@vonall/auth 0.0.0-stage → 0.1.0

package/dist/server/loads.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The `load` functions of the auth routes, for a Product's `+page.server.ts`/`+layout.server.ts` to re-export:
+ * `export { loginLoad as load } from "@vonall/auth/server";`
+ */
+import { type ServerLoadEvent } from "@sveltejs/kit";
+type Event = Pick<ServerLoadEvent, "locals" | "url" | "request" | "cookies" | "params">;
+/** `/auth`: which social logins have keys, and whether a password reset mail can be sent (the link is hidden otherwise). */
+export declare function authLayoutLoad(): Promise<{
+    providers: {
+        github: boolean;
+        google: boolean;
+    };
+    mail: boolean;
+}>;
+/** `/auth/login`. */
+export declare function loginLoad({ locals, url, request }: Event): Promise<{}>;
+/** `/auth/signup`: the signup mode decides; the very first account (the admin) needs nothing. */
+export declare function signupLoad({ locals, cookies }: Event): Promise<{
+    state: "allowed" | "needs_einladung" | "no_mail";
+    mode: "invite" | "open" | "admin";
+    einladung: {
+        inviterName: string;
+    } | null;
+}>;
+/**
+ * `/einladung/[token]`: the link of an Einladung. A valid one is remembered in a cookie so it survives signup with
+ * email, Google or GitHub (the signup hook takes it from there).
+ */
+export declare function einladungLoad({ params, cookies, locals, url }: Event): Promise<{
+    fehler: string;
+    einladung: null;
+    eingeloggt: boolean;
+} | {
+    fehler: null;
+    einladung: {
+        inviterName: string;
+    };
+    eingeloggt: boolean;
+}>;
+/** `/home`: login required; the user, the session (never its token), the providers and whether the user may invite. */
+export declare function homeLayoutLoad({ locals }: Event): {
+    user: any;
+    session: {
+        id: any;
+        expiresAt: any;
+    };
+    providers: {
+        github: boolean;
+        google: boolean;
+    };
+    einladen: boolean;
+};
+/** `/home/manage_user` (the Admin option): admins only. */
+export declare function manageUserLoad({ locals }: Event): {
+    currentUserId: any;
+};
+export {};

package/dist/server/loads.js

@@ -0,0 +1,83 @@
+/**
+ * The `load` functions of the auth routes, for a Product's `+page.server.ts`/`+layout.server.ts` to re-export:
+ * `export { loginLoad as load } from "@vonall/auth/server";`
+ */
+import { error, redirect } from "@sveltejs/kit";
+import { m } from "../messages.js";
+import { registry } from "./registry.js";
+import { EINLADUNG_COOKIE, EinladungService } from "./service/einladung.service.js";
+import { isStale, SESSION_NOT_FRESH } from "../util/fresh.js";
+import { sameSitePath } from "../util/sameSite.js";
+import { isAdmin, mayInvite } from "../util/signup.js";
+/** `/auth`: which social logins have keys, and whether a password reset mail can be sent (the link is hidden otherwise). */
+export async function authLayoutLoad() {
+    const { providers, mailer } = registry();
+    return { providers, mail: mailer.enabled };
+}
+/** `/auth/login`. */
+export async function loginLoad({ locals, url, request }) {
+    const { auth } = registry();
+    // An action refused the session as too old to be trusted (reauthPath): sign it out, so the form shows. Only a session
+    // that really is that old, so a link can't log anyone out.
+    if (locals.session && url.searchParams.get("error") === SESSION_NOT_FRESH.toLowerCase()) {
+        const { freshAge } = (await auth.$context).sessionConfig;
+        if (isStale(new Date(locals.session.createdAt), freshAge)) {
+            await auth.api.signOut({ headers: request.headers });
+            locals.session = null;
+            locals.user = null;
+        }
+    }
+    // An agent authorisation (signed query) may ask to log in again even with a session; then the form shows
+    if (locals.session && !url.searchParams.has("sig")) {
+        throw redirect(302, sameSitePath(url.searchParams.get("redirectTo"), url.origin) ?? "/home");
+    }
+    return {};
+}
+/** `/auth/signup`: the signup mode decides; the very first account (the admin) needs nothing. */
+export async function signupLoad({ locals, cookies }) {
+    if (locals.session)
+        throw redirect(302, "/home");
+    const { state, einladung } = await EinladungService.signup(cookies.get(EINLADUNG_COOKIE));
+    return { state, mode: registry().signupMode, einladung: einladung ? { inviterName: einladung.inviterName } : null };
+}
+/**
+ * `/einladung/[token]`: the link of an Einladung. A valid one is remembered in a cookie so it survives signup with
+ * email, Google or GitHub (the signup hook takes it from there).
+ */
+export async function einladungLoad({ params, cookies, locals, url }) {
+    const token = params.token;
+    if (!token)
+        throw error(404, { message: m().einladungUnbekannt, id: "unbekannt", timestamp: new Date().toISOString() });
+    const pruefung = await EinladungService.pruefen(token);
+    if (pruefung.isErr())
+        return { fehler: pruefung.error.message, einladung: null, eingeloggt: !!locals.user };
+    const einladung = pruefung.value;
+    cookies.set(EINLADUNG_COOKIE, token, {
+        path: "/",
+        httpOnly: true,
+        sameSite: "lax",
+        // Secure only over HTTPS: WebKit drops Secure cookies on http://localhost (the e2e preview)
+        secure: url.protocol === "https:",
+        expires: einladung.expiresAt,
+    });
+    return { fehler: null, einladung: { inviterName: einladung.inviterName }, eingeloggt: !!locals.user };
+}
+/** `/home`: login required; the user, the session (never its token), the providers and whether the user may invite. */
+export function homeLayoutLoad({ locals }) {
+    if (!locals.session || !locals.user)
+        throw redirect(302, "/auth/login");
+    const { providers, signupMode } = registry();
+    const user = { ...locals.user };
+    // Never the session token itself: page data ends up in the HTML and in client JS
+    const session = { id: locals.session.id, expiresAt: locals.session.expiresAt };
+    // Whether the Invitations tab shows: the signup mode decides who creates Einladungen
+    return { user, session, providers, einladen: mayInvite(signupMode, isAdmin(locals.user)) };
+}
+/** `/home/manage_user` (the Admin option): admins only. */
+export function manageUserLoad({ locals }) {
+    if (!locals.session || !locals.user)
+        throw redirect(302, "/auth/login");
+    if (!isAdmin(locals.user))
+        throw redirect(302, "/home");
+    return { currentUserId: locals.user.id };
+}

package/dist/server/registry.d.ts

@@ -0,0 +1,39 @@
+/**
+ * What `createAuth()` set up, for the package's repositories, services and remote functions: the Product's database,
+ * its tables, the options and the better-auth instance. One app per process, so a module-level value; the Product's
+ * wiring (`src/lib/auth.ts`) runs before any request.
+ */
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type { Mailer } from "@vonall/mail";
+import type { FullSchema } from "../schema/index.js";
+import type { Auth } from "./create.js";
+import type { SignupMode } from "../types.js";
+export type Db = NodePgDatabase<any>;
+/** Where the package reports; a Product passes its logger, the default is the console. */
+export type AuthLog = {
+    debug(message: string, context?: Record<string, unknown>): void;
+    info(message: string, context?: Record<string, unknown>): void;
+    warn(message: string, context?: Record<string, unknown>): void;
+    error(message: string, context?: Record<string, unknown>, error?: unknown): void;
+};
+export type Registry = {
+    db: Db;
+    schema: FullSchema;
+    appName: string;
+    origin: string;
+    /** The app's locale for dates in mails, e.g. "de-CH". */
+    locale: string;
+    signupMode: SignupMode;
+    mailer: Mailer;
+    admin: boolean;
+    log: AuthLog;
+    auth: Auth;
+    /** The social logins that have keys. */
+    providers: {
+        github: boolean;
+        google: boolean;
+    };
+};
+export declare function setRegistry(registry: Registry): void;
+export declare function registry(): Registry;
+export declare const consoleLog: AuthLog;

package/dist/server/registry.js

@@ -0,0 +1,15 @@
+let current = null;
+export function setRegistry(registry) {
+    current = registry;
+}
+export function registry() {
+    if (!current)
+        throw new Error("@vonall/auth: createAuth() has not run; import the app's auth wiring (src/lib/auth.ts) first");
+    return current;
+}
+export const consoleLog = {
+    debug: () => { },
+    info: (message, context) => console.info(message, context ?? ""),
+    warn: (message, context) => console.warn(message, context ?? ""),
+    error: (message, context, error) => console.error(message, context ?? "", error ?? ""),
+};

package/dist/server/repositories/EinladungRepo.d.ts

@@ -0,0 +1,36 @@
+export declare const EinladungRepo: {
+    insert(row: {
+        id: string;
+        tokenHash: string;
+        createdBy: string;
+        email: string | null;
+        expiresAt: Date;
+    }): Promise<void>;
+    /** The Einladung with the name of its inviter, by the hash of its token. */
+    getByTokenHash(tokenHash: string): Promise<{
+        id: string;
+        createdBy: string;
+        inviterName: string;
+        expiresAt: Date;
+        acceptedAt: Date | null;
+    }>;
+    /** Marks the Einladung as accepted, unless it already was or has expired; false when it couldn't be taken. */
+    accept(id: string, userId: string, now: Date): Promise<boolean>;
+    /** The user's Einladungen that are still open (not accepted, not expired), newest first. */
+    listOpenBy(userId: string, now: Date): Promise<{
+        id: string;
+        email: string | null;
+        expiresAt: Date;
+        createdAt: Date;
+    }[]>;
+    /** All open Einladungen with their inviter, for the admin. */
+    listAllOpen(now: Date): Promise<{
+        id: string;
+        email: string | null;
+        inviterName: string;
+        expiresAt: Date;
+        createdAt: Date;
+    }[]>;
+    /** Deletes an open Einladung of the user (or any, with `userId` null for the admin); false when there was none. */
+    deleteOpen(id: string, userId: string | null): Promise<boolean>;
+};

package/dist/server/repositories/EinladungRepo.js

@@ -0,0 +1,74 @@
+import { and, desc, eq, gt, isNull } from "drizzle-orm";
+import { registry } from "../registry.js";
+export const EinladungRepo = {
+    async insert(row) {
+        const { db, schema } = registry();
+        await db.insert(schema.einladung).values(row);
+    },
+    /** The Einladung with the name of its inviter, by the hash of its token. */
+    async getByTokenHash(tokenHash) {
+        const { db, schema } = registry();
+        const { einladung, user } = schema;
+        const rows = await db
+            .select({
+            id: einladung.id,
+            createdBy: einladung.createdBy,
+            inviterName: user.name,
+            expiresAt: einladung.expiresAt,
+            acceptedAt: einladung.acceptedAt,
+        })
+            .from(einladung)
+            .innerJoin(user, eq(einladung.createdBy, user.id))
+            .where(eq(einladung.tokenHash, tokenHash))
+            .limit(1);
+        return rows[0] ?? null;
+    },
+    /** Marks the Einladung as accepted, unless it already was or has expired; false when it couldn't be taken. */
+    async accept(id, userId, now) {
+        const { db, schema } = registry();
+        const { einladung } = schema;
+        const rows = await db
+            .update(einladung)
+            .set({ acceptedAt: now, acceptedBy: userId })
+            .where(and(eq(einladung.id, id), isNull(einladung.acceptedAt), gt(einladung.expiresAt, now)))
+            .returning({ id: einladung.id });
+        return rows.length === 1;
+    },
+    /** The user's Einladungen that are still open (not accepted, not expired), newest first. */
+    async listOpenBy(userId, now) {
+        const { db, schema } = registry();
+        const { einladung } = schema;
+        return await db
+            .select({ id: einladung.id, email: einladung.email, expiresAt: einladung.expiresAt, createdAt: einladung.createdAt })
+            .from(einladung)
+            .where(and(eq(einladung.createdBy, userId), isNull(einladung.acceptedAt), gt(einladung.expiresAt, now)))
+            .orderBy(desc(einladung.createdAt));
+    },
+    /** All open Einladungen with their inviter, for the admin. */
+    async listAllOpen(now) {
+        const { db, schema } = registry();
+        const { einladung, user } = schema;
+        return await db
+            .select({
+            id: einladung.id,
+            email: einladung.email,
+            inviterName: user.name,
+            expiresAt: einladung.expiresAt,
+            createdAt: einladung.createdAt,
+        })
+            .from(einladung)
+            .innerJoin(user, eq(einladung.createdBy, user.id))
+            .where(and(isNull(einladung.acceptedAt), gt(einladung.expiresAt, now)))
+            .orderBy(desc(einladung.createdAt));
+    },
+    /** Deletes an open Einladung of the user (or any, with `userId` null for the admin); false when there was none. */
+    async deleteOpen(id, userId) {
+        const { db, schema } = registry();
+        const { einladung } = schema;
+        const rows = await db
+            .delete(einladung)
+            .where(and(eq(einladung.id, id), isNull(einladung.acceptedAt), userId ? eq(einladung.createdBy, userId) : undefined))
+            .returning({ id: einladung.id });
+        return rows.length === 1;
+    },
+};

package/dist/server/repositories/UserRepo.d.ts

@@ -0,0 +1,19 @@
+import type { AppUserClient, UserInsert } from "../../types.js";
+export declare const UserRepo: {
+    /** Every account, oldest first (the admin's list). */
+    getAllUsers(): Promise<AppUserClient[]>;
+    getUserById(id: string): Promise<AppUserClient | null>;
+    getUserFromEmail(email: string): Promise<AppUserClient | null>;
+    countUsers(): Promise<number>;
+    /** Admin option only. */
+    setRole(userId: string, role: string): Promise<void>;
+    /** Creates a user outside better-auth's signup (tests, scripts); the first one becomes admin like any other. */
+    insertUser(data: UserInsert): Promise<void>;
+    getUserAccounts(userId: string): Promise<{
+        id: string;
+        providerId: string;
+        updatedAt: Date;
+    }[]>;
+    /** Deletes the user; every row that belongs to them goes with it (foreign keys cascade). */
+    deleteUser(userId: string): Promise<void>;
+};

package/dist/server/repositories/UserRepo.js

@@ -0,0 +1,67 @@
+import { asc, count, eq } from "drizzle-orm";
+import { registry } from "../registry.js";
+import { nameFromEmail } from "../../util/names.js";
+/** The columns the client gets; the admin ones exist only with the admin option. */
+function selection() {
+    const { user } = registry().schema;
+    const base = {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        createdAt: user.createdAt,
+        updatedAt: user.updatedAt,
+        twoFactorEnabled: user.twoFactorEnabled,
+        emailVerified: user.emailVerified,
+        image: user.image,
+    };
+    return registry().admin ? { ...base, role: user.role, banned: user.banned, banReason: user.banReason, banExpires: user.banExpires } : base;
+}
+const rows = (list) => list;
+export const UserRepo = {
+    /** Every account, oldest first (the admin's list). */
+    async getAllUsers() {
+        const { db, schema } = registry();
+        return rows(await db.select(selection()).from(schema.user).orderBy(asc(schema.user.createdAt)));
+    },
+    async getUserById(id) {
+        const { db, schema } = registry();
+        const list = rows(await db.select(selection()).from(schema.user).where(eq(schema.user.id, id)).limit(1));
+        return list[0] ?? null;
+    },
+    async getUserFromEmail(email) {
+        const { db, schema } = registry();
+        const list = rows(await db.select(selection()).from(schema.user).where(eq(schema.user.email, email)).limit(1));
+        return list[0] ?? null;
+    },
+    async countUsers() {
+        const { db, schema } = registry();
+        const [row] = await db.select({ n: count() }).from(schema.user);
+        return row.n;
+    },
+    /** Admin option only. */
+    async setRole(userId, role) {
+        const { db, schema } = registry();
+        await db.update(schema.user).set({ role }).where(eq(schema.user.id, userId));
+    },
+    /** Creates a user outside better-auth's signup (tests, scripts); the first one becomes admin like any other. */
+    async insertUser(data) {
+        const { db, schema, admin } = registry();
+        if (!data.name && data.email)
+            data.name = nameFromEmail(data.email);
+        await db.insert(schema.user).values(data);
+        if (admin && data.id && (await UserRepo.countUsers()) === 1)
+            await UserRepo.setRole(data.id, "admin");
+    },
+    async getUserAccounts(userId) {
+        const { db, schema } = registry();
+        return await db
+            .select({ id: schema.account.id, providerId: schema.account.providerId, updatedAt: schema.account.updatedAt })
+            .from(schema.account)
+            .where(eq(schema.account.userId, userId));
+    },
+    /** Deletes the user; every row that belongs to them goes with it (foreign keys cascade). */
+    async deleteUser(userId) {
+        const { db, schema } = registry();
+        await db.delete(schema.user).where(eq(schema.user.id, userId));
+    },
+};

package/dist/server/service/einladung.service.d.ts

@@ -0,0 +1,48 @@
+import { type Result } from "neverthrow";
+import type { EinladungInfo, OffeneEinladung, SignupMode, SignupState } from "../../types.js";
+export declare const EINLADUNG_GUELTIG_TAGE = 14;
+/** The cookie that carries an Einladung's token from its link through signup (email, Google or GitHub). */
+export declare const EINLADUNG_COOKIE = "einladung";
+export type EinladungError = {
+    kind: "unbekannt" | "abgelaufen" | "angenommen";
+    message: string;
+};
+export declare const EinladungService: {
+    /** Creates an Einladung and returns its token, shown only this once. */
+    erstellen(userId: string, input?: {
+        email?: string | null;
+    }, now?: Date): Promise<{
+        id: string;
+        token: string;
+        expiresAt: Date;
+    }>;
+    /** What the link offers, if it can still be used. */
+    pruefen(token: string, now?: Date): Promise<Result<EinladungInfo, EinladungError>>;
+    /**
+     * Whether someone may create an account now, and if not, why (the signup mode decides, `signupState`); whether it
+     * would be the very first account; and the Einladung the token stands for, if it is usable. One count, one lookup.
+     */
+    signup(token: string | undefined, options?: {
+        now?: Date;
+        mode?: SignupMode;
+        mail?: boolean;
+    }): Promise<{
+        state: SignupState;
+        firstAccount: boolean;
+        einladung: EinladungInfo | null;
+    }>;
+    /** Uses the Einladung for the new user: marks it as taken. */
+    annehmen(userId: string, token: string, now?: Date): Promise<Result<void, EinladungError>>;
+    offene(userId: string, now?: Date): Promise<OffeneEinladung[]>;
+    /** Withdraws an open Einladung of the user. */
+    zurueckziehen(userId: string, einladungId: string): Promise<Result<void, EinladungError>>;
+    /** For the admin: every open Einladung, and withdrawing any of them. */
+    alleOffenen(now?: Date): Promise<{
+        id: string;
+        email: string | null;
+        inviterName: string;
+        expiresAt: Date;
+        createdAt: Date;
+    }[]>;
+    zurueckziehenAlsAdmin(einladungId: string): Promise<Result<void, EinladungError>>;
+};

package/dist/server/service/einladung.service.js

@@ -0,0 +1,76 @@
+/**
+ * Einladungen: the only way into the app once the first account (the admin) exists. A link works once and expires
+ * after 14 days. Only the token's hash is stored.
+ */
+import { createHash, randomBytes } from "node:crypto";
+import { err, ok } from "neverthrow";
+import { m } from "../../messages.js";
+import { registry } from "../registry.js";
+import { EinladungRepo } from "../repositories/EinladungRepo.js";
+import { UserRepo } from "../repositories/UserRepo.js";
+import { signupState } from "../../util/signup.js";
+export const EINLADUNG_GUELTIG_TAGE = 14;
+/** The cookie that carries an Einladung's token from its link through signup (email, Google or GitHub). */
+export const EINLADUNG_COOKIE = "einladung";
+const hash = (token) => createHash("sha256").update(token).digest("hex");
+const fehler = {
+    unbekannt: () => ({ kind: "unbekannt", message: m().einladungUnbekannt }),
+    abgelaufen: () => ({ kind: "abgelaufen", message: m().einladungAbgelaufen }),
+    angenommen: () => ({ kind: "angenommen", message: m().einladungAngenommen }),
+};
+export const EinladungService = {
+    /** Creates an Einladung and returns its token, shown only this once. */
+    async erstellen(userId, input = {}, now = new Date()) {
+        const token = randomBytes(24).toString("base64url");
+        const id = crypto.randomUUID();
+        const expiresAt = new Date(now.getTime() + EINLADUNG_GUELTIG_TAGE * 24 * 60 * 60 * 1000);
+        await EinladungRepo.insert({ id, tokenHash: hash(token), createdBy: userId, email: input.email ?? null, expiresAt });
+        return { id, token, expiresAt };
+    },
+    /** What the link offers, if it can still be used. */
+    async pruefen(token, now = new Date()) {
+        const row = await EinladungRepo.getByTokenHash(hash(token));
+        if (!row)
+            return err(fehler.unbekannt());
+        if (row.acceptedAt)
+            return err(fehler.angenommen());
+        if (row.expiresAt <= now)
+            return err(fehler.abgelaufen());
+        return ok({ id: row.id, inviterName: row.inviterName, expiresAt: row.expiresAt });
+    },
+    /**
+     * Whether someone may create an account now, and if not, why (the signup mode decides, `signupState`); whether it
+     * would be the very first account; and the Einladung the token stands for, if it is usable. One count, one lookup.
+     */
+    async signup(token, options = {}) {
+        const { now = new Date(), mode = registry().signupMode, mail = registry().mailer.enabled } = options;
+        const accounts = await UserRepo.countUsers();
+        const geprueft = token ? await EinladungService.pruefen(token, now) : null;
+        const einladung = geprueft?.isOk() ? geprueft.value : null;
+        const einladungUsable = accounts > 0 && mode !== "open" && einladung !== null;
+        return { state: signupState({ mode, accounts, einladungUsable, mail }), firstAccount: accounts === 0, einladung };
+    },
+    /** Uses the Einladung for the new user: marks it as taken. */
+    async annehmen(userId, token, now = new Date()) {
+        const info = await EinladungService.pruefen(token, now);
+        if (info.isErr())
+            return err(info.error);
+        if (!(await EinladungRepo.accept(info.value.id, userId, now)))
+            return err(fehler.angenommen());
+        return ok(undefined);
+    },
+    async offene(userId, now = new Date()) {
+        return await EinladungRepo.listOpenBy(userId, now);
+    },
+    /** Withdraws an open Einladung of the user. */
+    async zurueckziehen(userId, einladungId) {
+        return (await EinladungRepo.deleteOpen(einladungId, userId)) ? ok(undefined) : err(fehler.unbekannt());
+    },
+    /** For the admin: every open Einladung, and withdrawing any of them. */
+    async alleOffenen(now = new Date()) {
+        return await EinladungRepo.listAllOpen(now);
+    },
+    async zurueckziehenAlsAdmin(einladungId) {
+        return (await EinladungRepo.deleteOpen(einladungId, null)) ? ok(undefined) : err(fehler.unbekannt());
+    },
+};

package/dist/server/service/konto.service.d.ts

@@ -0,0 +1,7 @@
+export declare const KontoService: {
+    /**
+     * Deletes the account with everything that belongs to it: the foreign keys of every user-owned table cascade, so a
+     * Product's own tables reference `user.id` with `onDelete: "cascade"`.
+     */
+    loeschen(userId: string): Promise<void>;
+};

package/dist/server/service/konto.service.js

@@ -0,0 +1,11 @@
+/** The user's account as a whole. */
+import { UserRepo } from "../repositories/UserRepo.js";
+export const KontoService = {
+    /**
+     * Deletes the account with everything that belongs to it: the foreign keys of every user-owned table cascade, so a
+     * Product's own tables reference `user.id` with `onDelete: "cascade"`.
+     */
+    async loeschen(userId) {
+        await UserRepo.deleteUser(userId);
+    },
+};

package/dist/server/service/mail.d.ts

@@ -0,0 +1,12 @@
+export declare function sendPasswordResetEmail(user: {
+    email: string;
+    name: string;
+}, url: string): Promise<void>;
+export declare function sendVerifyEmail(user: {
+    email: string;
+    name: string;
+}, url: string): Promise<void>;
+export declare function sendEinladungEmail(inviterName: string, to: string, einladung: {
+    link: string;
+    expiresAt: Date;
+}, locale: string): Promise<void>;

package/dist/server/service/mail.js

@@ -0,0 +1,40 @@
+/** The three mails of accounts, through the Product's mailer (`@vonall/mail`). */
+import { renderMail } from "@vonall/mail";
+import { m } from "../../messages.js";
+import { registry } from "../registry.js";
+import InvitationEmail from "../../templates/InvitationEmail.svelte";
+import ResetPasswordEmail from "../../templates/ResetPasswordEmail.svelte";
+import VerifyEmailEmail from "../../templates/VerifyEmailEmail.svelte";
+function footer() {
+    const { appName, origin } = registry();
+    return { appName, appLink: origin };
+}
+const footerText = (appName) => `\n---\n${appName}\n`;
+export async function sendPasswordResetEmail(user, url) {
+    const { mailer, appName } = registry();
+    await mailer.send({
+        to: user.email,
+        subject: m().resetSubject(appName),
+        text: m().resetText(user.name, appName, url) + footerText(appName),
+        html: renderMail(ResetPasswordEmail, { recipientName: user.name, link: url, ...footer() }),
+    });
+}
+export async function sendVerifyEmail(user, url) {
+    const { mailer, appName } = registry();
+    await mailer.send({
+        to: user.email,
+        subject: m().verifySubject(appName),
+        text: m().verifyText(user.name, appName, url) + footerText(appName),
+        html: renderMail(VerifyEmailEmail, { recipientName: user.name, link: url, ...footer() }),
+    });
+}
+export async function sendEinladungEmail(inviterName, to, einladung, locale) {
+    const { mailer, appName } = registry();
+    const validUntil = new Intl.DateTimeFormat(locale, { dateStyle: "long" }).format(einladung.expiresAt);
+    await mailer.send({
+        to,
+        subject: m().einladungSubject(inviterName, appName),
+        text: m().einladungText(inviterName, appName, einladung.link, validUntil) + footerText(appName),
+        html: renderMail(InvitationEmail, { inviterName, link: einladung.link, validUntil, ...footer() }),
+    });
+}

package/dist/templates/InvitationEmail.svelte

@@ -0,0 +1,18 @@
+<script lang="ts">
+	import { EmailLayout } from "@vonall/mail";
+	import { m } from "../messages.js";
+
+	let { inviterName, link, validUntil, appName, appLink }: {
+		inviterName: string;
+		link: string;
+		validUntil: string;
+		appName: string;
+		appLink: string;
+	} = $props();
+</script>
+
+<EmailLayout title={m().einladungTitle(appName)} {link} buttonLabel={m().einladungButton} {appName} {appLink}>
+	<p>{m().einladungHello}</p>
+	<p>{m().einladungBody(inviterName, appName)}</p>
+	<p>{m().einladungValid(validUntil)}</p>
+</EmailLayout>

package/dist/templates/InvitationEmail.svelte.d.ts

@@ -0,0 +1,10 @@
+type $$ComponentProps = {
+    inviterName: string;
+    link: string;
+    validUntil: string;
+    appName: string;
+    appLink: string;
+};
+declare const InvitationEmail: import("svelte").Component<$$ComponentProps, {}, "">;
+type InvitationEmail = ReturnType<typeof InvitationEmail>;
+export default InvitationEmail;

package/dist/templates/ResetPasswordEmail.svelte

@@ -0,0 +1,16 @@
+<script lang="ts">
+	import { EmailLayout } from "@vonall/mail";
+	import { m } from "../messages.js";
+
+	let { recipientName, link, appName, appLink }: {
+		recipientName: string;
+		link: string;
+		appName: string;
+		appLink: string;
+	} = $props();
+</script>
+
+<EmailLayout title={m().hello(recipientName)} {link} buttonLabel={m().resetButton} {appName} {appLink}>
+	<p>{m().resetBody(appName)}</p>
+	<p>{m().resetNotYou}</p>
+</EmailLayout>

package/dist/templates/ResetPasswordEmail.svelte.d.ts

@@ -0,0 +1,9 @@
+type $$ComponentProps = {
+    recipientName: string;
+    link: string;
+    appName: string;
+    appLink: string;
+};
+declare const ResetPasswordEmail: import("svelte").Component<$$ComponentProps, {}, "">;
+type ResetPasswordEmail = ReturnType<typeof ResetPasswordEmail>;
+export default ResetPasswordEmail;