@vonall/auth 0.0.0-stage → 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,12 @@
+# @vonall/auth
+
+## 0.1.0
+
+### Minor Changes
+
+- schema: the first release, the server side: `createAuth()` (better-auth with the signup hooks, the Einladung, the mails, Admin as an option), `authSchema()` with the tables (`user`, `session`, `account`, `verification`, `twoFactor`, `rate_limit`, `einladung`; the OAuth provider's with `mcp`), the `protected…`/`admin…` helpers, the remote functions of accounts and Einladungen, the route loads, `createAuthClient()`, the test helpers.
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @vonall/mail@0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 SebädrHecht
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,34 @@
-# Temporary Holding Version
+# @vonall/auth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Accounts for a Web App Factory Product: better-auth with the signup hooks (signup modes `invite`, `open`, `admin`;
+the first account is the admin), Einladungen, Konto, the three account mails, the `protected…`/`admin…` helpers for
+remote functions, the remote functions of accounts and Einladungen, the auth routes' `load`s; Admin as an option.
+The pages and the settings tabs follow in a later release.
+
+```ts
+// src/lib/remote/schema/auth.sql.ts: the tables, re-exported so drizzle-kit sees them (the Product keeps the migrations)
+import { authSchema } from "@vonall/auth/schema";
+export const schema = authSchema({ admin: true, mcp: true });
+export const { user, session, account, verification, twoFactor, rateLimit, einladung } = schema;
+
+// src/lib/auth.ts: the wiring, once
+import { createAuth } from "@vonall/auth/server";
+export const { auth, handle: sessionHandle, apiHandler } = createAuth({
+	db, schema, secret: BETTER_AUTH_SECRET, origin: ORIGIN, appName: APP_NAME, locale: LOCALE, signupMode: SIGNUP_MODE,
+	mailer, admin: true, social: { github: { clientId, clientSecret } }, log: logger,
+});
+
+// src/hooks.server.ts            sequence(securityHeaders, sessionHandle)
+// src/routes/api/auth/[...auth]  export const GET = apiHandler, POST = apiHandler
+// src/routes/auth/login          export { loginLoad as load } from "@vonall/auth/server"
+// src/app.d.ts                   user: AuthUser | null; session: AuthSession | null  (from "@vonall/auth/server")
+// src/lib/auth-client.ts         createAuthClient({ baseURL: PUBLIC_ORIGIN, admin: true })  (from "@vonall/auth/client")
+```
+
+Entry points: `@vonall/auth` (types, validation schemas, `isAdmin`, `mayInvite`, the fresh-session helpers, the
+messages), `@vonall/auth/schema`, `@vonall/auth/server`, `@vonall/auth/client`, `@vonall/auth/remote` (the remote
+functions a Product's components call), `@vonall/auth/testing` (`createUser`, `testAuth` for db tests).
+
+Strings come in English and German: `configureAuthMessages({ locale, overrides })`. A Product's own user-owned tables
+reference `user.id` with `onDelete: "cascade"`, so deleting a Konto takes everything with it. The MCP endpoint's
+better-auth plugins and rate limit rule come from `@vonall/mcp` through `plugins` and `rateLimitRules`.

package/dist/client/index.d.ts

@@ -0,0 +1,17 @@
+import { createAuthClient as createClient } from "better-auth/svelte";
+type ClientPlugin = NonNullable<Parameters<typeof createClient>[0]>["plugins"] extends (infer P)[] | undefined ? P : never;
+export type CreateAuthClientOptions = {
+    /** PUBLIC_ORIGIN. */
+    baseURL: string;
+    /** The Admin option (matches the server). */
+    admin?: boolean;
+    /** More client plugins, e.g. the MCP endpoint's (`@vonall/mcp/client`). */
+    plugins?: ClientPlugin[];
+};
+declare function build({ baseURL, admin, plugins }: CreateAuthClientOptions): import("better-auth/svelte").SvelteAuthClient<{
+    baseURL: string;
+    plugins: any[];
+}>;
+export type AuthClient = ReturnType<typeof build>;
+export declare function createAuthClient(options: CreateAuthClientOptions): AuthClient;
+export {};

package/dist/client/index.js

@@ -0,0 +1,18 @@
+/** The better-auth client for a Product's browser code; `src/lib/auth-client.ts` creates it once. */
+import { adminClient, twoFactorClient } from "better-auth/client/plugins";
+import { createAuthClient as createClient } from "better-auth/svelte";
+import { ac, roles } from "../permissions.js";
+function build({ baseURL, admin = false, plugins = [] }) {
+    return createClient({
+        baseURL: baseURL || "http://localhost:5173",
+        plugins: [
+            twoFactorClient(),
+            // The admin client's types are part of the client's type whether or not the option is on
+            ...(admin ? [adminClient({ ac, roles })] : []),
+            ...plugins,
+        ],
+    });
+}
+export function createAuthClient(options) {
+    return build(options);
+}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { configureAuthMessages, m, type AuthMessages, type Locale } from "./messages.js";
+export { ac, adminRole, roles, userRole } from "./permissions.js";
+export { emailSchema, MIN_PASSWORD_LENGTH, nameSchema, passwordSchema, SIGNUP_MODES, SIGNUP_STATES, type AppUserClient, type EinladungInfo, type OffeneEinladung, type SessionUser, type SignupMode, type SignupState, type UserInsert, type UserSelect, } from "./types.js";
+export { isSessionNotFresh, isStale, reauthPath, SESSION_NOT_FRESH } from "./util/fresh.js";
+export { messageOf } from "./util/messageOf.js";
+export { displayInitials, displayName, nameFromEmail } from "./util/names.js";
+export { sameSitePath } from "./util/sameSite.js";
+export { isAdmin, mayInvite, signupState } from "./util/signup.js";

package/dist/index.js

@@ -0,0 +1,10 @@
+// What both the browser and the server may import; the server side is `@vonall/auth/server`, the browser's client
+// `@vonall/auth/client`, the remote functions `@vonall/auth/remote`, the tables `@vonall/auth/schema`.
+export { configureAuthMessages, m } from "./messages.js";
+export { ac, adminRole, roles, userRole } from "./permissions.js";
+export { emailSchema, MIN_PASSWORD_LENGTH, nameSchema, passwordSchema, SIGNUP_MODES, SIGNUP_STATES, } from "./types.js";
+export { isSessionNotFresh, isStale, reauthPath, SESSION_NOT_FRESH } from "./util/fresh.js";
+export { messageOf } from "./util/messageOf.js";
+export { displayInitials, displayName, nameFromEmail } from "./util/names.js";
+export { sameSitePath } from "./util/sameSite.js";
+export { isAdmin, mayInvite, signupState } from "./util/signup.js";

package/dist/messages.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The package's strings, in English and German (Swiss spelling): what the server answers, what the mails say, and
+ * (from the UI release on) what the pages show. A Product calls configureAuthMessages once, from a module its root
+ * layout and its server wiring import, with its LOCALE and the few words it wants differently; code reads `m()`.
+ */
+export declare const en: {
+    needsEinladung: string;
+    noMail: string;
+    onlyAdminsInvite: string;
+    einladungUnbekannt: string;
+    einladungAbgelaufen: string;
+    einladungAngenommen: string;
+    unauthorized: string;
+    forbidden: string;
+    ownRole: string;
+    ownAccount: string;
+    passwordsMismatch: string;
+    mailFailed: string;
+    invalidEmail: string;
+    passwordTooShort: (min: number) => string;
+    nameRequired: string;
+    nameTooLong: (max: number) => string;
+    hello: (name: string) => string;
+    resetSubject: (app: string) => string;
+    resetText: (name: string, app: string, link: string) => string;
+    resetButton: string;
+    resetBody: (app: string) => string;
+    resetNotYou: string;
+    verifySubject: (app: string) => string;
+    verifyText: (name: string, app: string, link: string) => string;
+    verifyButton: string;
+    verifyBody: (app: string) => string;
+    verifyNotYou: string;
+    einladungSubject: (inviter: string, app: string) => string;
+    einladungText: (inviter: string, app: string, link: string, validUntil: string) => string;
+    einladungTitle: (app: string) => string;
+    einladungButton: string;
+    einladungHello: string;
+    einladungBody: (inviter: string, app: string) => string;
+    einladungValid: (validUntil: string) => string;
+};
+export type AuthMessages = typeof en;
+export declare const de: AuthMessages;
+export type Locale = "en" | "de";
+export declare function configureAuthMessages({ locale, overrides }: {
+    locale: Locale;
+    overrides?: Partial<AuthMessages>;
+}): void;
+/** The configured messages. */
+export declare const m: () => AuthMessages;

package/dist/messages.js

@@ -0,0 +1,88 @@
+/**
+ * The package's strings, in English and German (Swiss spelling): what the server answers, what the mails say, and
+ * (from the UI release on) what the pages show. A Product calls configureAuthMessages once, from a module its root
+ * layout and its server wiring import, with its LOCALE and the few words it wants differently; code reads `m()`.
+ */
+export const en = {
+    // Signup
+    needsEinladung: "Signing up needs an invitation",
+    noMail: "Accounts can't be created at the moment",
+    onlyAdminsInvite: "Only admins can invite people",
+    // Einladung
+    einladungUnbekannt: "This invitation does not exist (any more)",
+    einladungAbgelaufen: "This invitation has expired",
+    einladungAngenommen: "This invitation has already been used",
+    // Remote functions
+    unauthorized: "Unauthorized",
+    forbidden: "Forbidden",
+    ownRole: "You can't change your own role",
+    ownAccount: "Delete your own account under Settings",
+    passwordsMismatch: "The passwords don't match",
+    mailFailed: "The email could not be sent",
+    // Validation
+    invalidEmail: "Please enter a valid email address",
+    passwordTooShort: (min) => `The password needs at least ${min} characters`,
+    nameRequired: "Name is required",
+    nameTooLong: (max) => `At most ${max} characters`,
+    // Mails: subjects, plain-text bodies (the footer carries the app's name) and the HTML templates' strings
+    hello: (name) => `Hello ${name || "there"},`,
+    resetSubject: (app) => `Reset your password - ${app}`,
+    resetText: (name, app, link) => `${en.hello(name)}\n\nYou asked for a new password for ${app}. Set it here:\n\n${link}\n\nIf that wasn't you, just ignore this email.\n`,
+    resetButton: "Reset your password",
+    resetBody: (app) => `You asked for a new password for ${app}. The button below lets you set it:`,
+    resetNotYou: "If that wasn't you, just ignore this email; your password stays as it is.",
+    verifySubject: (app) => `Confirm your email address - ${app}`,
+    verifyText: (name, app, link) => `${en.hello(name)}\n\nYou created an account at ${app}. Confirm that this address is yours:\n\n${link}\n\nIf that wasn't you, just ignore this email.\n`,
+    verifyButton: "Confirm your email address",
+    verifyBody: (app) => `You created an account at ${app}. Confirm that this address is yours to start using it:`,
+    verifyNotYou: "If that wasn't you, just ignore this email; without the confirmation the account can't be used.",
+    einladungSubject: (inviter, app) => `${inviter || "Someone"} invites you to ${app}`,
+    einladungText: (inviter, app, link, validUntil) => `Hello,\n\n${inviter || "Someone"} invites you to ${app}.\n\nAccept the invitation: ${link}\n\nThe link works once and is valid until ${validUntil}.\n`,
+    einladungTitle: (app) => `Invitation to ${app}`,
+    einladungButton: "Accept the invitation",
+    einladungHello: "Hello,",
+    einladungBody: (inviter, app) => `${inviter || "Someone"} invites you to ${app}.`,
+    einladungValid: (validUntil) => `The link works once and is valid until ${validUntil}.`,
+};
+export const de = {
+    needsEinladung: "Zum Registrieren braucht es eine Einladung",
+    noMail: "Im Moment können keine Konten erstellt werden",
+    onlyAdminsInvite: "Nur die Verwaltung kann Leute einladen",
+    einladungUnbekannt: "Diese Einladung gibt es nicht (mehr)",
+    einladungAbgelaufen: "Diese Einladung ist abgelaufen",
+    einladungAngenommen: "Diese Einladung wurde schon verwendet",
+    unauthorized: "Nicht angemeldet",
+    forbidden: "Nicht erlaubt",
+    ownRole: "Die eigene Rolle lässt sich nicht ändern",
+    ownAccount: "Das eigene Konto löschst du in den Einstellungen",
+    passwordsMismatch: "Die Passwörter stimmen nicht überein",
+    mailFailed: "Die E-Mail konnte nicht verschickt werden",
+    invalidEmail: "Bitte gib eine gültige E-Mail-Adresse ein",
+    passwordTooShort: (min) => `Das Passwort braucht mindestens ${min} Zeichen`,
+    nameRequired: "Der Name fehlt",
+    nameTooLong: (max) => `Höchstens ${max} Zeichen`,
+    hello: (name) => (name ? `Hallo ${name}` : "Hallo"),
+    resetSubject: (app) => `Passwort zurücksetzen – ${app}`,
+    resetText: (name, app, link) => `${de.hello(name)}\n\nDu hast ein neues Passwort für ${app} angefordert. Hier legst du es fest:\n\n${link}\n\nWarst du das nicht, ignoriere diese E-Mail einfach.\n`,
+    resetButton: "Passwort zurücksetzen",
+    resetBody: (app) => `Du hast ein neues Passwort für ${app} angefordert. Mit dem Knopf unten legst du es fest:`,
+    resetNotYou: "Warst du das nicht, ignoriere diese E-Mail einfach; dein Passwort bleibt, wie es ist.",
+    verifySubject: (app) => `E-Mail-Adresse bestätigen – ${app}`,
+    verifyText: (name, app, link) => `${de.hello(name)}\n\nDu hast ein Konto bei ${app} erstellt. Bestätige, dass diese Adresse dir gehört:\n\n${link}\n\nWarst du das nicht, ignoriere diese E-Mail einfach.\n`,
+    verifyButton: "E-Mail-Adresse bestätigen",
+    verifyBody: (app) => `Du hast ein Konto bei ${app} erstellt. Bestätige, dass diese Adresse dir gehört, um loszulegen:`,
+    verifyNotYou: "Warst du das nicht, ignoriere diese E-Mail einfach; ohne Bestätigung lässt sich das Konto nicht nutzen.",
+    einladungSubject: (inviter, app) => `${inviter || "Jemand"} lädt dich zu ${app} ein`,
+    einladungText: (inviter, app, link, validUntil) => `Hallo\n\n${inviter || "Jemand"} lädt dich zu ${app} ein.\n\nEinladung annehmen: ${link}\n\nDer Link funktioniert einmal und ist bis ${validUntil} gültig.\n`,
+    einladungTitle: (app) => `Einladung zu ${app}`,
+    einladungButton: "Einladung annehmen",
+    einladungHello: "Hallo",
+    einladungBody: (inviter, app) => `${inviter || "Jemand"} lädt dich zu ${app} ein.`,
+    einladungValid: (validUntil) => `Der Link funktioniert einmal und ist bis ${validUntil} gültig.`,
+};
+let current = en;
+export function configureAuthMessages({ locale, overrides }) {
+    current = { ...(locale === "de" ? de : en), ...overrides };
+}
+/** The configured messages. */
+export const m = () => current;

package/dist/permissions.d.ts

@@ -0,0 +1,48 @@
+export declare const ac: {
+    newRole<const TRoleStatements extends import("better-auth/plugins").Statements>(statements: import("better-auth/plugins").RoleInput<{
+        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+        readonly session: readonly ["list", "revoke", "delete"];
+    }, TRoleStatements>): import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<TRoleStatements>, {
+        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+        readonly session: readonly ["list", "revoke", "delete"];
+    }>;
+    statements: {
+        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+        readonly session: readonly ["list", "revoke", "delete"];
+    };
+};
+/**
+ * The app admin manages accounts but can't act as or take over a friend's account: no impersonation, no setting a
+ * password or an email, no creating accounts (signup only through an Einladung).
+ */
+export declare const adminRole: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
+    readonly user: ["list", "get", "set-role", "ban", "delete"];
+    readonly session: ["list", "revoke"];
+}>, {
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+    readonly session: readonly ["list", "revoke", "delete"];
+}>;
+export declare const userRole: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
+    readonly user: [];
+    readonly session: [];
+}>, {
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+    readonly session: readonly ["list", "revoke", "delete"];
+}>;
+/** The roles as better-auth's admin plugin and client take them. */
+export declare const roles: {
+    admin: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
+        readonly user: ["list", "get", "set-role", "ban", "delete"];
+        readonly session: ["list", "revoke"];
+    }>, {
+        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+        readonly session: readonly ["list", "revoke", "delete"];
+    }>;
+    user: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
+        readonly user: [];
+        readonly session: [];
+    }>, {
+        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+        readonly session: readonly ["list", "revoke", "delete"];
+    }>;
+};

package/dist/permissions.js

@@ -0,0 +1,17 @@
+import { createAccessControl } from "better-auth/plugins/access";
+import { defaultStatements } from "better-auth/plugins/admin/access";
+export const ac = createAccessControl(defaultStatements);
+/**
+ * The app admin manages accounts but can't act as or take over a friend's account: no impersonation, no setting a
+ * password or an email, no creating accounts (signup only through an Einladung).
+ */
+export const adminRole = ac.newRole({
+    user: ["list", "get", "set-role", "ban", "delete"],
+    session: ["list", "revoke"],
+});
+export const userRole = ac.newRole({
+    user: [],
+    session: [],
+});
+/** The roles as better-auth's admin plugin and client take them. */
+export const roles = { admin: adminRole, user: userRole };

package/dist/remote/app_user.remote.d.ts

@@ -0,0 +1,66 @@
+/** The Admin option: every account. */
+export declare const getAllUsers: import("$app/server").RemoteQueryFunction<void, {
+    id: string;
+    name: string;
+    email: string;
+    image: string | null;
+    emailVerified: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+    twoFactorEnabled: boolean | null;
+    role: string;
+    banned: boolean;
+    banReason: string | null;
+    banExpires: Date | null;
+}[], void>;
+export declare const updateUserProfile: import("$app/server").RemoteForm<import("$app/server").RemoteFormInput, {
+    success: boolean;
+}>;
+export declare const changePassword: import("$app/server").RemoteForm<import("$app/server").RemoteFormInput, {
+    success: boolean;
+}>;
+export declare const setPassword: import("$app/server").RemoteForm<import("$app/server").RemoteFormInput, {
+    success: boolean;
+}>;
+export declare const getSessions: import("$app/server").RemoteQueryFunction<void, import("better-auth").Prettify<{
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    userId: string;
+    expiresAt: Date;
+    token: string;
+    ipAddress?: string | null | undefined | undefined;
+    userAgent?: string | null | undefined | undefined;
+    impersonatedBy?: string | null | undefined;
+}>[], void>;
+export declare const revokeSessionById: import("$app/server").RemoteCommand<{
+    sessionId: string;
+}, {
+    success: boolean;
+    isCurrentSession: boolean;
+}>;
+export declare const revokeOthers: import("$app/server").RemoteCommand<void, {
+    success: boolean;
+}>;
+export declare const getLinkedAccounts: import("$app/server").RemoteQueryFunction<void, {
+    id: string;
+    providerId: string;
+    updatedAt: Date;
+}[], void>;
+/** The Admin option. */
+export declare const setUserRole: import("$app/server").RemoteCommand<{
+    userId: string;
+    role: "user" | "admin";
+}, {
+    success: boolean;
+}>;
+/** The Admin option: the admin deletes another account with all its data. */
+export declare const deleteUser: import("$app/server").RemoteCommand<{
+    userId: string;
+}, {
+    success: boolean;
+}>;
+/** Deletes the user's own account with all its data. */
+export declare const deleteOwnAccount: import("$app/server").RemoteCommand<void, {
+    success: boolean;
+}>;

package/dist/remote/app_user.remote.js

@@ -0,0 +1,91 @@
+import { error, redirect } from "@sveltejs/kit";
+import { getRequestEvent } from "$app/server";
+import { z } from "zod";
+import { m } from "../messages.js";
+import { adminQuery, adminSchemaCommand, protectedCommand, protectedForm, protectedQuery, protectedSchemaCommand } from "../server/helpers.js";
+import { registry } from "../server/registry.js";
+import { UserRepo } from "../server/repositories/UserRepo.js";
+import { KontoService } from "../server/service/konto.service.js";
+import { emailSchema, nameSchema, passwordSchema } from "../types.js";
+import { isSessionNotFresh, reauthPath } from "../util/fresh.js";
+/** The Admin option: every account. */
+export const getAllUsers = adminQuery(async () => {
+    return await UserRepo.getAllUsers();
+});
+export const updateUserProfile = protectedForm(z.object({ name: nameSchema, email: emailSchema }), async (data, _issue, user) => {
+    const { auth } = registry();
+    const event = getRequestEvent();
+    if (data.email !== user.email) {
+        await auth.api.changeEmail({ body: { newEmail: data.email }, headers: event.request.headers });
+    }
+    await auth.api.updateUser({ body: { name: data.name }, headers: event.request.headers });
+    return { success: true };
+});
+const passwordPair = { newPassword: passwordSchema, confirmPassword: z.string() };
+const passwordsMatch = { error: () => m().passwordsMismatch, path: ["confirmPassword"] };
+export const changePassword = protectedForm(z.object({ currentPassword: passwordSchema, ...passwordPair }).refine((d) => d.newPassword === d.confirmPassword, passwordsMatch), async (data) => {
+    const event = getRequestEvent();
+    await registry().auth.api.changePassword({
+        body: { currentPassword: data.currentPassword, newPassword: data.newPassword, revokeOtherSessions: true },
+        headers: event.request.headers,
+    });
+    return { success: true };
+});
+export const setPassword = protectedForm(z.object(passwordPair).refine((d) => d.newPassword === d.confirmPassword, passwordsMatch), async (data) => {
+    const event = getRequestEvent();
+    await registry().auth.api.setPassword({ body: { newPassword: data.newPassword }, headers: event.request.headers });
+    return { success: true };
+});
+export const getSessions = protectedQuery(async () => {
+    const event = getRequestEvent();
+    try {
+        return await registry().auth.api.listSessions({ headers: event.request.headers });
+    }
+    catch (e) {
+        // Only a login from the last day may list the sessions; the sessions are in the settings
+        if (isSessionNotFresh(e))
+            redirect(303, reauthPath("/home/settings?tab=sessions"));
+        throw e;
+    }
+});
+export const revokeSessionById = protectedSchemaCommand(z.object({ sessionId: z.string() }), async (data) => {
+    const event = getRequestEvent();
+    const currentSessionToken = event.locals.session?.token;
+    await registry().auth.api.revokeSession({ body: { token: data.sessionId }, headers: event.request.headers });
+    const isCurrentSession = data.sessionId === currentSessionToken;
+    if (!isCurrentSession)
+        await getSessions().refresh();
+    return { success: true, isCurrentSession };
+});
+export const revokeOthers = protectedCommand(async () => {
+    const event = getRequestEvent();
+    await registry().auth.api.revokeOtherSessions({ headers: event.request.headers });
+    await getSessions().refresh();
+    return { success: true };
+});
+export const getLinkedAccounts = protectedQuery(async (user) => {
+    return await UserRepo.getUserAccounts(user.id);
+});
+/** The Admin option. */
+export const setUserRole = adminSchemaCommand(z.object({ userId: z.string(), role: z.enum(["admin", "user"]) }), async ({ userId, role }, admin) => {
+    if (userId === admin.id) {
+        throw error(400, { message: m().ownRole, id: "own_role", timestamp: new Date().toISOString() });
+    }
+    await UserRepo.setRole(userId, role);
+    await getAllUsers().refresh();
+    return { success: true };
+});
+/** The Admin option: the admin deletes another account with all its data. */
+export const deleteUser = adminSchemaCommand(z.object({ userId: z.string() }), async ({ userId }, admin) => {
+    if (userId === admin.id) {
+        throw error(400, { message: m().ownAccount, id: "own_account", timestamp: new Date().toISOString() });
+    }
+    await KontoService.loeschen(userId);
+    await getAllUsers().refresh();
+    return { success: true };
+});
+/** Deletes the user's own account with all its data. */
+export const deleteOwnAccount = protectedCommand(async (user) => {
+    await KontoService.loeschen(user.id);
+    return { success: true };
+});

package/dist/remote/einladung.remote.d.ts

@@ -0,0 +1,27 @@
+/** The user's open Einladungen, and whether the server can send them by email. */
+export declare const getOffeneEinladungen: import("$app/server").RemoteQueryFunction<void, {
+    einladungen: import("../types.js").OffeneEinladung[];
+    mail: boolean;
+}, void>;
+/** Creates an Einladung; the link is returned only here. With an email, it is also sent (if mail is set up). */
+export declare const createEinladung: import("$app/server").RemoteCommand<{
+    email: string | null;
+}, {
+    link: string;
+    expiresAt: Date;
+    mailFehler: string | null;
+}>;
+export declare const withdrawEinladung: import("$app/server").RemoteCommand<{
+    einladungId: string;
+}, void>;
+/** The Admin option: every open Einladung, and withdrawing any of them. */
+export declare const getAlleEinladungen: import("$app/server").RemoteQueryFunction<void, {
+    id: string;
+    email: string | null;
+    inviterName: string;
+    expiresAt: Date;
+    createdAt: Date;
+}[], void>;
+export declare const adminWithdrawEinladung: import("$app/server").RemoteCommand<{
+    einladungId: string;
+}, void>;

package/dist/remote/einladung.remote.js

@@ -0,0 +1,56 @@
+import { error } from "@sveltejs/kit";
+import { z } from "zod";
+import { m } from "../messages.js";
+import { adminQuery, adminSchemaCommand, protectedQuery, protectedSchemaCommand } from "../server/helpers.js";
+import { registry } from "../server/registry.js";
+import { EinladungService } from "../server/service/einladung.service.js";
+import { sendEinladungEmail } from "../server/service/mail.js";
+import { emailSchema } from "../types.js";
+import { messageOf } from "../util/messageOf.js";
+import { isAdmin, mayInvite } from "../util/signup.js";
+function unwrap(result) {
+    if (result.isOk())
+        return result.value;
+    throw error(result.error.kind === "unbekannt" ? 404 : 400, { message: result.error.message, id: result.error.kind, timestamp: new Date().toISOString() });
+}
+/** The user's open Einladungen, and whether the server can send them by email. */
+export const getOffeneEinladungen = protectedQuery(async (user) => {
+    return { einladungen: await EinladungService.offene(user.id), mail: registry().mailer.enabled };
+});
+/** Creates an Einladung; the link is returned only here. With an email, it is also sent (if mail is set up). */
+export const createEinladung = protectedSchemaCommand(z.object({ email: emailSchema.nullable() }), async ({ email }, user) => {
+    const { origin, signupMode, admin, locale } = registry();
+    if (!mayInvite(signupMode, isAdmin(user))) {
+        throw error(403, { message: m().onlyAdminsInvite, id: "forbidden", timestamp: new Date().toISOString() });
+    }
+    const einladung = await EinladungService.erstellen(user.id, { email });
+    const link = `${origin}/einladung/${einladung.token}`;
+    let mailFehler = null;
+    if (email) {
+        try {
+            await sendEinladungEmail(user.name, email, { link, expiresAt: einladung.expiresAt }, locale);
+        }
+        catch (e) {
+            mailFehler = messageOf(e, m().mailFailed);
+        }
+    }
+    await getOffeneEinladungen().refresh();
+    if (admin && isAdmin(user))
+        await getAlleEinladungen().refresh();
+    return { link, expiresAt: einladung.expiresAt, mailFehler };
+});
+export const withdrawEinladung = protectedSchemaCommand(z.object({ einladungId: z.string() }), async ({ einladungId }, user) => {
+    unwrap(await EinladungService.zurueckziehen(user.id, einladungId));
+    await getOffeneEinladungen().refresh();
+    if (registry().admin && isAdmin(user))
+        await getAlleEinladungen().refresh();
+});
+/** The Admin option: every open Einladung, and withdrawing any of them. */
+export const getAlleEinladungen = adminQuery(async () => {
+    return await EinladungService.alleOffenen();
+});
+export const adminWithdrawEinladung = adminSchemaCommand(z.object({ einladungId: z.string() }), async ({ einladungId }) => {
+    unwrap(await EinladungService.zurueckziehenAlsAdmin(einladungId));
+    await getAlleEinladungen().refresh();
+    await getOffeneEinladungen().refresh();
+});

package/dist/remote/index.d.ts

@@ -0,0 +1,2 @@
+export { changePassword, deleteOwnAccount, deleteUser, getAllUsers, getLinkedAccounts, getSessions, revokeOthers, revokeSessionById, setPassword, setUserRole, updateUserProfile, } from "./app_user.remote.js";
+export { adminWithdrawEinladung, createEinladung, getAlleEinladungen, getOffeneEinladungen, withdrawEinladung } from "./einladung.remote.js";

package/dist/remote/index.js

@@ -0,0 +1,2 @@
+export { changePassword, deleteOwnAccount, deleteUser, getAllUsers, getLinkedAccounts, getSessions, revokeOthers, revokeSessionById, setPassword, setUserRole, updateUserProfile, } from "./app_user.remote.js";
+export { adminWithdrawEinladung, createEinladung, getAlleEinladungen, getOffeneEinladungen, withdrawEinladung } from "./einladung.remote.js";