@things-factory/auth-base 10.1.232 → 10.1.241

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.232",
+  "version": "10.1.241",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -35,10 +35,10 @@
     "@reduxjs/toolkit": "^2.2.5",
     "@simplewebauthn/browser": "^13.0.0",
     "@simplewebauthn/server": "^13.0.0",
-    "@things-factory/email-base": "^10.1.228",
+    "@things-factory/email-base": "^10.1.234",
     "@things-factory/env": "^10.1.149",
-    "@things-factory/shell": "^10.1.228",
-    "@things-factory/task-lease": "^10.1.228",
+    "@things-factory/shell": "^10.1.234",
+    "@things-factory/task-lease": "^10.1.234",
     "@things-factory/utils": "^10.1.179",
     "@types/webappsec-credential-management": "^0.6.9",
     "jsonwebtoken": "^9.0.0",
@@ -50,5 +50,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "9307e1db833f13018e3f0ca9b1050f947cbefd68"
+  "gitHead": "d7fe2e1a1eb7c02cb21b897da26d385df014f908"
 }

package/tests/passkey-db.test.ts

@@ -259,6 +259,15 @@ describe("the caller's own passkeys (decision 6)", () => {
     expect((await credentialOf({ id: credential.credentialId } as any)).name).toBe('Phone')
   })
 
+  it('★ a name over the bound is refused with the bound, not cut', async () => {
+    const credential = await credentialOf(await registered(kim))
+    await mutation.updateMyWebAuthCredential(credential.id, 'Phone', context(kim))
+
+    await expect(mutation.updateMyWebAuthCredential(credential.id, '가'.repeat(65), context(kim))).rejects.toMatchObject({ code: 'passkey-name-too-long', params: { max: 64, length: 65 } })
+    expect((await credentialOf({ id: credential.credentialId } as any)).name).toBe('Phone')
+    expect((await mutation.updateMyWebAuthCredential(credential.id, '가'.repeat(64), context(kim))).name).toBe('가'.repeat(64))
+  })
+
   it('removes the caller’s own - it signs nobody in afterwards and the removal is audited', async () => {
     const authenticator = await registered(kim)
     const credential = await credentialOf(authenticator)

package/tests/refusals-have-korean.test.ts

@@ -0,0 +1,24 @@
+/*
+ * Every refusal this package throws has its Korean sentence - a missing one is read in the server's English fallback
+ * (inline help audit 2026-10-30: passkey-not-found, and the check-in's `error.domain not specified` printed as its key).
+ */
+import { readFileSync, readdirSync } from 'fs'
+import { join } from 'path'
+
+const ROOT = join(__dirname, '..')
+const ko: Record<string, string> = JSON.parse(readFileSync(join(ROOT, 'translations', 'ko.json'), 'utf8'))
+
+const sources = (dir: string): string[] =>
+  readdirSync(dir, { withFileTypes: true }).flatMap(entry => (entry.isDirectory() ? sources(join(dir, entry.name)) : /\.ts$/.test(entry.name) && !/\.test\.ts$/.test(entry.name) ? [join(dir, entry.name)] : []))
+const text = sources(join(ROOT, 'server')).map(file => readFileSync(file, 'utf8')).join('\n')
+
+test('★ every Refusal code has error.<code> in Korean', () => {
+  const codes = [...new Set([...text.matchAll(/new Refusal\(\s*'([a-z0-9-]+)'/g)].map(match => match[1]))]
+  expect(codes.length).toBeGreaterThanOrEqual(10)
+  expect(codes.filter(code => !(`error.${code}` in ko))).toEqual([])
+})
+
+test('★ the check-in refusal has its Korean sentence', () => {
+  expect(text).toMatch(/t\('error\.domain not specified'/)
+  expect(ko['error.domain not specified']).toBeTruthy()
+})

package/tests/signup-duplicate-db.test.ts

@@ -0,0 +1,68 @@
+/**
+ * Signing up refuses a username already taken, and a username that is another account's email.
+ *
+ * The email lookup was assigned to `user` instead of `duplicated`, so an email clash was never refused and a second
+ * account with the same address was made. And a username clash on the profile was named an email clash: the two
+ * codes shared one value.
+ */
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { User } = loadCompiled('service/user/user')
+const { signup } = loadCompiled('controllers/signup')
+const ERROR_CODES = loadCompiled('constants/error-code')
+
+const PASSWORD = 'N3w!Passw0rd'
+
+let here: any
+
+function signUp(username: string) {
+  return signup({ name: 'Lee', username, email: username, password: PASSWORD, domain: here, context: { lng: 'en' } })
+}
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  here = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
+  const salt = User.generateSalt()
+  await getRepository(User).save({
+    username: 'kim',
+    email: 'kim@example.com',
+    name: 'Kim',
+    salt,
+    password: User.encode(PASSWORD, salt),
+    status: 'activated',
+    domains: [here]
+  })
+})
+
+describe('signing up', () => {
+  it('★ refuses a username that is another account email, in any case', async () => {
+    await expect(signUp('KIM@example.com')).rejects.toMatchObject({ errorCode: ERROR_CODES.USER_DUPLICATED })
+    expect(await getRepository(User).countBy({ name: 'Lee' })).toBe(0)
+  })
+
+  it('refuses a username already taken', async () => {
+    await expect(signUp('kim')).rejects.toMatchObject({ errorCode: ERROR_CODES.USER_DUPLICATED })
+  })
+
+  it('makes an account for a username nobody has', async () => {
+    await signUp('lee@example.com')
+    expect(await getRepository(User).countBy({ username: 'lee@example.com' })).toBe(1)
+  })
+})
+
+describe('a username clash', () => {
+  it('★ is named a username clash, not an email clash', () => {
+    expect(ERROR_CODES.USERNAME_ALREADY_EXISTS).toBe('username already exists')
+    expect(ERROR_CODES.USERNAME_ALREADY_EXISTS).not.toBe(ERROR_CODES.EMAIL_ALREADY_EXISTS)
+  })
+})

package/translations/en.json

@@ -222,7 +222,7 @@
   "text.pattern_atleast_1_special": "at least 1 special character(!@#$%^&*())",
   "text.pattern_atleast_1_uppercase": "at least 1 uppercase character",
   "text.pattern_minimum_charaters": "minimum {length} charaters",
-  "text.pattern_not_allowed": "not allowed repeated charater",
+  "text.pattern_not_allowed": "no character 3 times in a row",
   "text.profile changed successfully": "profile changed successfully",
   "text.result": "result",
   "text.signout successfully": "signout successfully",
@@ -268,5 +268,8 @@
   "task.auth-base.audit-reading.name": "Reading the audit log",
   "task.auth-base.audit-reading.description": "Reads everyone's sign-ins, privilege use and refusals, and role changes in the domain.",
   "error.access-request-task-mismatch": "the work you picked does not include the refused privilege.",
-  "error.identity confirmation required": "confirm it is you to see this"
+  "error.identity confirmation required": "confirm it is you to see this",
+  "error.passkey-not-found": "There is no passkey of yours with this id. Reload the list.",
+  "error.passkey-name-too-long": "A passkey name takes up to {max} characters; this one has {length}.",
+  "error.domain not specified": "This account cannot enter the $t(term.domain) {subdomain}."
 }

package/translations/es.json

@@ -222,7 +222,7 @@
   "text.pattern_atleast_1_special": "al menos 1 carácter especial(!@#$%^&*())",
   "text.pattern_atleast_1_uppercase": "al menos 1 letra mayúscula",
   "text.pattern_minimum_charaters": "mínimo {length} caracteres",
-  "text.pattern_not_allowed": "no se permiten caracteres repetidos",
+  "text.pattern_not_allowed": "no se permite el mismo carácter 3 veces seguidas",
   "text.profile changed successfully": "perfil cambiado correctamente",
   "text.result": "resultado",
   "text.signout successfully": "sesión cerrada correctamente",
@@ -268,5 +268,8 @@
   "task.auth-base.audit-reading.name": "Consultar el registro de auditoría",
   "task.auth-base.audit-reading.description": "Lee los inicios de sesión, el uso y rechazo de privilegios y los cambios de rol de todos en el dominio.",
   "error.access-request-task-mismatch": "la tarea elegida no incluye el privilegio rechazado.",
-  "error.identity confirmation required": "confirme que es usted para ver esto"
+  "error.identity confirmation required": "confirme que es usted para ver esto",
+  "error.passkey-not-found": "No tiene ninguna llave de acceso con este id. Vuelva a cargar la lista.",
+  "error.passkey-name-too-long": "El nombre de una llave de acceso admite hasta {max} caracteres; este tiene {length}.",
+  "error.domain not specified": "Esta cuenta no puede entrar en el $t(term.domain) {subdomain}."
 }

package/translations/ja.json

@@ -62,7 +62,7 @@
   "text.pattern_atleast_1_special": "少なくとも1つの特殊文字(!@#$%^&*())",
   "text.pattern_atleast_1_uppercase": "少なくとも1つの大文字",
   "text.pattern_minimum_charaters": "少なくとも{length}文字",
-  "text.pattern_not_allowed": "文字の繰り返し使用不可",
+  "text.pattern_not_allowed": "同じ文字を3回連続で使用不可",
   "text.profile changed successfully": "プロフィールが正常に変更されました.",
   "text.result": "結果",
   "text.signout successfully": "ログアウトに成功しました.",
@@ -268,5 +268,8 @@
   "task.auth-base.audit-reading.name": "監査ログの閲覧",
   "task.auth-base.audit-reading.description": "全ユーザーのログイン、権限の使用と拒否、ロール変更の記録を読む。",
   "error.access-request-task-mismatch": "選んだ業務に拒否された権限が含まれていません。",
-  "error.identity confirmation required": "本人確認が必要です。"
+  "error.identity confirmation required": "本人確認が必要です。",
+  "error.passkey-not-found": "あなたのパスキーにこのパスキーはありません。一覧を再読み込みしてください。",
+  "error.passkey-name-too-long": "パスキー名は{max}文字までです。今は{length}文字です。",
+  "error.domain not specified": "このアカウントで入れる$t(term.domain)ではありません: {subdomain}"
 }

package/translations/ko.json

@@ -222,7 +222,7 @@
   "text.pattern_atleast_1_special": "최소 1개 특수문자(!@#$%^&*())",
   "text.pattern_atleast_1_uppercase": "최소 1개 대문자",
   "text.pattern_minimum_charaters": "최소 {length} 글자",
-  "text.pattern_not_allowed": "문자 반복 사용 불가",
+  "text.pattern_not_allowed": "같은 문자 3번 연속 사용 불가",
   "text.profile changed successfully": "프로필이 성공적으로 변경되었습니다.",
   "text.result": "결과",
   "text.signout successfully": "성공적으로 로그아웃 하였습니다.",
@@ -268,5 +268,8 @@
   "task.auth-base.audit-reading.name": "감사 기록 열람",
   "task.auth-base.audit-reading.description": "모든 사용자의 로그인, 권한 사용과 거절, 역할 변경 기록을 읽는다.",
   "error.access-request-task-mismatch": "선택한 업무에 접근이 거부된 권한이 포함되어 있지 않습니다.",
-  "error.identity confirmation required": "본인 확인이 필요합니다."
+  "error.identity confirmation required": "본인 확인이 필요합니다.",
+  "error.passkey-not-found": "내 패스키 가운데 이 패스키가 없습니다. 목록을 새로 불러오세요.",
+  "error.passkey-name-too-long": "패스키 이름은 {max}자까지입니다. 지금 {length}자입니다.",
+  "error.domain not specified": "이 계정으로 들어갈 수 있는 $t(term.domain)이 아닙니다: {subdomain}"
 }

package/translations/ms.json

@@ -62,7 +62,7 @@
   "text.pattern_atleast_1_special": "Sekurang-kurangnya 1 aksara istimewa (!@#$%^&*())",
   "text.pattern_atleast_1_uppercase": "Sekurang-kurangnya 1 aksara besar",
   "text.pattern_minimum_charaters": "Minimum {length} aksara",
-  "text.pattern_not_allowed": "Tidak dibenarkan aksara berulang",
+  "text.pattern_not_allowed": "Aksara yang sama tidak boleh 3 kali berturut-turut",
   "text.profile changed successfully": "Profil berjaya diubah",
   "text.result": "Hasil",
   "text.signout successfully": "Berjaya keluar",
@@ -268,5 +268,8 @@
   "task.auth-base.audit-reading.name": "Membaca log audit",
   "task.auth-base.audit-reading.description": "Membaca log masuk, penggunaan dan penolakan keistimewaan, serta perubahan peranan semua orang dalam domain.",
   "error.access-request-task-mismatch": "tugas yang dipilih tidak termasuk keistimewaan yang ditolak.",
-  "error.identity confirmation required": "sahkan ini anda untuk melihat ini"
+  "error.identity confirmation required": "sahkan ini anda untuk melihat ini",
+  "error.passkey-not-found": "Tiada kunci laluan anda dengan id ini. Muat semula senarai.",
+  "error.passkey-name-too-long": "Nama kunci laluan boleh sehingga {max} aksara; nama ini ada {length}.",
+  "error.domain not specified": "Akaun ini tidak boleh memasuki $t(term.domain) {subdomain}."
 }

package/translations/zh.json

@@ -62,7 +62,7 @@
   "text.pattern_atleast_1_special": "至少1个特殊字符（！@＃$％^＆*（））",
   "text.pattern_atleast_1_uppercase": "至少1个大写字母",
   "text.pattern_minimum_charaters": "最少未字符长度为{length}",
-  "text.pattern_not_allowed": "不允许重复字符",
+  "text.pattern_not_allowed": "同一字符不可连续出现3次",
   "text.profile changed successfully": "个人资料更改成功。",
   "text.result": "结果",
   "text.signout successfully": "登出成功。",
@@ -268,5 +268,8 @@
   "task.auth-base.audit-reading.name": "查看审计日志",
   "task.auth-base.audit-reading.description": "读取所有用户的登录、权限使用与拒绝以及角色变更记录。",
   "error.access-request-task-mismatch": "所选业务不包含被拒绝的权限。",
-  "error.identity confirmation required": "需要确认身份。"
+  "error.identity confirmation required": "需要确认身份。",
+  "error.passkey-not-found": "您的通行密钥中没有这一个。请重新加载列表。",
+  "error.passkey-name-too-long": "通行密钥名称最多 {max} 个字符,现在是 {length} 个。",
+  "error.domain not specified": "此账户无法进入该$t(term.domain): {subdomain}"
 }