8 @@ async function authenticate401Middleware(context, next) {
                     elementScript: '/auth/activate.js',
                     data: {
                         ...err.detail,
+                        /* One page answers both - the code is how it tells a locked account from one not yet confirmed. */
+                        errorCode: err.errorCode,
                         message,
                         redirectTo,
                         disableUserSignupProcess,
@@ -65,6 +67,8 @@ async function authenticate401Middleware(context, next) {
                     elementScript: '/auth/activate.js',
                     data: {
                         ...err.detail,
+                        /* One page answers both - the code is how it tells a locked account from one not yet confirmed. */
+                        errorCode: err.errorCode,
                         message,
                         redirectTo,
                         disableUserSignupProcess,

package/dist-server/middlewares/authenticate-401-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate-401-middleware.js","sourceRoot":"","sources":["../../server/middlewares/authenticate-401-middleware.ts"],"names":[],"mappings":";;AAUA,8DAuGC;AAjHD,6CAA4C;AAE5C,8DAAiH;AACjH,2DAAmD;AACnD,oDAA6C;AAE7C,MAAM,wBAAwB,GAAG,YAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;AAC9E,MAAM,0BAA0B,GAAG,YAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;AACvF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;AAE9C,KAAK,UAAU,yBAAyB,CAAC,OAAO,EAAE,IAAI;IAC3D,IAAI,CAAC;QACH,MAAM,IAAI,EAAE,CAAA;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,CAAA;QAEX,IAAI,GAAG,YAAY,yBAAS,EAAE,CAAC;YAC7B,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,SAAS,EAAE,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAA;QACjG,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,EAAE,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,GAAG,CAAA;YACX,CAAC;YAED,OAAO,GAAG,GAAG,CAAC,OAAO,CAAA;QACvB,CAAC;QAED,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;QAEtB;;;;WAIG;QAEH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;QAErD,IAAI,MAAM,IAAI,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACpD,IAAI,GAAG,CAAC,SAAS,IAAI,kCAAkB,EAAE,CAAC;gBACxC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;YACtB,CAAC;YACD,OAAM;QACR,CAAC;QAED,IAAI,CAAC,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YAClD,OAAM;QACR,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACrC,MAAM,EAAE,UAAU,GAAG,WAAW,IAAI,WAAW,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;QAE9E,QAAQ,GAAG,CAAC,SAAS,EAAE,CAAC;YACtB,KAAK,kCAAkB;gBACrB,OAAO,CAAC,QAAQ,CAAC,6BAA6B,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBAC/E,MAAK;YAEP,KAAK,2BAAW;gBACd,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBACvC,WAAW,EAAE,eAAe;oBAC5B,aAAa,EAAE,mBAAmB;oBAClC,IAAI,EAAE;wBACJ,GAAG,GAAG,CAAC,MAAM;wBACb,OAAO;wBACP,UAAU;wBACV,wBAAwB;wBACxB,0BAA0B;wBAC1B,SAAS;qBACV;iBACF,CAAC,CAAA;YAEJ,KAAK,kCAAkB;gBACrB,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBACvC,WAAW,EAAE,eAAe;oBAC5B,aAAa,EAAE,mBAAmB;oBAClC,IAAI,EAAE;wBACJ,GAAG,GAAG,CAAC,MAAM;wBACb,OAAO;wBACP,UAAU;wBACV,wBAAwB;wBACxB,0BAA0B;wBAC1B,SAAS;qBACV;iBACF,CAAC,CAAA;YAEJ,KAAK,+BAAe;gBAClB,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBACvC,WAAW,EAAE,aAAa;oBAC1B,aAAa,EAAE,iBAAiB;oBAChC,IAAI,EAAE;wBACJ,GAAG,GAAG,CAAC,MAAM;wBACb,OAAO;wBACP,UAAU;wBACV,wBAAwB;wBACxB,0BAA0B;wBAC1B,SAAS;qBACV;iBACF,CAAC,CAAA;YAEJ;gBACE,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBACvC,WAAW,EAAE,aAAa;oBAC1B,aAAa,EAAE,iBAAiB;oBAChC,IAAI,EAAE;wBACJ,GAAG,GAAG,CAAC,MAAM;wBACb,OAAO,EAAE,GAAG,YAAY,yBAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;wBAChD,UAAU;wBACV,wBAAwB;wBACxB,0BAA0B;wBAC1B,SAAS;qBACV;iBACF,CAAC,CAAA;QACN,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { config } from '@things-factory/env'\n\nimport { SUBDOMAIN_NOTFOUND, USER_DUPLICATED, USER_LOCKED, USER_NOT_ACTIVATED } from '../constants/error-code.js'\nimport { AuthError } from '../errors/auth-error.js'\nimport { accepts } from '../utils/accepts.js'\n\nconst disableUserSignupProcess = config.get('disableUserSignupProcess', false)\nconst disableUserFavoredLanguage = config.get('i18n/disableUserFavoredLanguage', false)\nconst languages = config.get('i18n/languages', false)\n\nexport async function authenticate401Middleware(context, next) {\n  try {\n    await next()\n  } catch (err) {\n    var message\n\n    if (err instanceof AuthError) {\n      message = (context.t && context.t(`error.${err.errorCode}`, err.detail || {})) || err.errorCode\n    } else {\n      if (err?.status !== 401) {\n        throw err\n      }\n\n      message = err.message\n    }\n\n    context.status = 401\n    context.body = message\n\n    /*\n     * 클라이언트 라우팅을 위한 ApiHistoryFallback의 상황과,\n     * 서버라우팅의 상황에서 발생하는 던져지는 401 에러인 경우에는\n     * error code에 맞춰서 적절하게 rewriting 되도록 한다.\n     */\n\n    const { method, header, path, originalUrl } = context\n\n    if (method == 'POST' && path.startsWith('/graphql')) {\n      if (err.errorCode == SUBDOMAIN_NOTFOUND) {\n        context.status = 403\n      }\n      return\n    }\n\n    if (!accepts(header.accept, ['text/html', '*/*'])) {\n      return\n    }\n\n    const { redirect_to } = context.query\n    const { redirectTo = redirect_to || originalUrl } = context.request.body || {}\n\n    switch (err.errorCode) {\n      case SUBDOMAIN_NOTFOUND:\n        context.redirect(`/auth/checkin?redirect_to=${encodeURIComponent(redirectTo)}`)\n        break\n\n      case USER_LOCKED:\n        return await context.render('auth-page', {\n          pageElement: 'auth-activate',\n          elementScript: '/auth/activate.js',\n          data: {\n            ...err.detail,\n            message,\n            redirectTo,\n            disableUserSignupProcess,\n            disableUserFavoredLanguage,\n            languages\n          }\n        })\n\n      case USER_NOT_ACTIVATED:\n        return await context.render('auth-page', {\n          pageElement: 'auth-activate',\n          elementScript: '/auth/activate.js',\n          data: {\n            ...err.detail,\n            message,\n            redirectTo,\n            disableUserSignupProcess,\n            disableUserFavoredLanguage,\n            languages\n          }\n        })\n\n      case USER_DUPLICATED:\n        return await context.render('auth-page', {\n          pageElement: 'auth-signup',\n          elementScript: '/auth/signup.js',\n          data: {\n            ...err.detail,\n            message,\n            redirectTo,\n            disableUserSignupProcess,\n            disableUserFavoredLanguage,\n            languages\n          }\n        })\n\n      default:\n        return await context.render('auth-page', {\n          pageElement: 'auth-signin',\n          elementScript: '/auth/signin.js',\n          data: {\n            ...err.detail,\n            message: err instanceof AuthError ? message : '',\n            redirectTo,\n            disableUserSignupProcess,\n            disableUserFavoredLanguage,\n            languages\n          }\n        })\n    }\n  }\n}\n"]}
+{"version":3,"file":"authenticate-401-middleware.js","sourceRoot":"","sources":["../../server/middlewares/authenticate-401-middleware.ts"],"names":[],"mappings":";;AAUA,8DA2GC;AArHD,6CAA4C;AAE5C,8DAAiH;AACjH,2DAAmD;AACnD,oDAA6C;AAE7C,MAAM,wBAAwB,GAAG,YAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;AAC9E,MAAM,0BAA0B,GAAG,YAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;AACvF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;AAE9C,KAAK,UAAU,yBAAyB,CAAC,OAAO,EAAE,IAAI;IAC3D,IAAI,CAAC;QACH,MAAM,IAAI,EAAE,CAAA;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,CAAA;QAEX,IAAI,GAAG,YAAY,yBAAS,EAAE,CAAC;YAC7B,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,SAAS,EAAE,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAA;QACjG,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,EAAE,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,GAAG,CAAA;YACX,CAAC;YAED,OAAO,GAAG,GAAG,CAAC,OAAO,CAAA;QACvB,CAAC;QAED,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;QAEtB;;;;WAIG;QAEH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;QAErD,IAAI,MAAM,IAAI,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACpD,IAAI,GAAG,CAAC,SAAS,IAAI,kCAAkB,EAAE,CAAC;gBACxC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;YACtB,CAAC;YACD,OAAM;QACR,CAAC;QAED,IAAI,CAAC,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YAClD,OAAM;QACR,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACrC,MAAM,EAAE,UAAU,GAAG,WAAW,IAAI,WAAW,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;QAE9E,QAAQ,GAAG,CAAC,SAAS,EAAE,CAAC;YACtB,KAAK,kCAAkB;gBACrB,OAAO,CAAC,QAAQ,CAAC,6BAA6B,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBAC/E,MAAK;YAEP,KAAK,2BAAW;gBACd,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBACvC,WAAW,EAAE,eAAe;oBAC5B,aAAa,EAAE,mBAAmB;oBAClC,IAAI,EAAE;wBACJ,GAAG,GAAG,CAAC,MAAM;wBACb,mGAAmG;wBACnG,SAAS,EAAE,GAAG,CAAC,SAAS;wBACxB,OAAO;wBACP,UAAU;wBACV,wBAAwB;wBACxB,0BAA0B;wBAC1B,SAAS;qBACV;iBACF,CAAC,CAAA;YAEJ,KAAK,kCAAkB;gBACrB,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBACvC,WAAW,EAAE,eAAe;oBAC5B,aAAa,EAAE,mBAAmB;oBAClC,IAAI,EAAE;wBACJ,GAAG,GAAG,CAAC,MAAM;wBACb,mGAAmG;wBACnG,SAAS,EAAE,GAAG,CAAC,SAAS;wBACxB,OAAO;wBACP,UAAU;wBACV,wBAAwB;wBACxB,0BAA0B;wBAC1B,SAAS;qBACV;iBACF,CAAC,CAAA;YAEJ,KAAK,+BAAe;gBAClB,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBACvC,WAAW,EAAE,aAAa;oBAC1B,aAAa,EAAE,iBAAiB;oBAChC,IAAI,EAAE;wBACJ,GAAG,GAAG,CAAC,MAAM;wBACb,OAAO;wBACP,UAAU;wBACV,wBAAwB;wBACxB,0BAA0B;wBAC1B,SAAS;qBACV;iBACF,CAAC,CAAA;YAEJ;gBACE,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBACvC,WAAW,EAAE,aAAa;oBAC1B,aAAa,EAAE,iBAAiB;oBAChC,IAAI,EAAE;wBACJ,GAAG,GAAG,CAAC,MAAM;wBACb,OAAO,EAAE,GAAG,YAAY,yBAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;wBAChD,UAAU;wBACV,wBAAwB;wBACxB,0BAA0B;wBAC1B,SAAS;qBACV;iBACF,CAAC,CAAA;QACN,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { config } from '@things-factory/env'\n\nimport { SUBDOMAIN_NOTFOUND, USER_DUPLICATED, USER_LOCKED, USER_NOT_ACTIVATED } from '../constants/error-code.js'\nimport { AuthError } from '../errors/auth-error.js'\nimport { accepts } from '../utils/accepts.js'\n\nconst disableUserSignupProcess = config.get('disableUserSignupProcess', false)\nconst disableUserFavoredLanguage = config.get('i18n/disableUserFavoredLanguage', false)\nconst languages = config.get('i18n/languages', false)\n\nexport async function authenticate401Middleware(context, next) {\n  try {\n    await next()\n  } catch (err) {\n    var message\n\n    if (err instanceof AuthError) {\n      message = (context.t && context.t(`error.${err.errorCode}`, err.detail || {})) || err.errorCode\n    } else {\n      if (err?.status !== 401) {\n        throw err\n      }\n\n      message = err.message\n    }\n\n    context.status = 401\n    context.body = message\n\n    /*\n     * 클라이언트 라우팅을 위한 ApiHistoryFallback의 상황과,\n     * 서버라우팅의 상황에서 발생하는 던져지는 401 에러인 경우에는\n     * error code에 맞춰서 적절하게 rewriting 되도록 한다.\n     */\n\n    const { method, header, path, originalUrl } = context\n\n    if (method == 'POST' && path.startsWith('/graphql')) {\n      if (err.errorCode == SUBDOMAIN_NOTFOUND) {\n        context.status = 403\n      }\n      return\n    }\n\n    if (!accepts(header.accept, ['text/html', '*/*'])) {\n      return\n    }\n\n    const { redirect_to } = context.query\n    const { redirectTo = redirect_to || originalUrl } = context.request.body || {}\n\n    switch (err.errorCode) {\n      case SUBDOMAIN_NOTFOUND:\n        context.redirect(`/auth/checkin?redirect_to=${encodeURIComponent(redirectTo)}`)\n        break\n\n      case USER_LOCKED:\n        return await context.render('auth-page', {\n          pageElement: 'auth-activate',\n          elementScript: '/auth/activate.js',\n          data: {\n            ...err.detail,\n            /* One page answers both - the code is how it tells a locked account from one not yet confirmed. */\n            errorCode: err.errorCode,\n            message,\n            redirectTo,\n            disableUserSignupProcess,\n            disableUserFavoredLanguage,\n            languages\n          }\n        })\n\n      case USER_NOT_ACTIVATED:\n        return await context.render('auth-page', {\n          pageElement: 'auth-activate',\n          elementScript: '/auth/activate.js',\n          data: {\n            ...err.detail,\n            /* One page answers both - the code is how it tells a locked account from one not yet confirmed. */\n            errorCode: err.errorCode,\n            message,\n            redirectTo,\n            disableUserSignupProcess,\n            disableUserFavoredLanguage,\n            languages\n          }\n        })\n\n      case USER_DUPLICATED:\n        return await context.render('auth-page', {\n          pageElement: 'auth-signup',\n          elementScript: '/auth/signup.js',\n          data: {\n            ...err.detail,\n            message,\n            redirectTo,\n            disableUserSignupProcess,\n            disableUserFavoredLanguage,\n            languages\n          }\n        })\n\n      default:\n        return await context.render('auth-page', {\n          pageElement: 'auth-signin',\n          elementScript: '/auth/signin.js',\n          data: {\n            ...err.detail,\n            message: err instanceof AuthError ? message : '',\n            redirectTo,\n            disableUserSignupProcess,\n            disableUserFavoredLanguage,\n            languages\n          }\n        })\n    }\n  }\n}\n"]}

package/dist-server/router/auth-public-process-router.js

@@ -153,15 +153,22 @@ exports.authPublicProcessRouter.post('/verify', async (context, next) => {
         });
     }
 });
+/*
+ * This and forgot-password give one answer whether or not the address has an account to mail - a
+ * different one would tell anyone which addresses are registered. Only a mail that was due and did
+ * not go is a failure. Both used to set nothing in those cases, and koa answered a bare 404 that the
+ * page showed as "Not Found".
+ */
 exports.authPublicProcessRouter.post('/resend-verification-email', async (context, next) => {
     const { t } = context;
-    const { email } = context.request.body;
-    var succeed = await (0, verification_js_1.resendVerificationEmail)(email, context);
-    var message = t('text.verification email sent');
-    if (succeed) {
-        context.status = 200;
-        context.body = message;
+    const { email } = context.request.body || {};
+    if ((await (0, verification_js_1.resendVerificationEmail)(email, context)) == 'failed') {
+        context.status = 503;
+        context.body = t('error.mail could not be sent');
+        return;
     }
+    context.status = 200;
+    context.body = t('text.verification email sent');
 });
 /*
  * ── The invitation page ─────────────────────────────────────────────────────
@@ -211,14 +218,13 @@ exports.authPublicProcessRouter.post('/forgot-password', async (context, next) =
             email
         }
     });
-    const succeed = await (0, reset_password_js_1.sendPasswordResetEmail)({
-        user,
-        context
-    });
-    if (succeed) {
-        context.status = 200;
-        context.body = t('text.password reset email sent');
+    if (user && !(await (0, reset_password_js_1.sendPasswordResetEmail)({ user, context }))) {
+        context.status = 503;
+        context.body = t('error.mail could not be sent');
+        return;
     }
+    context.status = 200;
+    context.body = t('text.password reset email sent');
 });
 exports.authPublicProcessRouter.post('/reset-password', async (context, next) => {
     const { header, t } = context;

package/dist-server/router/auth-public-process-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-public-process-router.js","sourceRoot":"","sources":["../../server/router/auth-public-process-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAC/B,qCAA+B;AAE/B,6CAA4C;AAC5C,iDAAsE;AAEtE,gEAA+D;AAC/D,wEAAwF;AACxF,kEAA0D;AAC1D,oEAAgF;AAChF,qDAA8C;AAC9C,oDAA6C;AAC7C,4EAAwE;AAExE,MAAM,wBAAwB,GAAG,YAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;AAC9E,MAAM,0BAA0B,GAAG,YAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;AACvF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;AACrD,MAAM,YAAY,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI;IAC7C,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;IACf,KAAK,EAAE,IAAI;IACX,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,KAAK;IAClB,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,KAAK;IACtB,oBAAoB,EAAE,CAAC;IACvB,oBAAoB,EAAE,EAAE;CACzB,CAAA;AAEY,QAAA,uBAAuB,GAAG,IAAI,oBAAM,CAAC;IAChD,MAAM,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC5D,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAE5C,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IAEtC,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;QAC1B,SAAS,EAAE,CAAC,SAAS,CAAC;KACvB,CAAC,CAAA;IAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAC9B,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC,EAAE;YAC9B,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,QAAQ,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAA;IACpD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,QAAQ,CAAC,yBAAyB,KAAK,UAAU,KAAK,EAAE,CAAC,CAAA;IACnE,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC9D,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;IAE/B,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,2BAA2B,CAAC,CAAA;IAE7C,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,IAAA,uBAAe,EAAC,OAAO,CAAC,CAAC,CAAA;IAC5C,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAA;IAEvC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,iBAAiB;QAC9B,aAAa,EAAE,0BAA0B;QACzC,IAAI,EAAE;YACJ,KAAK;YACL,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;GAGG;AACH,+BAAuB,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACrE,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,gBAAgB;QAC7B,aAAa,EAAE,yBAAyB;QACxC,IAAI,EAAE;YACJ,YAAY;YACZ,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAClE,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,aAAa;QAC1B,aAAa,EAAE,sBAAsB;QACrC,IAAI,EAAE;YACJ,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;IAEhC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,eAAe;QAC5B,aAAa,EAAE,mBAAmB;QAClC,IAAI,EAAE;YACJ,KAAK;YACL,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;;GAIG;AACH,+BAAuB,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC7D,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,aAAa;QAC1B,aAAa,EAAE,iBAAiB;QAChC,IAAI,EAAE;YACJ,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC9D,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAE5C,IAAI,OAAe,CAAA;IAEnB,IAAI,CAAC;QACH,MAAM,IAAA,wBAAM,EAAC,KAAK,CAAC,CAAA;QACnB,OAAO,GAAG,CAAC,CAAC,kCAAkC,CAAC,CAAA;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,GAAG,CAAC,CAAC,iCAAiC,CAAC,CAAA;IAChD,CAAC;IAED,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;IAEtB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YAChC,WAAW,EAAE,aAAa;YAC1B,aAAa,EAAE,iBAAiB;YAChC,IAAI,EAAE;gBACJ,OAAO;gBACP,wBAAwB;gBACxB,0BAA0B;gBAC1B,SAAS;aACV;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACjF,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IACrB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEtC,IAAI,OAAO,GAAG,MAAM,IAAA,yCAAuB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAC3D,IAAI,OAAO,GAAG,CAAC,CAAC,8BAA8B,CAAC,CAAA;IAE/C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;IACxB,CAAC;AACH,CAAC,CAAC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,+BAAuB,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACxE,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,wBAAwB;QACrC,aAAa,EAAE,4BAA4B;QAC3C,IAAI,EAAE;YACJ,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;;GAIG;AACH,+BAAuB,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACzE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAK,EAAU,CAAA;IAE5E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gCAAgB,EAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IAE7F,OAAO,CAAC,IAAI,GAAG;QACb,SAAS,EAAE,MAAM,EAAE,SAAS;QAC5B,OAAO;QACP,UAAU,EAAE,4BAA4B,kBAAkB,CAAC,GAAG,CAAC,EAAE;KAClE,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACvE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IACrB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEtC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,EAAE,CAAA;IAEzB,MAAM,QAAQ,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE;YACL,KAAK;SACN;KACF,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,MAAM,IAAA,0CAAsB,EAAC;QAC3C,IAAI;QACJ,OAAO;KACR,CAAC,CAAA;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,gCAAgC,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEhD,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,CAAC;YACzB,IAAI,OAAO,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;YAErD,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;YACpB,OAAO,CAAC,IAAI,GAAG;gBACb,OAAO;aACR,CAAA;YAED,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBAChC,WAAW,EAAE,gBAAgB;oBAC7B,aAAa,EAAE,yBAAyB;oBACxC,IAAI,EAAE;wBACJ,KAAK;wBACL,OAAO;wBACP,YAAY;wBACZ,wBAAwB;wBACxB,0BAA0B;wBAC1B,SAAS;qBACV;iBACF,CAAC,CAAA;YACJ,CAAC;YAED,OAAM;QACR,CAAC;QAED,MAAM,IAAA,iCAAa,EAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QAE7C,IAAI,OAAO,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;QACrD,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;QAEtB,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;QAE/B,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,aAAa;gBAC1B,aAAa,EAAE,iBAAiB;gBAChC,IAAI,EAAE;oBACJ,OAAO;oBACP,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAA;QAExB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,gBAAgB;gBAC7B,aAAa,EAAE,yBAAyB;gBACxC,IAAI,EAAE;oBACJ,KAAK;oBACL,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,YAAY;oBACZ,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACnE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEhD;;uCAEmC;IACnC,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;QAEtD,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAU,EAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAEjD;;;;;;OAMG;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,CAAC,CAAC,iCAAiC,CAAC,CAAA;QAEpD,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;QAEtB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,aAAa;gBAC1B,aAAa,EAAE,sBAAsB;gBACrC,IAAI,EAAE;oBACJ,KAAK;oBACL,OAAO;oBACP,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;QAED,OAAM;IACR,CAAC;IAED,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,6BAA6B,CAAC,CAAA;IAE/C,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;IAE/B,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YAChC,WAAW,EAAE,aAAa;YAC1B,aAAa,EAAE,iBAAiB;YAChC,IAAI,EAAE;gBACJ,OAAO,EAAE,CAAC,CAAC,6BAA6B,CAAC;gBACzC,wBAAwB;gBACxB,0BAA0B;gBAC1B,SAAS;aACV;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA","sourcesContent":["import Router from 'koa-router'\nimport { ILike } from 'typeorm'\n\nimport { config } from '@things-factory/env'\nimport { getRepository, getSiteRootPath } from '@things-factory/shell'\n\nimport { acceptInvitation } from '../controllers/invitation.js'\nimport { resetPassword, sendPasswordResetEmail } from '../controllers/reset-password.js'\nimport { unlockUser } from '../controllers/unlock-user.js'\nimport { resendVerificationEmail, verify } from '../controllers/verification.js'\nimport { User } from '../service/user/user.js'\nimport { accepts } from '../utils/accepts.js'\nimport { clearAccessTokenCookie } from '../utils/access-token-cookie.js'\n\nconst disableUserSignupProcess = config.get('disableUserSignupProcess', false)\nconst disableUserFavoredLanguage = config.get('i18n/disableUserFavoredLanguage', false)\nconst languages = config.get('i18n/languages', false)\nconst passwordRule = config.get('password') || {\n  lowerCase: true,\n  upperCase: true,\n  digit: true,\n  specialCharacter: true,\n  allowRepeat: false,\n  useTightPattern: true,\n  useLoosePattern: false,\n  tightCharacterLength: 8,\n  looseCharacterLength: 15\n}\n\nexport const authPublicProcessRouter = new Router({\n  prefix: '/auth'\n})\n\nauthPublicProcessRouter.post('/join', async (context, next) => {\n  const { email } = context.request.body || {}\n\n  const repository = getRepository(User)\n\n  var user = await repository.findOne({\n    where: { username: email },\n    relations: ['domains']\n  })\n\n  if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n    user = await repository.findOne({\n      where: { email: ILike(email) },\n      relations: ['domains']\n    })\n  }\n\n  if (user) {\n    context.redirect(`/auth/signin?username=${email}`)\n  } else {\n    context.redirect(`/auth/signup?username=${email}&email=${email}`)\n  }\n})\n\nauthPublicProcessRouter.all('/signout', async (context, next) => {\n  const { header, t } = context\n  clearAccessTokenCookie(context)\n\n  context.body = t('text.signout successfully')\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    context.redirect(getSiteRootPath(context))\n  }\n})\n\nauthPublicProcessRouter.get('/forgot-password', async (context, next) => {\n  const { email } = context.request.query\n\n  await context.render('auth-page', {\n    pageElement: 'forgot-password',\n    elementScript: '/auth/forgot-password.js',\n    data: {\n      email,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\n/*\n * The mailed link is `/auth/reset-password#<token>` (and the same shape for unlock and verify). The\n * page reads the token from the fragment; this request never carries it, so nothing here reads one.\n */\nauthPublicProcessRouter.get('/reset-password', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'reset-password',\n    elementScript: '/auth/reset-password.js',\n    data: {\n      passwordRule,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.get('/unlock-user', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'unlock-user',\n    elementScript: '/auth/unlock-user.js',\n    data: {\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.get('/activate/:email', async (context, next) => {\n  const { email } = context.params\n\n  await context.render('auth-page', {\n    pageElement: 'auth-activate',\n    elementScript: '/auth/activate.js',\n    data: {\n      email,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\n/*\n * Confirming an address is a POST from the page, not the GET of the link. The link used to be\n * `/auth/verify/<token>` and opening it confirmed — so did any mail scanner that fetched it, and the\n * token sat in every access log on the way.\n */\nauthPublicProcessRouter.get('/verify', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'auth-verify',\n    elementScript: '/auth/verify.js',\n    data: {\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.post('/verify', async (context, next) => {\n  const { header, t } = context\n  const { token } = context.request.body || {}\n\n  let message: string\n\n  try {\n    await verify(token)\n    message = t('text.user activated successfully')\n  } catch (e) {\n    context.status = 404\n    message = t('text.invalid verification token')\n  }\n\n  context.body = message\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    await context.render('auth-page', {\n      pageElement: 'auth-result',\n      elementScript: '/auth/result.js',\n      data: {\n        message,\n        disableUserSignupProcess,\n        disableUserFavoredLanguage,\n        languages\n      }\n    })\n  }\n})\n\nauthPublicProcessRouter.post('/resend-verification-email', async (context, next) => {\n  const { t } = context\n  const { email } = context.request.body\n\n  var succeed = await resendVerificationEmail(email, context)\n  var message = t('text.verification email sent')\n\n  if (succeed) {\n    context.status = 200\n    context.body = message\n  }\n})\n\n/*\n * ── The invitation page ─────────────────────────────────────────────────────\n * Public on purpose: the person following this link is not a member of the domain yet, which is\n * the entire point of an invitation. The old link went to `/auth/accept/<token>`, a path with no\n * route on any router, so it fell through to the private history-fallback — and the domain gate\n * there turned the invitee away for not being a member. It asked somebody trying to join to\n * already have joined.\n *\n * ── Why the token is not in this path ───────────────────────────────────────\n * It rides in the link's fragment (`#<token>`), which browsers do not send. So the request line\n * here carries nothing, and the token stays out of access logs, proxy logs and `Referer`. The\n * page reads it from the fragment, clears it from the address bar, and posts it below.\n */\nauthPublicProcessRouter.get('/accept-invitation', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'auth-accept-invitation',\n    elementScript: '/auth/accept-invitation.js',\n    data: {\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\n/*\n * The address is asked for as well as the token. A forwarded mail is the one way the token can\n * still travel, and nothing about where it sits can prevent that — so holding the link is not\n * enough on its own.\n */\nauthPublicProcessRouter.post('/accept-invitation', async (context, next) => {\n  const { token, email, name, password } = context.request.body || ({} as any)\n\n  const { domain, created } = await acceptInvitation({ token, email, name, password, context })\n\n  context.body = {\n    subdomain: domain?.subdomain,\n    created,\n    redirectTo: `/auth/signin?redirect_to=${encodeURIComponent('/')}`\n  }\n})\n\nauthPublicProcessRouter.post('/forgot-password', async (context, next) => {\n  const { t } = context\n  const { email } = context.request.body\n\n  if (!email) return next()\n\n  const userRepo = getRepository(User)\n  const user = await userRepo.findOne({\n    where: {\n      email\n    }\n  })\n\n  const succeed = await sendPasswordResetEmail({\n    user,\n    context\n  })\n\n  if (succeed) {\n    context.status = 200\n    context.body = t('text.password reset email sent')\n  }\n})\n\nauthPublicProcessRouter.post('/reset-password', async (context, next) => {\n  const { header, t } = context\n  const { password, token } = context.request.body\n\n  try {\n    if (!(token && password)) {\n      let message = t('error.token or password is invalid')\n\n      context.status = 404\n      context.body = {\n        message\n      }\n\n      if (accepts(header.accept, ['text/html', '*/*'])) {\n        await context.render('auth-page', {\n          pageElement: 'reset-password',\n          elementScript: '/auth/reset-password.js',\n          data: {\n            token,\n            message,\n            passwordRule,\n            disableUserSignupProcess,\n            disableUserFavoredLanguage,\n            languages\n          }\n        })\n      }\n\n      return\n    }\n\n    await resetPassword(token, password, context)\n\n    var message = t('text.password changed successfully')\n    context.body = message\n\n    clearAccessTokenCookie(context)\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'auth-result',\n        elementScript: '/auth/result.js',\n        data: {\n          message,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n  } catch (e) {\n    context.status = 404\n    context.body = e.message\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'reset-password',\n        elementScript: '/auth/reset-password.js',\n        data: {\n          token,\n          message: e.message,\n          passwordRule,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n  }\n})\n\nauthPublicProcessRouter.post('/unlock-user', async (context, next) => {\n  const { header, t } = context\n  const { password, token } = context.request.body\n\n  /* Both are required, the way `/auth/reset-password` requires them. This read `||`, so a body\n     carrying a password and no token passed the guard and reached the unlock with no token —\n     see the note in `unlockUser`. */\n  if (!(token && password)) {\n    context.status = 404\n    context.body = t('error.token or password is invalid')\n\n    return\n  }\n\n  const succeed = await unlockUser(token, password)\n\n  /*\n   * Say what happened. The success page used to render whether or not the unlock took, so a\n   * reused link, a token for another account, or an account that was never locked all read as\n   * \"account is reactivated\" — and the person then could not sign in.\n   *\n   * A refusal returns to the form with a reason, the shape `/auth/reset-password` already uses.\n   */\n  if (!succeed) {\n    const message = t('text.invalid verification token')\n\n    context.status = 404\n    context.body = message\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'unlock-user',\n        elementScript: '/auth/unlock-user.js',\n        data: {\n          token,\n          message,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n\n    return\n  }\n\n  context.body = t('text.password reset succeed')\n\n  clearAccessTokenCookie(context)\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    await context.render('auth-page', {\n      pageElement: 'auth-result',\n      elementScript: '/auth/result.js',\n      data: {\n        message: t('text.account is reactivated'),\n        disableUserSignupProcess,\n        disableUserFavoredLanguage,\n        languages\n      }\n    })\n  }\n})\n"]}
+{"version":3,"file":"auth-public-process-router.js","sourceRoot":"","sources":["../../server/router/auth-public-process-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAC/B,qCAA+B;AAE/B,6CAA4C;AAC5C,iDAAsE;AAEtE,gEAA+D;AAC/D,wEAAwF;AACxF,kEAA0D;AAC1D,oEAAgF;AAChF,qDAA8C;AAC9C,oDAA6C;AAC7C,4EAAwE;AAExE,MAAM,wBAAwB,GAAG,YAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;AAC9E,MAAM,0BAA0B,GAAG,YAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;AACvF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;AACrD,MAAM,YAAY,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI;IAC7C,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;IACf,KAAK,EAAE,IAAI;IACX,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,KAAK;IAClB,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,KAAK;IACtB,oBAAoB,EAAE,CAAC;IACvB,oBAAoB,EAAE,EAAE;CACzB,CAAA;AAEY,QAAA,uBAAuB,GAAG,IAAI,oBAAM,CAAC;IAChD,MAAM,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC5D,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAE5C,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IAEtC,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;QAC1B,SAAS,EAAE,CAAC,SAAS,CAAC;KACvB,CAAC,CAAA;IAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAC9B,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC,EAAE;YAC9B,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,QAAQ,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAA;IACpD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,QAAQ,CAAC,yBAAyB,KAAK,UAAU,KAAK,EAAE,CAAC,CAAA;IACnE,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC9D,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;IAE/B,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,2BAA2B,CAAC,CAAA;IAE7C,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,IAAA,uBAAe,EAAC,OAAO,CAAC,CAAC,CAAA;IAC5C,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAA;IAEvC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,iBAAiB;QAC9B,aAAa,EAAE,0BAA0B;QACzC,IAAI,EAAE;YACJ,KAAK;YACL,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;GAGG;AACH,+BAAuB,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACrE,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,gBAAgB;QAC7B,aAAa,EAAE,yBAAyB;QACxC,IAAI,EAAE;YACJ,YAAY;YACZ,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAClE,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,aAAa;QAC1B,aAAa,EAAE,sBAAsB;QACrC,IAAI,EAAE;YACJ,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;IAEhC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,eAAe;QAC5B,aAAa,EAAE,mBAAmB;QAClC,IAAI,EAAE;YACJ,KAAK;YACL,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;;GAIG;AACH,+BAAuB,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC7D,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,aAAa;QAC1B,aAAa,EAAE,iBAAiB;QAChC,IAAI,EAAE;YACJ,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC9D,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAE5C,IAAI,OAAe,CAAA;IAEnB,IAAI,CAAC;QACH,MAAM,IAAA,wBAAM,EAAC,KAAK,CAAC,CAAA;QACnB,OAAO,GAAG,CAAC,CAAC,kCAAkC,CAAC,CAAA;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,GAAG,CAAC,CAAC,iCAAiC,CAAC,CAAA;IAChD,CAAC;IAED,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;IAEtB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YAChC,WAAW,EAAE,aAAa;YAC1B,aAAa,EAAE,iBAAiB;YAChC,IAAI,EAAE;gBACJ,OAAO;gBACP,wBAAwB;gBACxB,0BAA0B;gBAC1B,SAAS;aACV;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA;AAEF;;;;;GAKG;AACH,+BAAuB,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACjF,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IACrB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAE5C,IAAI,CAAC,MAAM,IAAA,yCAAuB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;QAChE,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,8BAA8B,CAAC,CAAA;QAChD,OAAM;IACR,CAAC;IAED,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;IACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,8BAA8B,CAAC,CAAA;AAClD,CAAC,CAAC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,+BAAuB,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACxE,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,wBAAwB;QACrC,aAAa,EAAE,4BAA4B;QAC3C,IAAI,EAAE;YACJ,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;;GAIG;AACH,+BAAuB,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACzE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAK,EAAU,CAAA;IAE5E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gCAAgB,EAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IAE7F,OAAO,CAAC,IAAI,GAAG;QACb,SAAS,EAAE,MAAM,EAAE,SAAS;QAC5B,OAAO;QACP,UAAU,EAAE,4BAA4B,kBAAkB,CAAC,GAAG,CAAC,EAAE;KAClE,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACvE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IACrB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEtC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,EAAE,CAAA;IAEzB,MAAM,QAAQ,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE;YACL,KAAK;SACN;KACF,CAAC,CAAA;IAEF,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAA,0CAAsB,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,8BAA8B,CAAC,CAAA;QAChD,OAAM;IACR,CAAC;IAED,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;IACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,gCAAgC,CAAC,CAAA;AACpD,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEhD,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,CAAC;YACzB,IAAI,OAAO,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;YAErD,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;YACpB,OAAO,CAAC,IAAI,GAAG;gBACb,OAAO;aACR,CAAA;YAED,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBAChC,WAAW,EAAE,gBAAgB;oBAC7B,aAAa,EAAE,yBAAyB;oBACxC,IAAI,EAAE;wBACJ,KAAK;wBACL,OAAO;wBACP,YAAY;wBACZ,wBAAwB;wBACxB,0BAA0B;wBAC1B,SAAS;qBACV;iBACF,CAAC,CAAA;YACJ,CAAC;YAED,OAAM;QACR,CAAC;QAED,MAAM,IAAA,iCAAa,EAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QAE7C,IAAI,OAAO,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;QACrD,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;QAEtB,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;QAE/B,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,aAAa;gBAC1B,aAAa,EAAE,iBAAiB;gBAChC,IAAI,EAAE;oBACJ,OAAO;oBACP,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAA;QAExB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,gBAAgB;gBAC7B,aAAa,EAAE,yBAAyB;gBACxC,IAAI,EAAE;oBACJ,KAAK;oBACL,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,YAAY;oBACZ,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACnE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEhD;;uCAEmC;IACnC,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;QAEtD,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAU,EAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAEjD;;;;;;OAMG;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,CAAC,CAAC,iCAAiC,CAAC,CAAA;QAEpD,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;QAEtB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,aAAa;gBAC1B,aAAa,EAAE,sBAAsB;gBACrC,IAAI,EAAE;oBACJ,KAAK;oBACL,OAAO;oBACP,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;QAED,OAAM;IACR,CAAC;IAED,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,6BAA6B,CAAC,CAAA;IAE/C,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;IAE/B,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YAChC,WAAW,EAAE,aAAa;YAC1B,aAAa,EAAE,iBAAiB;YAChC,IAAI,EAAE;gBACJ,OAAO,EAAE,CAAC,CAAC,6BAA6B,CAAC;gBACzC,wBAAwB;gBACxB,0BAA0B;gBAC1B,SAAS;aACV;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA","sourcesContent":["import Router from 'koa-router'\nimport { ILike } from 'typeorm'\n\nimport { config } from '@things-factory/env'\nimport { getRepository, getSiteRootPath } from '@things-factory/shell'\n\nimport { acceptInvitation } from '../controllers/invitation.js'\nimport { resetPassword, sendPasswordResetEmail } from '../controllers/reset-password.js'\nimport { unlockUser } from '../controllers/unlock-user.js'\nimport { resendVerificationEmail, verify } from '../controllers/verification.js'\nimport { User } from '../service/user/user.js'\nimport { accepts } from '../utils/accepts.js'\nimport { clearAccessTokenCookie } from '../utils/access-token-cookie.js'\n\nconst disableUserSignupProcess = config.get('disableUserSignupProcess', false)\nconst disableUserFavoredLanguage = config.get('i18n/disableUserFavoredLanguage', false)\nconst languages = config.get('i18n/languages', false)\nconst passwordRule = config.get('password') || {\n  lowerCase: true,\n  upperCase: true,\n  digit: true,\n  specialCharacter: true,\n  allowRepeat: false,\n  useTightPattern: true,\n  useLoosePattern: false,\n  tightCharacterLength: 8,\n  looseCharacterLength: 15\n}\n\nexport const authPublicProcessRouter = new Router({\n  prefix: '/auth'\n})\n\nauthPublicProcessRouter.post('/join', async (context, next) => {\n  const { email } = context.request.body || {}\n\n  const repository = getRepository(User)\n\n  var user = await repository.findOne({\n    where: { username: email },\n    relations: ['domains']\n  })\n\n  if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n    user = await repository.findOne({\n      where: { email: ILike(email) },\n      relations: ['domains']\n    })\n  }\n\n  if (user) {\n    context.redirect(`/auth/signin?username=${email}`)\n  } else {\n    context.redirect(`/auth/signup?username=${email}&email=${email}`)\n  }\n})\n\nauthPublicProcessRouter.all('/signout', async (context, next) => {\n  const { header, t } = context\n  clearAccessTokenCookie(context)\n\n  context.body = t('text.signout successfully')\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    context.redirect(getSiteRootPath(context))\n  }\n})\n\nauthPublicProcessRouter.get('/forgot-password', async (context, next) => {\n  const { email } = context.request.query\n\n  await context.render('auth-page', {\n    pageElement: 'forgot-password',\n    elementScript: '/auth/forgot-password.js',\n    data: {\n      email,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\n/*\n * The mailed link is `/auth/reset-password#<token>` (and the same shape for unlock and verify). The\n * page reads the token from the fragment; this request never carries it, so nothing here reads one.\n */\nauthPublicProcessRouter.get('/reset-password', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'reset-password',\n    elementScript: '/auth/reset-password.js',\n    data: {\n      passwordRule,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.get('/unlock-user', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'unlock-user',\n    elementScript: '/auth/unlock-user.js',\n    data: {\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.get('/activate/:email', async (context, next) => {\n  const { email } = context.params\n\n  await context.render('auth-page', {\n    pageElement: 'auth-activate',\n    elementScript: '/auth/activate.js',\n    data: {\n      email,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\n/*\n * Confirming an address is a POST from the page, not the GET of the link. The link used to be\n * `/auth/verify/<token>` and opening it confirmed — so did any mail scanner that fetched it, and the\n * token sat in every access log on the way.\n */\nauthPublicProcessRouter.get('/verify', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'auth-verify',\n    elementScript: '/auth/verify.js',\n    data: {\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.post('/verify', async (context, next) => {\n  const { header, t } = context\n  const { token } = context.request.body || {}\n\n  let message: string\n\n  try {\n    await verify(token)\n    message = t('text.user activated successfully')\n  } catch (e) {\n    context.status = 404\n    message = t('text.invalid verification token')\n  }\n\n  context.body = message\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    await context.render('auth-page', {\n      pageElement: 'auth-result',\n      elementScript: '/auth/result.js',\n      data: {\n        message,\n        disableUserSignupProcess,\n        disableUserFavoredLanguage,\n        languages\n      }\n    })\n  }\n})\n\n/*\n * This and forgot-password give one answer whether or not the address has an account to mail - a\n * different one would tell anyone which addresses are registered. Only a mail that was due and did\n * not go is a failure. Both used to set nothing in those cases, and koa answered a bare 404 that the\n * page showed as \"Not Found\".\n */\nauthPublicProcessRouter.post('/resend-verification-email', async (context, next) => {\n  const { t } = context\n  const { email } = context.request.body || {}\n\n  if ((await resendVerificationEmail(email, context)) == 'failed') {\n    context.status = 503\n    context.body = t('error.mail could not be sent')\n    return\n  }\n\n  context.status = 200\n  context.body = t('text.verification email sent')\n})\n\n/*\n * ── The invitation page ─────────────────────────────────────────────────────\n * Public on purpose: the person following this link is not a member of the domain yet, which is\n * the entire point of an invitation. The old link went to `/auth/accept/<token>`, a path with no\n * route on any router, so it fell through to the private history-fallback — and the domain gate\n * there turned the invitee away for not being a member. It asked somebody trying to join to\n * already have joined.\n *\n * ── Why the token is not in this path ───────────────────────────────────────\n * It rides in the link's fragment (`#<token>`), which browsers do not send. So the request line\n * here carries nothing, and the token stays out of access logs, proxy logs and `Referer`. The\n * page reads it from the fragment, clears it from the address bar, and posts it below.\n */\nauthPublicProcessRouter.get('/accept-invitation', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'auth-accept-invitation',\n    elementScript: '/auth/accept-invitation.js',\n    data: {\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\n/*\n * The address is asked for as well as the token. A forwarded mail is the one way the token can\n * still travel, and nothing about where it sits can prevent that — so holding the link is not\n * enough on its own.\n */\nauthPublicProcessRouter.post('/accept-invitation', async (context, next) => {\n  const { token, email, name, password } = context.request.body || ({} as any)\n\n  const { domain, created } = await acceptInvitation({ token, email, name, password, context })\n\n  context.body = {\n    subdomain: domain?.subdomain,\n    created,\n    redirectTo: `/auth/signin?redirect_to=${encodeURIComponent('/')}`\n  }\n})\n\nauthPublicProcessRouter.post('/forgot-password', async (context, next) => {\n  const { t } = context\n  const { email } = context.request.body\n\n  if (!email) return next()\n\n  const userRepo = getRepository(User)\n  const user = await userRepo.findOne({\n    where: {\n      email\n    }\n  })\n\n  if (user && !(await sendPasswordResetEmail({ user, context }))) {\n    context.status = 503\n    context.body = t('error.mail could not be sent')\n    return\n  }\n\n  context.status = 200\n  context.body = t('text.password reset email sent')\n})\n\nauthPublicProcessRouter.post('/reset-password', async (context, next) => {\n  const { header, t } = context\n  const { password, token } = context.request.body\n\n  try {\n    if (!(token && password)) {\n      let message = t('error.token or password is invalid')\n\n      context.status = 404\n      context.body = {\n        message\n      }\n\n      if (accepts(header.accept, ['text/html', '*/*'])) {\n        await context.render('auth-page', {\n          pageElement: 'reset-password',\n          elementScript: '/auth/reset-password.js',\n          data: {\n            token,\n            message,\n            passwordRule,\n            disableUserSignupProcess,\n            disableUserFavoredLanguage,\n            languages\n          }\n        })\n      }\n\n      return\n    }\n\n    await resetPassword(token, password, context)\n\n    var message = t('text.password changed successfully')\n    context.body = message\n\n    clearAccessTokenCookie(context)\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'auth-result',\n        elementScript: '/auth/result.js',\n        data: {\n          message,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n  } catch (e) {\n    context.status = 404\n    context.body = e.message\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'reset-password',\n        elementScript: '/auth/reset-password.js',\n        data: {\n          token,\n          message: e.message,\n          passwordRule,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n  }\n})\n\nauthPublicProcessRouter.post('/unlock-user', async (context, next) => {\n  const { header, t } = context\n  const { password, token } = context.request.body\n\n  /* Both are required, the way `/auth/reset-password` requires them. This read `||`, so a body\n     carrying a password and no token passed the guard and reached the unlock with no token —\n     see the note in `unlockUser`. */\n  if (!(token && password)) {\n    context.status = 404\n    context.body = t('error.token or password is invalid')\n\n    return\n  }\n\n  const succeed = await unlockUser(token, password)\n\n  /*\n   * Say what happened. The success page used to render whether or not the unlock took, so a\n   * reused link, a token for another account, or an account that was never locked all read as\n   * \"account is reactivated\" — and the person then could not sign in.\n   *\n   * A refusal returns to the form with a reason, the shape `/auth/reset-password` already uses.\n   */\n  if (!succeed) {\n    const message = t('text.invalid verification token')\n\n    context.status = 404\n    context.body = message\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'unlock-user',\n        elementScript: '/auth/unlock-user.js',\n        data: {\n          token,\n          message,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n\n    return\n  }\n\n  context.body = t('text.password reset succeed')\n\n  clearAccessTokenCookie(context)\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    await context.render('auth-page', {\n      pageElement: 'auth-result',\n      elementScript: '/auth/result.js',\n      data: {\n        message: t('text.account is reactivated'),\n        disableUserSignupProcess,\n        disableUserFavoredLanguage,\n        languages\n      }\n    })\n  }\n})\n"]}