@tollwyn/baukasten 0.0.2 → 1.2.2

package/dist/server/pages.js

@@ -0,0 +1,491 @@
+import { fail, redirect } from '@sveltejs/kit';
+import { z } from 'zod';
+import { EmailTaken, normalizeEmail, sha256 } from './accounts.js';
+import { emailField, field, passwordField, problem } from './fields.js';
+import { LIMITS } from './limits.js';
+import { deliver } from './mail.js';
+import { sendLink, signUp } from './services.js';
+import { parseVia } from './via.js';
+import { clearSessionCookie, requireAccount, safeNext, SESSION_COOKIE, setSessionCookie, tooMany } from './web.js';
+/** The marks of the product as the frame shows them: the picture of a shared link at its whole address. */
+export function frameBrand(brand, origin) {
+    if (brand === undefined)
+        return null;
+    return {
+        logo: brand.logo,
+        icon: { href: brand.icon, type: brand.icon.endsWith('.svg') ? 'image/svg+xml' : 'image/png' },
+        image: new URL(brand.image, origin).href
+    };
+}
+const TO = {
+    verifyUnsent: '/verify-email?unsent',
+    accountVerified: '/account?verified',
+    accountEmailChanged: '/account?email-changed',
+    loginVerified: '/login?verified',
+    loginEmailChanged: '/login?email-changed',
+    loggedOut: '/logout',
+    deleted: '/logout?deleted'
+};
+export function createPages(services) {
+    async function logIn(event, s, accountId) {
+        setSessionCookie(event.cookies, await s.accounts.createSession(accountId));
+    }
+    /**
+     * A check of the current password of a logged-in account counts like a login, per account and
+     * before the check, so that a session cannot guess the password; a right one clears the count.
+     */
+    function passwordAttempt(s, account) {
+        const key = `password:${account.id}`;
+        return { seconds: s.limits.take(key, LIMITS.login), passed: () => s.limits.reset(key) };
+    }
+    return {
+        layout: {
+            load: ({ locals, url }) => {
+                const s = services();
+                return {
+                    frame: {
+                        language: s.config.language,
+                        name: s.config.name,
+                        navigation: s.product.navigation,
+                        via: parseVia(url.searchParams.get('via')),
+                        account: locals.account === null
+                            ? null
+                            : { email: locals.account.email, emailVerified: locals.account.emailVerified },
+                        brand: frameBrand(s.product.brand, s.config.publicOrigin)
+                    }
+                };
+            }
+        },
+        imprint: { load: () => ({ legal: services().legal.imprint }) },
+        privacy: { load: () => ({ legal: services().legal.privacy }) },
+        terms: { load: () => ({ legal: services().legal.terms }) },
+        signup: {
+            load: ({ locals, url }) => {
+                const s = services();
+                if (locals.account !== null)
+                    redirect(303, s.product.accounts.home);
+                return {
+                    signup: { ...s.product.accounts.signup, via: parseVia(url.searchParams.get('via')) }
+                };
+            },
+            actions: {
+                default: async (event) => {
+                    const s = services();
+                    const m = s.messages;
+                    const form = await event.request.formData();
+                    const email = field(form, 'email').trim();
+                    const password = field(form, 'password');
+                    const error = problem(emailField(m), email) ??
+                        problem(passwordField(m), password) ??
+                        (field(form, 'terms') === 'accepted' ? null : m.signup.acceptTerms) ??
+                        (field(form, 'business') === 'confirmed' ? null : m.signup.confirmBusiness);
+                    if (error !== null)
+                        return fail(400, { email, error });
+                    const seconds = s.limits.take(`signup:${s.address(event)}`, LIMITS.signup);
+                    if (seconds > 0)
+                        return tooMany(event, seconds, { email, error: m.tooMany(seconds) });
+                    let account;
+                    try {
+                        account = await s.accounts.create({
+                            // The form carries the referral tag of the page; one that is none counts as without.
+                            ...signUp(s, email, parseVia(field(form, 'via'))),
+                            password
+                        });
+                    }
+                    catch (caught) {
+                        if (caught instanceof EmailTaken) {
+                            return fail(409, { email, error: m.signup.taken, taken: true });
+                        }
+                        throw caught;
+                    }
+                    await logIn(event, s, account.id);
+                    const sent = await sendLink(s, account, { purpose: 'verify' });
+                    redirect(303, sent.kind === 'sent' ? s.product.accounts.home : TO.verifyUnsent);
+                }
+            }
+        },
+        login: {
+            load: ({ locals, url }) => {
+                const s = services();
+                if (locals.account !== null) {
+                    redirect(303, safeNext(url.searchParams.get('next'), s.product.accounts.home));
+                }
+                const notice = url.searchParams.has('verified')
+                    ? 'verified'
+                    : url.searchParams.has('email-changed')
+                        ? 'emailChanged'
+                        : null;
+                return { login: { notice } };
+            },
+            actions: {
+                default: async (event) => {
+                    const s = services();
+                    const m = s.messages;
+                    const form = await event.request.formData();
+                    const email = field(form, 'email').trim();
+                    const password = field(form, 'password');
+                    if (problem(emailField(m), email) !== null || password === '' || password.length > 200) {
+                        return fail(400, { email, error: m.login.wrong });
+                    }
+                    // Every try counts before the password is checked: parallel guesses cannot slip by. The
+                    // address counts on its own, against one password tried on many accounts and against
+                    // a flood of scrypt.
+                    const address = s.address(event);
+                    const key = `login:${address}:${sha256(normalizeEmail(email)).toString('hex')}`;
+                    const seconds = Math.max(s.limits.take(`login-address:${address}`, LIMITS.loginAddress), s.limits.take(key, LIMITS.login));
+                    if (seconds > 0)
+                        return tooMany(event, seconds, { email, error: m.tooMany(seconds) });
+                    const account = await s.accounts.authenticate(email, password);
+                    if (account === null)
+                        return fail(400, { email, error: m.login.wrong });
+                    s.limits.reset(key);
+                    await s.accounts.removeExpired();
+                    await logIn(event, s, account.id);
+                    redirect(303, safeNext(event.url.searchParams.get('next'), s.product.accounts.home));
+                }
+            }
+        },
+        logout: {
+            load: ({ locals, url }) => ({
+                logout: { loggedIn: locals.account !== null, deleted: url.searchParams.has('deleted') }
+            }),
+            actions: {
+                default: async ({ cookies }) => {
+                    const token = cookies.get(SESSION_COOKIE);
+                    if (token !== undefined)
+                        await services().accounts.endSession(token);
+                    clearSessionCookie(cookies);
+                    redirect(303, TO.loggedOut);
+                }
+            }
+        },
+        forgotPassword: {
+            actions: {
+                default: async (event) => {
+                    const s = services();
+                    const m = s.messages;
+                    const email = field(await event.request.formData(), 'email').trim();
+                    const error = problem(emailField(m), email);
+                    if (error !== null)
+                        return fail(400, { email, error });
+                    const seconds = s.limits.take(`forgot:${s.address(event)}`, LIMITS.forgotPassword);
+                    if (seconds > 0)
+                        return tooMany(event, seconds, { email, error: m.tooMany(seconds) });
+                    // The answer is the same with or without an account, as fast, and when the mail did
+                    // not go: the link goes out after the answer, and a failure is in the log.
+                    const account = await s.accounts.findByEmail(email);
+                    if (account !== null) {
+                        sendLink(s, account, { purpose: 'reset' }).catch((error) => {
+                            s.log.error('mail failed', { kind: 'reset', account: account.id, error });
+                        });
+                    }
+                    return { email, sent: true };
+                }
+            }
+        },
+        resetPassword: {
+            load: async ({ url }) => {
+                const token = url.searchParams.get('token');
+                if (token === null)
+                    return { reset: { token: '', valid: false } };
+                const valid = (await services().accounts.peekLink(token, 'reset')) !== null;
+                return { reset: { token, valid } };
+            },
+            actions: {
+                default: async (event) => {
+                    const s = services();
+                    const m = s.messages;
+                    const form = await event.request.formData();
+                    const password = field(form, 'password');
+                    const error = problem(passwordField(m), password);
+                    if (error !== null)
+                        return fail(400, { error });
+                    const accountId = await s.accounts.resetPassword(field(form, 'token'), password);
+                    if (accountId === null)
+                        return fail(400, { error: m.link.invalid });
+                    await s.accounts.removeExpired();
+                    await logIn(event, s, accountId);
+                    redirect(303, s.product.accounts.home);
+                }
+            }
+        },
+        /**
+         * The link of the mail opens a page with a button instead of confirming on GET, so that a mail
+         * scanner that opens links does not use it up. Confirming never logs into an account that has
+         * a password: whoever holds a mistyped address must not get in. An account from the API has
+         * none; it may set one here and is logged in.
+         */
+        verifyEmail: {
+            load: async ({ locals, url }) => {
+                const token = url.searchParams.get('token');
+                if (token !== null) {
+                    const use = await services().accounts.peekLink(token, 'verify');
+                    return {
+                        verify: {
+                            kind: 'link',
+                            token,
+                            valid: use !== null,
+                            needsPassword: use !== null && !use.hasPassword
+                        }
+                    };
+                }
+                if (locals.account === null)
+                    return { verify: { kind: 'none' } };
+                if (locals.account.emailVerified)
+                    return { verify: { kind: 'confirmed' } };
+                return {
+                    verify: {
+                        kind: 'pending',
+                        email: locals.account.email,
+                        unsent: url.searchParams.has('unsent')
+                    }
+                };
+            },
+            actions: {
+                confirm: async (event) => {
+                    const s = services();
+                    const m = s.messages;
+                    const form = await event.request.formData();
+                    const password = field(form, 'password');
+                    if (password !== '') {
+                        const error = problem(passwordField(m), password);
+                        if (error !== null)
+                            return fail(400, { error });
+                    }
+                    const use = await s.accounts.confirmEmail(field(form, 'token'), password === '' ? null : password);
+                    if (use === null)
+                        return fail(400, { error: m.link.invalid });
+                    if (event.locals.account !== null && event.locals.account.id === use.accountId) {
+                        redirect(303, TO.accountVerified);
+                    }
+                    if (use.hasPassword)
+                        redirect(303, TO.loginVerified);
+                    await logIn(event, s, use.accountId);
+                    redirect(303, TO.accountVerified);
+                },
+                resend: async (event) => {
+                    const s = services();
+                    const account = requireAccount(event);
+                    if (account.emailVerified)
+                        redirect(303, '/verify-email');
+                    const sent = await sendLink(s, account, { purpose: 'verify' });
+                    switch (sent.kind) {
+                        case 'limited':
+                            return tooMany(event, sent.seconds, { error: s.messages.tooMany(sent.seconds) });
+                        case 'failed':
+                            return fail(502, { error: s.messages.mailFailed });
+                        case 'sent':
+                            return { resent: account.email };
+                    }
+                }
+            }
+        },
+        confirmEmail: {
+            load: async ({ url }) => {
+                const token = url.searchParams.get('token');
+                if (token === null)
+                    return { confirm: { token: '', newEmail: null } };
+                const use = await services().accounts.peekLink(token, 'change_email');
+                return { confirm: { token, newEmail: use === null ? null : use.newEmail } };
+            },
+            actions: {
+                default: async (event) => {
+                    const s = services();
+                    const result = await s.accounts.confirmEmailChange(field(await event.request.formData(), 'token'));
+                    switch (result.kind) {
+                        case 'invalid':
+                            return fail(400, { error: s.messages.link.invalid });
+                        case 'taken':
+                            return fail(409, { error: s.messages.account.taken });
+                        case 'changed': {
+                            // The address has changed; a notice that did not go is in the log.
+                            const notice = s.messages.mails.changed({
+                                name: s.config.name,
+                                origin: s.config.publicOrigin,
+                                newEmail: result.newEmail
+                            });
+                            await deliver(s.mail, s.log, { to: result.oldEmail, ...notice }, { kind: 'email_changed', account: result.accountId });
+                            // The address has changed; receipts that still go to the old one are in the log.
+                            await s.billing
+                                .followEmail(result.accountId, result.newEmail)
+                                .catch((error) => {
+                                s.log.error('stripe: the customer kept the old address', {
+                                    account: result.accountId,
+                                    error
+                                });
+                            });
+                            const own = event.locals.account !== null && event.locals.account.id === result.accountId;
+                            redirect(303, own ? TO.accountEmailChanged : TO.loginEmailChanged);
+                        }
+                    }
+                }
+            }
+        },
+        account: {
+            load: async (event) => {
+                const s = services();
+                const account = requireAccount(event);
+                const keys = await s.accounts.listApiKeys(account.id);
+                const customer = await s.billing.hasCustomer(account.id);
+                const notice = event.url.searchParams.has('verified')
+                    ? 'verified'
+                    : event.url.searchParams.has('email-changed')
+                        ? 'emailChanged'
+                        : null;
+                return {
+                    account: {
+                        email: account.email,
+                        emailVerified: account.emailVerified,
+                        hasPassword: account.hasPassword,
+                        keyExample: `${s.product.accounts.keyPrefix}_…`,
+                        customer,
+                        keys: keys.map((key) => ({
+                            id: key.id,
+                            name: key.name,
+                            prefix: key.prefix,
+                            created: key.createdAt.toISOString().slice(0, 10)
+                        })),
+                        notice
+                    }
+                };
+            },
+            actions: {
+                // Only a confirmed address makes keys: a key of an address not one's own would outlast
+                // the day its owner takes the account.
+                createKey: async (event) => {
+                    const s = services();
+                    const account = requireAccount(event);
+                    if (!account.emailVerified) {
+                        return fail(403, {
+                            action: 'createKey',
+                            error: s.messages.account.confirmFirst
+                        });
+                    }
+                    const typed = field(await event.request.formData(), 'name')
+                        .trim()
+                        .slice(0, 80);
+                    const name = typed === '' ? s.messages.account.keyName : typed;
+                    const { key } = await s.accounts.createApiKey(account.id, name, s.product.accounts.keyPrefix);
+                    return { action: 'createKey', key };
+                },
+                revokeKey: async (event) => {
+                    const s = services();
+                    const account = requireAccount(event);
+                    const id = field(await event.request.formData(), 'id');
+                    if (z.uuid().safeParse(id).success)
+                        await s.accounts.revokeApiKey(account.id, id);
+                    return { action: 'revokeKey' };
+                },
+                changePassword: async (event) => {
+                    const s = services();
+                    const m = s.messages;
+                    const account = requireAccount(event);
+                    const form = await event.request.formData();
+                    const next = field(form, 'next');
+                    const error = problem(passwordField(m), next);
+                    if (error !== null)
+                        return fail(400, { action: 'changePassword', error });
+                    const attempt = passwordAttempt(s, account);
+                    if (attempt.seconds > 0) {
+                        return tooMany(event, attempt.seconds, {
+                            action: 'changePassword',
+                            error: m.tooMany(attempt.seconds)
+                        });
+                    }
+                    const current = account.hasPassword ? field(form, 'current') : null;
+                    if (!(await s.accounts.changePassword(account.id, current, next))) {
+                        return fail(400, { action: 'changePassword', error: m.account.wrongCurrent });
+                    }
+                    attempt.passed();
+                    const token = event.cookies.get(SESSION_COOKIE);
+                    if (token === undefined)
+                        throw new Error('an account without the cookie of its session');
+                    await s.accounts.endOtherSessions(account.id, token);
+                    return { action: 'changePassword', done: true };
+                },
+                changeEmail: async (event) => {
+                    const s = services();
+                    const m = s.messages;
+                    const account = requireAccount(event);
+                    const form = await event.request.formData();
+                    const email = field(form, 'email').trim();
+                    const failed = (status, error) => fail(status, { action: 'changeEmail', email, error });
+                    const error = problem(emailField(m), email);
+                    if (error !== null)
+                        return failed(400, error);
+                    if (normalizeEmail(email) === account.email)
+                        return failed(400, m.account.sameEmail);
+                    if (account.hasPassword) {
+                        const attempt = passwordAttempt(s, account);
+                        if (attempt.seconds > 0) {
+                            return tooMany(event, attempt.seconds, {
+                                action: 'changeEmail',
+                                email,
+                                error: m.tooMany(attempt.seconds)
+                            });
+                        }
+                        if ((await s.accounts.authenticate(account.email, field(form, 'password'))) === null) {
+                            return failed(400, m.account.wrongPassword);
+                        }
+                        attempt.passed();
+                    }
+                    const seconds = s.limits.take(`email-change:${account.id}`, LIMITS.emailChange);
+                    if (seconds > 0) {
+                        return tooMany(event, seconds, {
+                            action: 'changeEmail',
+                            email,
+                            error: m.tooMany(seconds)
+                        });
+                    }
+                    if ((await s.accounts.findByEmail(email)) !== null)
+                        return failed(409, m.account.taken);
+                    const sent = await sendLink(s, account, { purpose: 'change_email', newEmail: email });
+                    switch (sent.kind) {
+                        case 'limited':
+                            return tooMany(event, sent.seconds, {
+                                action: 'changeEmail',
+                                email,
+                                error: m.tooMany(sent.seconds)
+                            });
+                        case 'failed':
+                            return failed(502, m.mailFailed);
+                        case 'sent':
+                            return {
+                                action: 'changeEmail',
+                                email: '',
+                                sentTo: normalizeEmail(email)
+                            };
+                    }
+                },
+                /**
+                 * Only a customer has a portal; opening it must not make one, which with the live key
+                 * makes the account live.
+                 */
+                portal: async (event) => {
+                    const s = services();
+                    const account = requireAccount(event);
+                    if (!(await s.billing.hasCustomer(account.id)))
+                        redirect(303, '/account');
+                    redirect(303, await s.billing.portal(account, '/account'));
+                },
+                delete: async (event) => {
+                    const s = services();
+                    const account = requireAccount(event);
+                    const typed = normalizeEmail(field(await event.request.formData(), 'confirm'));
+                    if (typed !== account.email) {
+                        return fail(400, {
+                            action: 'delete',
+                            error: s.messages.account.confirmDelete
+                        });
+                    }
+                    // A deleted account pays for nothing: its subscriptions end first, and a failure at
+                    // Stripe leaves the account as it is.
+                    await s.billing.endSubscriptions(account.id);
+                    await s.accounts.delete(account.id, s.deleteHook);
+                    clearSessionCookie(event.cookies);
+                    redirect(303, TO.deleted);
+                }
+            }
+        }
+    };
+}