@things-factory/auth-base 10.1.213 → 10.1.218

package/dist-server/utils/password-reset-rule.d.ts

@@ -0,0 +1,15 @@
+import { Domain, Refusal } from '@things-factory/shell';
+import { EntityManager } from 'typeorm';
+import { User } from '../service/user/user.js';
+/**
+ * Whom a domain may put back on the default password.
+ *
+ * A person has one password for every domain they work in, and the default password is known to everyone who
+ * was ever handed it. Resetting one is therefore the same as taking the account: the first one to sign in with
+ * the default is sent to set a new password. A domain may do that only to an account that is wholly its own -
+ * one that works in no other domain and owns no domain. The system domain's owner (the super user) and any
+ * domain's owner are refused here, whichever domain asks; so are `admin` accounts, as `inactivateUser` refuses them.
+ *
+ * @returns the refusal, or `null` when `target` may be reset from `domain`. `target` must carry its `domains`.
+ */
+export declare function passwordResetRefusal(target: User, domain: Domain, tx?: EntityManager): Promise<Refusal | null>;

package/dist-server/utils/password-reset-rule.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.passwordResetRefusal = passwordResetRefusal;
+const shell_1 = require("@things-factory/shell");
+const domain_owner_js_1 = require("../service/domain-owner/domain-owner.js");
+/**
+ * Whom a domain may put back on the default password.
+ *
+ * A person has one password for every domain they work in, and the default password is known to everyone who
+ * was ever handed it. Resetting one is therefore the same as taking the account: the first one to sign in with
+ * the default is sent to set a new password. A domain may do that only to an account that is wholly its own -
+ * one that works in no other domain and owns no domain. The system domain's owner (the super user) and any
+ * domain's owner are refused here, whichever domain asks; so are `admin` accounts, as `inactivateUser` refuses them.
+ *
+ * @returns the refusal, or `null` when `target` may be reset from `domain`. `target` must carry its `domains`.
+ */
+async function passwordResetRefusal(target, domain, tx) {
+    if (target.userType == 'admin' || (await ownsAnyDomain(target, tx))) {
+        return new shell_1.Refusal('password-reset-owner-account', {}, "A domain owner's or administrator's password is not reset to the default.");
+    }
+    const elsewhere = (target.domains || []).filter((userDomain) => userDomain.id !== domain.id);
+    if (elsewhere.length > 0) {
+        return new shell_1.Refusal('password-reset-reaches-other-domains', { domains: elsewhere.map((userDomain) => userDomain.name).join(', ') }, `The account also works in ${elsewhere.map((userDomain) => userDomain.name).join(', ')} - its password is not this domain's to reset.`);
+    }
+    return null;
+}
+/** Owner of any domain - through the `DomainOwner` table or the primary owner column (`domain-ownership.ts`). */
+async function ownsAnyDomain(user, tx) {
+    if (await (0, shell_1.getRepository)(shell_1.Domain, tx).exists({ where: { owner: user.id } })) {
+        return true;
+    }
+    return await (0, shell_1.getRepository)(domain_owner_js_1.DomainOwner, tx).exists({ where: { user: { id: user.id } } });
+}
+//# sourceMappingURL=password-reset-rule.js.map

package/dist-server/utils/password-reset-rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset-rule.js","sourceRoot":"","sources":["../../server/utils/password-reset-rule.ts"],"names":[],"mappings":";;AAiBA,oDAuBC;AAxCD,iDAAsE;AAGtE,6EAAqE;AAGrE;;;;;;;;;;GAUG;AACI,KAAK,UAAU,oBAAoB,CACxC,MAAY,EACZ,MAAc,EACd,EAAkB;IAElB,IAAI,MAAM,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,eAAO,CAChB,8BAA8B,EAC9B,EAAE,EACF,2EAA2E,CAC5E,CAAA;IACH,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAA;IACpG,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,eAAO,CAChB,sCAAsC,EACtC,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC9E,6BAA6B,SAAS,CAAC,GAAG,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gDAAgD,CAC/I,CAAA;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,iHAAiH;AACjH,KAAK,UAAU,aAAa,CAAC,IAAU,EAAE,EAAkB;IACzD,IAAI,MAAM,IAAA,qBAAa,EAAC,cAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,MAAM,IAAA,qBAAa,EAAC,6BAAW,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;AAC1F,CAAC","sourcesContent":["import { Domain, getRepository, Refusal } from '@things-factory/shell'\nimport { EntityManager } from 'typeorm'\n\nimport { DomainOwner } from '../service/domain-owner/domain-owner.js'\nimport { User } from '../service/user/user.js'\n\n/**\n * Whom a domain may put back on the default password.\n *\n * A person has one password for every domain they work in, and the default password is known to everyone who\n * was ever handed it. Resetting one is therefore the same as taking the account: the first one to sign in with\n * the default is sent to set a new password. A domain may do that only to an account that is wholly its own -\n * one that works in no other domain and owns no domain. The system domain's owner (the super user) and any\n * domain's owner are refused here, whichever domain asks; so are `admin` accounts, as `inactivateUser` refuses them.\n *\n * @returns the refusal, or `null` when `target` may be reset from `domain`. `target` must carry its `domains`.\n */\nexport async function passwordResetRefusal(\n  target: User,\n  domain: Domain,\n  tx?: EntityManager\n): Promise<Refusal | null> {\n  if (target.userType == 'admin' || (await ownsAnyDomain(target, tx))) {\n    return new Refusal(\n      'password-reset-owner-account',\n      {},\n      \"A domain owner's or administrator's password is not reset to the default.\"\n    )\n  }\n\n  const elsewhere = (target.domains || []).filter((userDomain: Domain) => userDomain.id !== domain.id)\n  if (elsewhere.length > 0) {\n    return new Refusal(\n      'password-reset-reaches-other-domains',\n      { domains: elsewhere.map((userDomain: Domain) => userDomain.name).join(', ') },\n      `The account also works in ${elsewhere.map((userDomain: Domain) => userDomain.name).join(', ')} - its password is not this domain's to reset.`\n    )\n  }\n\n  return null\n}\n\n/** Owner of any domain - through the `DomainOwner` table or the primary owner column (`domain-ownership.ts`). */\nasync function ownsAnyDomain(user: User, tx?: EntityManager): Promise<boolean> {\n  if (await getRepository(Domain, tx).exists({ where: { owner: user.id } })) {\n    return true\n  }\n\n  return await getRepository(DomainOwner, tx).exists({ where: { user: { id: user.id } } })\n}\n"]}

package/dist-server/utils/verification-token-rule.js

@@ -27,7 +27,7 @@ const crypto_1 = require("crypto");
  * and a rule that reads it would extend a link by touching the row. `expiresAt` is written once,
  * with the token.
  *
- * A row without `expiresAt` reads as **expired** — the rule `invitation-state.ts` uses. Such rows
+ * A row without `expiresAt` reads as **expired**. Such rows
  * were written before this existed, with the token in plain text; refusing them is also how links
  * already sent stop working when this ships.
  *
@@ -39,6 +39,8 @@ const crypto_1 = require("crypto");
 const HOUR = 60 * 60 * 1000;
 exports.VERIFICATION_TOKEN_LIFETIME_MS = Object.freeze({
     'password-reset': 1 * HOUR,
+    /* Handed over by mail or by hand, so it lives as long as an invitation did (ADR-0161 decision 3). */
+    'password-setup': 48 * HOUR,
     unlock: 1 * HOUR,
     activation: 48 * HOUR
 });

package/dist-server/utils/verification-token-rule.js.map

@@ -1 +1 @@
-{"version":3,"file":"verification-token-rule.js","sourceRoot":"","sources":["../../server/utils/verification-token-rule.ts"],"names":[],"mappings":";;;AA2CA,sDAEC;AAQD,gEAQC;AAMD,0DAYC;AA/ED,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEd,QAAA,8BAA8B,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC5F,gBAAgB,EAAE,CAAC,GAAG,IAAI;IAC1B,MAAM,EAAE,CAAC,GAAG,IAAI;IAChB,UAAU,EAAE,EAAE,GAAG,IAAI;CACtB,CAAC,CAAA;AAEF,6CAA6C;AAC7C,SAAgB,qBAAqB,CAAC,KAAa;IACjD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,0BAA0B,CAAC,IAAY,EAAE,MAAY,IAAI,IAAI,EAAE;IAC7E,MAAM,QAAQ,GAAG,sCAA8B,CAAC,IAAI,CAAC,CAAA;IAErD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,mBAAmB,CAAC,CAAA;IACtE,CAAC;IAED,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAA;AAC3C,CAAC;AAKD,0GAA0G;AAC1G,SAAgB,uBAAuB,CAAC,MAA+B,EAAE,MAAY,IAAI,IAAI,EAAE;IAC7F,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAE3F,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAA;AACrC,CAAC","sourcesContent":["import { createHash } from 'crypto'\n\n/**\n * How long a mailed link lives, and what the table keeps of it. (Pure rule.)\n *\n * Password reset, unlock and sign-up confirmation each mail a link that carries a token, and the\n * token is the whole credential: whoever holds the link resets the password or unlocks the account.\n * Before 2026-09-24 those tokens never expired, were stored as written and were found by that same\n * value — so a reset mail from last year still changed a password today, and a copy of the table\n * (a backup, a replica, a dump handed to support) was a set of live reset links.\n *\n * ── The lifetimes ──────────────────────────────────────────────────────────\n *\n *   password-reset   1 hour    hands the account over at once, so short\n *   unlock           1 hour    the same\n *   activation       48 hours  the person may read the mail late; it only confirms an address\n *\n * Decided with the architect, 2026-09-24 (`docs/design/auth-rebuild-questions-2026-09-24.md` Q4).\n *\n * ── Expiry is its own column ───────────────────────────────────────────────\n * Not derived from `createdAt` or `updatedAt`: `updatedAt` moves every time the row is saved again,\n * and a rule that reads it would extend a link by touching the row. `expiresAt` is written once,\n * with the token.\n *\n * A row without `expiresAt` reads as **expired** — the rule `invitation-state.ts` uses. Such rows\n * were written before this existed, with the token in plain text; refusing them is also how links\n * already sent stop working when this ships.\n *\n * ── What is stored is a hash ───────────────────────────────────────────────\n * sha256 of the token. The token is 16 random bytes, so there is nothing for a slow hash to protect\n * — it guards against guessing, and there is no guessing a random 128-bit value. The point is only\n * that the table no longer holds anything a link can be made from.\n */\n\nconst HOUR = 60 * 60 * 1000\n\nexport const VERIFICATION_TOKEN_LIFETIME_MS: Readonly<Record<string, number>> = Object.freeze({\n  'password-reset': 1 * HOUR,\n  unlock: 1 * HOUR,\n  activation: 48 * HOUR\n})\n\n/** The value the table keeps for a token. */\nexport function hashVerificationToken(token: string): string {\n  return createHash('sha256').update(token, 'utf8').digest('hex')\n}\n\n/**\n * When a token of this type, issued at `now`, stops working.\n *\n * Throws for a type with no lifetime here — a new kind of mailed link has to say how long it lives\n * rather than inherit forever.\n */\nexport function verificationTokenExpiresAt(type: string, now: Date = new Date()): Date {\n  const lifetime = VERIFICATION_TOKEN_LIFETIME_MS[type]\n\n  if (!lifetime) {\n    throw new Error(`verification token type '${type}' has no lifetime`)\n  }\n\n  return new Date(now.getTime() + lifetime)\n}\n\n/** The parts of a stored token this rule reads. */\nexport type VerificationTokenRecord = { expiresAt?: Date | string | null } | null | undefined\n\n/** May this token still be used, as of `now`? Absence of an expiry refuses; the expiry itself refuses. */\nexport function isVerificationTokenLive(record: VerificationTokenRecord, now: Date = new Date()): boolean {\n  if (!record?.expiresAt) {\n    return false\n  }\n\n  const at = record.expiresAt instanceof Date ? record.expiresAt : new Date(record.expiresAt)\n\n  if (Number.isNaN(at.getTime())) {\n    return false\n  }\n\n  return now.getTime() < at.getTime()\n}\n"]}
+{"version":3,"file":"verification-token-rule.js","sourceRoot":"","sources":["../../server/utils/verification-token-rule.ts"],"names":[],"mappings":";;;AA6CA,sDAEC;AAQD,gEAQC;AAMD,0DAYC;AAjFD,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEd,QAAA,8BAA8B,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC5F,gBAAgB,EAAE,CAAC,GAAG,IAAI;IAC1B,qGAAqG;IACrG,gBAAgB,EAAE,EAAE,GAAG,IAAI;IAC3B,MAAM,EAAE,CAAC,GAAG,IAAI;IAChB,UAAU,EAAE,EAAE,GAAG,IAAI;CACtB,CAAC,CAAA;AAEF,6CAA6C;AAC7C,SAAgB,qBAAqB,CAAC,KAAa;IACjD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,0BAA0B,CAAC,IAAY,EAAE,MAAY,IAAI,IAAI,EAAE;IAC7E,MAAM,QAAQ,GAAG,sCAA8B,CAAC,IAAI,CAAC,CAAA;IAErD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,mBAAmB,CAAC,CAAA;IACtE,CAAC;IAED,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAA;AAC3C,CAAC;AAKD,0GAA0G;AAC1G,SAAgB,uBAAuB,CAAC,MAA+B,EAAE,MAAY,IAAI,IAAI,EAAE;IAC7F,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAE3F,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAA;AACrC,CAAC","sourcesContent":["import { createHash } from 'crypto'\n\n/**\n * How long a mailed link lives, and what the table keeps of it. (Pure rule.)\n *\n * Password reset, unlock and sign-up confirmation each mail a link that carries a token, and the\n * token is the whole credential: whoever holds the link resets the password or unlocks the account.\n * Before 2026-09-24 those tokens never expired, were stored as written and were found by that same\n * value — so a reset mail from last year still changed a password today, and a copy of the table\n * (a backup, a replica, a dump handed to support) was a set of live reset links.\n *\n * ── The lifetimes ──────────────────────────────────────────────────────────\n *\n *   password-reset   1 hour    hands the account over at once, so short\n *   unlock           1 hour    the same\n *   activation       48 hours  the person may read the mail late; it only confirms an address\n *\n * Decided with the architect, 2026-09-24 (`docs/design/auth-rebuild-questions-2026-09-24.md` Q4).\n *\n * ── Expiry is its own column ───────────────────────────────────────────────\n * Not derived from `createdAt` or `updatedAt`: `updatedAt` moves every time the row is saved again,\n * and a rule that reads it would extend a link by touching the row. `expiresAt` is written once,\n * with the token.\n *\n * A row without `expiresAt` reads as **expired**. Such rows\n * were written before this existed, with the token in plain text; refusing them is also how links\n * already sent stop working when this ships.\n *\n * ── What is stored is a hash ───────────────────────────────────────────────\n * sha256 of the token. The token is 16 random bytes, so there is nothing for a slow hash to protect\n * — it guards against guessing, and there is no guessing a random 128-bit value. The point is only\n * that the table no longer holds anything a link can be made from.\n */\n\nconst HOUR = 60 * 60 * 1000\n\nexport const VERIFICATION_TOKEN_LIFETIME_MS: Readonly<Record<string, number>> = Object.freeze({\n  'password-reset': 1 * HOUR,\n  /* Handed over by mail or by hand, so it lives as long as an invitation did (ADR-0161 decision 3). */\n  'password-setup': 48 * HOUR,\n  unlock: 1 * HOUR,\n  activation: 48 * HOUR\n})\n\n/** The value the table keeps for a token. */\nexport function hashVerificationToken(token: string): string {\n  return createHash('sha256').update(token, 'utf8').digest('hex')\n}\n\n/**\n * When a token of this type, issued at `now`, stops working.\n *\n * Throws for a type with no lifetime here — a new kind of mailed link has to say how long it lives\n * rather than inherit forever.\n */\nexport function verificationTokenExpiresAt(type: string, now: Date = new Date()): Date {\n  const lifetime = VERIFICATION_TOKEN_LIFETIME_MS[type]\n\n  if (!lifetime) {\n    throw new Error(`verification token type '${type}' has no lifetime`)\n  }\n\n  return new Date(now.getTime() + lifetime)\n}\n\n/** The parts of a stored token this rule reads. */\nexport type VerificationTokenRecord = { expiresAt?: Date | string | null } | null | undefined\n\n/** May this token still be used, as of `now`? Absence of an expiry refuses; the expiry itself refuses. */\nexport function isVerificationTokenLive(record: VerificationTokenRecord, now: Date = new Date()): boolean {\n  if (!record?.expiresAt) {\n    return false\n  }\n\n  const at = record.expiresAt instanceof Date ? record.expiresAt : new Date(record.expiresAt)\n\n  if (Number.isNaN(at.getTime())) {\n    return false\n  }\n\n  return now.getTime() < at.getTime()\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.213",
+  "version": "10.1.218",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -50,5 +50,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "81f23aa18cb584c7d8185e81cca0d688f509cf8c"
+  "gitHead": "b4e60fdfe307cecebb2264267f616749a502d5fe"
 }

package/tests/add-user-gates.test.ts

@@ -0,0 +1,34 @@
+import { buildSchema } from 'type-graphql'
+
+import { loadCompiled } from './compiled'
+
+/**
+ * The questions the user popups ask are gated as the actions they lead to.
+ *
+ * `checkUserExistence` is asked only by the add-user popup, before `inviteUser` / `createUser`
+ * (each `user:mutation`, owner granted). It asked `user:query` alone, so a domain owner without that role was refused
+ * the lookup and the popup took the refusal for "no account" - and set out to create an account for someone who
+ * had one. `mayIssuePasswordSetupLink` answers for the setup link button, so it stands where `issuePasswordSetupLink` does.
+ */
+const { schema: declared } = loadCompiled('service/index')
+const { privilegeDirectiveResolver, privilegeOfField } = loadCompiled('service/privilege/privilege-directive')
+
+function gateOf(field: string) {
+  const gate = privilegeOfField('Query', field)
+  return [gate.known, gate['gate']?.category, gate['gate']?.privilege, gate['gate']?.owner]
+}
+
+describe('what the user popups ask', () => {
+  beforeAll(async () => {
+    const schema = await buildSchema({ resolvers: declared.resolverClasses, validate: false })
+    privilegeDirectiveResolver(schema, { modules: [] })
+  })
+
+  it('★ checkUserExistence asks what adding a user asks - user:mutation, or the owner', () => {
+    expect(gateOf('checkUserExistence')).toEqual([true, 'user', 'mutation', true])
+  })
+
+  it('mayIssuePasswordSetupLink asks what issuing asks', () => {
+    expect(gateOf('mayIssuePasswordSetupLink')).toEqual([true, 'user', 'mutation', true])
+  })
+})

package/tests/list-inheritance-db.test.ts

@@ -19,9 +19,6 @@ const { Appliance } = loadCompiled('service/appliance/appliance')
 const { ApplianceQuery } = loadCompiled('service/appliance/appliance-query')
 const { Application } = loadCompiled('service/application/application')
 const { ApplicationQuery } = loadCompiled('service/application/application-query')
-const { Invitation } = loadCompiled('service/invitation/invitation')
-const { InvitationStatus } = loadCompiled('utils/invitation-state')
-const { InvitationQuery } = loadCompiled('service/invitation/invitation-query')
 const { Partner } = loadCompiled('service/partner/partner')
 const { PartnerQuery } = loadCompiled('service/partner/partner-query')
 
@@ -101,18 +98,6 @@ const LISTS: [string, () => Promise<any>, (params: any, context: any) => Promise
       }),
     (params, context) => new ApplicationQuery().applications(params, context)
   ],
-  [
-    'invitations',
-    () =>
-      getRepository(Invitation).save({
-        email: 'lee@acme.z',
-        domain: parent,
-        status: InvitationStatus.PENDING,
-        token: 'parent-token',
-        expiresAt: new Date(Date.now() + 3600_000)
-      }),
-    (params, context) => new InvitationQuery().invitations(params, context)
-  ],
   [
     'partners',
     () => getRepository(Partner).save({ domain: parent, partnerDomain, requestedAt: new Date() }),

package/tests/lock-recovery.test.ts

@@ -70,7 +70,7 @@ describe('재설정 메일 경로 (PASSWORD_RESET)', () => {
     const user = await lockedUser()
     await giveToken(user.id, 'tok', VerificationTokenType.PASSWORD_RESET)
 
-    await resetPassword('tok', NEW, context)
+    await resetPassword('tok', NEW, 'kim@example.com', context)
 
     const after = await getRepository(User).findOneBy({ id: user.id })
     expect(User.verify(after.password, NEW, after.salt)).toBe(true)
@@ -84,7 +84,7 @@ describe('재설정 메일 경로 (PASSWORD_RESET)', () => {
     const user = await lockedUser()
     await giveToken(user.id, 'tok', VerificationTokenType.PASSWORD_RESET)
 
-    await resetPassword('tok', NEW, context)
+    await resetPassword('tok', NEW, 'kim@example.com', context)
 
     await expect(signin({ username: 'kim', password: NEW })).rejects.toThrow()
   })

package/tests/open-doors.test.ts

@@ -81,8 +81,7 @@ describe('the doors that were closed', () => {
    *   domainUserRoleRegister         makes a domain, its roles and its users. `domainRegister`
    *                                  beside it makes only a domain and is super-user only
    *   loginHistories                 everybody's sign-ins - now the audit's, behind `audit:query` (ADR-0141)
-   *   invitation / invitations       and neither of them scopes by tenant at all
-   *   sendInvitation / cancelInvitation / inviteUser
+   *   inviteUser
    */
   const CLOSED = {
     Mutation: [
@@ -92,11 +91,9 @@ describe('the doors that were closed', () => {
       'deleteAuthProvider',
       'deleteAuthProviders',
       'domainUserRoleRegister',
-      'sendInvitation',
-      'cancelInvitation',
       'inviteUser'
     ],
-    Query: ['auditRecords', 'auditPeople', 'auditDoors', 'auditHealth', 'invitation', 'invitations']
+    Query: ['auditRecords', 'auditPeople', 'auditDoors', 'auditHealth']
   }
 
   it.each(Object.entries(CLOSED).flatMap(([t, fields]) => fields.map(f => [t, f])))('%s.%s', (typeName, field) => {

package/tests/password-reset-rule-db.test.ts

@@ -0,0 +1,159 @@
+/**
+ * Whose password a domain may take back - by issuing a password setup link (ADR-0161).
+ *
+ * The reset asked only that the person belong to the asking domain. A person has one password for every domain, so a
+ * user manager of any domain could take the password of someone who also works elsewhere, of another domain's owner,
+ * and of the super user (the system domain's owner) the moment that person was a member here. It was the default
+ * password then; it is a setup link now, and the same people are refused.
+ */
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { User } = loadCompiled('service/user/user')
+const { UserMutation } = loadCompiled('service/user/user-mutation')
+const { UserQuery } = loadCompiled('service/user/user-query')
+const { DomainOwner } = loadCompiled('service/domain-owner/domain-owner')
+
+const OWN_PASSWORD = 'Mine!5678'
+
+let here: any
+let other: any
+let system: any
+
+async function makeUser(domains: any[], extra: any = {}) {
+  const tag = Math.random().toString(36).slice(2, 8)
+  const salt = User.generateSalt()
+  return await getRepository(User).save({
+    username: `u-${tag}`,
+    email: `u-${tag}@example.com`,
+    name: 'Kim',
+    salt,
+    password: User.encode(OWN_PASSWORD, salt),
+    status: 'activated',
+    domains,
+    ...extra
+  })
+}
+
+function context(domain: any) {
+  return {
+    state: { domain, tx: undefined },
+    t: (key: string) => key,
+    headers: {},
+    request: { protocol: 'https', host: 'acme.example.com' }
+  } as any
+}
+
+function reset(user: any, domain: any) {
+  return new UserMutation().issuePasswordSetupLink(user.username, false, context(domain))
+}
+
+function mayReset(user: any, domain: any) {
+  return new UserQuery().mayIssuePasswordSetupLink(user.id, context(domain))
+}
+
+async function stillHasOwnPassword(user: any) {
+  const read = await getRepository(User).findOneBy({ id: user.id })
+  return User.verify(read.password, OWN_PASSWORD, read.salt)
+}
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+
+  const domainRepository = getRepository(Domain)
+  here = await domainRepository.save({ name: 'Plant A', subdomain: 'plant-a' })
+  other = await domainRepository.save({ name: 'Plant B', subdomain: 'plant-b' })
+  system = await domainRepository.save({ name: 'System', subdomain: 'system' })
+})
+
+describe('a person wholly of this domain', () => {
+  it('is issued a link and waits for a password, and the screen offers it', async () => {
+    const user = await makeUser([here])
+
+    expect(await mayReset(user, here)).toBe(true)
+    await expect(reset(user, here)).resolves.toMatchObject({ link: expect.stringContaining('/auth/reset-password#') })
+
+    const read = await getRepository(User).findOneBy({ id: user.id })
+    expect(read.status).toBe('password_reset_required')
+    expect(await stillHasOwnPassword(user)).toBe(false)
+  })
+})
+
+describe('refused, and the password stays', () => {
+  it('★ someone who also works in another domain', async () => {
+    const user = await makeUser([here, other])
+
+    expect(await mayReset(user, here)).toBe(false)
+    await expect(reset(user, here)).rejects.toMatchObject({
+      code: 'password-reset-reaches-other-domains',
+      params: { domains: 'Plant B' }
+    })
+    expect(await stillHasOwnPassword(user)).toBe(true)
+  })
+
+  it("★ another domain's owner, through the owner table, though a member only here", async () => {
+    const user = await makeUser([here])
+    await getRepository(DomainOwner).save({ domain: other, user })
+
+    expect(await mayReset(user, here)).toBe(false)
+    await expect(reset(user, here)).rejects.toMatchObject({ code: 'password-reset-owner-account' })
+    expect(await stillHasOwnPassword(user)).toBe(true)
+  })
+
+  it("★ another domain's primary owner (the column only)", async () => {
+    const user = await makeUser([here])
+    await getRepository(Domain).update({ id: other.id }, { owner: user.id })
+
+    expect(await mayReset(user, here)).toBe(false)
+    await expect(reset(user, here)).rejects.toMatchObject({ code: 'password-reset-owner-account' })
+    expect(await stillHasOwnPassword(user)).toBe(true)
+  })
+
+  it('★ the super user - asked from the system domain itself', async () => {
+    const superUser = await makeUser([system])
+    await getRepository(Domain).update({ id: system.id }, { owner: superUser.id })
+
+    expect(await mayReset(superUser, system)).toBe(false)
+    await expect(reset(superUser, system)).rejects.toMatchObject({ code: 'password-reset-owner-account' })
+    expect(await stillHasOwnPassword(superUser)).toBe(true)
+  })
+
+  it('★ the super user - asked from a domain they are also a member of', async () => {
+    const superUser = await makeUser([system, here])
+    await getRepository(Domain).update({ id: system.id }, { owner: superUser.id })
+
+    expect(await mayReset(superUser, here)).toBe(false)
+    await expect(reset(superUser, here)).rejects.toMatchObject({ code: 'password-reset-owner-account' })
+    expect(await stillHasOwnPassword(superUser)).toBe(true)
+  })
+
+  it("this domain's own owner", async () => {
+    const owner = await makeUser([here])
+    await getRepository(DomainOwner).save({ domain: here, user: owner })
+
+    expect(await mayReset(owner, here)).toBe(false)
+    await expect(reset(owner, here)).rejects.toMatchObject({ code: 'password-reset-owner-account' })
+  })
+
+  it('an admin account, as inactivateUser refuses it', async () => {
+    const admin = await makeUser([here], { userType: 'admin' })
+
+    expect(await mayReset(admin, here)).toBe(false)
+    await expect(reset(admin, here)).rejects.toMatchObject({ code: 'password-reset-owner-account' })
+  })
+
+  it('the screen is told no for someone who is not a member here', async () => {
+    const stranger = await makeUser([other])
+
+    expect(await mayReset(stranger, here)).toBe(false)
+  })
+})

package/tests/password-setup-db.test.ts

@@ -0,0 +1,213 @@
+/**
+ * An administrator never sets anybody's password (ADR-0161).
+ *
+ * It used to be the installation's default password - one value everyone handed one knew, with no end, for every
+ * account an administrator made or reset. Now such an account waits for its password, and the person sets it through
+ * a one-time link that is mailed or handed over: 48 hours, hashed at rest, asking for the address it was for, and the
+ * only live one. Issuing it ends the sessions opened before.
+ */
+
+import { authDataSource, closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const jwt = require('jsonwebtoken')
+
+const { User } = loadCompiled('service/user/user')
+const { UserMutation } = loadCompiled('service/user/user-mutation')
+const { VerificationToken } = loadCompiled('service/verification-token/verification-token')
+const { signin } = loadCompiled('controllers/signin')
+const { resetPassword } = loadCompiled('controllers/reset-password')
+const { hashVerificationToken } = loadCompiled('utils/verification-token-rule')
+
+const OWN_PASSWORD = 'Mine!5678'
+const NEW_PASSWORD = 'N3w!Passw0rd'
+const HOUR = 60 * 60 * 1000
+
+let here: any
+
+function context(tx?: any) {
+  return {
+    state: { domain: here, tx },
+    t: (key: string) => key,
+    headers: {},
+    request: { protocol: 'https', host: 'acme.example.com' }
+  } as any
+}
+
+async function makeActive(email = 'kim@example.com') {
+  const salt = User.generateSalt()
+  return await getRepository(User).save({
+    username: email,
+    email,
+    name: 'Kim',
+    salt,
+    password: User.encode(OWN_PASSWORD, salt),
+    status: 'activated',
+    domains: [here]
+  })
+}
+
+function create(email = 'lee@example.com') {
+  return new UserMutation().createUser({ username: email, email, name: 'Lee', userType: 'user' }, context())
+}
+
+function issue(user: any, mail = false, tx?: any) {
+  return new UserMutation().issuePasswordSetupLink(user.username, mail, context(tx))
+}
+
+const tokenOf = (link: string) => link.split('#')[1]
+const reload = (id: string) => getRepository(User).findOneBy({ id })
+const setPassword = (token: string, email: string, password = NEW_PASSWORD) =>
+  resetPassword(token, password, email, { t: (key: string) => key })
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  here = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
+})
+
+describe('an account an administrator makes', () => {
+  it('★ waits for its password, which nobody was given', async () => {
+    const made = await create()
+    const read = await reload(made.id)
+
+    expect(read.status).toBe('password_reset_required')
+    expect(read.password).toBeTruthy()
+  })
+
+  it('★ does not sign in, and a guess against it is not counted', async () => {
+    const made = await create()
+
+    await expect(signin({ username: made.username, password: 'anything' })).rejects.toMatchObject({
+      errorCode: 'password-setup-pending'
+    })
+    expect((await reload(made.id)).failCount ?? 0).toBe(0)
+  })
+
+  it('★ is refused on every request too', async () => {
+    const made = await create()
+
+    await expect(User.checkAuth({ username: made.username, email: made.email })).rejects.toMatchObject({
+      errorCode: 'password-setup-pending'
+    })
+  })
+
+  it('is not opened by activating it', async () => {
+    const made = await create()
+
+    await expect(new UserMutation().activateUser(made.username, context())).rejects.toMatchObject({
+      code: 'password-setup-pending'
+    })
+  })
+})
+
+describe('the setup link', () => {
+  it('★ is handed back once, kept only as a hash, and lives 48 hours', async () => {
+    const made = await create()
+    const before = Date.now()
+
+    const issued = await issue(made)
+
+    expect(issued.link).toMatch(/^https?:\/\/acme\.example\.com\/auth\/reset-password#[0-9a-f]{32}$/)
+    const stored = await getRepository(VerificationToken).findOneBy({ userId: made.id })
+    expect(stored.type).toBe('password-setup')
+    expect(stored.token).toBe(hashVerificationToken(tokenOf(issued.link)))
+    expect(stored.token).not.toBe(tokenOf(issued.link))
+    expect(new Date(stored.expiresAt).getTime() - before).toBeGreaterThanOrEqual(48 * HOUR - 1000)
+    expect(new Date(stored.expiresAt).getTime() - before).toBeLessThanOrEqual(48 * HOUR + 5000)
+  })
+
+  it('★ opens the account with the address it was for, and then signs in', async () => {
+    const made = await create()
+    const { link } = await issue(made)
+
+    await setPassword(tokenOf(link), 'LEE@example.com ')
+
+    expect((await reload(made.id)).status).toBe('activated')
+    await expect(signin({ username: made.username, password: NEW_PASSWORD })).resolves.toMatchObject({
+      token: expect.any(String)
+    })
+  })
+
+  it('★ is not enough without the address it was for', async () => {
+    const made = await create()
+    const { link } = await issue(made)
+
+    await expect(setPassword(tokenOf(link), 'someone@else.example')).rejects.toThrow()
+    await expect(setPassword(tokenOf(link), '')).rejects.toThrow()
+    expect((await reload(made.id)).status).toBe('password_reset_required')
+  })
+
+  it('works once', async () => {
+    const made = await create()
+    const { link } = await issue(made)
+
+    await setPassword(tokenOf(link), made.email)
+    await expect(setPassword(tokenOf(link), made.email, 'An0ther!Pass')).rejects.toThrow()
+  })
+
+  it('★ issued again, retires the last one', async () => {
+    const made = await create()
+    const first = await issue(made)
+    const second = await issue(made)
+
+    await expect(setPassword(tokenOf(first.link), made.email)).rejects.toThrow()
+    await setPassword(tokenOf(second.link), made.email)
+    expect((await reload(made.id)).status).toBe('activated')
+  })
+})
+
+describe('taking back the password of an account in use', () => {
+  it('★ stops the old password and ends the sessions opened before', async () => {
+    const kim = await makeActive()
+    const { token: before } = await signin({ username: kim.username, password: OWN_PASSWORD })
+    await expect(User.checkAuth(jwt.decode(before))).resolves.toBeTruthy()
+
+    const { link } = await issue(kim)
+
+    await expect(signin({ username: kim.username, password: OWN_PASSWORD })).rejects.toMatchObject({
+      errorCode: 'password-setup-pending'
+    })
+
+    await setPassword(tokenOf(link), kim.email)
+
+    /* Open again - but the session from before stays ended: its generation has passed. */
+    await expect(User.checkAuth(jwt.decode(before))).rejects.toThrow()
+    const { token: after } = await signin({ username: kim.username, password: NEW_PASSWORD })
+    await expect(User.checkAuth(jwt.decode(after))).resolves.toBeTruthy()
+  })
+
+  it('★ by mail - a mail that does not go out changes nothing', async () => {
+    const kim = await makeActive()
+
+    await expect(
+      authDataSource().transaction(async (tx: any) => await issue(kim, true, tx))
+    ).rejects.toMatchObject({ code: 'password-setup-mail-not-sent' })
+
+    const read = await reload(kim.id)
+    expect(read.status).toBe('activated')
+    expect(User.verify(read.password, OWN_PASSWORD, read.salt)).toBe(true)
+    expect(await getRepository(VerificationToken).findOneBy({ userId: kim.id })).toBeNull()
+  })
+})
+
+describe('a forgotten password', () => {
+  it('asks for the address as well, through the same page', async () => {
+    const kim = await makeActive()
+    const { makeVerificationToken } = loadCompiled('controllers/utils/make-verification-token')
+    const { saveVerificationToken } = loadCompiled('controllers/utils/save-verification-token')
+    const token = makeVerificationToken()
+    await saveVerificationToken(kim.id, token, 'password-reset')
+
+    await expect(setPassword(token, 'someone@else.example')).rejects.toThrow()
+    await setPassword(token, kim.email)
+    await expect(signin({ username: kim.username, password: NEW_PASSWORD })).resolves.toBeTruthy()
+  })
+})

package/tests/picture-reducer.test.ts

@@ -0,0 +1,25 @@
+import { SET_PICTURE, SET_PROFILE } from '../client/actions/auth'
+import auth from '../client/reducers/auth'
+
+/** The signed-in person's picture, which the header's avatar draws (`auth.picture`). */
+describe('the signed-in person\'s picture', () => {
+  const picture = { picture: '/attachment/face.png', left: 0, top: 0, zoom: 1 }
+
+  it('starts with none - the avatar draws a monogram', () => {
+    expect(auth(undefined, { type: '@@INIT' }).picture).toBeNull()
+  })
+
+  it('★ is set by SET_PICTURE and survives a later profile', () => {
+    let state = auth(undefined, { type: SET_PICTURE, picture })
+    state = auth(state, { type: SET_PROFILE, user: { name: '남상혁' } })
+
+    expect(state.picture).toEqual(picture)
+    expect(state.user).toEqual({ name: '남상혁' })
+  })
+
+  it('a missing picture clears it', () => {
+    const state = auth(auth(undefined, { type: SET_PICTURE, picture }), { type: SET_PICTURE, picture: undefined })
+
+    expect(state.picture).toBeNull()
+  })
+})