@things-factory/auth-base 10.1.192 → 10.1.198

package/dist-server/role-tasks.js

@@ -0,0 +1,20 @@
+"use strict";
+/*
+ * The work this module names, for the seats applications build (ADR-0139 decision 11).
+ *
+ * A task holds whole privileges: each opens everything its doors open, and the words under `task.<id>` in this
+ * module's translations say what that is. Seats are put together by applications (`RoleTemplate.tasks`).
+ *
+ * Data only - `server/index.ts` registers it - so an application's tests read it without starting the framework.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ROLE_TASKS = void 0;
+exports.ROLE_TASKS = [
+    { id: 'auth-base.users-and-roles', grants: [{ category: 'user', axes: ['query', 'mutation'] }] },
+    { id: 'auth-base.privilege-reading', grants: [{ category: 'privilege', axes: ['query'] }] },
+    { id: 'auth-base.security', grants: [{ category: 'security', axes: ['query', 'mutation'] }] },
+    { id: 'auth-base.env-vars', grants: [{ category: 'env-var', axes: ['query', 'mutation'] }] },
+    /* Everybody's audit record in the domain (ADR-0141 §5). */
+    { id: 'auth-base.audit-reading', grants: [{ category: 'audit', axes: ['query'] }] }
+];
+//# sourceMappingURL=role-tasks.js.map

package/dist-server/role-tasks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-tasks.js","sourceRoot":"","sources":["../server/role-tasks.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAIU,QAAA,UAAU,GAAe;IACpC,EAAE,EAAE,EAAE,2BAA2B,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE;IAChG,EAAE,EAAE,EAAE,6BAA6B,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;IAC3F,EAAE,EAAE,EAAE,oBAAoB,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE;IAC7F,EAAE,EAAE,EAAE,oBAAoB,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE;IAC5F,2DAA2D;IAC3D,EAAE,EAAE,EAAE,yBAAyB,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;CACpF,CAAA","sourcesContent":["/*\n * The work this module names, for the seats applications build (ADR-0139 decision 11).\n *\n * A task holds whole privileges: each opens everything its doors open, and the words under `task.<id>` in this\n * module's translations say what that is. Seats are put together by applications (`RoleTemplate.tasks`).\n *\n * Data only - `server/index.ts` registers it - so an application's tests read it without starting the framework.\n */\n\nimport type { RoleTask } from './service/role-template/role-task.js'\n\nexport const ROLE_TASKS: RoleTask[] = [\n  { id: 'auth-base.users-and-roles', grants: [{ category: 'user', axes: ['query', 'mutation'] }] },\n  { id: 'auth-base.privilege-reading', grants: [{ category: 'privilege', axes: ['query'] }] },\n  { id: 'auth-base.security', grants: [{ category: 'security', axes: ['query', 'mutation'] }] },\n  { id: 'auth-base.env-vars', grants: [{ category: 'env-var', axes: ['query', 'mutation'] }] },\n  /* Everybody's audit record in the domain (ADR-0141 §5). */\n  { id: 'auth-base.audit-reading', grants: [{ category: 'audit', axes: ['query'] }] }\n]\n"]}

package/dist-server/router/auth-checkin-router.js

@@ -5,7 +5,7 @@ const tslib_1 = require("tslib");
 const koa_router_1 = tslib_1.__importDefault(require("koa-router"));
 const env_1 = require("@things-factory/env");
 const shell_1 = require("@things-factory/shell");
-const login_history_js_1 = require("../service/login-history/login-history.js");
+const audit_recorder_js_1 = require("../service/audit/audit-recorder.js");
 const accepts_js_1 = require("../utils/accepts.js");
 const access_token_cookie_js_1 = require("../utils/access-token-cookie.js");
 const get_user_domains_js_1 = require("../utils/get-user-domains.js");
@@ -89,10 +89,8 @@ exports.authCheckinRouter.get('/auth/checkin/:subdomain?', async (context, next)
 // })
 async function checkIn(checkInDomain, redirectTo, context) {
     const { user } = context.state;
-    const remoteAddress = context.req.headers['x-forwarded-for']
-        ? context.req.headers['x-forwarded-for'].split(',')[0].trim()
-        : context.req.connection.remoteAddress;
-    await login_history_js_1.LoginHistory.stamp(checkInDomain, user, remoteAddress);
+    /* The check-in is the audit's (ADR-0141 §8): its address and browser are the request line's. */
+    await (0, audit_recorder_js_1.recordAuditAction)({ kind: 'auth.checkin', outcome: 'ok' }, { actorId: user.id, domainId: checkInDomain.id });
     if (redirectTo) {
         return context.redirect((0, shell_1.getRedirectSubdomainPath)(context, checkInDomain, redirectTo));
     }

package/dist-server/router/auth-checkin-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-checkin-router.js","sourceRoot":"","sources":["../../server/router/auth-checkin-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAE/B,6CAA4C;AAC5C,iDAA+F;AAE/F,gFAAwE;AAExE,oDAA6C;AAC7C,4EAAwE;AACxE,sEAA6D;AAC7D,8EAAyE;AAEzE,MAAM,WAAW,GAAG,YAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;AAEhC,QAAA,iBAAiB,GAAG,IAAI,oBAAM,EAAE,CAAA;AAE7C,yBAAiB,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACzE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;IAElC,IAAI,OAAO,GAAsB,MAAM,IAAA,oCAAc,EAAC,IAAI,CAAC,CAAA;IAE3D,IAAI,CAAC,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAClD,yCAAyC;QACzC,IAAI,CAAC;YACH,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA,CAAC,qCAAqC;YACrH,MAAM,aAAa,GAAgC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAA,CAAC,wCAAwC;YACxI,IAAI,CAAC,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;YAEnF,MAAM,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;YAC3C,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;QACrB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;YAC/B,MAAM,CAAC,CAAA;QACT,CAAC;IACH,CAAC;SAAM,CAAC;QACN,qCAAqC;QACrC,MAAM,UAAU,GAAG,IAAA,gDAAsB,EAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAE7E,IAAI,CAAC;YACH,IAAI,OAAe,CAAA;YAEnB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,6CAA6C;gBAC7C,SAAS,GAAG,IAAA,6BAAqB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAA;YACxD,CAAC;YAED,IAAI,aAA8B,CAAA;YAClC,IAAI,SAAS,EAAE,CAAC;gBACd,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC,CAAA;gBAC3D,IAAI,CAAC,aAAa;oBAAE,OAAO,GAAG,CAAC,CAAC,0BAA0B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;YAC5E,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;YAC5B,CAAC;YAED,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,MAAM,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;YAC1D,CAAC;YAED,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,cAAc;gBAC3B,aAAa,EAAE,kBAAkB;gBACjC,IAAI,EAAE;oBACJ,IAAI,EAAE;wBACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB;oBACD,OAAO;oBACP,WAAW;oBACX,UAAU;oBACV,OAAO;iBACR;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;YAC/B,OAAO,CAAC,QAAQ,CACd,yBAAyB,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAC3G,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,4DAA4D;AAC5D,mCAAmC;AACnC,6CAA6C;AAC7C,uBAAuB;AACvB,8DAA8D;AAC9D,MAAM;AAEN,2BAA2B;AAC3B,KAAK;AAEL,KAAK,UAAU,OAAO,CACpB,aAA8B,EAC9B,UAAyB,EACzB,OAAwB;IAExB,MAAM,EAAE,IAAI,EAAE,GAAmB,OAAO,CAAC,KAAK,CAAA;IAC9C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC1D,CAAC,CAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QACzE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAA;IAExC,MAAM,+BAAY,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,aAAa,CAAC,CAAA;IAE5D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAA,gCAAwB,EAAC,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAA;IACvF,CAAC;AACH,CAAC","sourcesContent":["import Router from 'koa-router'\n\nimport { config } from '@things-factory/env'\nimport { Domain, findSubdomainFromPath, getRedirectSubdomainPath } from '@things-factory/shell'\n\nimport { LoginHistory } from '../service/login-history/login-history.js'\nimport { User } from '../service/user/user.js'\nimport { accepts } from '../utils/accepts.js'\nimport { clearAccessTokenCookie } from '../utils/access-token-cookie.js'\nimport { getUserDomains } from '../utils/get-user-domains.js'\nimport { sameOriginRedirectPath } from '../utils/same-origin-redirect.js'\n\nconst domainTypes = config.get('domainTypes')\n\nexport const authCheckinRouter = new Router()\n\nauthCheckinRouter.get('/auth/checkin/:subdomain?', async (context, next) => {\n  const { request, t } = context\n  const header = request.header\n  const { user } = context.state\n  let { subdomain } = context.params\n\n  let domains: Partial<Domain>[] = await getUserDomains(user)\n\n  if (!accepts(header.accept, ['text/html', '*/*'])) {\n    // When request expects non html response\n    try {\n      if (!subdomain) throw new Error(t('error.domain not specified', { subdomain })) // When params doesn't have subdomain\n      const checkInDomain: Partial<Domain> | undefined = domains.find(d => d.subdomain === subdomain) // When no matched domain with subdomain\n      if (!checkInDomain) throw new Error(t('error.domain not specified', { subdomain }))\n\n      await checkIn(checkInDomain, null, context)\n      context.body = true\n    } catch (e) {\n      clearAccessTokenCookie(context)\n      throw e\n    }\n  } else {\n    // When request expects html response\n    const redirectTo = sameOriginRedirectPath(context.query.redirect_to, context)\n\n    try {\n      let message: string\n\n      if (!subdomain) {\n        /* try to find domain from redirectTo path */\n        subdomain = findSubdomainFromPath(context, redirectTo)\n      }\n\n      let checkInDomain: Partial<Domain>\n      if (subdomain) {\n        checkInDomain = domains.find(d => d.subdomain == subdomain)\n        if (!checkInDomain) message = t('error.domain not allowed', { subdomain })\n      } else if (domains.length === 1) {\n        checkInDomain = domains[0]\n      }\n\n      if (checkInDomain) {\n        return await checkIn(checkInDomain, redirectTo, context)\n      }\n\n      await context.render('auth-page', {\n        pageElement: 'auth-checkin',\n        elementScript: '/auth/checkin.js',\n        data: {\n          user: {\n            username: user.username,\n            email: user.email,\n            locale: user.locale,\n            name: user.name,\n            userType: user.userType\n          },\n          domains,\n          domainTypes,\n          redirectTo,\n          message\n        }\n      })\n    } catch (e) {\n      clearAccessTokenCookie(context)\n      context.redirect(\n        `/auth/signin?username=${encodeURIComponent(user.username)}&redirect_to=${encodeURIComponent(redirectTo)}`\n      )\n    }\n  }\n})\n\n// authCheckinRouter.get('/auth/domains', async context => {\n//   const { user } = context.state\n//   var domains = await getUserDomains(user)\n//   if (domainTypes) {\n//     domains = domains.filter(d => d.extType == domainTypes)\n//   }\n\n//   context.body = domains\n// })\n\nasync function checkIn(\n  checkInDomain: Partial<Domain>,\n  redirectTo: string | null,\n  context: ResolverContext\n): Promise<void> {\n  const { user }: { user: User } = context.state\n  const remoteAddress = context.req.headers['x-forwarded-for']\n    ? (context.req.headers['x-forwarded-for'] as string).split(',')[0].trim()\n    : context.req.connection.remoteAddress\n\n  await LoginHistory.stamp(checkInDomain, user, remoteAddress)\n\n  if (redirectTo) {\n    return context.redirect(getRedirectSubdomainPath(context, checkInDomain, redirectTo))\n  }\n}\n"]}
+{"version":3,"file":"auth-checkin-router.js","sourceRoot":"","sources":["../../server/router/auth-checkin-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAE/B,6CAA4C;AAC5C,iDAA+F;AAE/F,0EAAsE;AAEtE,oDAA6C;AAC7C,4EAAwE;AACxE,sEAA6D;AAC7D,8EAAyE;AAEzE,MAAM,WAAW,GAAG,YAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;AAEhC,QAAA,iBAAiB,GAAG,IAAI,oBAAM,EAAE,CAAA;AAE7C,yBAAiB,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACzE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;IAElC,IAAI,OAAO,GAAsB,MAAM,IAAA,oCAAc,EAAC,IAAI,CAAC,CAAA;IAE3D,IAAI,CAAC,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAClD,yCAAyC;QACzC,IAAI,CAAC;YACH,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA,CAAC,qCAAqC;YACrH,MAAM,aAAa,GAAgC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAA,CAAC,wCAAwC;YACxI,IAAI,CAAC,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;YAEnF,MAAM,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;YAC3C,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;QACrB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;YAC/B,MAAM,CAAC,CAAA;QACT,CAAC;IACH,CAAC;SAAM,CAAC;QACN,qCAAqC;QACrC,MAAM,UAAU,GAAG,IAAA,gDAAsB,EAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAE7E,IAAI,CAAC;YACH,IAAI,OAAe,CAAA;YAEnB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,6CAA6C;gBAC7C,SAAS,GAAG,IAAA,6BAAqB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAA;YACxD,CAAC;YAED,IAAI,aAA8B,CAAA;YAClC,IAAI,SAAS,EAAE,CAAC;gBACd,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC,CAAA;gBAC3D,IAAI,CAAC,aAAa;oBAAE,OAAO,GAAG,CAAC,CAAC,0BAA0B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;YAC5E,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;YAC5B,CAAC;YAED,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,MAAM,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;YAC1D,CAAC;YAED,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,cAAc;gBAC3B,aAAa,EAAE,kBAAkB;gBACjC,IAAI,EAAE;oBACJ,IAAI,EAAE;wBACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB;oBACD,OAAO;oBACP,WAAW;oBACX,UAAU;oBACV,OAAO;iBACR;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;YAC/B,OAAO,CAAC,QAAQ,CACd,yBAAyB,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAC3G,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,4DAA4D;AAC5D,mCAAmC;AACnC,6CAA6C;AAC7C,uBAAuB;AACvB,8DAA8D;AAC9D,MAAM;AAEN,2BAA2B;AAC3B,KAAK;AAEL,KAAK,UAAU,OAAO,CACpB,aAA8B,EAC9B,UAAyB,EACzB,OAAwB;IAExB,MAAM,EAAE,IAAI,EAAE,GAAmB,OAAO,CAAC,KAAK,CAAA;IAE9C,gGAAgG;IAChG,MAAM,IAAA,qCAAiB,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,CAAA;IAElH,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAA,gCAAwB,EAAC,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAA;IACvF,CAAC;AACH,CAAC","sourcesContent":["import Router from 'koa-router'\n\nimport { config } from '@things-factory/env'\nimport { Domain, findSubdomainFromPath, getRedirectSubdomainPath } from '@things-factory/shell'\n\nimport { recordAuditAction } from '../service/audit/audit-recorder.js'\nimport { User } from '../service/user/user.js'\nimport { accepts } from '../utils/accepts.js'\nimport { clearAccessTokenCookie } from '../utils/access-token-cookie.js'\nimport { getUserDomains } from '../utils/get-user-domains.js'\nimport { sameOriginRedirectPath } from '../utils/same-origin-redirect.js'\n\nconst domainTypes = config.get('domainTypes')\n\nexport const authCheckinRouter = new Router()\n\nauthCheckinRouter.get('/auth/checkin/:subdomain?', async (context, next) => {\n  const { request, t } = context\n  const header = request.header\n  const { user } = context.state\n  let { subdomain } = context.params\n\n  let domains: Partial<Domain>[] = await getUserDomains(user)\n\n  if (!accepts(header.accept, ['text/html', '*/*'])) {\n    // When request expects non html response\n    try {\n      if (!subdomain) throw new Error(t('error.domain not specified', { subdomain })) // When params doesn't have subdomain\n      const checkInDomain: Partial<Domain> | undefined = domains.find(d => d.subdomain === subdomain) // When no matched domain with subdomain\n      if (!checkInDomain) throw new Error(t('error.domain not specified', { subdomain }))\n\n      await checkIn(checkInDomain, null, context)\n      context.body = true\n    } catch (e) {\n      clearAccessTokenCookie(context)\n      throw e\n    }\n  } else {\n    // When request expects html response\n    const redirectTo = sameOriginRedirectPath(context.query.redirect_to, context)\n\n    try {\n      let message: string\n\n      if (!subdomain) {\n        /* try to find domain from redirectTo path */\n        subdomain = findSubdomainFromPath(context, redirectTo)\n      }\n\n      let checkInDomain: Partial<Domain>\n      if (subdomain) {\n        checkInDomain = domains.find(d => d.subdomain == subdomain)\n        if (!checkInDomain) message = t('error.domain not allowed', { subdomain })\n      } else if (domains.length === 1) {\n        checkInDomain = domains[0]\n      }\n\n      if (checkInDomain) {\n        return await checkIn(checkInDomain, redirectTo, context)\n      }\n\n      await context.render('auth-page', {\n        pageElement: 'auth-checkin',\n        elementScript: '/auth/checkin.js',\n        data: {\n          user: {\n            username: user.username,\n            email: user.email,\n            locale: user.locale,\n            name: user.name,\n            userType: user.userType\n          },\n          domains,\n          domainTypes,\n          redirectTo,\n          message\n        }\n      })\n    } catch (e) {\n      clearAccessTokenCookie(context)\n      context.redirect(\n        `/auth/signin?username=${encodeURIComponent(user.username)}&redirect_to=${encodeURIComponent(redirectTo)}`\n      )\n    }\n  }\n})\n\n// authCheckinRouter.get('/auth/domains', async context => {\n//   const { user } = context.state\n//   var domains = await getUserDomains(user)\n//   if (domainTypes) {\n//     domains = domains.filter(d => d.extType == domainTypes)\n//   }\n\n//   context.body = domains\n// })\n\nasync function checkIn(\n  checkInDomain: Partial<Domain>,\n  redirectTo: string | null,\n  context: ResolverContext\n): Promise<void> {\n  const { user }: { user: User } = context.state\n\n  /* The check-in is the audit's (ADR-0141 §8): its address and browser are the request line's. */\n  await recordAuditAction({ kind: 'auth.checkin', outcome: 'ok' }, { actorId: user.id, domainId: checkInDomain.id })\n\n  if (redirectTo) {\n    return context.redirect(getRedirectSubdomainPath(context, checkInDomain, redirectTo))\n  }\n}\n"]}

package/dist-server/router/auth-public-process-router.js

@@ -12,6 +12,8 @@ const unlock_user_js_1 = require("../controllers/unlock-user.js");
 const verification_js_1 = require("../controllers/verification.js");
 const user_js_1 = require("../service/user/user.js");
 const accepts_js_1 = require("../utils/accepts.js");
+const audit_recorder_js_1 = require("../service/audit/audit-recorder.js");
+const site_root_router_js_1 = require("./site-root-router.js");
 const access_token_cookie_js_1 = require("../utils/access-token-cookie.js");
 const disableUserSignupProcess = env_1.config.get('disableUserSignupProcess', false);
 const disableUserFavoredLanguage = env_1.config.get('i18n/disableUserFavoredLanguage', false);
@@ -50,9 +52,13 @@ exports.authPublicProcessRouter.post('/join', async (context, next) => {
         context.redirect(`/auth/signup?username=${email}&email=${email}`);
     }
 });
-exports.authPublicProcessRouter.all('/signout', async (context, next) => {
+exports.authPublicProcessRouter.all('/signout', site_root_router_js_1.findAuth, async (context, next) => {
     const { header, t } = context;
     (0, access_token_cookie_js_1.clearAccessTokenCookie)(context);
+    /* After the cookie is gone: an audit failure never keeps anyone signed in (ADR-0141 §4-2). */
+    if (context.state.user) {
+        await (0, audit_recorder_js_1.recordAuditAction)({ kind: 'auth.signout', outcome: 'ok' }, { domainId: null });
+    }
     context.body = t('text.signout successfully');
     if ((0, accepts_js_1.accepts)(header.accept, ['text/html', '*/*'])) {
         context.redirect((0, shell_1.getSiteRootPath)(context));

package/dist-server/router/auth-public-process-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-public-process-router.js","sourceRoot":"","sources":["../../server/router/auth-public-process-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAC/B,qCAA+B;AAE/B,6CAA4C;AAC5C,iDAAsE;AAEtE,gEAA+D;AAC/D,wEAAwF;AACxF,kEAA0D;AAC1D,oEAAgF;AAChF,qDAA8C;AAC9C,oDAA6C;AAC7C,4EAAwE;AAExE,MAAM,wBAAwB,GAAG,YAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;AAC9E,MAAM,0BAA0B,GAAG,YAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;AACvF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;AACrD,MAAM,YAAY,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI;IAC7C,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;IACf,KAAK,EAAE,IAAI;IACX,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,KAAK;IAClB,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,KAAK;IACtB,oBAAoB,EAAE,CAAC;IACvB,oBAAoB,EAAE,EAAE;CACzB,CAAA;AAEY,QAAA,uBAAuB,GAAG,IAAI,oBAAM,CAAC;IAChD,MAAM,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC5D,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAE5C,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IAEtC,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;QAC1B,SAAS,EAAE,CAAC,SAAS,CAAC;KACvB,CAAC,CAAA;IAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAC9B,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC,EAAE;YAC9B,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,QAAQ,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAA;IACpD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,QAAQ,CAAC,yBAAyB,KAAK,UAAU,KAAK,EAAE,CAAC,CAAA;IACnE,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC9D,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;IAE/B,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,2BAA2B,CAAC,CAAA;IAE7C,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,IAAA,uBAAe,EAAC,OAAO,CAAC,CAAC,CAAA;IAC5C,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAA;IAEvC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,iBAAiB;QAC9B,aAAa,EAAE,0BAA0B;QACzC,IAAI,EAAE;YACJ,KAAK;YACL,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;GAGG;AACH,+BAAuB,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACrE,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,gBAAgB;QAC7B,aAAa,EAAE,yBAAyB;QACxC,IAAI,EAAE;YACJ,YAAY;YACZ,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAClE,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,aAAa;QAC1B,aAAa,EAAE,sBAAsB;QACrC,IAAI,EAAE;YACJ,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;IAEhC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,eAAe;QAC5B,aAAa,EAAE,mBAAmB;QAClC,IAAI,EAAE;YACJ,KAAK;YACL,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;;GAIG;AACH,+BAAuB,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC7D,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,aAAa;QAC1B,aAAa,EAAE,iBAAiB;QAChC,IAAI,EAAE;YACJ,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC9D,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAE5C,IAAI,OAAe,CAAA;IAEnB,IAAI,CAAC;QACH,MAAM,IAAA,wBAAM,EAAC,KAAK,CAAC,CAAA;QACnB,OAAO,GAAG,CAAC,CAAC,kCAAkC,CAAC,CAAA;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,GAAG,CAAC,CAAC,iCAAiC,CAAC,CAAA;IAChD,CAAC;IAED,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;IAEtB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YAChC,WAAW,EAAE,aAAa;YAC1B,aAAa,EAAE,iBAAiB;YAChC,IAAI,EAAE;gBACJ,OAAO;gBACP,wBAAwB;gBACxB,0BAA0B;gBAC1B,SAAS;aACV;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA;AAEF;;;;;GAKG;AACH,+BAAuB,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACjF,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IACrB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAE5C,IAAI,CAAC,MAAM,IAAA,yCAAuB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;QAChE,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,8BAA8B,CAAC,CAAA;QAChD,OAAM;IACR,CAAC;IAED,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;IACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,8BAA8B,CAAC,CAAA;AAClD,CAAC,CAAC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,+BAAuB,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACxE,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,wBAAwB;QACrC,aAAa,EAAE,4BAA4B;QAC3C,IAAI,EAAE;YACJ,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;;GAIG;AACH,+BAAuB,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACzE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAK,EAAU,CAAA;IAE5E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gCAAgB,EAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IAE7F,OAAO,CAAC,IAAI,GAAG;QACb,SAAS,EAAE,MAAM,EAAE,SAAS;QAC5B,OAAO;QACP,UAAU,EAAE,4BAA4B,kBAAkB,CAAC,GAAG,CAAC,EAAE;KAClE,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACvE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IACrB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEtC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,EAAE,CAAA;IAEzB,MAAM,QAAQ,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE;YACL,KAAK;SACN;KACF,CAAC,CAAA;IAEF,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAA,0CAAsB,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,8BAA8B,CAAC,CAAA;QAChD,OAAM;IACR,CAAC;IAED,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;IACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,gCAAgC,CAAC,CAAA;AACpD,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEhD,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,CAAC;YACzB,IAAI,OAAO,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;YAErD,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;YACpB,OAAO,CAAC,IAAI,GAAG;gBACb,OAAO;aACR,CAAA;YAED,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBAChC,WAAW,EAAE,gBAAgB;oBAC7B,aAAa,EAAE,yBAAyB;oBACxC,IAAI,EAAE;wBACJ,KAAK;wBACL,OAAO;wBACP,YAAY;wBACZ,wBAAwB;wBACxB,0BAA0B;wBAC1B,SAAS;qBACV;iBACF,CAAC,CAAA;YACJ,CAAC;YAED,OAAM;QACR,CAAC;QAED,MAAM,IAAA,iCAAa,EAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QAE7C,IAAI,OAAO,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;QACrD,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;QAEtB,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;QAE/B,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,aAAa;gBAC1B,aAAa,EAAE,iBAAiB;gBAChC,IAAI,EAAE;oBACJ,OAAO;oBACP,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAA;QAExB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,gBAAgB;gBAC7B,aAAa,EAAE,yBAAyB;gBACxC,IAAI,EAAE;oBACJ,KAAK;oBACL,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,YAAY;oBACZ,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACnE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEhD;;uCAEmC;IACnC,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;QAEtD,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAU,EAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAEjD;;;;;;OAMG;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,CAAC,CAAC,iCAAiC,CAAC,CAAA;QAEpD,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;QAEtB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,aAAa;gBAC1B,aAAa,EAAE,sBAAsB;gBACrC,IAAI,EAAE;oBACJ,KAAK;oBACL,OAAO;oBACP,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;QAED,OAAM;IACR,CAAC;IAED,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,6BAA6B,CAAC,CAAA;IAE/C,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;IAE/B,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YAChC,WAAW,EAAE,aAAa;YAC1B,aAAa,EAAE,iBAAiB;YAChC,IAAI,EAAE;gBACJ,OAAO,EAAE,CAAC,CAAC,6BAA6B,CAAC;gBACzC,wBAAwB;gBACxB,0BAA0B;gBAC1B,SAAS;aACV;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA","sourcesContent":["import Router from 'koa-router'\nimport { ILike } from 'typeorm'\n\nimport { config } from '@things-factory/env'\nimport { getRepository, getSiteRootPath } from '@things-factory/shell'\n\nimport { acceptInvitation } from '../controllers/invitation.js'\nimport { resetPassword, sendPasswordResetEmail } from '../controllers/reset-password.js'\nimport { unlockUser } from '../controllers/unlock-user.js'\nimport { resendVerificationEmail, verify } from '../controllers/verification.js'\nimport { User } from '../service/user/user.js'\nimport { accepts } from '../utils/accepts.js'\nimport { clearAccessTokenCookie } from '../utils/access-token-cookie.js'\n\nconst disableUserSignupProcess = config.get('disableUserSignupProcess', false)\nconst disableUserFavoredLanguage = config.get('i18n/disableUserFavoredLanguage', false)\nconst languages = config.get('i18n/languages', false)\nconst passwordRule = config.get('password') || {\n  lowerCase: true,\n  upperCase: true,\n  digit: true,\n  specialCharacter: true,\n  allowRepeat: false,\n  useTightPattern: true,\n  useLoosePattern: false,\n  tightCharacterLength: 8,\n  looseCharacterLength: 15\n}\n\nexport const authPublicProcessRouter = new Router({\n  prefix: '/auth'\n})\n\nauthPublicProcessRouter.post('/join', async (context, next) => {\n  const { email } = context.request.body || {}\n\n  const repository = getRepository(User)\n\n  var user = await repository.findOne({\n    where: { username: email },\n    relations: ['domains']\n  })\n\n  if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n    user = await repository.findOne({\n      where: { email: ILike(email) },\n      relations: ['domains']\n    })\n  }\n\n  if (user) {\n    context.redirect(`/auth/signin?username=${email}`)\n  } else {\n    context.redirect(`/auth/signup?username=${email}&email=${email}`)\n  }\n})\n\nauthPublicProcessRouter.all('/signout', async (context, next) => {\n  const { header, t } = context\n  clearAccessTokenCookie(context)\n\n  context.body = t('text.signout successfully')\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    context.redirect(getSiteRootPath(context))\n  }\n})\n\nauthPublicProcessRouter.get('/forgot-password', async (context, next) => {\n  const { email } = context.request.query\n\n  await context.render('auth-page', {\n    pageElement: 'forgot-password',\n    elementScript: '/auth/forgot-password.js',\n    data: {\n      email,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\n/*\n * The mailed link is `/auth/reset-password#<token>` (and the same shape for unlock and verify). The\n * page reads the token from the fragment; this request never carries it, so nothing here reads one.\n */\nauthPublicProcessRouter.get('/reset-password', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'reset-password',\n    elementScript: '/auth/reset-password.js',\n    data: {\n      passwordRule,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.get('/unlock-user', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'unlock-user',\n    elementScript: '/auth/unlock-user.js',\n    data: {\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.get('/activate/:email', async (context, next) => {\n  const { email } = context.params\n\n  await context.render('auth-page', {\n    pageElement: 'auth-activate',\n    elementScript: '/auth/activate.js',\n    data: {\n      email,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\n/*\n * Confirming an address is a POST from the page, not the GET of the link. The link used to be\n * `/auth/verify/<token>` and opening it confirmed — so did any mail scanner that fetched it, and the\n * token sat in every access log on the way.\n */\nauthPublicProcessRouter.get('/verify', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'auth-verify',\n    elementScript: '/auth/verify.js',\n    data: {\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.post('/verify', async (context, next) => {\n  const { header, t } = context\n  const { token } = context.request.body || {}\n\n  let message: string\n\n  try {\n    await verify(token)\n    message = t('text.user activated successfully')\n  } catch (e) {\n    context.status = 404\n    message = t('text.invalid verification token')\n  }\n\n  context.body = message\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    await context.render('auth-page', {\n      pageElement: 'auth-result',\n      elementScript: '/auth/result.js',\n      data: {\n        message,\n        disableUserSignupProcess,\n        disableUserFavoredLanguage,\n        languages\n      }\n    })\n  }\n})\n\n/*\n * This and forgot-password give one answer whether or not the address has an account to mail - a\n * different one would tell anyone which addresses are registered. Only a mail that was due and did\n * not go is a failure. Both used to set nothing in those cases, and koa answered a bare 404 that the\n * page showed as \"Not Found\".\n */\nauthPublicProcessRouter.post('/resend-verification-email', async (context, next) => {\n  const { t } = context\n  const { email } = context.request.body || {}\n\n  if ((await resendVerificationEmail(email, context)) == 'failed') {\n    context.status = 503\n    context.body = t('error.mail could not be sent')\n    return\n  }\n\n  context.status = 200\n  context.body = t('text.verification email sent')\n})\n\n/*\n * ── The invitation page ─────────────────────────────────────────────────────\n * Public on purpose: the person following this link is not a member of the domain yet, which is\n * the entire point of an invitation. The old link went to `/auth/accept/<token>`, a path with no\n * route on any router, so it fell through to the private history-fallback — and the domain gate\n * there turned the invitee away for not being a member. It asked somebody trying to join to\n * already have joined.\n *\n * ── Why the token is not in this path ───────────────────────────────────────\n * It rides in the link's fragment (`#<token>`), which browsers do not send. So the request line\n * here carries nothing, and the token stays out of access logs, proxy logs and `Referer`. The\n * page reads it from the fragment, clears it from the address bar, and posts it below.\n */\nauthPublicProcessRouter.get('/accept-invitation', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'auth-accept-invitation',\n    elementScript: '/auth/accept-invitation.js',\n    data: {\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\n/*\n * The address is asked for as well as the token. A forwarded mail is the one way the token can\n * still travel, and nothing about where it sits can prevent that — so holding the link is not\n * enough on its own.\n */\nauthPublicProcessRouter.post('/accept-invitation', async (context, next) => {\n  const { token, email, name, password } = context.request.body || ({} as any)\n\n  const { domain, created } = await acceptInvitation({ token, email, name, password, context })\n\n  context.body = {\n    subdomain: domain?.subdomain,\n    created,\n    redirectTo: `/auth/signin?redirect_to=${encodeURIComponent('/')}`\n  }\n})\n\nauthPublicProcessRouter.post('/forgot-password', async (context, next) => {\n  const { t } = context\n  const { email } = context.request.body\n\n  if (!email) return next()\n\n  const userRepo = getRepository(User)\n  const user = await userRepo.findOne({\n    where: {\n      email\n    }\n  })\n\n  if (user && !(await sendPasswordResetEmail({ user, context }))) {\n    context.status = 503\n    context.body = t('error.mail could not be sent')\n    return\n  }\n\n  context.status = 200\n  context.body = t('text.password reset email sent')\n})\n\nauthPublicProcessRouter.post('/reset-password', async (context, next) => {\n  const { header, t } = context\n  const { password, token } = context.request.body\n\n  try {\n    if (!(token && password)) {\n      let message = t('error.token or password is invalid')\n\n      context.status = 404\n      context.body = {\n        message\n      }\n\n      if (accepts(header.accept, ['text/html', '*/*'])) {\n        await context.render('auth-page', {\n          pageElement: 'reset-password',\n          elementScript: '/auth/reset-password.js',\n          data: {\n            token,\n            message,\n            passwordRule,\n            disableUserSignupProcess,\n            disableUserFavoredLanguage,\n            languages\n          }\n        })\n      }\n\n      return\n    }\n\n    await resetPassword(token, password, context)\n\n    var message = t('text.password changed successfully')\n    context.body = message\n\n    clearAccessTokenCookie(context)\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'auth-result',\n        elementScript: '/auth/result.js',\n        data: {\n          message,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n  } catch (e) {\n    context.status = 404\n    context.body = e.message\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'reset-password',\n        elementScript: '/auth/reset-password.js',\n        data: {\n          token,\n          message: e.message,\n          passwordRule,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n  }\n})\n\nauthPublicProcessRouter.post('/unlock-user', async (context, next) => {\n  const { header, t } = context\n  const { password, token } = context.request.body\n\n  /* Both are required, the way `/auth/reset-password` requires them. This read `||`, so a body\n     carrying a password and no token passed the guard and reached the unlock with no token —\n     see the note in `unlockUser`. */\n  if (!(token && password)) {\n    context.status = 404\n    context.body = t('error.token or password is invalid')\n\n    return\n  }\n\n  const succeed = await unlockUser(token, password)\n\n  /*\n   * Say what happened. The success page used to render whether or not the unlock took, so a\n   * reused link, a token for another account, or an account that was never locked all read as\n   * \"account is reactivated\" — and the person then could not sign in.\n   *\n   * A refusal returns to the form with a reason, the shape `/auth/reset-password` already uses.\n   */\n  if (!succeed) {\n    const message = t('text.invalid verification token')\n\n    context.status = 404\n    context.body = message\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'unlock-user',\n        elementScript: '/auth/unlock-user.js',\n        data: {\n          token,\n          message,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n\n    return\n  }\n\n  context.body = t('text.password reset succeed')\n\n  clearAccessTokenCookie(context)\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    await context.render('auth-page', {\n      pageElement: 'auth-result',\n      elementScript: '/auth/result.js',\n      data: {\n        message: t('text.account is reactivated'),\n        disableUserSignupProcess,\n        disableUserFavoredLanguage,\n        languages\n      }\n    })\n  }\n})\n"]}
+{"version":3,"file":"auth-public-process-router.js","sourceRoot":"","sources":["../../server/router/auth-public-process-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAC/B,qCAA+B;AAE/B,6CAA4C;AAC5C,iDAAsE;AAEtE,gEAA+D;AAC/D,wEAAwF;AACxF,kEAA0D;AAC1D,oEAAgF;AAChF,qDAA8C;AAC9C,oDAA6C;AAC7C,0EAAsE;AACtE,+DAAgD;AAChD,4EAAwE;AAExE,MAAM,wBAAwB,GAAG,YAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;AAC9E,MAAM,0BAA0B,GAAG,YAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;AACvF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;AACrD,MAAM,YAAY,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI;IAC7C,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;IACf,KAAK,EAAE,IAAI;IACX,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,KAAK;IAClB,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,KAAK;IACtB,oBAAoB,EAAE,CAAC;IACvB,oBAAoB,EAAE,EAAE;CACzB,CAAA;AAEY,QAAA,uBAAuB,GAAG,IAAI,oBAAM,CAAC;IAChD,MAAM,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC5D,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAE5C,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IAEtC,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;QAC1B,SAAS,EAAE,CAAC,SAAS,CAAC;KACvB,CAAC,CAAA;IAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAC9B,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC,EAAE;YAC9B,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,QAAQ,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAA;IACpD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,QAAQ,CAAC,yBAAyB,KAAK,UAAU,KAAK,EAAE,CAAC,CAAA;IACnE,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,8BAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACxE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;IAE/B,8FAA8F;IAC9F,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,IAAA,qCAAiB,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACtF,CAAC;IAED,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,2BAA2B,CAAC,CAAA;IAE7C,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,IAAA,uBAAe,EAAC,OAAO,CAAC,CAAC,CAAA;IAC5C,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAA;IAEvC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,iBAAiB;QAC9B,aAAa,EAAE,0BAA0B;QACzC,IAAI,EAAE;YACJ,KAAK;YACL,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;GAGG;AACH,+BAAuB,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACrE,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,gBAAgB;QAC7B,aAAa,EAAE,yBAAyB;QACxC,IAAI,EAAE;YACJ,YAAY;YACZ,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAClE,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,aAAa;QAC1B,aAAa,EAAE,sBAAsB;QACrC,IAAI,EAAE;YACJ,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;IAEhC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,eAAe;QAC5B,aAAa,EAAE,mBAAmB;QAClC,IAAI,EAAE;YACJ,KAAK;YACL,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;;GAIG;AACH,+BAAuB,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC7D,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,aAAa;QAC1B,aAAa,EAAE,iBAAiB;QAChC,IAAI,EAAE;YACJ,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC9D,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAE5C,IAAI,OAAe,CAAA;IAEnB,IAAI,CAAC;QACH,MAAM,IAAA,wBAAM,EAAC,KAAK,CAAC,CAAA;QACnB,OAAO,GAAG,CAAC,CAAC,kCAAkC,CAAC,CAAA;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,GAAG,CAAC,CAAC,iCAAiC,CAAC,CAAA;IAChD,CAAC;IAED,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;IAEtB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YAChC,WAAW,EAAE,aAAa;YAC1B,aAAa,EAAE,iBAAiB;YAChC,IAAI,EAAE;gBACJ,OAAO;gBACP,wBAAwB;gBACxB,0BAA0B;gBAC1B,SAAS;aACV;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA;AAEF;;;;;GAKG;AACH,+BAAuB,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACjF,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IACrB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAE5C,IAAI,CAAC,MAAM,IAAA,yCAAuB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;QAChE,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,8BAA8B,CAAC,CAAA;QAChD,OAAM;IACR,CAAC;IAED,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;IACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,8BAA8B,CAAC,CAAA;AAClD,CAAC,CAAC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,+BAAuB,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACxE,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,wBAAwB;QACrC,aAAa,EAAE,4BAA4B;QAC3C,IAAI,EAAE;YACJ,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;;GAIG;AACH,+BAAuB,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACzE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAK,EAAU,CAAA;IAE5E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gCAAgB,EAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IAE7F,OAAO,CAAC,IAAI,GAAG;QACb,SAAS,EAAE,MAAM,EAAE,SAAS;QAC5B,OAAO;QACP,UAAU,EAAE,4BAA4B,kBAAkB,CAAC,GAAG,CAAC,EAAE;KAClE,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACvE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IACrB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEtC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,EAAE,CAAA;IAEzB,MAAM,QAAQ,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE;YACL,KAAK;SACN;KACF,CAAC,CAAA;IAEF,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAA,0CAAsB,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,8BAA8B,CAAC,CAAA;QAChD,OAAM;IACR,CAAC;IAED,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;IACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,gCAAgC,CAAC,CAAA;AACpD,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEhD,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,CAAC;YACzB,IAAI,OAAO,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;YAErD,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;YACpB,OAAO,CAAC,IAAI,GAAG;gBACb,OAAO;aACR,CAAA;YAED,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBAChC,WAAW,EAAE,gBAAgB;oBAC7B,aAAa,EAAE,yBAAyB;oBACxC,IAAI,EAAE;wBACJ,KAAK;wBACL,OAAO;wBACP,YAAY;wBACZ,wBAAwB;wBACxB,0BAA0B;wBAC1B,SAAS;qBACV;iBACF,CAAC,CAAA;YACJ,CAAC;YAED,OAAM;QACR,CAAC;QAED,MAAM,IAAA,iCAAa,EAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QAE7C,IAAI,OAAO,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;QACrD,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;QAEtB,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;QAE/B,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,aAAa;gBAC1B,aAAa,EAAE,iBAAiB;gBAChC,IAAI,EAAE;oBACJ,OAAO;oBACP,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAA;QAExB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,gBAAgB;gBAC7B,aAAa,EAAE,yBAAyB;gBACxC,IAAI,EAAE;oBACJ,KAAK;oBACL,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,YAAY;oBACZ,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACnE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEhD;;uCAEmC;IACnC,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;QAEtD,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAU,EAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAEjD;;;;;;OAMG;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,CAAC,CAAC,iCAAiC,CAAC,CAAA;QAEpD,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;QAEtB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,aAAa;gBAC1B,aAAa,EAAE,sBAAsB;gBACrC,IAAI,EAAE;oBACJ,KAAK;oBACL,OAAO;oBACP,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;QAED,OAAM;IACR,CAAC;IAED,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,6BAA6B,CAAC,CAAA;IAE/C,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;IAE/B,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YAChC,WAAW,EAAE,aAAa;YAC1B,aAAa,EAAE,iBAAiB;YAChC,IAAI,EAAE;gBACJ,OAAO,EAAE,CAAC,CAAC,6BAA6B,CAAC;gBACzC,wBAAwB;gBACxB,0BAA0B;gBAC1B,SAAS;aACV;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA","sourcesContent":["import Router from 'koa-router'\nimport { ILike } from 'typeorm'\n\nimport { config } from '@things-factory/env'\nimport { getRepository, getSiteRootPath } from '@things-factory/shell'\n\nimport { acceptInvitation } from '../controllers/invitation.js'\nimport { resetPassword, sendPasswordResetEmail } from '../controllers/reset-password.js'\nimport { unlockUser } from '../controllers/unlock-user.js'\nimport { resendVerificationEmail, verify } from '../controllers/verification.js'\nimport { User } from '../service/user/user.js'\nimport { accepts } from '../utils/accepts.js'\nimport { recordAuditAction } from '../service/audit/audit-recorder.js'\nimport { findAuth } from './site-root-router.js'\nimport { clearAccessTokenCookie } from '../utils/access-token-cookie.js'\n\nconst disableUserSignupProcess = config.get('disableUserSignupProcess', false)\nconst disableUserFavoredLanguage = config.get('i18n/disableUserFavoredLanguage', false)\nconst languages = config.get('i18n/languages', false)\nconst passwordRule = config.get('password') || {\n  lowerCase: true,\n  upperCase: true,\n  digit: true,\n  specialCharacter: true,\n  allowRepeat: false,\n  useTightPattern: true,\n  useLoosePattern: false,\n  tightCharacterLength: 8,\n  looseCharacterLength: 15\n}\n\nexport const authPublicProcessRouter = new Router({\n  prefix: '/auth'\n})\n\nauthPublicProcessRouter.post('/join', async (context, next) => {\n  const { email } = context.request.body || {}\n\n  const repository = getRepository(User)\n\n  var user = await repository.findOne({\n    where: { username: email },\n    relations: ['domains']\n  })\n\n  if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n    user = await repository.findOne({\n      where: { email: ILike(email) },\n      relations: ['domains']\n    })\n  }\n\n  if (user) {\n    context.redirect(`/auth/signin?username=${email}`)\n  } else {\n    context.redirect(`/auth/signup?username=${email}&email=${email}`)\n  }\n})\n\nauthPublicProcessRouter.all('/signout', findAuth, async (context, next) => {\n  const { header, t } = context\n  clearAccessTokenCookie(context)\n\n  /* After the cookie is gone: an audit failure never keeps anyone signed in (ADR-0141 §4-2). */\n  if (context.state.user) {\n    await recordAuditAction({ kind: 'auth.signout', outcome: 'ok' }, { domainId: null })\n  }\n\n  context.body = t('text.signout successfully')\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    context.redirect(getSiteRootPath(context))\n  }\n})\n\nauthPublicProcessRouter.get('/forgot-password', async (context, next) => {\n  const { email } = context.request.query\n\n  await context.render('auth-page', {\n    pageElement: 'forgot-password',\n    elementScript: '/auth/forgot-password.js',\n    data: {\n      email,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\n/*\n * The mailed link is `/auth/reset-password#<token>` (and the same shape for unlock and verify). The\n * page reads the token from the fragment; this request never carries it, so nothing here reads one.\n */\nauthPublicProcessRouter.get('/reset-password', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'reset-password',\n    elementScript: '/auth/reset-password.js',\n    data: {\n      passwordRule,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.get('/unlock-user', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'unlock-user',\n    elementScript: '/auth/unlock-user.js',\n    data: {\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.get('/activate/:email', async (context, next) => {\n  const { email } = context.params\n\n  await context.render('auth-page', {\n    pageElement: 'auth-activate',\n    elementScript: '/auth/activate.js',\n    data: {\n      email,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\n/*\n * Confirming an address is a POST from the page, not the GET of the link. The link used to be\n * `/auth/verify/<token>` and opening it confirmed — so did any mail scanner that fetched it, and the\n * token sat in every access log on the way.\n */\nauthPublicProcessRouter.get('/verify', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'auth-verify',\n    elementScript: '/auth/verify.js',\n    data: {\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.post('/verify', async (context, next) => {\n  const { header, t } = context\n  const { token } = context.request.body || {}\n\n  let message: string\n\n  try {\n    await verify(token)\n    message = t('text.user activated successfully')\n  } catch (e) {\n    context.status = 404\n    message = t('text.invalid verification token')\n  }\n\n  context.body = message\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    await context.render('auth-page', {\n      pageElement: 'auth-result',\n      elementScript: '/auth/result.js',\n      data: {\n        message,\n        disableUserSignupProcess,\n        disableUserFavoredLanguage,\n        languages\n      }\n    })\n  }\n})\n\n/*\n * This and forgot-password give one answer whether or not the address has an account to mail - a\n * different one would tell anyone which addresses are registered. Only a mail that was due and did\n * not go is a failure. Both used to set nothing in those cases, and koa answered a bare 404 that the\n * page showed as \"Not Found\".\n */\nauthPublicProcessRouter.post('/resend-verification-email', async (context, next) => {\n  const { t } = context\n  const { email } = context.request.body || {}\n\n  if ((await resendVerificationEmail(email, context)) == 'failed') {\n    context.status = 503\n    context.body = t('error.mail could not be sent')\n    return\n  }\n\n  context.status = 200\n  context.body = t('text.verification email sent')\n})\n\n/*\n * ── The invitation page ─────────────────────────────────────────────────────\n * Public on purpose: the person following this link is not a member of the domain yet, which is\n * the entire point of an invitation. The old link went to `/auth/accept/<token>`, a path with no\n * route on any router, so it fell through to the private history-fallback — and the domain gate\n * there turned the invitee away for not being a member. It asked somebody trying to join to\n * already have joined.\n *\n * ── Why the token is not in this path ───────────────────────────────────────\n * It rides in the link's fragment (`#<token>`), which browsers do not send. So the request line\n * here carries nothing, and the token stays out of access logs, proxy logs and `Referer`. The\n * page reads it from the fragment, clears it from the address bar, and posts it below.\n */\nauthPublicProcessRouter.get('/accept-invitation', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'auth-accept-invitation',\n    elementScript: '/auth/accept-invitation.js',\n    data: {\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\n/*\n * The address is asked for as well as the token. A forwarded mail is the one way the token can\n * still travel, and nothing about where it sits can prevent that — so holding the link is not\n * enough on its own.\n */\nauthPublicProcessRouter.post('/accept-invitation', async (context, next) => {\n  const { token, email, name, password } = context.request.body || ({} as any)\n\n  const { domain, created } = await acceptInvitation({ token, email, name, password, context })\n\n  context.body = {\n    subdomain: domain?.subdomain,\n    created,\n    redirectTo: `/auth/signin?redirect_to=${encodeURIComponent('/')}`\n  }\n})\n\nauthPublicProcessRouter.post('/forgot-password', async (context, next) => {\n  const { t } = context\n  const { email } = context.request.body\n\n  if (!email) return next()\n\n  const userRepo = getRepository(User)\n  const user = await userRepo.findOne({\n    where: {\n      email\n    }\n  })\n\n  if (user && !(await sendPasswordResetEmail({ user, context }))) {\n    context.status = 503\n    context.body = t('error.mail could not be sent')\n    return\n  }\n\n  context.status = 200\n  context.body = t('text.password reset email sent')\n})\n\nauthPublicProcessRouter.post('/reset-password', async (context, next) => {\n  const { header, t } = context\n  const { password, token } = context.request.body\n\n  try {\n    if (!(token && password)) {\n      let message = t('error.token or password is invalid')\n\n      context.status = 404\n      context.body = {\n        message\n      }\n\n      if (accepts(header.accept, ['text/html', '*/*'])) {\n        await context.render('auth-page', {\n          pageElement: 'reset-password',\n          elementScript: '/auth/reset-password.js',\n          data: {\n            token,\n            message,\n            passwordRule,\n            disableUserSignupProcess,\n            disableUserFavoredLanguage,\n            languages\n          }\n        })\n      }\n\n      return\n    }\n\n    await resetPassword(token, password, context)\n\n    var message = t('text.password changed successfully')\n    context.body = message\n\n    clearAccessTokenCookie(context)\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'auth-result',\n        elementScript: '/auth/result.js',\n        data: {\n          message,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n  } catch (e) {\n    context.status = 404\n    context.body = e.message\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'reset-password',\n        elementScript: '/auth/reset-password.js',\n        data: {\n          token,\n          message: e.message,\n          passwordRule,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n  }\n})\n\nauthPublicProcessRouter.post('/unlock-user', async (context, next) => {\n  const { header, t } = context\n  const { password, token } = context.request.body\n\n  /* Both are required, the way `/auth/reset-password` requires them. This read `||`, so a body\n     carrying a password and no token passed the guard and reached the unlock with no token —\n     see the note in `unlockUser`. */\n  if (!(token && password)) {\n    context.status = 404\n    context.body = t('error.token or password is invalid')\n\n    return\n  }\n\n  const succeed = await unlockUser(token, password)\n\n  /*\n   * Say what happened. The success page used to render whether or not the unlock took, so a\n   * reused link, a token for another account, or an account that was never locked all read as\n   * \"account is reactivated\" — and the person then could not sign in.\n   *\n   * A refusal returns to the form with a reason, the shape `/auth/reset-password` already uses.\n   */\n  if (!succeed) {\n    const message = t('text.invalid verification token')\n\n    context.status = 404\n    context.body = message\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'unlock-user',\n        elementScript: '/auth/unlock-user.js',\n        data: {\n          token,\n          message,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n\n    return\n  }\n\n  context.body = t('text.password reset succeed')\n\n  clearAccessTokenCookie(context)\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    await context.render('auth-page', {\n      pageElement: 'auth-result',\n      elementScript: '/auth/result.js',\n      data: {\n        message: t('text.account is reactivated'),\n        disableUserSignupProcess,\n        disableUserFavoredLanguage,\n        languages\n      }\n    })\n  }\n})\n"]}

package/dist-server/router/site-root-router.d.ts

@@ -1 +1,3 @@
 export declare const siteRootRouter: any;
+/** Who the access token says this is, when it says anyone - the route goes on either way. */
+export declare function findAuth(context: any, next: any): Promise<any>;

package/dist-server/router/site-root-router.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.siteRootRouter = void 0;
+exports.findAuth = findAuth;
 const tslib_1 = require("tslib");
 const koa_router_1 = tslib_1.__importDefault(require("koa-router"));
 const koa_passport_1 = tslib_1.__importDefault(require("koa-passport"));
@@ -10,6 +11,7 @@ const user_js_1 = require("../service/user/user.js");
 const get_user_domains_js_1 = require("../utils/get-user-domains.js");
 const PUBLIC_HOME_ROUTE = env_1.config.get('publicHomeRoute', '/public/home');
 exports.siteRootRouter = new koa_router_1.default();
+/** Who the access token says this is, when it says anyone - the route goes on either way. */
 async function findAuth(context, next) {
     return await koa_passport_1.default.authenticate('jwt', { session: false }, async (err, decoded, info) => {
         if (decoded) {

package/dist-server/router/site-root-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"site-root-router.js","sourceRoot":"","sources":["../../server/router/site-root-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAC/B,wEAAmC;AAEnC,iDAAgE;AAChE,6CAA4C;AAE5C,qDAA8C;AAC9C,sEAA6D;AAE7D,MAAM,iBAAiB,GAAG,YAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;AAE1D,QAAA,cAAc,GAAG,IAAI,oBAAM,EAAE,CAAA;AAE1C,KAAK,UAAU,QAAQ,CAAC,OAAO,EAAE,IAAI;IACnC,OAAO,MAAM,sBAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACzF,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,cAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;gBAC1C,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;YAC3B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC,CAAA,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,EAAE,CAAA;IACd,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;AACnB,CAAC;AAED,sBAAc,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,wBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC1E,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAEtC,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAA;IAEnC,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;QACtB,MAAM,WAAW,GAAsB,MAAM,IAAA,oCAAc,EAAC,IAAI,CAAC,CAAA;QACjE,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC;YACtE,OAAO,MAAM,IAAI,EAAE,CAAA;QACrB,CAAC;QAED,OAAO,OAAO,CAAC,QAAQ,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAA;IACvD,CAAC;IAED,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAEjC,OAAM;IACR,CAAC;IAED,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;AACrC,CAAC,CAAC,CAAA","sourcesContent":["import Router from 'koa-router'\nimport passport from 'koa-passport'\n\nimport { Domain, domainMiddleware } from '@things-factory/shell'\nimport { config } from '@things-factory/env'\n\nimport { User } from '../service/user/user.js'\nimport { getUserDomains } from '../utils/get-user-domains.js'\n\nconst PUBLIC_HOME_ROUTE = config.get('publicHomeRoute', '/public/home')\n\nexport const siteRootRouter = new Router()\n\nasync function findAuth(context, next) {\n  return await passport.authenticate('jwt', { session: false }, async (err, decoded, info) => {\n    if (decoded) {\n      try {\n        const user = await User.checkAuth(decoded)\n        context.state.user = user\n      } catch (e) {}\n    }\n\n    await next()\n  })(context, next)\n}\n\nsiteRootRouter.get('/', findAuth, domainMiddleware, async (context, next) => {\n  const { user, domain } = context.state\n\n  const subdomain = domain?.subdomain\n\n  if (user && subdomain) {\n    const userDomains: Partial<Domain>[] = await getUserDomains(user)\n    if (userDomains.find(userDomain => userDomain.subdomain == subdomain)) {\n      return await next()\n    }\n\n    return context.redirect(`/auth/checkin/${subdomain}`)\n  }\n\n  if (user && !subdomain) {\n    context.redirect('/auth/checkin')\n\n    return\n  }\n\n  context.redirect(PUBLIC_HOME_ROUTE)\n})\n"]}
+{"version":3,"file":"site-root-router.js","sourceRoot":"","sources":["../../server/router/site-root-router.ts"],"names":[],"mappings":";;;AAcA,4BAWC;;AAzBD,oEAA+B;AAC/B,wEAAmC;AAEnC,iDAAgE;AAChE,6CAA4C;AAE5C,qDAA8C;AAC9C,sEAA6D;AAE7D,MAAM,iBAAiB,GAAG,YAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;AAE1D,QAAA,cAAc,GAAG,IAAI,oBAAM,EAAE,CAAA;AAE1C,6FAA6F;AACtF,KAAK,UAAU,QAAQ,CAAC,OAAO,EAAE,IAAI;IAC1C,OAAO,MAAM,sBAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACzF,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,cAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;gBAC1C,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;YAC3B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC,CAAA,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,EAAE,CAAA;IACd,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;AACnB,CAAC;AAED,sBAAc,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,wBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC1E,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAEtC,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAA;IAEnC,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;QACtB,MAAM,WAAW,GAAsB,MAAM,IAAA,oCAAc,EAAC,IAAI,CAAC,CAAA;QACjE,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC;YACtE,OAAO,MAAM,IAAI,EAAE,CAAA;QACrB,CAAC;QAED,OAAO,OAAO,CAAC,QAAQ,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAA;IACvD,CAAC;IAED,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAEjC,OAAM;IACR,CAAC;IAED,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;AACrC,CAAC,CAAC,CAAA","sourcesContent":["import Router from 'koa-router'\nimport passport from 'koa-passport'\n\nimport { Domain, domainMiddleware } from '@things-factory/shell'\nimport { config } from '@things-factory/env'\n\nimport { User } from '../service/user/user.js'\nimport { getUserDomains } from '../utils/get-user-domains.js'\n\nconst PUBLIC_HOME_ROUTE = config.get('publicHomeRoute', '/public/home')\n\nexport const siteRootRouter = new Router()\n\n/** Who the access token says this is, when it says anyone - the route goes on either way. */\nexport async function findAuth(context, next) {\n  return await passport.authenticate('jwt', { session: false }, async (err, decoded, info) => {\n    if (decoded) {\n      try {\n        const user = await User.checkAuth(decoded)\n        context.state.user = user\n      } catch (e) {}\n    }\n\n    await next()\n  })(context, next)\n}\n\nsiteRootRouter.get('/', findAuth, domainMiddleware, async (context, next) => {\n  const { user, domain } = context.state\n\n  const subdomain = domain?.subdomain\n\n  if (user && subdomain) {\n    const userDomains: Partial<Domain>[] = await getUserDomains(user)\n    if (userDomains.find(userDomain => userDomain.subdomain == subdomain)) {\n      return await next()\n    }\n\n    return context.redirect(`/auth/checkin/${subdomain}`)\n  }\n\n  if (user && !subdomain) {\n    context.redirect('/auth/checkin')\n\n    return\n  }\n\n  context.redirect(PUBLIC_HOME_ROUTE)\n})\n"]}

package/dist-server/service/access-request/index.d.ts

@@ -2,4 +2,4 @@ import { AccessRequest } from './access-request.js';
 import { AccessRequestMutation } from './access-request-mutation.js';
 import { AccessRequestQuery } from './access-request-query.js';
 export declare const entities: (typeof AccessRequest)[];
-export declare const resolvers: (typeof AccessRequestMutation | typeof AccessRequestQuery)[];
+export declare const resolvers: (typeof AccessRequestQuery | typeof AccessRequestMutation)[];

package/dist-server/service/audit/audit-action.d.ts

@@ -0,0 +1,36 @@
+import { Domain } from '@things-factory/shell';
+import { User } from '../user/user.js';
+/**
+ * One thing done, as the audit keeps it (ADR-0141 §3.2 · §3.3).
+ *
+ * `kind` says which: `door.check` (a `@privilege` judgement), `door.result` (what a passed door
+ * did), or an event a service or the audit subscriber wrote (`role.grant`, `auth.signin`, ...).
+ * Only the columns below exist, and `detail` takes only the keys its kind registered
+ * (`audit-kinds.ts`) - no business value, secret or request text has a place to go.
+ *
+ * Immutable like `AuditRequest`, and for the same reason without foreign keys.
+ */
+export declare class AuditAction {
+    readonly id: string;
+    requestId?: string;
+    domain?: Domain;
+    domainId?: string;
+    actor?: User;
+    actorId?: string;
+    createdAt: Date;
+    kind: string;
+    door?: string;
+    decision?: string;
+    basis?: string;
+    outcome?: string;
+    code?: string;
+    count: number;
+    returned?: number;
+    targetKind?: string;
+    targetIds?: string[];
+    truncated: boolean;
+    targetRole?: string;
+    objectKind?: string;
+    objectId?: string;
+    detail?: Record<string, string | number | boolean | null>;
+}

package/dist-server/service/audit/audit-action.js

@@ -0,0 +1,137 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditAction = void 0;
+const tslib_1 = require("tslib");
+const type_graphql_1 = require("type-graphql");
+const typeorm_1 = require("typeorm");
+const shell_1 = require("@things-factory/shell");
+const user_js_1 = require("../user/user.js");
+/**
+ * One thing done, as the audit keeps it (ADR-0141 §3.2 · §3.3).
+ *
+ * `kind` says which: `door.check` (a `@privilege` judgement), `door.result` (what a passed door
+ * did), or an event a service or the audit subscriber wrote (`role.grant`, `auth.signin`, ...).
+ * Only the columns below exist, and `detail` takes only the keys its kind registered
+ * (`audit-kinds.ts`) - no business value, secret or request text has a place to go.
+ *
+ * Immutable like `AuditRequest`, and for the same reason without foreign keys.
+ */
+let AuditAction = class AuditAction {
+};
+exports.AuditAction = AuditAction;
+tslib_1.__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    (0, type_graphql_1.Field)(type => type_graphql_1.ID, { description: 'Unique identifier.' }),
+    tslib_1.__metadata("design:type", String)
+], AuditAction.prototype, "id", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true, length: 36 }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'The request this was done in. Empty for work outside any request.' }),
+    tslib_1.__metadata("design:type", String)
+], AuditAction.prototype, "requestId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.ManyToOne)(type => shell_1.Domain, { nullable: true, createForeignKeyConstraints: false }),
+    (0, type_graphql_1.Field)(type => shell_1.Domain, { nullable: true, description: 'The domain it was done in.' }),
+    tslib_1.__metadata("design:type", shell_1.Domain)
+], AuditAction.prototype, "domain", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.RelationId)((action) => action.domain),
+    tslib_1.__metadata("design:type", String)
+], AuditAction.prototype, "domainId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.ManyToOne)(type => user_js_1.User, { nullable: true, createForeignKeyConstraints: false }),
+    (0, type_graphql_1.Field)(type => user_js_1.User, { nullable: true, description: 'Who did it. Empty when nobody is known - a sign-in to an account that does not exist.' }),
+    tslib_1.__metadata("design:type", user_js_1.User)
+], AuditAction.prototype, "actor", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.RelationId)((action) => action.actor),
+    tslib_1.__metadata("design:type", String)
+], AuditAction.prototype, "actorId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.CreateDateColumn)(),
+    (0, type_graphql_1.Field)({ description: 'When it was written.' }),
+    tslib_1.__metadata("design:type", Date)
+], AuditAction.prototype, "createdAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ length: 64 }),
+    (0, type_graphql_1.Field)({ description: 'What kind of action: door.check, door.result, role.grant, auth.signin, ...' }),
+    tslib_1.__metadata("design:type", String)
+], AuditAction.prototype, "kind", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true, length: 128 }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'The door, as category:privilege, or owner / super for a door that asks ownership only.' }),
+    tslib_1.__metadata("design:type", String)
+], AuditAction.prototype, "door", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true, length: 16 }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'granted or denied - for a door check.' }),
+    tslib_1.__metadata("design:type", String)
+], AuditAction.prototype, "decision", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true, length: 32 }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'Why: role, domain-owner, superuser when granted; role, address, license, ownership, unknown when denied.' }),
+    tslib_1.__metadata("design:type", String)
+], AuditAction.prototype, "basis", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true, length: 16 }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'ok or error - what was done after the door, or how an event ended.' }),
+    tslib_1.__metadata("design:type", String)
+], AuditAction.prototype, "outcome", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true, length: 64 }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'A fixed code for an error or a refusal. Never a message.' }),
+    tslib_1.__metadata("design:type", String)
+], AuditAction.prototype, "code", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ type: 'int', default: 1 }),
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'How many times this happened in the request - equal checks are kept as one row.' }),
+    tslib_1.__metadata("design:type", Number)
+], AuditAction.prototype, "count", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ type: 'int', nullable: true }),
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { nullable: true, description: 'How many items a list returned, summed over the request.' }),
+    tslib_1.__metadata("design:type", Number)
+], AuditAction.prototype, "returned", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true, length: 64 }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'Kind of the target - User, Role, ...' }),
+    tslib_1.__metadata("design:type", String)
+], AuditAction.prototype, "targetKind", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ type: 'simple-json', nullable: true }),
+    (0, type_graphql_1.Field)(type => [String], { nullable: true, description: 'Target ids, up to 100.' }),
+    tslib_1.__metadata("design:type", Array)
+], AuditAction.prototype, "targetIds", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ default: false }),
+    (0, type_graphql_1.Field)({ description: 'Whether more targets than were kept.' }),
+    tslib_1.__metadata("design:type", Boolean)
+], AuditAction.prototype, "truncated", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true, length: 16 }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'requested - named by the caller; handled - confirmed by the service.' }),
+    tslib_1.__metadata("design:type", String)
+], AuditAction.prototype, "targetRole", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true, length: 64 }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'Kind of the second object - the Role granted, the Privilege added.' }),
+    tslib_1.__metadata("design:type", String)
+], AuditAction.prototype, "objectKind", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true, length: 128 }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'Id or name of the second object.' }),
+    tslib_1.__metadata("design:type", String)
+], AuditAction.prototype, "objectId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ type: 'simple-json', nullable: true }),
+    (0, type_graphql_1.Field)(type => shell_1.ScalarObject, { nullable: true, description: 'Further facts, only the keys the kind registered.' }),
+    tslib_1.__metadata("design:type", Object)
+], AuditAction.prototype, "detail", void 0);
+exports.AuditAction = AuditAction = tslib_1.__decorate([
+    (0, typeorm_1.Entity)(),
+    (0, typeorm_1.Index)('ix_audit_action_0', (action) => [action.domain, action.createdAt]),
+    (0, typeorm_1.Index)('ix_audit_action_1', (action) => [action.actor, action.createdAt]),
+    (0, typeorm_1.Index)('ix_audit_action_2', (action) => [action.requestId]),
+    (0, type_graphql_1.ObjectType)({ description: 'One thing done, as the audit keeps it.' })
+], AuditAction);
+//# sourceMappingURL=audit-action.js.map

package/dist-server/service/audit/audit-action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-action.js","sourceRoot":"","sources":["../../../server/service/audit/audit-action.ts"],"names":[],"mappings":";;;;AAAA,+CAAyD;AACzD,qCAAgH;AAEhH,iDAA4D;AAE5D,6CAAsC;AAEtC;;;;;;;;;GASG;AAMI,IAAM,WAAW,GAAjB,MAAM,WAAW;CAsFvB,CAAA;AAtFY,kCAAW;AAGb;IAFR,IAAA,gCAAsB,EAAC,MAAM,CAAC;IAC9B,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAE,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;;uCACtC;AAInB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,mEAAmE,EAAE,CAAC;;8CAC1F;AAIlB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,CAAC;IACjF,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;sCAC5E,cAAM;2CAAA;AAGf;IADC,IAAA,oBAAU,EAAC,CAAC,MAAmB,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;;6CAClC;AAIjB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,CAAC;IAC/E,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,uFAAuF,EAAE,CAAC;sCACtI,cAAI;0CAAA;AAGZ;IADC,IAAA,oBAAU,EAAC,CAAC,MAAmB,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;;4CAClC;AAIhB;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;sCACpC,IAAI;8CAAA;AAIf;IAFC,IAAA,gBAAM,EAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtB,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,4EAA4E,EAAE,CAAC;;yCACzF;AAIZ;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACvC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wFAAwF,EAAE,CAAC;;yCACpH;AAIb;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,uCAAuC,EAAE,CAAC;;6CAC/D;AAIjB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,0GAA0G,EAAE,CAAC;;0CACrI;AAId;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oEAAoE,EAAE,CAAC;;4CAC7F;AAIhB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;;yCACtF;AAIb;IAFC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACnC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,iFAAiF,EAAE,CAAC;;0CAC1G;AAIb;IAFC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACvC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;;6CAC/F;AAIjB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;;+CAC5D;AAInB;IAFC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;;8CAC/D;AAIpB;IAFC,IAAA,gBAAM,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;;8CAC7C;AAIlB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sEAAsE,EAAE,CAAC;;+CAC5F;AAInB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oEAAoE,EAAE,CAAC;;+CAC1F;AAInB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACvC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;;6CAC1D;AAIjB;IAFC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,oBAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;;2CACzD;sBArF9C,WAAW;IALvB,IAAA,gBAAM,GAAE;IACR,IAAA,eAAK,EAAC,mBAAmB,EAAE,CAAC,MAAmB,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACtF,IAAA,eAAK,EAAC,mBAAmB,EAAE,CAAC,MAAmB,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACrF,IAAA,eAAK,EAAC,mBAAmB,EAAE,CAAC,MAAmB,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvE,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;GACzD,WAAW,CAsFvB","sourcesContent":["import { Field, ID, Int, ObjectType } from 'type-graphql'\nimport { Column, CreateDateColumn, Entity, Index, ManyToOne, PrimaryGeneratedColumn, RelationId } from 'typeorm'\n\nimport { Domain, ScalarObject } from '@things-factory/shell'\n\nimport { User } from '../user/user.js'\n\n/**\n * One thing done, as the audit keeps it (ADR-0141 §3.2 · §3.3).\n *\n * `kind` says which: `door.check` (a `@privilege` judgement), `door.result` (what a passed door\n * did), or an event a service or the audit subscriber wrote (`role.grant`, `auth.signin`, ...).\n * Only the columns below exist, and `detail` takes only the keys its kind registered\n * (`audit-kinds.ts`) - no business value, secret or request text has a place to go.\n *\n * Immutable like `AuditRequest`, and for the same reason without foreign keys.\n */\n@Entity()\n@Index('ix_audit_action_0', (action: AuditAction) => [action.domain, action.createdAt])\n@Index('ix_audit_action_1', (action: AuditAction) => [action.actor, action.createdAt])\n@Index('ix_audit_action_2', (action: AuditAction) => [action.requestId])\n@ObjectType({ description: 'One thing done, as the audit keeps it.' })\nexport class AuditAction {\n  @PrimaryGeneratedColumn('uuid')\n  @Field(type => ID, { description: 'Unique identifier.' })\n  readonly id: string\n\n  @Column({ nullable: true, length: 36 })\n  @Field({ nullable: true, description: 'The request this was done in. Empty for work outside any request.' })\n  requestId?: string\n\n  @ManyToOne(type => Domain, { nullable: true, createForeignKeyConstraints: false })\n  @Field(type => Domain, { nullable: true, description: 'The domain it was done in.' })\n  domain?: Domain\n\n  @RelationId((action: AuditAction) => action.domain)\n  domainId?: string\n\n  @ManyToOne(type => User, { nullable: true, createForeignKeyConstraints: false })\n  @Field(type => User, { nullable: true, description: 'Who did it. Empty when nobody is known - a sign-in to an account that does not exist.' })\n  actor?: User\n\n  @RelationId((action: AuditAction) => action.actor)\n  actorId?: string\n\n  @CreateDateColumn()\n  @Field({ description: 'When it was written.' })\n  createdAt: Date\n\n  @Column({ length: 64 })\n  @Field({ description: 'What kind of action: door.check, door.result, role.grant, auth.signin, ...' })\n  kind: string\n\n  @Column({ nullable: true, length: 128 })\n  @Field({ nullable: true, description: 'The door, as category:privilege, or owner / super for a door that asks ownership only.' })\n  door?: string\n\n  @Column({ nullable: true, length: 16 })\n  @Field({ nullable: true, description: 'granted or denied - for a door check.' })\n  decision?: string\n\n  @Column({ nullable: true, length: 32 })\n  @Field({ nullable: true, description: 'Why: role, domain-owner, superuser when granted; role, address, license, ownership, unknown when denied.' })\n  basis?: string\n\n  @Column({ nullable: true, length: 16 })\n  @Field({ nullable: true, description: 'ok or error - what was done after the door, or how an event ended.' })\n  outcome?: string\n\n  @Column({ nullable: true, length: 64 })\n  @Field({ nullable: true, description: 'A fixed code for an error or a refusal. Never a message.' })\n  code?: string\n\n  @Column({ type: 'int', default: 1 })\n  @Field(type => Int, { description: 'How many times this happened in the request - equal checks are kept as one row.' })\n  count: number\n\n  @Column({ type: 'int', nullable: true })\n  @Field(type => Int, { nullable: true, description: 'How many items a list returned, summed over the request.' })\n  returned?: number\n\n  @Column({ nullable: true, length: 64 })\n  @Field({ nullable: true, description: 'Kind of the target - User, Role, ...' })\n  targetKind?: string\n\n  @Column({ type: 'simple-json', nullable: true })\n  @Field(type => [String], { nullable: true, description: 'Target ids, up to 100.' })\n  targetIds?: string[]\n\n  @Column({ default: false })\n  @Field({ description: 'Whether more targets than were kept.' })\n  truncated: boolean\n\n  @Column({ nullable: true, length: 16 })\n  @Field({ nullable: true, description: 'requested - named by the caller; handled - confirmed by the service.' })\n  targetRole?: string\n\n  @Column({ nullable: true, length: 64 })\n  @Field({ nullable: true, description: 'Kind of the second object - the Role granted, the Privilege added.' })\n  objectKind?: string\n\n  @Column({ nullable: true, length: 128 })\n  @Field({ nullable: true, description: 'Id or name of the second object.' })\n  objectId?: string\n\n  @Column({ type: 'simple-json', nullable: true })\n  @Field(type => ScalarObject, { nullable: true, description: 'Further facts, only the keys the kind registered.' })\n  detail?: Record<string, string | number | boolean | null>\n}\n"]}

package/dist-server/service/audit/audit-kinds.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The kinds of audit action, and the `detail` keys each may carry (ADR-0141 §3.4).
+ *
+ * The audit stores only fields it allows. The fixed columns of `AuditAction` hold no business
+ * value; `detail` is the one open place, so it takes only the keys its kind registered here, and
+ * a kind nobody registered is refused - a module that wants a new event says so here, at import,
+ * and a typo does not become a new kind quietly.
+ *
+ * A key holds a security state or a count, never a business value: a user's status (`activated` →
+ * `locked`) is the account's security state; a salary is not, and has no key to go in.
+ */
+export type AuditDetailValue = string | number | boolean | null;
+export declare function registerAuditKind(kind: string, detail?: readonly string[]): void;
+export declare function isAuditKind(kind: string): boolean;
+/**
+ * The detail as it may be stored: unknown kinds throw, keys the kind did not register throw, and
+ * values are cut to 64 characters. Throwing is right - this is a program writing the wrong thing.
+ */
+export declare function allowedDetail(kind: string, detail?: Record<string, AuditDetailValue>): Record<string, AuditDetailValue> | undefined;

package/dist-server/service/audit/audit-kinds.js

@@ -0,0 +1,70 @@
+"use strict";
+/**
+ * The kinds of audit action, and the `detail` keys each may carry (ADR-0141 §3.4).
+ *
+ * The audit stores only fields it allows. The fixed columns of `AuditAction` hold no business
+ * value; `detail` is the one open place, so it takes only the keys its kind registered here, and
+ * a kind nobody registered is refused - a module that wants a new event says so here, at import,
+ * and a typo does not become a new kind quietly.
+ *
+ * A key holds a security state or a count, never a business value: a user's status (`activated` →
+ * `locked`) is the account's security state; a salary is not, and has no key to go in.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerAuditKind = registerAuditKind;
+exports.isAuditKind = isAuditKind;
+exports.allowedDetail = allowedDetail;
+const KINDS = new Map();
+function registerAuditKind(kind, detail = []) {
+    const known = KINDS.get(kind);
+    if (known && known.join() !== detail.join()) {
+        throw new Error(`Audit kind "${kind}" is registered twice with different detail keys.`);
+    }
+    KINDS.set(kind, detail);
+}
+function isAuditKind(kind) {
+    return KINDS.has(kind);
+}
+/**
+ * The detail as it may be stored: unknown kinds throw, keys the kind did not register throw, and
+ * values are cut to 64 characters. Throwing is right - this is a program writing the wrong thing.
+ */
+function allowedDetail(kind, detail) {
+    const keys = KINDS.get(kind);
+    if (!keys) {
+        throw new Error(`Audit kind "${kind}" is not registered. Register it with registerAuditKind() first.`);
+    }
+    if (!detail)
+        return undefined;
+    const kept = {};
+    for (const [key, value] of Object.entries(detail)) {
+        if (!keys.includes(key)) {
+            throw new Error(`Audit kind "${kind}" does not allow detail "${key}". Allowed: ${keys.join(', ') || 'none'}.`);
+        }
+        kept[key] = typeof value === 'string' ? value.slice(0, 64) : value;
+    }
+    return Object.keys(kept).length ? kept : undefined;
+}
+/* Doors */
+registerAuditKind('door.check');
+registerAuditKind('door.result');
+/* Signing in and out (ADR-0141 §3.3). The reason of a failure is the error code column. */
+registerAuditKind('auth.signin');
+registerAuditKind('auth.checkin');
+registerAuditKind('auth.signout');
+registerAuditKind('password.change');
+registerAuditKind('password.reset-by-admin');
+registerAuditKind('credential.issue');
+registerAuditKind('webauthn.register');
+/* Who may do what */
+registerAuditKind('role.grant');
+registerAuditKind('role.revoke');
+registerAuditKind('role.privilege.add');
+registerAuditKind('role.privilege.remove');
+registerAuditKind('role.delete');
+registerAuditKind('user.status', ['from', 'to']);
+registerAuditKind('domain.owner.add');
+registerAuditKind('domain.owner.remove');
+registerAuditKind('invitation.create');
+registerAuditKind('invitation.status', ['from', 'to']);
+//# sourceMappingURL=audit-kinds.js.map

package/dist-server/service/audit/audit-kinds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-kinds.js","sourceRoot":"","sources":["../../../server/service/audit/audit-kinds.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAMH,8CAMC;AAED,kCAEC;AAMD,sCAkBC;AApCD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA6B,CAAA;AAElD,SAAgB,iBAAiB,CAAC,IAAY,EAAE,SAA4B,EAAE;IAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,mDAAmD,CAAC,CAAA;IACzF,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AACzB,CAAC;AAED,SAAgB,WAAW,CAAC,IAAY;IACtC,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACxB,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAC3B,IAAY,EACZ,MAAyC;IAEzC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,kEAAkE,CAAC,CAAA;IACxG,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAE7B,MAAM,IAAI,GAAqC,EAAE,CAAA;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,4BAA4B,GAAG,eAAe,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC,CAAA;QAChH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACpE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AACpD,CAAC;AAED,WAAW;AACX,iBAAiB,CAAC,YAAY,CAAC,CAAA;AAC/B,iBAAiB,CAAC,aAAa,CAAC,CAAA;AAEhC,2FAA2F;AAC3F,iBAAiB,CAAC,aAAa,CAAC,CAAA;AAChC,iBAAiB,CAAC,cAAc,CAAC,CAAA;AACjC,iBAAiB,CAAC,cAAc,CAAC,CAAA;AACjC,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;AACpC,iBAAiB,CAAC,yBAAyB,CAAC,CAAA;AAC5C,iBAAiB,CAAC,kBAAkB,CAAC,CAAA;AACrC,iBAAiB,CAAC,mBAAmB,CAAC,CAAA;AAEtC,qBAAqB;AACrB,iBAAiB,CAAC,YAAY,CAAC,CAAA;AAC/B,iBAAiB,CAAC,aAAa,CAAC,CAAA;AAChC,iBAAiB,CAAC,oBAAoB,CAAC,CAAA;AACvC,iBAAiB,CAAC,uBAAuB,CAAC,CAAA;AAC1C,iBAAiB,CAAC,aAAa,CAAC,CAAA;AAChC,iBAAiB,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;AAChD,iBAAiB,CAAC,kBAAkB,CAAC,CAAA;AACrC,iBAAiB,CAAC,qBAAqB,CAAC,CAAA;AACxC,iBAAiB,CAAC,mBAAmB,CAAC,CAAA;AACtC,iBAAiB,CAAC,mBAAmB,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA","sourcesContent":["/**\n * The kinds of audit action, and the `detail` keys each may carry (ADR-0141 §3.4).\n *\n * The audit stores only fields it allows. The fixed columns of `AuditAction` hold no business\n * value; `detail` is the one open place, so it takes only the keys its kind registered here, and\n * a kind nobody registered is refused - a module that wants a new event says so here, at import,\n * and a typo does not become a new kind quietly.\n *\n * A key holds a security state or a count, never a business value: a user's status (`activated` →\n * `locked`) is the account's security state; a salary is not, and has no key to go in.\n */\n\nexport type AuditDetailValue = string | number | boolean | null\n\nconst KINDS = new Map<string, readonly string[]>()\n\nexport function registerAuditKind(kind: string, detail: readonly string[] = []) {\n  const known = KINDS.get(kind)\n  if (known && known.join() !== detail.join()) {\n    throw new Error(`Audit kind \"${kind}\" is registered twice with different detail keys.`)\n  }\n  KINDS.set(kind, detail)\n}\n\nexport function isAuditKind(kind: string): boolean {\n  return KINDS.has(kind)\n}\n\n/**\n * The detail as it may be stored: unknown kinds throw, keys the kind did not register throw, and\n * values are cut to 64 characters. Throwing is right - this is a program writing the wrong thing.\n */\nexport function allowedDetail(\n  kind: string,\n  detail?: Record<string, AuditDetailValue>\n): Record<string, AuditDetailValue> | undefined {\n  const keys = KINDS.get(kind)\n  if (!keys) {\n    throw new Error(`Audit kind \"${kind}\" is not registered. Register it with registerAuditKind() first.`)\n  }\n  if (!detail) return undefined\n\n  const kept: Record<string, AuditDetailValue> = {}\n  for (const [key, value] of Object.entries(detail)) {\n    if (!keys.includes(key)) {\n      throw new Error(`Audit kind \"${kind}\" does not allow detail \"${key}\". Allowed: ${keys.join(', ') || 'none'}.`)\n    }\n    kept[key] = typeof value === 'string' ? value.slice(0, 64) : value\n  }\n  return Object.keys(kept).length ? kept : undefined\n}\n\n/* Doors */\nregisterAuditKind('door.check')\nregisterAuditKind('door.result')\n\n/* Signing in and out (ADR-0141 §3.3). The reason of a failure is the error code column. */\nregisterAuditKind('auth.signin')\nregisterAuditKind('auth.checkin')\nregisterAuditKind('auth.signout')\nregisterAuditKind('password.change')\nregisterAuditKind('password.reset-by-admin')\nregisterAuditKind('credential.issue')\nregisterAuditKind('webauthn.register')\n\n/* Who may do what */\nregisterAuditKind('role.grant')\nregisterAuditKind('role.revoke')\nregisterAuditKind('role.privilege.add')\nregisterAuditKind('role.privilege.remove')\nregisterAuditKind('role.delete')\nregisterAuditKind('user.status', ['from', 'to'])\nregisterAuditKind('domain.owner.add')\nregisterAuditKind('domain.owner.remove')\nregisterAuditKind('invitation.create')\nregisterAuditKind('invitation.status', ['from', 'to'])\n"]}

package/dist-server/service/audit/audit-query.d.ts

@@ -0,0 +1,11 @@
+import { AuditAction } from './audit-action.js';
+import { AuditRequest } from './audit-request.js';
+import { AuditDoor, AuditHealth, AuditPerson, AuditRecordFilter, AuditRecordList } from './audit-types.js';
+export declare class AuditQuery {
+    auditRecords(filter: AuditRecordFilter, context: ResolverContext): Promise<AuditRecordList>;
+    auditPeople(from: Date, to: Date, context: ResolverContext): Promise<AuditPerson[]>;
+    auditDoors(from: Date, to: Date, context: ResolverContext): Promise<AuditDoor[]>;
+    auditHealth(): Promise<AuditHealth>;
+    myAuditActions(kind: string, limit: number, context: ResolverContext): Promise<AuditAction[]>;
+    request(action: AuditAction): Promise<AuditRequest | null>;
+}