@things-factory/auth-base 10.1.215 → 10.1.218

package/dist-server/utils/verification-token-rule.js

@@ -27,7 +27,7 @@ const crypto_1 = require("crypto");
  * and a rule that reads it would extend a link by touching the row. `expiresAt` is written once,
  * with the token.
  *
- * A row without `expiresAt` reads as **expired** — the rule `invitation-state.ts` uses. Such rows
+ * A row without `expiresAt` reads as **expired**. Such rows
  * were written before this existed, with the token in plain text; refusing them is also how links
  * already sent stop working when this ships.
  *
@@ -39,6 +39,8 @@ const crypto_1 = require("crypto");
 const HOUR = 60 * 60 * 1000;
 exports.VERIFICATION_TOKEN_LIFETIME_MS = Object.freeze({
     'password-reset': 1 * HOUR,
+    /* Handed over by mail or by hand, so it lives as long as an invitation did (ADR-0161 decision 3). */
+    'password-setup': 48 * HOUR,
     unlock: 1 * HOUR,
     activation: 48 * HOUR
 });

package/dist-server/utils/verification-token-rule.js.map

@@ -1 +1 @@
-{"version":3,"file":"verification-token-rule.js","sourceRoot":"","sources":["../../server/utils/verification-token-rule.ts"],"names":[],"mappings":";;;AA2CA,sDAEC;AAQD,gEAQC;AAMD,0DAYC;AA/ED,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEd,QAAA,8BAA8B,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC5F,gBAAgB,EAAE,CAAC,GAAG,IAAI;IAC1B,MAAM,EAAE,CAAC,GAAG,IAAI;IAChB,UAAU,EAAE,EAAE,GAAG,IAAI;CACtB,CAAC,CAAA;AAEF,6CAA6C;AAC7C,SAAgB,qBAAqB,CAAC,KAAa;IACjD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,0BAA0B,CAAC,IAAY,EAAE,MAAY,IAAI,IAAI,EAAE;IAC7E,MAAM,QAAQ,GAAG,sCAA8B,CAAC,IAAI,CAAC,CAAA;IAErD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,mBAAmB,CAAC,CAAA;IACtE,CAAC;IAED,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAA;AAC3C,CAAC;AAKD,0GAA0G;AAC1G,SAAgB,uBAAuB,CAAC,MAA+B,EAAE,MAAY,IAAI,IAAI,EAAE;IAC7F,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAE3F,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAA;AACrC,CAAC","sourcesContent":["import { createHash } from 'crypto'\n\n/**\n * How long a mailed link lives, and what the table keeps of it. (Pure rule.)\n *\n * Password reset, unlock and sign-up confirmation each mail a link that carries a token, and the\n * token is the whole credential: whoever holds the link resets the password or unlocks the account.\n * Before 2026-09-24 those tokens never expired, were stored as written and were found by that same\n * value — so a reset mail from last year still changed a password today, and a copy of the table\n * (a backup, a replica, a dump handed to support) was a set of live reset links.\n *\n * ── The lifetimes ──────────────────────────────────────────────────────────\n *\n *   password-reset   1 hour    hands the account over at once, so short\n *   unlock           1 hour    the same\n *   activation       48 hours  the person may read the mail late; it only confirms an address\n *\n * Decided with the architect, 2026-09-24 (`docs/design/auth-rebuild-questions-2026-09-24.md` Q4).\n *\n * ── Expiry is its own column ───────────────────────────────────────────────\n * Not derived from `createdAt` or `updatedAt`: `updatedAt` moves every time the row is saved again,\n * and a rule that reads it would extend a link by touching the row. `expiresAt` is written once,\n * with the token.\n *\n * A row without `expiresAt` reads as **expired** — the rule `invitation-state.ts` uses. Such rows\n * were written before this existed, with the token in plain text; refusing them is also how links\n * already sent stop working when this ships.\n *\n * ── What is stored is a hash ───────────────────────────────────────────────\n * sha256 of the token. The token is 16 random bytes, so there is nothing for a slow hash to protect\n * — it guards against guessing, and there is no guessing a random 128-bit value. The point is only\n * that the table no longer holds anything a link can be made from.\n */\n\nconst HOUR = 60 * 60 * 1000\n\nexport const VERIFICATION_TOKEN_LIFETIME_MS: Readonly<Record<string, number>> = Object.freeze({\n  'password-reset': 1 * HOUR,\n  unlock: 1 * HOUR,\n  activation: 48 * HOUR\n})\n\n/** The value the table keeps for a token. */\nexport function hashVerificationToken(token: string): string {\n  return createHash('sha256').update(token, 'utf8').digest('hex')\n}\n\n/**\n * When a token of this type, issued at `now`, stops working.\n *\n * Throws for a type with no lifetime here — a new kind of mailed link has to say how long it lives\n * rather than inherit forever.\n */\nexport function verificationTokenExpiresAt(type: string, now: Date = new Date()): Date {\n  const lifetime = VERIFICATION_TOKEN_LIFETIME_MS[type]\n\n  if (!lifetime) {\n    throw new Error(`verification token type '${type}' has no lifetime`)\n  }\n\n  return new Date(now.getTime() + lifetime)\n}\n\n/** The parts of a stored token this rule reads. */\nexport type VerificationTokenRecord = { expiresAt?: Date | string | null } | null | undefined\n\n/** May this token still be used, as of `now`? Absence of an expiry refuses; the expiry itself refuses. */\nexport function isVerificationTokenLive(record: VerificationTokenRecord, now: Date = new Date()): boolean {\n  if (!record?.expiresAt) {\n    return false\n  }\n\n  const at = record.expiresAt instanceof Date ? record.expiresAt : new Date(record.expiresAt)\n\n  if (Number.isNaN(at.getTime())) {\n    return false\n  }\n\n  return now.getTime() < at.getTime()\n}\n"]}
+{"version":3,"file":"verification-token-rule.js","sourceRoot":"","sources":["../../server/utils/verification-token-rule.ts"],"names":[],"mappings":";;;AA6CA,sDAEC;AAQD,gEAQC;AAMD,0DAYC;AAjFD,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEd,QAAA,8BAA8B,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC5F,gBAAgB,EAAE,CAAC,GAAG,IAAI;IAC1B,qGAAqG;IACrG,gBAAgB,EAAE,EAAE,GAAG,IAAI;IAC3B,MAAM,EAAE,CAAC,GAAG,IAAI;IAChB,UAAU,EAAE,EAAE,GAAG,IAAI;CACtB,CAAC,CAAA;AAEF,6CAA6C;AAC7C,SAAgB,qBAAqB,CAAC,KAAa;IACjD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,0BAA0B,CAAC,IAAY,EAAE,MAAY,IAAI,IAAI,EAAE;IAC7E,MAAM,QAAQ,GAAG,sCAA8B,CAAC,IAAI,CAAC,CAAA;IAErD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,mBAAmB,CAAC,CAAA;IACtE,CAAC;IAED,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAA;AAC3C,CAAC;AAKD,0GAA0G;AAC1G,SAAgB,uBAAuB,CAAC,MAA+B,EAAE,MAAY,IAAI,IAAI,EAAE;IAC7F,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAE3F,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAA;AACrC,CAAC","sourcesContent":["import { createHash } from 'crypto'\n\n/**\n * How long a mailed link lives, and what the table keeps of it. (Pure rule.)\n *\n * Password reset, unlock and sign-up confirmation each mail a link that carries a token, and the\n * token is the whole credential: whoever holds the link resets the password or unlocks the account.\n * Before 2026-09-24 those tokens never expired, were stored as written and were found by that same\n * value — so a reset mail from last year still changed a password today, and a copy of the table\n * (a backup, a replica, a dump handed to support) was a set of live reset links.\n *\n * ── The lifetimes ──────────────────────────────────────────────────────────\n *\n *   password-reset   1 hour    hands the account over at once, so short\n *   unlock           1 hour    the same\n *   activation       48 hours  the person may read the mail late; it only confirms an address\n *\n * Decided with the architect, 2026-09-24 (`docs/design/auth-rebuild-questions-2026-09-24.md` Q4).\n *\n * ── Expiry is its own column ───────────────────────────────────────────────\n * Not derived from `createdAt` or `updatedAt`: `updatedAt` moves every time the row is saved again,\n * and a rule that reads it would extend a link by touching the row. `expiresAt` is written once,\n * with the token.\n *\n * A row without `expiresAt` reads as **expired**. Such rows\n * were written before this existed, with the token in plain text; refusing them is also how links\n * already sent stop working when this ships.\n *\n * ── What is stored is a hash ───────────────────────────────────────────────\n * sha256 of the token. The token is 16 random bytes, so there is nothing for a slow hash to protect\n * — it guards against guessing, and there is no guessing a random 128-bit value. The point is only\n * that the table no longer holds anything a link can be made from.\n */\n\nconst HOUR = 60 * 60 * 1000\n\nexport const VERIFICATION_TOKEN_LIFETIME_MS: Readonly<Record<string, number>> = Object.freeze({\n  'password-reset': 1 * HOUR,\n  /* Handed over by mail or by hand, so it lives as long as an invitation did (ADR-0161 decision 3). */\n  'password-setup': 48 * HOUR,\n  unlock: 1 * HOUR,\n  activation: 48 * HOUR\n})\n\n/** The value the table keeps for a token. */\nexport function hashVerificationToken(token: string): string {\n  return createHash('sha256').update(token, 'utf8').digest('hex')\n}\n\n/**\n * When a token of this type, issued at `now`, stops working.\n *\n * Throws for a type with no lifetime here — a new kind of mailed link has to say how long it lives\n * rather than inherit forever.\n */\nexport function verificationTokenExpiresAt(type: string, now: Date = new Date()): Date {\n  const lifetime = VERIFICATION_TOKEN_LIFETIME_MS[type]\n\n  if (!lifetime) {\n    throw new Error(`verification token type '${type}' has no lifetime`)\n  }\n\n  return new Date(now.getTime() + lifetime)\n}\n\n/** The parts of a stored token this rule reads. */\nexport type VerificationTokenRecord = { expiresAt?: Date | string | null } | null | undefined\n\n/** May this token still be used, as of `now`? Absence of an expiry refuses; the expiry itself refuses. */\nexport function isVerificationTokenLive(record: VerificationTokenRecord, now: Date = new Date()): boolean {\n  if (!record?.expiresAt) {\n    return false\n  }\n\n  const at = record.expiresAt instanceof Date ? record.expiresAt : new Date(record.expiresAt)\n\n  if (Number.isNaN(at.getTime())) {\n    return false\n  }\n\n  return now.getTime() < at.getTime()\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.215",
+  "version": "10.1.218",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -50,5 +50,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "7de5e80eb1f4e2e268746aee39f820e7563f454d"
+  "gitHead": "b4e60fdfe307cecebb2264267f616749a502d5fe"
 }

package/tests/add-user-gates.test.ts

@@ -0,0 +1,34 @@
+import { buildSchema } from 'type-graphql'
+
+import { loadCompiled } from './compiled'
+
+/**
+ * The questions the user popups ask are gated as the actions they lead to.
+ *
+ * `checkUserExistence` is asked only by the add-user popup, before `inviteUser` / `createUser`
+ * (each `user:mutation`, owner granted). It asked `user:query` alone, so a domain owner without that role was refused
+ * the lookup and the popup took the refusal for "no account" - and set out to create an account for someone who
+ * had one. `mayIssuePasswordSetupLink` answers for the setup link button, so it stands where `issuePasswordSetupLink` does.
+ */
+const { schema: declared } = loadCompiled('service/index')
+const { privilegeDirectiveResolver, privilegeOfField } = loadCompiled('service/privilege/privilege-directive')
+
+function gateOf(field: string) {
+  const gate = privilegeOfField('Query', field)
+  return [gate.known, gate['gate']?.category, gate['gate']?.privilege, gate['gate']?.owner]
+}
+
+describe('what the user popups ask', () => {
+  beforeAll(async () => {
+    const schema = await buildSchema({ resolvers: declared.resolverClasses, validate: false })
+    privilegeDirectiveResolver(schema, { modules: [] })
+  })
+
+  it('★ checkUserExistence asks what adding a user asks - user:mutation, or the owner', () => {
+    expect(gateOf('checkUserExistence')).toEqual([true, 'user', 'mutation', true])
+  })
+
+  it('mayIssuePasswordSetupLink asks what issuing asks', () => {
+    expect(gateOf('mayIssuePasswordSetupLink')).toEqual([true, 'user', 'mutation', true])
+  })
+})

package/tests/list-inheritance-db.test.ts

@@ -19,9 +19,6 @@ const { Appliance } = loadCompiled('service/appliance/appliance')
 const { ApplianceQuery } = loadCompiled('service/appliance/appliance-query')
 const { Application } = loadCompiled('service/application/application')
 const { ApplicationQuery } = loadCompiled('service/application/application-query')
-const { Invitation } = loadCompiled('service/invitation/invitation')
-const { InvitationStatus } = loadCompiled('utils/invitation-state')
-const { InvitationQuery } = loadCompiled('service/invitation/invitation-query')
 const { Partner } = loadCompiled('service/partner/partner')
 const { PartnerQuery } = loadCompiled('service/partner/partner-query')
 
@@ -101,18 +98,6 @@ const LISTS: [string, () => Promise<any>, (params: any, context: any) => Promise
       }),
     (params, context) => new ApplicationQuery().applications(params, context)
   ],
-  [
-    'invitations',
-    () =>
-      getRepository(Invitation).save({
-        email: 'lee@acme.z',
-        domain: parent,
-        status: InvitationStatus.PENDING,
-        token: 'parent-token',
-        expiresAt: new Date(Date.now() + 3600_000)
-      }),
-    (params, context) => new InvitationQuery().invitations(params, context)
-  ],
   [
     'partners',
     () => getRepository(Partner).save({ domain: parent, partnerDomain, requestedAt: new Date() }),

package/tests/lock-recovery.test.ts

@@ -70,7 +70,7 @@ describe('재설정 메일 경로 (PASSWORD_RESET)', () => {
     const user = await lockedUser()
     await giveToken(user.id, 'tok', VerificationTokenType.PASSWORD_RESET)
 
-    await resetPassword('tok', NEW, context)
+    await resetPassword('tok', NEW, 'kim@example.com', context)
 
     const after = await getRepository(User).findOneBy({ id: user.id })
     expect(User.verify(after.password, NEW, after.salt)).toBe(true)
@@ -84,7 +84,7 @@ describe('재설정 메일 경로 (PASSWORD_RESET)', () => {
     const user = await lockedUser()
     await giveToken(user.id, 'tok', VerificationTokenType.PASSWORD_RESET)
 
-    await resetPassword('tok', NEW, context)
+    await resetPassword('tok', NEW, 'kim@example.com', context)
 
     await expect(signin({ username: 'kim', password: NEW })).rejects.toThrow()
   })

package/tests/open-doors.test.ts

@@ -81,8 +81,7 @@ describe('the doors that were closed', () => {
    *   domainUserRoleRegister         makes a domain, its roles and its users. `domainRegister`
    *                                  beside it makes only a domain and is super-user only
    *   loginHistories                 everybody's sign-ins - now the audit's, behind `audit:query` (ADR-0141)
-   *   invitation / invitations       and neither of them scopes by tenant at all
-   *   sendInvitation / cancelInvitation / inviteUser
+   *   inviteUser
    */
   const CLOSED = {
     Mutation: [
@@ -92,11 +91,9 @@ describe('the doors that were closed', () => {
       'deleteAuthProvider',
       'deleteAuthProviders',
       'domainUserRoleRegister',
-      'sendInvitation',
-      'cancelInvitation',
       'inviteUser'
     ],
-    Query: ['auditRecords', 'auditPeople', 'auditDoors', 'auditHealth', 'invitation', 'invitations']
+    Query: ['auditRecords', 'auditPeople', 'auditDoors', 'auditHealth']
   }
 
   it.each(Object.entries(CLOSED).flatMap(([t, fields]) => fields.map(f => [t, f])))('%s.%s', (typeName, field) => {

package/tests/password-reset-rule-db.test.ts

@@ -1,14 +1,12 @@
 /**
- * Whom a domain may put back on the default password.
+ * Whose password a domain may take back - by issuing a password setup link (ADR-0161).
  *
- * `resetPasswordToDefault` asked only that the person belong to the asking domain. A person has one password for
- * every domain, and the default is known: whoever signs in with it first is sent to set a new one. So a user manager
- * of any domain could take the account of someone who also works elsewhere, of another domain's owner, and of the
- * super user (the system domain's owner) the moment that person was a member here.
+ * The reset asked only that the person belong to the asking domain. A person has one password for every domain, so a
+ * user manager of any domain could take the password of someone who also works elsewhere, of another domain's owner,
+ * and of the super user (the system domain's owner) the moment that person was a member here. It was the default
+ * password then; it is a setup link now, and the same people are refused.
  */
 
-import { config } from '@things-factory/env'
-
 import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
 import { loadCompiled } from './compiled'
 
@@ -17,7 +15,6 @@ const { UserMutation } = loadCompiled('service/user/user-mutation')
 const { UserQuery } = loadCompiled('service/user/user-query')
 const { DomainOwner } = loadCompiled('service/domain-owner/domain-owner')
 
-const DEFAULT_PASSWORD = 'Default!234'
 const OWN_PASSWORD = 'Mine!5678'
 
 let here: any
@@ -40,15 +37,20 @@ async function makeUser(domains: any[], extra: any = {}) {
 }
 
 function context(domain: any) {
-  return { state: { domain, tx: undefined }, t: (key: string) => key } as any
+  return {
+    state: { domain, tx: undefined },
+    t: (key: string) => key,
+    headers: {},
+    request: { protocol: 'https', host: 'acme.example.com' }
+  } as any
 }
 
 function reset(user: any, domain: any) {
-  return new UserMutation().resetPasswordToDefault(user.username, context(domain))
+  return new UserMutation().issuePasswordSetupLink(user.username, false, context(domain))
 }
 
 function mayReset(user: any, domain: any) {
-  return new UserQuery().mayResetPasswordToDefault(user.id, context(domain))
+  return new UserQuery().mayIssuePasswordSetupLink(user.id, context(domain))
 }
 
 async function stillHasOwnPassword(user: any) {
@@ -61,13 +63,11 @@ beforeAll(async () => {
 })
 
 afterAll(async () => {
-  config.set('password', undefined)
   await closeAuthDatabase()
 })
 
 beforeEach(async () => {
   await resetAuthDatabase()
-  config.set('password', { defaultPassword: DEFAULT_PASSWORD })
 
   const domainRepository = getRepository(Domain)
   here = await domainRepository.save({ name: 'Plant A', subdomain: 'plant-a' })
@@ -76,14 +76,15 @@ beforeEach(async () => {
 })
 
 describe('a person wholly of this domain', () => {
-  it('is reset to the default, and the screen offers it', async () => {
+  it('is issued a link and waits for a password, and the screen offers it', async () => {
     const user = await makeUser([here])
 
     expect(await mayReset(user, here)).toBe(true)
-    await expect(reset(user, here)).resolves.toBe(true)
+    await expect(reset(user, here)).resolves.toMatchObject({ link: expect.stringContaining('/auth/reset-password#') })
 
     const read = await getRepository(User).findOneBy({ id: user.id })
-    expect(User.verify(read.password, DEFAULT_PASSWORD, read.salt)).toBe(true)
+    expect(read.status).toBe('password_reset_required')
+    expect(await stillHasOwnPassword(user)).toBe(false)
   })
 })
 

package/tests/password-setup-db.test.ts

@@ -0,0 +1,213 @@
+/**
+ * An administrator never sets anybody's password (ADR-0161).
+ *
+ * It used to be the installation's default password - one value everyone handed one knew, with no end, for every
+ * account an administrator made or reset. Now such an account waits for its password, and the person sets it through
+ * a one-time link that is mailed or handed over: 48 hours, hashed at rest, asking for the address it was for, and the
+ * only live one. Issuing it ends the sessions opened before.
+ */
+
+import { authDataSource, closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const jwt = require('jsonwebtoken')
+
+const { User } = loadCompiled('service/user/user')
+const { UserMutation } = loadCompiled('service/user/user-mutation')
+const { VerificationToken } = loadCompiled('service/verification-token/verification-token')
+const { signin } = loadCompiled('controllers/signin')
+const { resetPassword } = loadCompiled('controllers/reset-password')
+const { hashVerificationToken } = loadCompiled('utils/verification-token-rule')
+
+const OWN_PASSWORD = 'Mine!5678'
+const NEW_PASSWORD = 'N3w!Passw0rd'
+const HOUR = 60 * 60 * 1000
+
+let here: any
+
+function context(tx?: any) {
+  return {
+    state: { domain: here, tx },
+    t: (key: string) => key,
+    headers: {},
+    request: { protocol: 'https', host: 'acme.example.com' }
+  } as any
+}
+
+async function makeActive(email = 'kim@example.com') {
+  const salt = User.generateSalt()
+  return await getRepository(User).save({
+    username: email,
+    email,
+    name: 'Kim',
+    salt,
+    password: User.encode(OWN_PASSWORD, salt),
+    status: 'activated',
+    domains: [here]
+  })
+}
+
+function create(email = 'lee@example.com') {
+  return new UserMutation().createUser({ username: email, email, name: 'Lee', userType: 'user' }, context())
+}
+
+function issue(user: any, mail = false, tx?: any) {
+  return new UserMutation().issuePasswordSetupLink(user.username, mail, context(tx))
+}
+
+const tokenOf = (link: string) => link.split('#')[1]
+const reload = (id: string) => getRepository(User).findOneBy({ id })
+const setPassword = (token: string, email: string, password = NEW_PASSWORD) =>
+  resetPassword(token, password, email, { t: (key: string) => key })
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  here = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
+})
+
+describe('an account an administrator makes', () => {
+  it('★ waits for its password, which nobody was given', async () => {
+    const made = await create()
+    const read = await reload(made.id)
+
+    expect(read.status).toBe('password_reset_required')
+    expect(read.password).toBeTruthy()
+  })
+
+  it('★ does not sign in, and a guess against it is not counted', async () => {
+    const made = await create()
+
+    await expect(signin({ username: made.username, password: 'anything' })).rejects.toMatchObject({
+      errorCode: 'password-setup-pending'
+    })
+    expect((await reload(made.id)).failCount ?? 0).toBe(0)
+  })
+
+  it('★ is refused on every request too', async () => {
+    const made = await create()
+
+    await expect(User.checkAuth({ username: made.username, email: made.email })).rejects.toMatchObject({
+      errorCode: 'password-setup-pending'
+    })
+  })
+
+  it('is not opened by activating it', async () => {
+    const made = await create()
+
+    await expect(new UserMutation().activateUser(made.username, context())).rejects.toMatchObject({
+      code: 'password-setup-pending'
+    })
+  })
+})
+
+describe('the setup link', () => {
+  it('★ is handed back once, kept only as a hash, and lives 48 hours', async () => {
+    const made = await create()
+    const before = Date.now()
+
+    const issued = await issue(made)
+
+    expect(issued.link).toMatch(/^https?:\/\/acme\.example\.com\/auth\/reset-password#[0-9a-f]{32}$/)
+    const stored = await getRepository(VerificationToken).findOneBy({ userId: made.id })
+    expect(stored.type).toBe('password-setup')
+    expect(stored.token).toBe(hashVerificationToken(tokenOf(issued.link)))
+    expect(stored.token).not.toBe(tokenOf(issued.link))
+    expect(new Date(stored.expiresAt).getTime() - before).toBeGreaterThanOrEqual(48 * HOUR - 1000)
+    expect(new Date(stored.expiresAt).getTime() - before).toBeLessThanOrEqual(48 * HOUR + 5000)
+  })
+
+  it('★ opens the account with the address it was for, and then signs in', async () => {
+    const made = await create()
+    const { link } = await issue(made)
+
+    await setPassword(tokenOf(link), 'LEE@example.com ')
+
+    expect((await reload(made.id)).status).toBe('activated')
+    await expect(signin({ username: made.username, password: NEW_PASSWORD })).resolves.toMatchObject({
+      token: expect.any(String)
+    })
+  })
+
+  it('★ is not enough without the address it was for', async () => {
+    const made = await create()
+    const { link } = await issue(made)
+
+    await expect(setPassword(tokenOf(link), 'someone@else.example')).rejects.toThrow()
+    await expect(setPassword(tokenOf(link), '')).rejects.toThrow()
+    expect((await reload(made.id)).status).toBe('password_reset_required')
+  })
+
+  it('works once', async () => {
+    const made = await create()
+    const { link } = await issue(made)
+
+    await setPassword(tokenOf(link), made.email)
+    await expect(setPassword(tokenOf(link), made.email, 'An0ther!Pass')).rejects.toThrow()
+  })
+
+  it('★ issued again, retires the last one', async () => {
+    const made = await create()
+    const first = await issue(made)
+    const second = await issue(made)
+
+    await expect(setPassword(tokenOf(first.link), made.email)).rejects.toThrow()
+    await setPassword(tokenOf(second.link), made.email)
+    expect((await reload(made.id)).status).toBe('activated')
+  })
+})
+
+describe('taking back the password of an account in use', () => {
+  it('★ stops the old password and ends the sessions opened before', async () => {
+    const kim = await makeActive()
+    const { token: before } = await signin({ username: kim.username, password: OWN_PASSWORD })
+    await expect(User.checkAuth(jwt.decode(before))).resolves.toBeTruthy()
+
+    const { link } = await issue(kim)
+
+    await expect(signin({ username: kim.username, password: OWN_PASSWORD })).rejects.toMatchObject({
+      errorCode: 'password-setup-pending'
+    })
+
+    await setPassword(tokenOf(link), kim.email)
+
+    /* Open again - but the session from before stays ended: its generation has passed. */
+    await expect(User.checkAuth(jwt.decode(before))).rejects.toThrow()
+    const { token: after } = await signin({ username: kim.username, password: NEW_PASSWORD })
+    await expect(User.checkAuth(jwt.decode(after))).resolves.toBeTruthy()
+  })
+
+  it('★ by mail - a mail that does not go out changes nothing', async () => {
+    const kim = await makeActive()
+
+    await expect(
+      authDataSource().transaction(async (tx: any) => await issue(kim, true, tx))
+    ).rejects.toMatchObject({ code: 'password-setup-mail-not-sent' })
+
+    const read = await reload(kim.id)
+    expect(read.status).toBe('activated')
+    expect(User.verify(read.password, OWN_PASSWORD, read.salt)).toBe(true)
+    expect(await getRepository(VerificationToken).findOneBy({ userId: kim.id })).toBeNull()
+  })
+})
+
+describe('a forgotten password', () => {
+  it('asks for the address as well, through the same page', async () => {
+    const kim = await makeActive()
+    const { makeVerificationToken } = loadCompiled('controllers/utils/make-verification-token')
+    const { saveVerificationToken } = loadCompiled('controllers/utils/save-verification-token')
+    const token = makeVerificationToken()
+    await saveVerificationToken(kim.id, token, 'password-reset')
+
+    await expect(setPassword(token, 'someone@else.example')).rejects.toThrow()
+    await setPassword(token, kim.email)
+    await expect(signin({ username: kim.username, password: NEW_PASSWORD })).resolves.toBeTruthy()
+  })
+})

package/tests/picture-reducer.test.ts

@@ -0,0 +1,25 @@
+import { SET_PICTURE, SET_PROFILE } from '../client/actions/auth'
+import auth from '../client/reducers/auth'
+
+/** The signed-in person's picture, which the header's avatar draws (`auth.picture`). */
+describe('the signed-in person\'s picture', () => {
+  const picture = { picture: '/attachment/face.png', left: 0, top: 0, zoom: 1 }
+
+  it('starts with none - the avatar draws a monogram', () => {
+    expect(auth(undefined, { type: '@@INIT' }).picture).toBeNull()
+  })
+
+  it('★ is set by SET_PICTURE and survives a later profile', () => {
+    let state = auth(undefined, { type: SET_PICTURE, picture })
+    state = auth(state, { type: SET_PROFILE, user: { name: '남상혁' } })
+
+    expect(state.picture).toEqual(picture)
+    expect(state.user).toEqual({ name: '남상혁' })
+  })
+
+  it('a missing picture clears it', () => {
+    const state = auth(auth(undefined, { type: SET_PICTURE, picture }), { type: SET_PICTURE, picture: undefined })
+
+    expect(state.picture).toBeNull()
+  })
+})

package/tests/verification-token-db.test.ts

@@ -109,7 +109,12 @@ describe('the rule', () => {
   const now = new Date('2026-09-24T12:00:00Z')
 
   it('gives each mailed link its lifetime', () => {
-    expect(VERIFICATION_TOKEN_LIFETIME_MS).toEqual({ 'password-reset': HOUR, unlock: HOUR, activation: 48 * HOUR })
+    expect(VERIFICATION_TOKEN_LIFETIME_MS).toEqual({
+      'password-reset': HOUR,
+      'password-setup': 48 * HOUR,
+      unlock: HOUR,
+      activation: 48 * HOUR
+    })
     expect(verificationTokenExpiresAt('password-reset', now).getTime()).toBe(now.getTime() + HOUR)
   })
 
@@ -153,11 +158,11 @@ describe('password reset', () => {
     await sendPasswordResetEmail({ user, context })
     const token = tokenInLastMail(RESET_PASSWORD_PATH)
 
-    await resetPassword(token, NEW, context)
+    await resetPassword(token, NEW, 'kim@example.com', context)
 
     const after = await getRepository(User).findOneBy({ id: user.id })
     expect(User.verify(after.password, NEW, after.salt)).toBe(true)
-    await expect(resetPassword(token, OLD, context)).rejects.toThrow('text.invalid verification token')
+    await expect(resetPassword(token, OLD, 'kim@example.com', context)).rejects.toThrow('text.invalid verification token')
   })
 
   it('refuses the link after it expires', async () => {
@@ -167,7 +172,7 @@ describe('password reset', () => {
 
     await expireAt(user.id, new Date(Date.now() - 1))
 
-    await expect(resetPassword(token, NEW, context)).rejects.toThrow('text.invalid verification token')
+    await expect(resetPassword(token, NEW, 'kim@example.com', context)).rejects.toThrow('text.invalid verification token')
     const after = await getRepository(User).findOneBy({ id: user.id })
     expect(User.verify(after.password, OLD, after.salt)).toBe(true)
   })
@@ -180,7 +185,7 @@ describe('password reset', () => {
       type: VerificationTokenType.PASSWORD_RESET
     })
 
-    await expect(resetPassword('b'.repeat(32), NEW, context)).rejects.toThrow('text.invalid verification token')
+    await expect(resetPassword('b'.repeat(32), NEW, 'kim@example.com', context)).rejects.toThrow('text.invalid verification token')
   })
 
   it('refuses a row whose expiry is missing, even when the hash matches', async () => {
@@ -194,7 +199,7 @@ describe('password reset', () => {
 
     await expireAt(user.id, null)
 
-    await expect(resetPassword(token, NEW, context)).rejects.toThrow('text.invalid verification token')
+    await expect(resetPassword(token, NEW, 'kim@example.com', context)).rejects.toThrow('text.invalid verification token')
   })
 
   it('does not find a token by the value stored in the table', async () => {
@@ -203,7 +208,7 @@ describe('password reset', () => {
     await sendPasswordResetEmail({ user, context })
     const stored = (await row(user.id)).token
 
-    await expect(resetPassword(stored, NEW, context)).rejects.toThrow('text.invalid verification token')
+    await expect(resetPassword(stored, NEW, 'kim@example.com', context)).rejects.toThrow('text.invalid verification token')
   })
 })
 

package/translations/en.json

@@ -9,7 +9,6 @@
   "error.invalid username": "invalid username: {username}",
   "error.mail could not be sent": "the email could not be sent. try again in a moment.",
   "error.ownership required": "unauthorized! domain or system ownership required",
-  "error.password should be supported": "initial password or default password should be supported",
   "error.password should match the rule": "password should match following rule. ${rule}",
   "error.password used in the past": "password used in the past",
   "error.role-name-stands-inherited": "a role called {name} is already visible here, defined in {domain}. stand this domain's own of that name only if that is what you mean to do.",
@@ -29,6 +28,8 @@
   "error.x is not a member of y": "{x} is not a member of {y}",
   "error.x privilege required": "unauthorized! {x} privilege required",
   "error.role-not-assignable-here": "this domain cannot assign the role(s) {roles}.",
+  "error.password-setup-pending": "This account is waiting for its password. Set it through the password setup link you received, then sign in.",
+  "error.password-setup-mail-not-sent": "The mail to {email} did not go out. Nothing was changed - copy the link instead.",
   "error.password-reset-owner-account": "A domain owner's or administrator's password is not reset to the default.",
   "error.password-reset-reaches-other-domains": "they also work in {domains}, so their password is not this $t(term.domain)'s to reset.",
   "error.x not allowed from this address": "unauthorized! {x} is not allowed from this address",
@@ -212,7 +213,6 @@
   "text.delete account succeed": "delete account succeed",
   "text.inactive user": "inactive user",
   "text.invalid verification token": "invalid verification token",
-  "text.invitation email sent": "invitation email sent",
   "text.password changed successfully": "password changed successfully",
   "text.password reset email sent": "if an account uses this address, a password reset email is on its way.",
   "text.password reset succeed": "password reset succeed",

package/translations/es.json

@@ -9,7 +9,6 @@
   "error.invalid username": "nombre de usuario no válido: {username}",
   "error.mail could not be sent": "no se pudo enviar el correo. vuelva a intentarlo en un momento.",
   "error.ownership required": "¡no autorizado! se requiere la propiedad del dominio o del sistema",
-  "error.password should be supported": "se debe proporcionar una contraseña inicial o una contraseña predeterminada",
   "error.password should match the rule": "la contraseña debe cumplir la siguiente regla. ${rule}",
   "error.password used in the past": "contraseña usada anteriormente",
   "error.role-name-stands-inherited": "ya se muestra aquí un rol llamado {name}, definido en {domain}. cree en este dominio uno propio con ese nombre solo si es lo que pretende hacer.",
@@ -29,6 +28,8 @@
   "error.x is not a member of y": "{x} no es miembro de {y}",
   "error.x privilege required": "¡no autorizado! se requiere el privilegio {x}",
   "error.role-not-assignable-here": "este dominio no puede asignar los roles {roles}.",
+  "error.password-setup-pending": "Esta cuenta espera su contraseña. Establézcala con el enlace de configuración recibido y luego inicie sesión.",
+  "error.password-setup-mail-not-sent": "No se pudo enviar el correo a {email}. No se cambió nada: copie el enlace.",
   "error.password-reset-owner-account": "la contraseña de un propietario o administrador no se restablece al valor predeterminado.",
   "error.password-reset-reaches-other-domains": "también trabaja en {domains}; este dominio no puede restablecer su contraseña.",
   "error.x not allowed from this address": "¡no autorizado! {x} no está permitido desde esta dirección",
@@ -212,7 +213,6 @@
   "text.delete account succeed": "cuenta eliminada correctamente",
   "text.inactive user": "usuario inactivo",
   "text.invalid verification token": "token de verificación no válido",
-  "text.invitation email sent": "correo de invitación enviado",
   "text.password changed successfully": "contraseña cambiada correctamente",
   "text.password reset email sent": "si hay una cuenta con esta dirección, le enviamos un correo de restablecimiento de contraseña.",
   "text.password reset succeed": "contraseña restablecida correctamente",

package/translations/ja.json

@@ -9,7 +9,6 @@
   "error.invalid username": "無効なユーザー名: {username}",
   "error.mail could not be sent": "メールを送れませんでした. しばらくしてからもう一度お試しください.",
   "error.ownership required": "権限がありません。$t(term.domain)またはシステムの所有者権限が必要です。",
-  "error.password should be supported": "初期パスワードまたはデフォルトパスワードがサポートされるべきです",
   "error.password should match the rule": "パスワードは次の規則を守らなければなりません. {rule}",
   "error.password used in the past": "過去に使用されたパスワードです.",
   "error.role-name-stands-inherited": "{name} ロールは {domain} に定義されており、ここからも見えています。この$t(term.domain)に同じ名前で別に立てるつもりの場合のみ作成します。",
@@ -29,6 +28,8 @@
   "error.x is not a member of y": "{x}は{y}のメンバーではありません.",
   "error.x privilege required": "権限がありません。{x} 権限が必要です。",
   "error.role-not-assignable-here": "この$t(term.domain)では付与できないロールです: {roles}",
+  "error.password-setup-pending": "パスワード設定待ちのアカウントです。受け取ったパスワード設定リンクでパスワードを設定してからログインしてください。",
+  "error.password-setup-mail-not-sent": "{email} にメールを送れませんでした。変更はありません。リンクをコピーして伝えてください。",
   "error.password-reset-owner-account": "$t(term.domain)のオーナーや管理者のパスワードは初期値にリセットしません。",
   "error.password-reset-reaches-other-domains": "{domains}でも利用している方のため、この$t(term.domain)ではパスワードをリセットできません。",
   "error.x not allowed from this address": "権限がありません。このアドレスからは {x} 権限を使えません。",
@@ -52,7 +53,6 @@
   "text.delete account succeed": "アカウントが削除されました.",
   "text.inactive user": "非アクティブユーザーです.",
   "text.invalid verification token": "確認トークンが無効です.",
-  "text.invitation email sent": "招待メールを送りました.",
   "text.password changed successfully": "パスワードが正常に変更されました.",
   "text.password reset email sent": "登録済みのアドレスであれば、パスワード リセットメールを送りました.",
   "text.password reset succeed": "パスワードが正常にリセットされました.",