@things-factory/auth-base 10.1.31 → 10.1.33

package/dist-server/controllers/invitation.d.ts

@@ -1,12 +1,49 @@
-export declare function invite(attrs: any, withEmailInvitation?: Boolean): Promise<boolean>;
-export declare function acceptInvitation(token: any): Promise<boolean>;
-export declare function sendInvitationEmail({ invitation, user, context }: {
-    invitation: any;
-    user: any;
+import { EntityManager } from 'typeorm';
+import { Domain } from '@things-factory/shell';
+import { Invitation } from '../service/invitation/invitation.js';
+import { Role } from '../service/role/role.js';
+import { User } from '../service/user/user.js';
+/**
+ * Create a pending invitation and mail it.
+ *
+ * ⚠ One pending invitation per person and domain. The history keeps every row, so this cannot be
+ * a unique index without forbidding "invited, left, invited again" — see the note on the entity.
+ * An existing pending one is re-issued rather than duplicated: a new token, a new expiry, and the
+ * same row, so the list shows one line per invitation rather than one per time somebody pressed
+ * the button.
+ */
+export declare function inviteByEmail({ email, domain, roles, user, context, tx }: {
+    email: string;
+    domain: Domain;
+    roles?: Role[];
+    user?: User;
     context: any;
-}): Promise<boolean>;
-export declare function resendInvitationEmail({ email, reference, type }: {
+    tx?: EntityManager;
+}): Promise<Invitation>;
+/** Mail the link. Kept apart so re-sending does not have to go through creating one. */
+export declare function mailInvitation(invitation: Invitation, context: any): Promise<void>;
+/**
+ * Accept an invitation.
+ *
+ * The invited address has to be given as well as the token — see the note at the top. Everything
+ * that refuses here refuses the same way on purpose: a wrong token, a wrong address, an expired
+ * one and a cancelled one are one answer, so that trying them apart tells the caller nothing.
+ */
+export declare function acceptInvitation({ token, email, name, password, context, tx }: {
+    token: string;
     email: string;
-    reference: string;
-    type: string;
-}, context: any): Promise<boolean>;
+    name?: string;
+    password?: string;
+    context: any;
+    tx?: EntityManager;
+}): Promise<{
+    domain: Domain;
+    created: boolean;
+}>;
+/**
+ * Withdraw a pending invitation.
+ *
+ * The row stays and says it was cancelled. Deleting it would take with it the fact that somebody
+ * was invited at all, which is the thing the list exists to show.
+ */
+export declare function cancelInvitation(id: string, domain: Domain, user: User, tx?: EntityManager): Promise<boolean>;

package/dist-server/controllers/invitation.js

@@ -1,138 +1,184 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.invite = invite;
+exports.inviteByEmail = inviteByEmail;
+exports.mailInvitation = mailInvitation;
 exports.acceptInvitation = acceptInvitation;
-exports.sendInvitationEmail = sendInvitationEmail;
-exports.resendInvitationEmail = resendInvitationEmail;
+exports.cancelInvitation = cancelInvitation;
 const typeorm_1 = require("typeorm");
-const url_1 = require("url");
 const email_base_1 = require("@things-factory/email-base");
+const env_1 = require("@things-factory/env");
 const shell_1 = require("@things-factory/shell");
 const invitation_js_1 = require("../service/invitation/invitation.js");
 const user_js_1 = require("../service/user/user.js");
 const invitation_email_js_1 = require("../templates/invitation-email.js");
+const build_auth_url_js_1 = require("../utils/build-auth-url.js");
+const invitation_state_js_1 = require("../utils/invitation-state.js");
 const make_invitation_token_js_1 = require("./utils/make-invitation-token.js");
-const save_invitation_token_js_1 = require("./utils/save-invitation-token.js");
-async function invite(attrs, withEmailInvitation) {
-    const { username, reference, type, context } = attrs;
-    const repository = (0, shell_1.getRepository)(user_js_1.User);
-    var user = await repository.findOne({
-        where: { username },
+/**
+ * Inviting somebody into a domain, and their accepting it.
+ *
+ * ── What this is for, and what it is not ────────────────────────────────────
+ * `inviteUser` already puts a person who **has an account** into a domain, at once, with no mail
+ * and no say from them. That is the right tool when the administrator has the authority and the
+ * person already exists.
+ *
+ * This is for the case the `user-invite` screen records as having no path at all: **somebody with
+ * no account, in an installation with no default password.** Nobody can set their password for
+ * them, so the only way in is a mail they can prove they received. That is what the token is.
+ *
+ * ── Where the token sits ────────────────────────────────────────────────────
+ * In the link's **fragment** — `…/accept-invitation#<token>` — which browsers do not send to the
+ * server. So it stays out of access logs, proxy logs and `Referer`. The page strips it from the
+ * address bar as soon as it has read it.
+ *
+ * That leaves one way it can still travel: the mail itself being forwarded. Nothing about where
+ * the token sits can close that, so accepting asks for the invited address as well. Holding the
+ * link is then not enough on its own.
+ *
+ * ⚠ `/verify/:token`, `/reset-password?token=` and `/unlock-user?token=` still put theirs in the
+ * URL. A password reset token is not lighter than this one. Moving those three is its own job.
+ */
+/** How long an invitation stands. Short, because it is a credential someone is holding. */
+const EXPIRES_IN_HOURS = Number(env_1.config.get('invitation/expiresInHours', 48)) || 48;
+function expiryFrom(now) {
+    return new Date(now.getTime() + EXPIRES_IN_HOURS * 60 * 60 * 1000);
+}
+/**
+ * Create a pending invitation and mail it.
+ *
+ * ⚠ One pending invitation per person and domain. The history keeps every row, so this cannot be
+ * a unique index without forbidding "invited, left, invited again" — see the note on the entity.
+ * An existing pending one is re-issued rather than duplicated: a new token, a new expiry, and the
+ * same row, so the list shows one line per invitation rather than one per time somebody pressed
+ * the button.
+ */
+async function inviteByEmail({ email, domain, roles, user, context, tx }) {
+    const repository = (0, shell_1.getRepository)(invitation_js_1.Invitation, tx);
+    const now = new Date();
+    const alreadyIn = await (0, shell_1.getRepository)(user_js_1.User, tx).findOne({
+        where: { email: (0, typeorm_1.ILike)(email) },
         relations: ['domains']
     });
-    if (!user && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(username)) {
-        user = await repository.findOne({
-            where: { email: (0, typeorm_1.ILike)(username) },
-            relations: ['domains']
-        });
+    if (alreadyIn?.domains?.some(d => d.id === domain.id)) {
+        throw new shell_1.Refusal('invitation-already-a-member', { email, domain: domain.name }, `${email} is already in ${domain.name}.`);
     }
-    var domains = user.domains;
-    // TODO reference should not be a domain.id (security reason)
-    if (user) {
-        const domain = domains.find(domain => domain.id == reference);
-        if (domain) {
-            const msg = `user already a member of the ${type}.`;
-            throw new Error(msg);
-        }
+    const standing = await repository.findOne({
+        where: { email: (0, typeorm_1.ILike)(email), domain: { id: domain.id }, status: invitation_state_js_1.InvitationStatus.PENDING },
+        relations: ['domain']
+    });
+    const invitation = await repository.save({
+        ...(standing || {}),
+        email,
+        domain,
+        roles: roles || [],
+        status: invitation_state_js_1.InvitationStatus.PENDING,
+        token: (0, make_invitation_token_js_1.makeInvitationToken)(),
+        expiresAt: expiryFrom(now),
+        acceptedAt: null,
+        creator: standing ? standing['creator'] : user,
+        updater: user
+    });
+    await mailInvitation(invitation, context);
+    return invitation;
+}
+/** Mail the link. Kept apart so re-sending does not have to go through creating one. */
+async function mailInvitation(invitation, context) {
+    /*
+     * `buildAuthURL` reads the address this request arrived on, and falls back the way sign-in and
+     * OAuth do. The four mail controllers here each built theirs from `context.header.referer`
+     * instead, which **throws when the header is absent** — and the whole send sits in a
+     * `try { … } catch { return false }`, so it failed silently. This is that helper's first caller.
+     */
+    const acceptUrl = `${(0, build_auth_url_js_1.buildAuthURL)('/accept-invitation', context)}#${invitation.token}`;
+    await (0, email_base_1.sendEmail)({
+        receiver: invitation.email,
+        subject: 'Invitation',
+        content: (0, invitation_email_js_1.getInvitationEmailForm)({
+            username: invitation.email,
+            email: invitation.email,
+            acceptUrl,
+            /* Printed as text too: the link's fragment needs JavaScript, and this does not. */
+            code: invitation.token
+        })
+    });
+}
+/**
+ * Accept an invitation.
+ *
+ * The invited address has to be given as well as the token — see the note at the top. Everything
+ * that refuses here refuses the same way on purpose: a wrong token, a wrong address, an expired
+ * one and a cancelled one are one answer, so that trying them apart tells the caller nothing.
+ */
+async function acceptInvitation({ token, email, name, password, context, tx }) {
+    const repository = (0, shell_1.getRepository)(invitation_js_1.Invitation, tx);
+    const invitation = token && email
+        ? await repository.findOne({ where: { token }, relations: ['domain', 'roles'] })
+        : null;
+    const addressMatches = invitation?.email && email && invitation.email.toLowerCase() === email.trim().toLowerCase();
+    if (!invitation || !addressMatches || !(0, invitation_state_js_1.mayAccept)(invitation)) {
+        throw new shell_1.Refusal('invitation-not-open', {}, 'This invitation cannot be used.');
     }
-    if (withEmailInvitation) {
-        const email = user.email;
-        // TODO 초대장의 유효기간을 설정할 수 있어야 함.
-        var invitation = await (0, shell_1.getRepository)(invitation_js_1.Invitation).findOneBy({
-            email: (0, typeorm_1.ILike)(email),
-            reference,
-            type
-        });
-        if (!invitation) {
-            invitation = await (0, shell_1.getRepository)(invitation_js_1.Invitation).save({
-                email,
-                reference,
-                type
-            });
+    const userRepository = (0, shell_1.getRepository)(user_js_1.User, tx);
+    let person = await userRepository.findOne({ where: { email: (0, typeorm_1.ILike)(invitation.email) }, relations: ['domains'] });
+    const created = !person;
+    if (!person) {
+        if (!password) {
+            throw new shell_1.Refusal('invitation-needs-a-password', {}, 'Choose a password to finish joining.');
         }
-        return await sendInvitationEmail({
-            invitation,
-            user,
-            context
+        /* The same rule the sign-up path applies; it throws its own message in the caller's language. */
+        user_js_1.User.validatePasswordByRule(password, context?.lng);
+        const salt = user_js_1.User.generateSalt();
+        person = await userRepository.save({
+            userType: 'user',
+            name: name || invitation.email,
+            username: invitation.email,
+            email: invitation.email,
+            salt,
+            password: user_js_1.User.encode(password, salt),
+            passwordUpdatedAt: new Date(),
+            /* Arriving through a mail they received is the verification, so they arrive usable. */
+            status: user_js_1.UserStatus.ACTIVATED,
+            domains: [invitation.domain]
         });
     }
-    if (user) {
-        user.domains = [...domains, await (0, shell_1.getRepository)(shell_1.Domain).findOneBy({ id: reference })];
-        await (0, shell_1.getRepository)(user_js_1.User).save(user);
+    else if (!person.domains?.some(d => d.id === invitation.domain.id)) {
+        person.domains = [...(person.domains || []), invitation.domain];
+        await userRepository.save(person);
     }
-    else {
-        // TODO need to signup
+    /*
+     * Roles are given on arrival. Without them the person signs in and has no screens at all —
+     * which is why the invitation carries them, rather than leaving the administrator to notice
+     * afterwards.
+     */
+    if (invitation.roles?.length) {
+        const loaded = await userRepository.findOne({ where: { id: person.id }, relations: ['roles'] });
+        const held = new Set((loaded?.roles || []).map(role => role.id));
+        await userRepository.save({
+            ...loaded,
+            roles: [...(loaded?.roles || []), ...invitation.roles.filter(role => !held.has(role.id))]
+        });
     }
-}
-async function acceptInvitation(token) {
-    var invitation = await (0, shell_1.getRepository)(invitation_js_1.Invitation).findOneBy({
-        token
+    await repository.save({
+        ...invitation,
+        status: invitation_state_js_1.InvitationStatus.ACCEPTED,
+        acceptedAt: new Date()
     });
-    if (!invitation) {
-        throw new Error(`not found invitation.`);
-    }
-    var { email, reference, type } = invitation;
-    var user = await (0, shell_1.getRepository)(user_js_1.User).findOne({ where: { email: (0, typeorm_1.ILike)(email) }, relations: ['domains'] });
-    if (user) {
-        var domains = user.domains;
-        const domain = domains.find(domain => domain.id == reference);
-        if (domain) {
-            const msg = `user already a member of the ${type}.`;
-            throw new Error(msg);
-        }
-        user.domains = [...domains, await (0, shell_1.getRepository)(shell_1.Domain).findOneBy({ id: reference })];
-        await (0, shell_1.getRepository)(user_js_1.User).save(user);
-        await (0, shell_1.getRepository)(invitation_js_1.Invitation).delete(invitation.id);
-    }
-    else {
-        // TODO goto signup
-    }
-    return true;
+    return { domain: invitation.domain, created };
 }
-async function sendInvitationEmail({ invitation, user, context }) {
-    try {
-        var token = (0, make_invitation_token_js_1.makeInvitationToken)();
-        var verifaction = await (0, save_invitation_token_js_1.saveInvitationToken)(invitation.id, token);
-        if (verifaction) {
-            var serviceUrl = new url_1.URL(`/auth/accept/${token}`, context.header.referer);
-            await (0, email_base_1.sendEmail)({
-                receiver: invitation.email,
-                subject: 'Invitation',
-                content: (0, invitation_email_js_1.getInvitationEmailForm)({
-                    username: user.username,
-                    email: invitation.email,
-                    acceptUrl: serviceUrl
-                })
-            });
-            return true;
-        }
-    }
-    catch (e) {
+/**
+ * Withdraw a pending invitation.
+ *
+ * The row stays and says it was cancelled. Deleting it would take with it the fact that somebody
+ * was invited at all, which is the thing the list exists to show.
+ */
+async function cancelInvitation(id, domain, user, tx) {
+    const repository = (0, shell_1.getRepository)(invitation_js_1.Invitation, tx);
+    const invitation = await repository.findOne({ where: { id, domain: { id: domain.id } }, relations: ['domain'] });
+    if (!invitation || !(0, invitation_state_js_1.mayAccept)(invitation)) {
+        /* Nothing to withdraw: already accepted, already cancelled, or already run out. */
         return false;
     }
-}
-async function resendInvitationEmail({ email, reference, type }, context) {
-    var invitation = await (0, shell_1.getRepository)(invitation_js_1.Invitation).findOneBy({
-        email: (0, typeorm_1.ILike)(email),
-        reference,
-        type
-    });
-    if (!invitation) {
-        throw new Error(`not found invitation.`);
-    }
-    var user = await (0, shell_1.getRepository)(user_js_1.User).findOne({
-        where: {
-            email: (0, typeorm_1.ILike)(email),
-            status: user_js_1.UserStatus.ACTIVATED
-        }
-    });
-    if (!user) {
-        throw new Error(`user not found: ${email}`);
-    }
-    return await sendInvitationEmail({
-        invitation,
-        user,
-        context
-    });
+    await repository.save({ ...invitation, status: invitation_state_js_1.InvitationStatus.CANCELLED, updater: user });
+    return true;
 }
 //# sourceMappingURL=invitation.js.map

package/dist-server/controllers/invitation.js.map

@@ -1 +1 @@
-{"version":3,"file":"invitation.js","sourceRoot":"","sources":["../../server/controllers/invitation.ts"],"names":[],"mappings":";;AAYA,wBA4DC;AAED,4CA+BC;AAED,kDAuBC;AAED,sDA8BC;AAlKD,qCAA+B;AAC/B,6BAAyB;AAEzB,2DAAsD;AACtD,iDAA6D;AAE7D,uEAAgE;AAChE,qDAA0D;AAC1D,0EAAyE;AACzE,+EAAsE;AACtE,+EAAsE;AAE/D,KAAK,UAAU,MAAM,CAAC,KAAK,EAAE,mBAA6B;IAC/D,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IACpD,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IAEtC,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE,EAAE,QAAQ,EAAE;QACnB,SAAS,EAAE,CAAC,SAAS,CAAC;KACvB,CAAC,CAAA;IAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzD,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAC9B,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;YACjC,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;IAE1B,6DAA6D;IAE7D,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,SAAS,CAAC,CAAA;QAE7D,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,gCAAgC,IAAI,GAAG,CAAA;YACnD,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IAED,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QAExB,+BAA+B;QAC/B,IAAI,UAAU,GAAG,MAAM,IAAA,qBAAa,EAAC,0BAAU,CAAC,CAAC,SAAS,CAAC;YACzD,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC;YACnB,SAAS;YACT,IAAI;SACL,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,UAAU,GAAG,MAAM,IAAA,qBAAa,EAAC,0BAAU,CAAC,CAAC,IAAI,CAAC;gBAChD,KAAK;gBACL,SAAS;gBACT,IAAI;aACL,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,MAAM,mBAAmB,CAAC;YAC/B,UAAU;YACV,IAAI;YACJ,OAAO;SACR,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,OAAO,EAAE,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;QACrF,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACtC,CAAC;SAAM,CAAC;QACN,sBAAsB;IACxB,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,gBAAgB,CAAC,KAAK;IAC1C,IAAI,UAAU,GAAG,MAAM,IAAA,qBAAa,EAAC,0BAAU,CAAC,CAAC,SAAS,CAAC;QACzD,KAAK;KACN,CAAC,CAAA;IAEF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAC1C,CAAC;IAED,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,UAAU,CAAA;IAE3C,IAAI,IAAI,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IAExG,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,SAAS,CAAC,CAAA;QAE7D,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,gCAAgC,IAAI,GAAG,CAAA;YACnD,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAA;QACtB,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,OAAO,EAAE,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;QACrF,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEpC,MAAM,IAAA,qBAAa,EAAC,0BAAU,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IACvD,CAAC;SAAM,CAAC;QACN,mBAAmB;IACrB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAEM,KAAK,UAAU,mBAAmB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;IACrE,IAAI,CAAC;QACH,IAAI,KAAK,GAAG,IAAA,8CAAmB,GAAE,CAAA;QACjC,IAAI,WAAW,GAAG,MAAM,IAAA,8CAAmB,EAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAEjE,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,UAAU,GAAG,IAAI,SAAG,CAAC,gBAAgB,KAAK,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAEzE,MAAM,IAAA,sBAAS,EAAC;gBACd,QAAQ,EAAE,UAAU,CAAC,KAAK;gBAC1B,OAAO,EAAE,YAAY;gBACrB,OAAO,EAAE,IAAA,4CAAsB,EAAC;oBAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK,EAAE,UAAU,CAAC,KAAK;oBACvB,SAAS,EAAE,UAAU;iBACtB,CAAC;aACH,CAAC,CAAA;YAEF,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,qBAAqB,CACzC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAsD,EAC9E,OAAO;IAEP,IAAI,UAAU,GAAG,MAAM,IAAA,qBAAa,EAAC,0BAAU,CAAC,CAAC,SAAS,CAAC;QACzD,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC;QACnB,SAAS;QACT,IAAI;KACL,CAAC,CAAA;IAEF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAC1C,CAAC;IAED,IAAI,IAAI,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;QAC3C,KAAK,EAAE;YACL,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC;YACnB,MAAM,EAAE,oBAAU,CAAC,SAAS;SAC7B;KACF,CAAC,CAAA;IAEF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO,MAAM,mBAAmB,CAAC;QAC/B,UAAU;QACV,IAAI;QACJ,OAAO;KACR,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { ILike } from 'typeorm'\nimport { URL } from 'url'\n\nimport { sendEmail } from '@things-factory/email-base'\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { Invitation } from '../service/invitation/invitation.js'\nimport { User, UserStatus } from '../service/user/user.js'\nimport { getInvitationEmailForm } from '../templates/invitation-email.js'\nimport { makeInvitationToken } from './utils/make-invitation-token.js'\nimport { saveInvitationToken } from './utils/save-invitation-token.js'\n\nexport async function invite(attrs, withEmailInvitation?: Boolean) {\n  const { username, reference, type, context } = attrs\n  const repository = getRepository(User)\n\n  var user = await repository.findOne({\n    where: { username },\n    relations: ['domains']\n  })\n\n  if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n    user = await repository.findOne({\n      where: { email: ILike(username) },\n      relations: ['domains']\n    })\n  }\n\n  var domains = user.domains\n\n  // TODO reference should not be a domain.id (security reason)\n\n  if (user) {\n    const domain = domains.find(domain => domain.id == reference)\n\n    if (domain) {\n      const msg = `user already a member of the ${type}.`\n      throw new Error(msg)\n    }\n  }\n\n  if (withEmailInvitation) {\n    const email = user.email\n\n    // TODO 초대장의 유효기간을 설정할 수 있어야 함.\n    var invitation = await getRepository(Invitation).findOneBy({\n      email: ILike(email),\n      reference,\n      type\n    })\n\n    if (!invitation) {\n      invitation = await getRepository(Invitation).save({\n        email,\n        reference,\n        type\n      })\n    }\n\n    return await sendInvitationEmail({\n      invitation,\n      user,\n      context\n    })\n  }\n\n  if (user) {\n    user.domains = [...domains, await getRepository(Domain).findOneBy({ id: reference })]\n    await getRepository(User).save(user)\n  } else {\n    // TODO need to signup\n  }\n}\n\nexport async function acceptInvitation(token) {\n  var invitation = await getRepository(Invitation).findOneBy({\n    token\n  })\n\n  if (!invitation) {\n    throw new Error(`not found invitation.`)\n  }\n\n  var { email, reference, type } = invitation\n\n  var user = await getRepository(User).findOne({ where: { email: ILike(email) }, relations: ['domains'] })\n\n  if (user) {\n    var domains = user.domains\n    const domain = domains.find(domain => domain.id == reference)\n\n    if (domain) {\n      const msg = `user already a member of the ${type}.`\n      throw new Error(msg)\n    }\n\n    user.domains = [...domains, await getRepository(Domain).findOneBy({ id: reference })]\n    await getRepository(User).save(user)\n\n    await getRepository(Invitation).delete(invitation.id)\n  } else {\n    // TODO goto signup\n  }\n\n  return true\n}\n\nexport async function sendInvitationEmail({ invitation, user, context }) {\n  try {\n    var token = makeInvitationToken()\n    var verifaction = await saveInvitationToken(invitation.id, token)\n\n    if (verifaction) {\n      var serviceUrl = new URL(`/auth/accept/${token}`, context.header.referer)\n\n      await sendEmail({\n        receiver: invitation.email,\n        subject: 'Invitation',\n        content: getInvitationEmailForm({\n          username: user.username,\n          email: invitation.email,\n          acceptUrl: serviceUrl\n        })\n      })\n\n      return true\n    }\n  } catch (e) {\n    return false\n  }\n}\n\nexport async function resendInvitationEmail(\n  { email, reference, type }: { email: string; reference: string; type: string },\n  context\n) {\n  var invitation = await getRepository(Invitation).findOneBy({\n    email: ILike(email),\n    reference,\n    type\n  })\n\n  if (!invitation) {\n    throw new Error(`not found invitation.`)\n  }\n\n  var user = await getRepository(User).findOne({\n    where: {\n      email: ILike(email),\n      status: UserStatus.ACTIVATED\n    }\n  })\n\n  if (!user) {\n    throw new Error(`user not found: ${email}`)\n  }\n\n  return await sendInvitationEmail({\n    invitation,\n    user,\n    context\n  })\n}\n"]}
+{"version":3,"file":"invitation.js","sourceRoot":"","sources":["../../server/controllers/invitation.ts"],"names":[],"mappings":";;AAuDA,sCAoDC;AAGD,wCAoBC;AASD,4CAkFC;AAQD,4CAaC;AAlPD,qCAA8C;AAE9C,2DAAsD;AACtD,6CAA4C;AAC5C,iDAAsE;AAEtE,uEAAgE;AAEhE,qDAA0D;AAC1D,0EAAyE;AACzE,kEAAyD;AACzD,sEAA0E;AAC1E,+EAAsE;AAEtE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,2FAA2F;AAC3F,MAAM,gBAAgB,GAAG,MAAM,CAAC,YAAM,CAAC,GAAG,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;AAElF,SAAS,UAAU,CAAC,GAAS;IAC3B,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;AACpE,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,aAAa,CAAC,EAClC,KAAK,EACL,MAAM,EACN,KAAK,EACL,IAAI,EACJ,OAAO,EACP,EAAE,EAQH;IACC,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,0BAAU,EAAE,EAAE,CAAC,CAAA;IAChD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IAEtB,MAAM,SAAS,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC;QACtD,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC,EAAE;QAC9B,SAAS,EAAE,CAAC,SAAS,CAAC;KACvB,CAAC,CAAA;IAEF,IAAI,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,eAAO,CACf,6BAA6B,EAC7B,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAC9B,GAAG,KAAK,kBAAkB,MAAM,CAAC,IAAI,GAAG,CACzC,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;QACxC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,sCAAgB,CAAC,OAAO,EAAE;QAC3F,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB,CAAC,CAAA;IAEF,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC;QACvC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;QACnB,KAAK;QACL,MAAM;QACN,KAAK,EAAE,KAAK,IAAI,EAAE;QAClB,MAAM,EAAE,sCAAgB,CAAC,OAAO;QAChC,KAAK,EAAE,IAAA,8CAAmB,GAAE;QAC5B,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC;QAC1B,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;QAC9C,OAAO,EAAE,IAAI;KACP,CAAC,CAAA;IAET,MAAM,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IAEzC,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,wFAAwF;AACjF,KAAK,UAAU,cAAc,CAAC,UAAsB,EAAE,OAAY;IACvE;;;;;OAKG;IACH,MAAM,SAAS,GAAG,GAAG,IAAA,gCAAY,EAAC,oBAAoB,EAAE,OAAO,CAAC,IAAI,UAAU,CAAC,KAAK,EAAE,CAAA;IAEtF,MAAM,IAAA,sBAAS,EAAC;QACd,QAAQ,EAAE,UAAU,CAAC,KAAK;QAC1B,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,IAAA,4CAAsB,EAAC;YAC9B,QAAQ,EAAE,UAAU,CAAC,KAAK;YAC1B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,SAAS;YACT,mFAAmF;YACnF,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB,CAAC;KACH,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,gBAAgB,CAAC,EACrC,KAAK,EACL,KAAK,EACL,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,EAAE,EAQH;IACC,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,0BAAU,EAAE,EAAE,CAAC,CAAA;IAEhD,MAAM,UAAU,GACd,KAAK,IAAI,KAAK;QACZ,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QAChF,CAAC,CAAC,IAAI,CAAA;IAEV,MAAM,cAAc,GAAG,UAAU,EAAE,KAAK,IAAI,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAElH,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,IAAI,CAAC,IAAA,+BAAS,EAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,eAAO,CAAC,qBAAqB,EAAE,EAAE,EAAE,iCAAiC,CAAC,CAAA;IACjF,CAAC;IAED,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;IAE9C,IAAI,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IAChH,MAAM,OAAO,GAAG,CAAC,MAAM,CAAA;IAEvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,eAAO,CAAC,6BAA6B,EAAE,EAAE,EAAE,sCAAsC,CAAC,CAAA;QAC9F,CAAC;QAED,iGAAiG;QACjG,cAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAEnD,MAAM,IAAI,GAAG,cAAI,CAAC,YAAY,EAAE,CAAA;QAEhC,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC;YACjC,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,IAAI,IAAI,UAAU,CAAC,KAAK;YAC9B,QAAQ,EAAE,UAAU,CAAC,KAAK;YAC1B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,IAAI;YACJ,QAAQ,EAAE,cAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC;YACrC,iBAAiB,EAAE,IAAI,IAAI,EAAE;YAC7B,uFAAuF;YACvF,MAAM,EAAE,oBAAU,CAAC,SAAS;YAC5B,OAAO,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;SACtB,CAAC,CAAA;IACX,CAAC;SAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACrE,MAAM,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;QAC/D,MAAM,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC;IAED;;;;OAIG;IACH,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC/F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAEhE,MAAM,cAAc,CAAC,IAAI,CAAC;YACxB,GAAG,MAAM;YACT,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;SACnF,CAAC,CAAA;IACX,CAAC;IAED,MAAM,UAAU,CAAC,IAAI,CAAC;QACpB,GAAG,UAAU;QACb,MAAM,EAAE,sCAAgB,CAAC,QAAQ;QACjC,UAAU,EAAE,IAAI,IAAI,EAAE;KAChB,CAAC,CAAA;IAET,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,CAAA;AAC/C,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,gBAAgB,CAAC,EAAU,EAAE,MAAc,EAAE,IAAU,EAAE,EAAkB;IAC/F,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,0BAAU,EAAE,EAAE,CAAC,CAAA;IAEhD,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAEhH,IAAI,CAAC,UAAU,IAAI,CAAC,IAAA,+BAAS,EAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,mFAAmF;QACnF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,sCAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAS,CAAC,CAAA;IAElG,OAAO,IAAI,CAAA;AACb,CAAC","sourcesContent":["import { EntityManager, ILike } from 'typeorm'\n\nimport { sendEmail } from '@things-factory/email-base'\nimport { config } from '@things-factory/env'\nimport { Domain, getRepository, Refusal } from '@things-factory/shell'\n\nimport { Invitation } from '../service/invitation/invitation.js'\nimport { Role } from '../service/role/role.js'\nimport { User, UserStatus } from '../service/user/user.js'\nimport { getInvitationEmailForm } from '../templates/invitation-email.js'\nimport { buildAuthURL } from '../utils/build-auth-url.js'\nimport { InvitationStatus, mayAccept } from '../utils/invitation-state.js'\nimport { makeInvitationToken } from './utils/make-invitation-token.js'\n\n/**\n * Inviting somebody into a domain, and their accepting it.\n *\n * ── What this is for, and what it is not ────────────────────────────────────\n * `inviteUser` already puts a person who **has an account** into a domain, at once, with no mail\n * and no say from them. That is the right tool when the administrator has the authority and the\n * person already exists.\n *\n * This is for the case the `user-invite` screen records as having no path at all: **somebody with\n * no account, in an installation with no default password.** Nobody can set their password for\n * them, so the only way in is a mail they can prove they received. That is what the token is.\n *\n * ── Where the token sits ────────────────────────────────────────────────────\n * In the link's **fragment** — `…/accept-invitation#<token>` — which browsers do not send to the\n * server. So it stays out of access logs, proxy logs and `Referer`. The page strips it from the\n * address bar as soon as it has read it.\n *\n * That leaves one way it can still travel: the mail itself being forwarded. Nothing about where\n * the token sits can close that, so accepting asks for the invited address as well. Holding the\n * link is then not enough on its own.\n *\n * ⚠ `/verify/:token`, `/reset-password?token=` and `/unlock-user?token=` still put theirs in the\n * URL. A password reset token is not lighter than this one. Moving those three is its own job.\n */\n\n/** How long an invitation stands. Short, because it is a credential someone is holding. */\nconst EXPIRES_IN_HOURS = Number(config.get('invitation/expiresInHours', 48)) || 48\n\nfunction expiryFrom(now: Date): Date {\n  return new Date(now.getTime() + EXPIRES_IN_HOURS * 60 * 60 * 1000)\n}\n\n/**\n * Create a pending invitation and mail it.\n *\n * ⚠ One pending invitation per person and domain. The history keeps every row, so this cannot be\n * a unique index without forbidding \"invited, left, invited again\" — see the note on the entity.\n * An existing pending one is re-issued rather than duplicated: a new token, a new expiry, and the\n * same row, so the list shows one line per invitation rather than one per time somebody pressed\n * the button.\n */\nexport async function inviteByEmail({\n  email,\n  domain,\n  roles,\n  user,\n  context,\n  tx\n}: {\n  email: string\n  domain: Domain\n  roles?: Role[]\n  user?: User\n  context: any\n  tx?: EntityManager\n}): Promise<Invitation> {\n  const repository = getRepository(Invitation, tx)\n  const now = new Date()\n\n  const alreadyIn = await getRepository(User, tx).findOne({\n    where: { email: ILike(email) },\n    relations: ['domains']\n  })\n\n  if (alreadyIn?.domains?.some(d => d.id === domain.id)) {\n    throw new Refusal(\n      'invitation-already-a-member',\n      { email, domain: domain.name },\n      `${email} is already in ${domain.name}.`\n    )\n  }\n\n  const standing = await repository.findOne({\n    where: { email: ILike(email), domain: { id: domain.id }, status: InvitationStatus.PENDING },\n    relations: ['domain']\n  })\n\n  const invitation = await repository.save({\n    ...(standing || {}),\n    email,\n    domain,\n    roles: roles || [],\n    status: InvitationStatus.PENDING,\n    token: makeInvitationToken(),\n    expiresAt: expiryFrom(now),\n    acceptedAt: null,\n    creator: standing ? standing['creator'] : user,\n    updater: user\n  } as any)\n\n  await mailInvitation(invitation, context)\n\n  return invitation\n}\n\n/** Mail the link. Kept apart so re-sending does not have to go through creating one. */\nexport async function mailInvitation(invitation: Invitation, context: any): Promise<void> {\n  /*\n   * `buildAuthURL` reads the address this request arrived on, and falls back the way sign-in and\n   * OAuth do. The four mail controllers here each built theirs from `context.header.referer`\n   * instead, which **throws when the header is absent** — and the whole send sits in a\n   * `try { … } catch { return false }`, so it failed silently. This is that helper's first caller.\n   */\n  const acceptUrl = `${buildAuthURL('/accept-invitation', context)}#${invitation.token}`\n\n  await sendEmail({\n    receiver: invitation.email,\n    subject: 'Invitation',\n    content: getInvitationEmailForm({\n      username: invitation.email,\n      email: invitation.email,\n      acceptUrl,\n      /* Printed as text too: the link's fragment needs JavaScript, and this does not. */\n      code: invitation.token\n    })\n  })\n}\n\n/**\n * Accept an invitation.\n *\n * The invited address has to be given as well as the token — see the note at the top. Everything\n * that refuses here refuses the same way on purpose: a wrong token, a wrong address, an expired\n * one and a cancelled one are one answer, so that trying them apart tells the caller nothing.\n */\nexport async function acceptInvitation({\n  token,\n  email,\n  name,\n  password,\n  context,\n  tx\n}: {\n  token: string\n  email: string\n  name?: string\n  password?: string\n  context: any\n  tx?: EntityManager\n}): Promise<{ domain: Domain; created: boolean }> {\n  const repository = getRepository(Invitation, tx)\n\n  const invitation =\n    token && email\n      ? await repository.findOne({ where: { token }, relations: ['domain', 'roles'] })\n      : null\n\n  const addressMatches = invitation?.email && email && invitation.email.toLowerCase() === email.trim().toLowerCase()\n\n  if (!invitation || !addressMatches || !mayAccept(invitation)) {\n    throw new Refusal('invitation-not-open', {}, 'This invitation cannot be used.')\n  }\n\n  const userRepository = getRepository(User, tx)\n\n  let person = await userRepository.findOne({ where: { email: ILike(invitation.email) }, relations: ['domains'] })\n  const created = !person\n\n  if (!person) {\n    if (!password) {\n      throw new Refusal('invitation-needs-a-password', {}, 'Choose a password to finish joining.')\n    }\n\n    /* The same rule the sign-up path applies; it throws its own message in the caller's language. */\n    User.validatePasswordByRule(password, context?.lng)\n\n    const salt = User.generateSalt()\n\n    person = await userRepository.save({\n      userType: 'user',\n      name: name || invitation.email,\n      username: invitation.email,\n      email: invitation.email,\n      salt,\n      password: User.encode(password, salt),\n      passwordUpdatedAt: new Date(),\n      /* Arriving through a mail they received is the verification, so they arrive usable. */\n      status: UserStatus.ACTIVATED,\n      domains: [invitation.domain]\n    } as any)\n  } else if (!person.domains?.some(d => d.id === invitation.domain.id)) {\n    person.domains = [...(person.domains || []), invitation.domain]\n    await userRepository.save(person)\n  }\n\n  /*\n   * Roles are given on arrival. Without them the person signs in and has no screens at all —\n   * which is why the invitation carries them, rather than leaving the administrator to notice\n   * afterwards.\n   */\n  if (invitation.roles?.length) {\n    const loaded = await userRepository.findOne({ where: { id: person.id }, relations: ['roles'] })\n    const held = new Set((loaded?.roles || []).map(role => role.id))\n\n    await userRepository.save({\n      ...loaded,\n      roles: [...(loaded?.roles || []), ...invitation.roles.filter(role => !held.has(role.id))]\n    } as any)\n  }\n\n  await repository.save({\n    ...invitation,\n    status: InvitationStatus.ACCEPTED,\n    acceptedAt: new Date()\n  } as any)\n\n  return { domain: invitation.domain, created }\n}\n\n/**\n * Withdraw a pending invitation.\n *\n * The row stays and says it was cancelled. Deleting it would take with it the fact that somebody\n * was invited at all, which is the thing the list exists to show.\n */\nexport async function cancelInvitation(id: string, domain: Domain, user: User, tx?: EntityManager): Promise<boolean> {\n  const repository = getRepository(Invitation, tx)\n\n  const invitation = await repository.findOne({ where: { id, domain: { id: domain.id } }, relations: ['domain'] })\n\n  if (!invitation || !mayAccept(invitation)) {\n    /* Nothing to withdraw: already accepted, already cancelled, or already run out. */\n    return false\n  }\n\n  await repository.save({ ...invitation, status: InvitationStatus.CANCELLED, updater: user } as any)\n\n  return true\n}\n"]}

package/dist-server/controllers/profile.d.ts

@@ -13,6 +13,7 @@ export declare function updateProfile({ id }: {
     roles?: import("../index.js").Role[];
     userType: string;
     reference: string;
+    credentialSerial?: number;
     salt: string;
     ssoId: string;
     status: import("../service/user/user.js").UserStatus;

package/dist-server/router/auth-public-process-router.js

@@ -140,19 +140,42 @@ exports.authPublicProcessRouter.post('/resend-verification-email', async (contex
         context.body = message;
     }
 });
-exports.authPublicProcessRouter.post('/resend-invitation-email', async (context, next) => {
-    const { t } = context;
-    const { email, reference, type } = context.request.body;
-    var succeed = await (0, invitation_js_1.resendInvitationEmail)({
-        email,
-        reference,
-        type
-    }, context);
-    var message = t('text.invitation email sent');
-    if (succeed) {
-        context.status = 200;
-        context.body = message;
-    }
+/*
+ * ── The invitation page ─────────────────────────────────────────────────────
+ * Public on purpose: the person following this link is not a member of the domain yet, which is
+ * the entire point of an invitation. The old link went to `/auth/accept/<token>`, a path with no
+ * route on any router, so it fell through to the private history-fallback — and the domain gate
+ * there turned the invitee away for not being a member. It asked somebody trying to join to
+ * already have joined.
+ *
+ * ── Why the token is not in this path ───────────────────────────────────────
+ * It rides in the link's fragment (`#<token>`), which browsers do not send. So the request line
+ * here carries nothing, and the token stays out of access logs, proxy logs and `Referer`. The
+ * page reads it from the fragment, clears it from the address bar, and posts it below.
+ */
+exports.authPublicProcessRouter.get('/accept-invitation', async (context, next) => {
+    await context.render('auth-page', {
+        pageElement: 'auth-accept-invitation',
+        elementScript: '/auth/accept-invitation.js',
+        data: {
+            disableUserFavoredLanguage,
+            languages
+        }
+    });
+});
+/*
+ * The address is asked for as well as the token. A forwarded mail is the one way the token can
+ * still travel, and nothing about where it sits can prevent that — so holding the link is not
+ * enough on its own.
+ */
+exports.authPublicProcessRouter.post('/accept-invitation', async (context, next) => {
+    const { token, email, name, password } = context.request.body || {};
+    const { domain, created } = await (0, invitation_js_1.acceptInvitation)({ token, email, name, password, context });
+    context.body = {
+        subdomain: domain?.subdomain,
+        created,
+        redirectTo: `/auth/signin?redirect_to=${encodeURIComponent('/')}`
+    };
 });
 exports.authPublicProcessRouter.post('/forgot-password', async (context, next) => {
     const { t } = context;

package/dist-server/router/auth-public-process-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-public-process-router.js","sourceRoot":"","sources":["../../server/router/auth-public-process-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAC/B,qCAA+B;AAE/B,6CAA4C;AAC5C,iDAAsE;AAEtE,gEAAoE;AACpE,wEAAwF;AACxF,kEAA0D;AAC1D,oEAAgF;AAChF,qDAA8C;AAC9C,oDAA6C;AAC7C,4EAAwE;AAExE,MAAM,wBAAwB,GAAG,YAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;AAC9E,MAAM,0BAA0B,GAAG,YAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;AACvF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;AACrD,MAAM,YAAY,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI;IAC7C,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;IACf,KAAK,EAAE,IAAI;IACX,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,KAAK;IAClB,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,KAAK;IACtB,oBAAoB,EAAE,CAAC;IACvB,oBAAoB,EAAE,EAAE;CACzB,CAAA;AAEY,QAAA,uBAAuB,GAAG,IAAI,oBAAM,CAAC;IAChD,MAAM,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC5D,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAE5C,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IAEtC,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;QAC1B,SAAS,EAAE,CAAC,SAAS,CAAC;KACvB,CAAC,CAAA;IAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAC9B,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC,EAAE;YAC9B,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,QAAQ,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAA;IACpD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,QAAQ,CAAC,yBAAyB,KAAK,UAAU,KAAK,EAAE,CAAC,CAAA;IACnE,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC9D,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;IAE/B,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,2BAA2B,CAAC,CAAA;IAE7C,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,IAAA,uBAAe,EAAC,OAAO,CAAC,CAAC,CAAA;IAC5C,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAA;IAEvC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,iBAAiB;QAC9B,aAAa,EAAE,0BAA0B;QACzC,IAAI,EAAE;YACJ,KAAK;YACL,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACrE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAA;IAEvC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,gBAAgB;QAC7B,aAAa,EAAE,yBAAyB;QACxC,IAAI,EAAE;YACJ,KAAK;YACL,YAAY;YACZ,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAClE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAA;IAEvC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,aAAa;QAC1B,aAAa,EAAE,sBAAsB;QACrC,IAAI,EAAE;YACJ,KAAK;YACL,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;IAEhC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,eAAe;QAC5B,aAAa,EAAE,mBAAmB;QAClC,IAAI,EAAE;YACJ,KAAK;YACL,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACpE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAA;IAEhC,MAAM,IAAA,wBAAM,EAAC,KAAK,CAAC,CAAA;IAEnB,IAAI,OAAO,GAAG,CAAC,CAAC,kCAAkC,CAAC,CAAA;IAEnD,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;IAEtB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YAChC,WAAW,EAAE,aAAa;YAC1B,aAAa,EAAE,iBAAiB;YAChC,IAAI,EAAE;gBACJ,OAAO;gBACP,wBAAwB;gBACxB,0BAA0B;gBAC1B,SAAS;aACV;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACjF,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IACrB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEtC,IAAI,OAAO,GAAG,MAAM,IAAA,yCAAuB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAC3D,IAAI,OAAO,GAAG,CAAC,CAAC,8BAA8B,CAAC,CAAA;IAE/C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;IACxB,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC/E,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IACrB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEvD,IAAI,OAAO,GAAG,MAAM,IAAA,qCAAqB,EACvC;QACE,KAAK;QACL,SAAS;QACT,IAAI;KACL,EACD,OAAO,CACR,CAAA;IAED,IAAI,OAAO,GAAG,CAAC,CAAC,4BAA4B,CAAC,CAAA;IAE7C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;IACxB,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACvE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IACrB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEtC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,EAAE,CAAA;IAEzB,MAAM,QAAQ,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE;YACL,KAAK;SACN;KACF,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,MAAM,IAAA,0CAAsB,EAAC;QAC3C,IAAI;QACJ,OAAO;KACR,CAAC,CAAA;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,gCAAgC,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEhD,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,CAAC;YACzB,IAAI,OAAO,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;YAErD,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;YACpB,OAAO,CAAC,IAAI,GAAG;gBACb,OAAO;aACR,CAAA;YAED,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBAChC,WAAW,EAAE,gBAAgB;oBAC7B,aAAa,EAAE,yBAAyB;oBACxC,IAAI,EAAE;wBACJ,KAAK;wBACL,OAAO;wBACP,YAAY;wBACZ,wBAAwB;wBACxB,0BAA0B;wBAC1B,SAAS;qBACV;iBACF,CAAC,CAAA;YACJ,CAAC;YAED,OAAM;QACR,CAAC;QAED,MAAM,IAAA,iCAAa,EAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QAE7C,IAAI,OAAO,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;QACrD,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;QAEtB,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;QAE/B,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,aAAa;gBAC1B,aAAa,EAAE,iBAAiB;gBAChC,IAAI,EAAE;oBACJ,OAAO;oBACP,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAA;QAExB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,gBAAgB;gBAC7B,aAAa,EAAE,yBAAyB;gBACxC,IAAI,EAAE;oBACJ,KAAK;oBACL,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,YAAY;oBACZ,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACnE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEhD;;uCAEmC;IACnC,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;QAEtD,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAU,EAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAEjD;;;;;;OAMG;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,CAAC,CAAC,iCAAiC,CAAC,CAAA;QAEpD,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;QAEtB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,aAAa;gBAC1B,aAAa,EAAE,sBAAsB;gBACrC,IAAI,EAAE;oBACJ,KAAK;oBACL,OAAO;oBACP,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;QAED,OAAM;IACR,CAAC;IAED,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,6BAA6B,CAAC,CAAA;IAE/C,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;IAE/B,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YAChC,WAAW,EAAE,aAAa;YAC1B,aAAa,EAAE,iBAAiB;YAChC,IAAI,EAAE;gBACJ,OAAO,EAAE,CAAC,CAAC,6BAA6B,CAAC;gBACzC,wBAAwB;gBACxB,0BAA0B;gBAC1B,SAAS;aACV;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA","sourcesContent":["import Router from 'koa-router'\nimport { ILike } from 'typeorm'\n\nimport { config } from '@things-factory/env'\nimport { getRepository, getSiteRootPath } from '@things-factory/shell'\n\nimport { resendInvitationEmail } from '../controllers/invitation.js'\nimport { resetPassword, sendPasswordResetEmail } from '../controllers/reset-password.js'\nimport { unlockUser } from '../controllers/unlock-user.js'\nimport { resendVerificationEmail, verify } from '../controllers/verification.js'\nimport { User } from '../service/user/user.js'\nimport { accepts } from '../utils/accepts.js'\nimport { clearAccessTokenCookie } from '../utils/access-token-cookie.js'\n\nconst disableUserSignupProcess = config.get('disableUserSignupProcess', false)\nconst disableUserFavoredLanguage = config.get('i18n/disableUserFavoredLanguage', false)\nconst languages = config.get('i18n/languages', false)\nconst passwordRule = config.get('password') || {\n  lowerCase: true,\n  upperCase: true,\n  digit: true,\n  specialCharacter: true,\n  allowRepeat: false,\n  useTightPattern: true,\n  useLoosePattern: false,\n  tightCharacterLength: 8,\n  looseCharacterLength: 15\n}\n\nexport const authPublicProcessRouter = new Router({\n  prefix: '/auth'\n})\n\nauthPublicProcessRouter.post('/join', async (context, next) => {\n  const { email } = context.request.body || {}\n\n  const repository = getRepository(User)\n\n  var user = await repository.findOne({\n    where: { username: email },\n    relations: ['domains']\n  })\n\n  if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n    user = await repository.findOne({\n      where: { email: ILike(email) },\n      relations: ['domains']\n    })\n  }\n\n  if (user) {\n    context.redirect(`/auth/signin?username=${email}`)\n  } else {\n    context.redirect(`/auth/signup?username=${email}&email=${email}`)\n  }\n})\n\nauthPublicProcessRouter.all('/signout', async (context, next) => {\n  const { header, t } = context\n  clearAccessTokenCookie(context)\n\n  context.body = t('text.signout successfully')\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    context.redirect(getSiteRootPath(context))\n  }\n})\n\nauthPublicProcessRouter.get('/forgot-password', async (context, next) => {\n  const { email } = context.request.query\n\n  await context.render('auth-page', {\n    pageElement: 'forgot-password',\n    elementScript: '/auth/forgot-password.js',\n    data: {\n      email,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.get('/reset-password', async (context, next) => {\n  const { token } = context.request.query\n\n  await context.render('auth-page', {\n    pageElement: 'reset-password',\n    elementScript: '/auth/reset-password.js',\n    data: {\n      token,\n      passwordRule,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.get('/unlock-user', async (context, next) => {\n  const { token } = context.request.query\n\n  await context.render('auth-page', {\n    pageElement: 'unlock-user',\n    elementScript: '/auth/unlock-user.js',\n    data: {\n      token,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.get('/activate/:email', async (context, next) => {\n  const { email } = context.params\n\n  await context.render('auth-page', {\n    pageElement: 'auth-activate',\n    elementScript: '/auth/activate.js',\n    data: {\n      email,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.get('/verify/:token', async (context, next) => {\n  const { header, t } = context\n  var token = context.params.token\n\n  await verify(token)\n\n  var message = t('text.user activated successfully')\n\n  context.body = message\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    await context.render('auth-page', {\n      pageElement: 'auth-result',\n      elementScript: '/auth/result.js',\n      data: {\n        message,\n        disableUserSignupProcess,\n        disableUserFavoredLanguage,\n        languages\n      }\n    })\n  }\n})\n\nauthPublicProcessRouter.post('/resend-verification-email', async (context, next) => {\n  const { t } = context\n  const { email } = context.request.body\n\n  var succeed = await resendVerificationEmail(email, context)\n  var message = t('text.verification email sent')\n\n  if (succeed) {\n    context.status = 200\n    context.body = message\n  }\n})\n\nauthPublicProcessRouter.post('/resend-invitation-email', async (context, next) => {\n  const { t } = context\n  const { email, reference, type } = context.request.body\n\n  var succeed = await resendInvitationEmail(\n    {\n      email,\n      reference,\n      type\n    },\n    context\n  )\n\n  var message = t('text.invitation email sent')\n\n  if (succeed) {\n    context.status = 200\n    context.body = message\n  }\n})\n\nauthPublicProcessRouter.post('/forgot-password', async (context, next) => {\n  const { t } = context\n  const { email } = context.request.body\n\n  if (!email) return next()\n\n  const userRepo = getRepository(User)\n  const user = await userRepo.findOne({\n    where: {\n      email\n    }\n  })\n\n  const succeed = await sendPasswordResetEmail({\n    user,\n    context\n  })\n\n  if (succeed) {\n    context.status = 200\n    context.body = t('text.password reset email sent')\n  }\n})\n\nauthPublicProcessRouter.post('/reset-password', async (context, next) => {\n  const { header, t } = context\n  const { password, token } = context.request.body\n\n  try {\n    if (!(token && password)) {\n      let message = t('error.token or password is invalid')\n\n      context.status = 404\n      context.body = {\n        message\n      }\n\n      if (accepts(header.accept, ['text/html', '*/*'])) {\n        await context.render('auth-page', {\n          pageElement: 'reset-password',\n          elementScript: '/auth/reset-password.js',\n          data: {\n            token,\n            message,\n            passwordRule,\n            disableUserSignupProcess,\n            disableUserFavoredLanguage,\n            languages\n          }\n        })\n      }\n\n      return\n    }\n\n    await resetPassword(token, password, context)\n\n    var message = t('text.password changed successfully')\n    context.body = message\n\n    clearAccessTokenCookie(context)\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'auth-result',\n        elementScript: '/auth/result.js',\n        data: {\n          message,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n  } catch (e) {\n    context.status = 404\n    context.body = e.message\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'reset-password',\n        elementScript: '/auth/reset-password.js',\n        data: {\n          token,\n          message: e.message,\n          passwordRule,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n  }\n})\n\nauthPublicProcessRouter.post('/unlock-user', async (context, next) => {\n  const { header, t } = context\n  const { password, token } = context.request.body\n\n  /* Both are required, the way `/auth/reset-password` requires them. This read `||`, so a body\n     carrying a password and no token passed the guard and reached the unlock with no token —\n     see the note in `unlockUser`. */\n  if (!(token && password)) {\n    context.status = 404\n    context.body = t('error.token or password is invalid')\n\n    return\n  }\n\n  const succeed = await unlockUser(token, password)\n\n  /*\n   * Say what happened. The success page used to render whether or not the unlock took, so a\n   * reused link, a token for another account, or an account that was never locked all read as\n   * \"account is reactivated\" — and the person then could not sign in.\n   *\n   * A refusal returns to the form with a reason, the shape `/auth/reset-password` already uses.\n   */\n  if (!succeed) {\n    const message = t('text.invalid verification token')\n\n    context.status = 404\n    context.body = message\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'unlock-user',\n        elementScript: '/auth/unlock-user.js',\n        data: {\n          token,\n          message,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n\n    return\n  }\n\n  context.body = t('text.password reset succeed')\n\n  clearAccessTokenCookie(context)\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    await context.render('auth-page', {\n      pageElement: 'auth-result',\n      elementScript: '/auth/result.js',\n      data: {\n        message: t('text.account is reactivated'),\n        disableUserSignupProcess,\n        disableUserFavoredLanguage,\n        languages\n      }\n    })\n  }\n})\n"]}
+{"version":3,"file":"auth-public-process-router.js","sourceRoot":"","sources":["../../server/router/auth-public-process-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAC/B,qCAA+B;AAE/B,6CAA4C;AAC5C,iDAAsE;AAEtE,gEAA+D;AAC/D,wEAAwF;AACxF,kEAA0D;AAC1D,oEAAgF;AAChF,qDAA8C;AAC9C,oDAA6C;AAC7C,4EAAwE;AAExE,MAAM,wBAAwB,GAAG,YAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;AAC9E,MAAM,0BAA0B,GAAG,YAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;AACvF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;AACrD,MAAM,YAAY,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI;IAC7C,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;IACf,KAAK,EAAE,IAAI;IACX,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,KAAK;IAClB,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,KAAK;IACtB,oBAAoB,EAAE,CAAC;IACvB,oBAAoB,EAAE,EAAE;CACzB,CAAA;AAEY,QAAA,uBAAuB,GAAG,IAAI,oBAAM,CAAC;IAChD,MAAM,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC5D,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAE5C,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IAEtC,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;QAC1B,SAAS,EAAE,CAAC,SAAS,CAAC;KACvB,CAAC,CAAA;IAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAC9B,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC,EAAE;YAC9B,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,QAAQ,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAA;IACpD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,QAAQ,CAAC,yBAAyB,KAAK,UAAU,KAAK,EAAE,CAAC,CAAA;IACnE,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC9D,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;IAE/B,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,2BAA2B,CAAC,CAAA;IAE7C,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,IAAA,uBAAe,EAAC,OAAO,CAAC,CAAC,CAAA;IAC5C,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAA;IAEvC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,iBAAiB;QAC9B,aAAa,EAAE,0BAA0B;QACzC,IAAI,EAAE;YACJ,KAAK;YACL,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACrE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAA;IAEvC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,gBAAgB;QAC7B,aAAa,EAAE,yBAAyB;QACxC,IAAI,EAAE;YACJ,KAAK;YACL,YAAY;YACZ,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAClE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAA;IAEvC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,aAAa;QAC1B,aAAa,EAAE,sBAAsB;QACrC,IAAI,EAAE;YACJ,KAAK;YACL,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;IAEhC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,eAAe;QAC5B,aAAa,EAAE,mBAAmB;QAClC,IAAI,EAAE;YACJ,KAAK;YACL,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACpE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAA;IAEhC,MAAM,IAAA,wBAAM,EAAC,KAAK,CAAC,CAAA;IAEnB,IAAI,OAAO,GAAG,CAAC,CAAC,kCAAkC,CAAC,CAAA;IAEnD,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;IAEtB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YAChC,WAAW,EAAE,aAAa;YAC1B,aAAa,EAAE,iBAAiB;YAChC,IAAI,EAAE;gBACJ,OAAO;gBACP,wBAAwB;gBACxB,0BAA0B;gBAC1B,SAAS;aACV;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACjF,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IACrB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEtC,IAAI,OAAO,GAAG,MAAM,IAAA,yCAAuB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAC3D,IAAI,OAAO,GAAG,CAAC,CAAC,8BAA8B,CAAC,CAAA;IAE/C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;IACxB,CAAC;AACH,CAAC,CAAC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,+BAAuB,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACxE,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,wBAAwB;QACrC,aAAa,EAAE,4BAA4B;QAC3C,IAAI,EAAE;YACJ,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;;GAIG;AACH,+BAAuB,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACzE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAK,EAAU,CAAA;IAE5E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gCAAgB,EAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IAE7F,OAAO,CAAC,IAAI,GAAG;QACb,SAAS,EAAE,MAAM,EAAE,SAAS;QAC5B,OAAO;QACP,UAAU,EAAE,4BAA4B,kBAAkB,CAAC,GAAG,CAAC,EAAE;KAClE,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACvE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IACrB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEtC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,EAAE,CAAA;IAEzB,MAAM,QAAQ,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE;YACL,KAAK;SACN;KACF,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,MAAM,IAAA,0CAAsB,EAAC;QAC3C,IAAI;QACJ,OAAO;KACR,CAAC,CAAA;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,gCAAgC,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEhD,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,CAAC;YACzB,IAAI,OAAO,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;YAErD,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;YACpB,OAAO,CAAC,IAAI,GAAG;gBACb,OAAO;aACR,CAAA;YAED,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBAChC,WAAW,EAAE,gBAAgB;oBAC7B,aAAa,EAAE,yBAAyB;oBACxC,IAAI,EAAE;wBACJ,KAAK;wBACL,OAAO;wBACP,YAAY;wBACZ,wBAAwB;wBACxB,0BAA0B;wBAC1B,SAAS;qBACV;iBACF,CAAC,CAAA;YACJ,CAAC;YAED,OAAM;QACR,CAAC;QAED,MAAM,IAAA,iCAAa,EAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QAE7C,IAAI,OAAO,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;QACrD,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;QAEtB,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;QAE/B,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,aAAa;gBAC1B,aAAa,EAAE,iBAAiB;gBAChC,IAAI,EAAE;oBACJ,OAAO;oBACP,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAA;QAExB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,gBAAgB;gBAC7B,aAAa,EAAE,yBAAyB;gBACxC,IAAI,EAAE;oBACJ,KAAK;oBACL,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,YAAY;oBACZ,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACnE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEhD;;uCAEmC;IACnC,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;QAEtD,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAU,EAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAEjD;;;;;;OAMG;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,CAAC,CAAC,iCAAiC,CAAC,CAAA;QAEpD,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;QAEtB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,aAAa;gBAC1B,aAAa,EAAE,sBAAsB;gBACrC,IAAI,EAAE;oBACJ,KAAK;oBACL,OAAO;oBACP,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;QAED,OAAM;IACR,CAAC;IAED,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,6BAA6B,CAAC,CAAA;IAE/C,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;IAE/B,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YAChC,WAAW,EAAE,aAAa;YAC1B,aAAa,EAAE,iBAAiB;YAChC,IAAI,EAAE;gBACJ,OAAO,EAAE,CAAC,CAAC,6BAA6B,CAAC;gBACzC,wBAAwB;gBACxB,0BAA0B;gBAC1B,SAAS;aACV;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA","sourcesContent":["import Router from 'koa-router'\nimport { ILike } from 'typeorm'\n\nimport { config } from '@things-factory/env'\nimport { getRepository, getSiteRootPath } from '@things-factory/shell'\n\nimport { acceptInvitation } from '../controllers/invitation.js'\nimport { resetPassword, sendPasswordResetEmail } from '../controllers/reset-password.js'\nimport { unlockUser } from '../controllers/unlock-user.js'\nimport { resendVerificationEmail, verify } from '../controllers/verification.js'\nimport { User } from '../service/user/user.js'\nimport { accepts } from '../utils/accepts.js'\nimport { clearAccessTokenCookie } from '../utils/access-token-cookie.js'\n\nconst disableUserSignupProcess = config.get('disableUserSignupProcess', false)\nconst disableUserFavoredLanguage = config.get('i18n/disableUserFavoredLanguage', false)\nconst languages = config.get('i18n/languages', false)\nconst passwordRule = config.get('password') || {\n  lowerCase: true,\n  upperCase: true,\n  digit: true,\n  specialCharacter: true,\n  allowRepeat: false,\n  useTightPattern: true,\n  useLoosePattern: false,\n  tightCharacterLength: 8,\n  looseCharacterLength: 15\n}\n\nexport const authPublicProcessRouter = new Router({\n  prefix: '/auth'\n})\n\nauthPublicProcessRouter.post('/join', async (context, next) => {\n  const { email } = context.request.body || {}\n\n  const repository = getRepository(User)\n\n  var user = await repository.findOne({\n    where: { username: email },\n    relations: ['domains']\n  })\n\n  if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n    user = await repository.findOne({\n      where: { email: ILike(email) },\n      relations: ['domains']\n    })\n  }\n\n  if (user) {\n    context.redirect(`/auth/signin?username=${email}`)\n  } else {\n    context.redirect(`/auth/signup?username=${email}&email=${email}`)\n  }\n})\n\nauthPublicProcessRouter.all('/signout', async (context, next) => {\n  const { header, t } = context\n  clearAccessTokenCookie(context)\n\n  context.body = t('text.signout successfully')\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    context.redirect(getSiteRootPath(context))\n  }\n})\n\nauthPublicProcessRouter.get('/forgot-password', async (context, next) => {\n  const { email } = context.request.query\n\n  await context.render('auth-page', {\n    pageElement: 'forgot-password',\n    elementScript: '/auth/forgot-password.js',\n    data: {\n      email,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.get('/reset-password', async (context, next) => {\n  const { token } = context.request.query\n\n  await context.render('auth-page', {\n    pageElement: 'reset-password',\n    elementScript: '/auth/reset-password.js',\n    data: {\n      token,\n      passwordRule,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.get('/unlock-user', async (context, next) => {\n  const { token } = context.request.query\n\n  await context.render('auth-page', {\n    pageElement: 'unlock-user',\n    elementScript: '/auth/unlock-user.js',\n    data: {\n      token,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.get('/activate/:email', async (context, next) => {\n  const { email } = context.params\n\n  await context.render('auth-page', {\n    pageElement: 'auth-activate',\n    elementScript: '/auth/activate.js',\n    data: {\n      email,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.get('/verify/:token', async (context, next) => {\n  const { header, t } = context\n  var token = context.params.token\n\n  await verify(token)\n\n  var message = t('text.user activated successfully')\n\n  context.body = message\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    await context.render('auth-page', {\n      pageElement: 'auth-result',\n      elementScript: '/auth/result.js',\n      data: {\n        message,\n        disableUserSignupProcess,\n        disableUserFavoredLanguage,\n        languages\n      }\n    })\n  }\n})\n\nauthPublicProcessRouter.post('/resend-verification-email', async (context, next) => {\n  const { t } = context\n  const { email } = context.request.body\n\n  var succeed = await resendVerificationEmail(email, context)\n  var message = t('text.verification email sent')\n\n  if (succeed) {\n    context.status = 200\n    context.body = message\n  }\n})\n\n/*\n * ── The invitation page ─────────────────────────────────────────────────────\n * Public on purpose: the person following this link is not a member of the domain yet, which is\n * the entire point of an invitation. The old link went to `/auth/accept/<token>`, a path with no\n * route on any router, so it fell through to the private history-fallback — and the domain gate\n * there turned the invitee away for not being a member. It asked somebody trying to join to\n * already have joined.\n *\n * ── Why the token is not in this path ───────────────────────────────────────\n * It rides in the link's fragment (`#<token>`), which browsers do not send. So the request line\n * here carries nothing, and the token stays out of access logs, proxy logs and `Referer`. The\n * page reads it from the fragment, clears it from the address bar, and posts it below.\n */\nauthPublicProcessRouter.get('/accept-invitation', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'auth-accept-invitation',\n    elementScript: '/auth/accept-invitation.js',\n    data: {\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\n/*\n * The address is asked for as well as the token. A forwarded mail is the one way the token can\n * still travel, and nothing about where it sits can prevent that — so holding the link is not\n * enough on its own.\n */\nauthPublicProcessRouter.post('/accept-invitation', async (context, next) => {\n  const { token, email, name, password } = context.request.body || ({} as any)\n\n  const { domain, created } = await acceptInvitation({ token, email, name, password, context })\n\n  context.body = {\n    subdomain: domain?.subdomain,\n    created,\n    redirectTo: `/auth/signin?redirect_to=${encodeURIComponent('/')}`\n  }\n})\n\nauthPublicProcessRouter.post('/forgot-password', async (context, next) => {\n  const { t } = context\n  const { email } = context.request.body\n\n  if (!email) return next()\n\n  const userRepo = getRepository(User)\n  const user = await userRepo.findOne({\n    where: {\n      email\n    }\n  })\n\n  const succeed = await sendPasswordResetEmail({\n    user,\n    context\n  })\n\n  if (succeed) {\n    context.status = 200\n    context.body = t('text.password reset email sent')\n  }\n})\n\nauthPublicProcessRouter.post('/reset-password', async (context, next) => {\n  const { header, t } = context\n  const { password, token } = context.request.body\n\n  try {\n    if (!(token && password)) {\n      let message = t('error.token or password is invalid')\n\n      context.status = 404\n      context.body = {\n        message\n      }\n\n      if (accepts(header.accept, ['text/html', '*/*'])) {\n        await context.render('auth-page', {\n          pageElement: 'reset-password',\n          elementScript: '/auth/reset-password.js',\n          data: {\n            token,\n            message,\n            passwordRule,\n            disableUserSignupProcess,\n            disableUserFavoredLanguage,\n            languages\n          }\n        })\n      }\n\n      return\n    }\n\n    await resetPassword(token, password, context)\n\n    var message = t('text.password changed successfully')\n    context.body = message\n\n    clearAccessTokenCookie(context)\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'auth-result',\n        elementScript: '/auth/result.js',\n        data: {\n          message,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n  } catch (e) {\n    context.status = 404\n    context.body = e.message\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'reset-password',\n        elementScript: '/auth/reset-password.js',\n        data: {\n          token,\n          message: e.message,\n          passwordRule,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n  }\n})\n\nauthPublicProcessRouter.post('/unlock-user', async (context, next) => {\n  const { header, t } = context\n  const { password, token } = context.request.body\n\n  /* Both are required, the way `/auth/reset-password` requires them. This read `||`, so a body\n     carrying a password and no token passed the guard and reached the unlock with no token —\n     see the note in `unlockUser`. */\n  if (!(token && password)) {\n    context.status = 404\n    context.body = t('error.token or password is invalid')\n\n    return\n  }\n\n  const succeed = await unlockUser(token, password)\n\n  /*\n   * Say what happened. The success page used to render whether or not the unlock took, so a\n   * reused link, a token for another account, or an account that was never locked all read as\n   * \"account is reactivated\" — and the person then could not sign in.\n   *\n   * A refusal returns to the form with a reason, the shape `/auth/reset-password` already uses.\n   */\n  if (!succeed) {\n    const message = t('text.invalid verification token')\n\n    context.status = 404\n    context.body = message\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'unlock-user',\n        elementScript: '/auth/unlock-user.js',\n        data: {\n          token,\n          message,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n\n    return\n  }\n\n  context.body = t('text.password reset succeed')\n\n  clearAccessTokenCookie(context)\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    await context.render('auth-page', {\n      pageElement: 'auth-result',\n      elementScript: '/auth/result.js',\n      data: {\n        message: t('text.account is reactivated'),\n        disableUserSignupProcess,\n        disableUserFavoredLanguage,\n        languages\n      }\n    })\n  }\n})\n"]}

package/dist-server/router/oauth2/oauth2-router.js

@@ -66,8 +66,13 @@ exports.oauth2Router.post('/refresh-token', async (context, next) => {
             throw new Error('Domain is not found');
         const appKey = decoded.application.appKey;
         const scopes = decoded.scope;
-        const newAccessToken = application_js_1.Application.generateAccessToken(domain, appUser, appKey, scopes);
-        const newRefreshToken = application_js_1.Application.generateRefreshToken(domain, appUser, appKey, scopes);
+        /*
+         * This route reads the key back out of the token rather than holding the application, so it
+         * names the field. The signer takes `{ appKey }` for exactly this reason — see the note on
+         * `Application.sign`.
+         */
+        const newAccessToken = application_js_1.Application.generateAccessToken(domain, appUser, { appKey }, scopes);
+        const newRefreshToken = application_js_1.Application.generateRefreshToken(domain, appUser, { appKey }, scopes);
         appUser.password = newRefreshToken;
         await (0, shell_1.getRepository)(user_js_1.User).save(appUser);
         (0, access_token_cookie_js_1.setAccessTokenCookie)(context, newAccessToken);