@webda/auth 0.0.0-stage → 4.0.0-beta.10

package/lib/email/emailpassword.service.js

@@ -0,0 +1,714 @@
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+import { Ident, Operation, Password, Route, registerPasswordPolicy, runAsSystem, Service, ServiceParameters, useContext, useDynamicService, useModelMetadata, WebdaError } from "@webda/core";
+import { WEBDA_PRIMARY_KEY } from "@webda/models";
+import { useAuthentication } from "../provider.js";
+import { AccountExists, IdentLinkedElsewhere, InvalidCredentials, Throttled, TokenInvalid } from "../errors.js";
+import { signEmailToken, verifyEmailToken } from "./tokens.js";
+import { canSend, countAttempt, markSent } from "../throttle.js";
+/** EmailPasswordProvider parameters */
+export class EmailPasswordParameters extends ServiceParameters {
+    /**
+     * @param params - raw parameters
+     * @returns this
+     */
+    load(params = {}) {
+        super.load(params);
+        this.mailer ?? (this.mailer = "Mailer");
+        this.verification ?? (this.verification = "before");
+        this.password = { ...this.password, policy: this.password?.policy ?? ".{8,}" };
+        this.throttle = {
+            resendDelay: this.throttle?.resendDelay ?? 14400000,
+            failedBeforeDelay: this.throttle?.failedBeforeDelay ?? 3,
+            lockout: this.throttle?.lockout ?? 900000
+        };
+        this.redirects ?? (this.redirects = {});
+        this.url ?? (this.url = "/auth/email");
+        return this;
+    }
+}
+// bcrypt cost-10 hash of a throwaway string: compared against for unknown emails so timing matches
+const DUMMY_HASH = "$2b$10$Loq148myoR.Yp2D2x5zkj.Z0FQq2afzaddIc2PGWzzdJCOEL.FZ4W";
+/**
+ * Profile attributes a client may set: attributes of the user model input schema, minus behaviors, relations,
+ * primary key fields and private (`_`-prefixed) fields
+ * @param model - user model
+ * @returns the allowed attribute names
+ */
+function allowedProfileKeys(model) {
+    const meta = useModelMetadata(model);
+    const relations = meta?.Relations ?? {};
+    const denied = new Set([
+        ...(model.prototype?.[WEBDA_PRIMARY_KEY] ?? ["uuid"]),
+        ...(relations.behaviors ?? []).map((r) => r.attribute),
+        ...(relations.links ?? []).map((r) => r.attribute),
+        ...(relations.queries ?? []).map((r) => r.attribute),
+        ...(relations.maps ?? []).map((r) => r.attribute),
+        ...(relations.binaries ?? []).map((r) => r.attribute),
+        ...(relations.parent ? [relations.parent.attribute] : [])
+    ]);
+    const props = Object.keys(meta?.Schemas?.Input?.properties ?? {});
+    return new Set(props.filter(k => !denied.has(k) && !k.startsWith("_")));
+}
+/**
+ * @param model - user model
+ * @param profile - client supplied profile
+ * @returns the profile restricted to the attributes the model allows
+ */
+function sanitizeProfile(model, profile) {
+    const safe = {};
+    if (!profile || typeof profile !== "object" || Array.isArray(profile))
+        return safe;
+    const allowed = allowedProfileKeys(model);
+    for (const [key, value] of Object.entries(profile)) {
+        if (allowed.has(key))
+            safe[key] = value;
+    }
+    return safe;
+}
+/**
+ * Email + password login method
+ *
+ * The password policy is process-wide: resolve() registers the one of this provider and stop() restores the
+ * default. With several instances the last one resolved wins.
+ *
+ * Known residual exposure: Auth.Email.Register answers AccountExists for a registered email (enumeration), and
+ * login timing differs slightly for known emails. An unverified squatter owning an email blocks its registration
+ * until the real owner goes through account recovery.
+ *
+ * Under `allowedEmailDomains` an email must be verified: with `verification` "after" or "none" a new registration is
+ * unverified and therefore refused (EMAIL_DOMAIN_NOT_ALLOWED); use "before".
+ * @WebdaModda EmailPasswordProvider
+ */
+let EmailPasswordProvider = (() => {
+    var _a;
+    let _classSuper = Service;
+    let _instanceExtraInitializers = [];
+    let _login_decorators;
+    let _register_decorators;
+    let _startVerification_decorators;
+    let _verify_decorators;
+    let _startRecovery_decorators;
+    let _recover_decorators;
+    let _changePassword_decorators;
+    let _recoverRedirect_decorators;
+    let _verifyRedirect_decorators;
+    return _a = class EmailPasswordProvider extends _classSuper {
+            constructor() {
+                super(...arguments);
+                this.providerName = (__runInitializers(this, _instanceExtraInitializers), "email");
+                /** Mails sent without being awaited */
+                this.pendingMails = new Set();
+            }
+            /** @override */
+            resolve() {
+                super.resolve();
+                const verifierName = this.parameters.password.verifier;
+                const regexp = new RegExp(this.parameters.password.policy);
+                registerPasswordPolicy(verifierName
+                    ? { validate: (p, u) => useDynamicService(verifierName).validate(p, u) }
+                    : { validate: async (p) => regexp.test(p) });
+                return this;
+            }
+            /** @override */
+            async init() {
+                await super.init();
+                if (this.parameters.verification !== "none" && !useDynamicService(this.parameters.mailer)) {
+                    throw new Error(`EmailPasswordProvider requires a Mailer service '${this.parameters.mailer}'`);
+                }
+                const required = [
+                    "failure",
+                    "recover",
+                    ...(this.parameters.verification !== "none" ? ["verified", "register"] : [])
+                ];
+                for (const key of required) {
+                    if (!this.parameters.redirects?.[key]) {
+                        throw new Error(`EmailPasswordProvider '${this.getName()}' requires the 'redirects.${key}' parameter`);
+                    }
+                }
+                return this;
+            }
+            /** @override */
+            async stop() {
+                registerPasswordPolicy(undefined);
+                await super.stop();
+            }
+            /**
+             * @returns public info
+             */
+            getPublicInfo() {
+                return { name: "email", type: "password" };
+            }
+            /**
+             * @param email - normalised email
+             * @returns the email ident
+             */
+            async getIdent(email) {
+                return runAsSystem(() => useAuthentication().findIdent("email", email));
+            }
+            /**
+             * Absolute link for an emailed token
+             * @param path - path under the provider url
+             * @param token - token
+             * @returns url
+             */
+            buildLink(path, token) {
+                const ctx = useContext();
+                const relative = `${this.parameters.url}${path}?token=${encodeURIComponent(token)}`;
+                return ctx?.getHttpContext ? ctx.getHttpContext().getAbsoluteUrl(relative) : relative;
+            }
+            /**
+             * @param template - mail template
+             * @param to - recipient
+             * @param url - link
+             * @param token - token
+             */
+            async sendMail(template, to, url, token) {
+                const ctx = useContext();
+                await useDynamicService(this.parameters.mailer).send({
+                    to,
+                    locale: ctx?.getLocale?.(),
+                    template,
+                    replacements: { url, token, to }
+                });
+            }
+            /**
+             * Count a login attempt before verifying it and decide whether the ident is locked
+             *
+             * Rule, equivalent to `isLocked(ident, failedBeforeDelay, lockout)` on the state before this attempt:
+             * `_loginAttempts` is incremented first (atomically; the new value is returned by the memory repository and
+             * re-read otherwise), so this attempt is locked when the count of PREVIOUS attempts (`_loginAttempts - 1`) is at
+             * least `failedBeforeDelay`, unless that lock has expired, ie `_lastLoginAttemptAt` as read when this call started
+             * is older than `lockout`. `_lastLoginAttemptAt` is only refreshed by attempts that are not refused, so hammering
+             * a locked ident does not extend the lock; a count reaching the threshold without timestamp is an expired lock.
+             * Both are top-level attributes: stores implement atomic increment and
+             * single attribute set on them (nested-path atomic operations are not portable across stores). The timestamp
+             * is a plain set (last writer wins); the counter is never written back from a snapshot. A burst starting exactly
+             * when an expired lock is read is verified as a whole: it is bounded to one burst per lock window.
+             * @param ident - the ident
+             * @returns true when this attempt must be refused without checking the password
+             */
+            async countAttempt(ident) {
+                return countAttempt(ident.ref(), "_loginAttempts", "_lastLoginAttemptAt", this.parameters.throttle, ident);
+            }
+            /**
+             * Login with email and password
+             * @param email - email
+             * @param password - password
+             * @returns the auth result
+             */
+            // Schemas are compiled per class: name them explicitly so any service instance name works
+            async login(email, password) {
+                const normalized = Ident.normalizeEmail(email);
+                const ctx = useContext();
+                const auth = useAuthentication();
+                const ident = await this.getIdent(normalized);
+                const userId = ident?.getUser()?.toString();
+                const user = userId
+                    ? await runAsSystem(() => auth.getUserModel().ref(userId).get()).catch(() => undefined)
+                    : undefined;
+                // Count before verifying: parallel guesses are each counted and refused once the threshold is crossed
+                if (ident && (await this.countAttempt(ident))) {
+                    throw new Throttled();
+                }
+                let ok;
+                if (user && user.password) {
+                    ok = await user.password.verify(password);
+                }
+                else {
+                    // Same cost as a real check so timing does not reveal unknown emails
+                    const dummy = new Password();
+                    dummy.setHash(DUMMY_HASH);
+                    await dummy.verify(`${password}`);
+                    ok = false;
+                }
+                if (!ok || !ident) {
+                    await auth.emit("Authentication.LoginFailed", { context: ctx, user });
+                    throw new InvalidCredentials();
+                }
+                // A success always follows a counted attempt (a user implies an ident), so the counter is non-zero here
+                await runAsSystem(() => ident.ref().setAttribute("_loginAttempts", 0));
+                return auth.complete({
+                    provider: "email",
+                    providerUid: normalized,
+                    email: normalized,
+                    emailVerified: ident.isVerified(),
+                    amr: ["pwd"],
+                    user
+                });
+            }
+            /**
+             * Register with email and password
+             * @param email - email
+             * @param password - password
+             * @param token - register token from the emailed link (verification "before")
+             * @param profile - extra user fields
+             * @returns the auth result, or verification_sent
+             */
+            // Schemas are compiled per class: name them explicitly so any service instance name works
+            async register(email, password, token, profile) {
+                const ctx = useContext();
+                if (ctx.getSession()?.isLogged()) {
+                    throw new WebdaError.Gone("Already logged in");
+                }
+                const normalized = Ident.normalizeEmail(email);
+                const mode = this.parameters.verification;
+                const auth = useAuthentication();
+                const existing = await this.getIdent(normalized);
+                // Any owned email ident refuses: logging in as its owner here would skip the password check
+                if (existing?.getUser()) {
+                    throw new AccountExists();
+                }
+                let verified = false;
+                if (mode === "before") {
+                    if (!token) {
+                        // Refuse early what the policy would refuse later
+                        auth.applyPolicy({
+                            provider: "email",
+                            providerUid: normalized,
+                            email: normalized,
+                            emailVerified: true,
+                            amr: ["pwd"]
+                        });
+                        // Same silent throttle as a logged-out StartVerification: the answer never depends on it
+                        await this.sendUnownedLink(normalized);
+                        return { status: "verification_sent" };
+                    }
+                    const claims = await verifyEmailToken(token, "register");
+                    if (claims.email !== normalized) {
+                        throw new TokenInvalid();
+                    }
+                    verified = true;
+                }
+                const base = {
+                    provider: "email",
+                    providerUid: normalized,
+                    email: normalized,
+                    emailVerified: verified,
+                    amr: ["pwd"]
+                };
+                // Nothing is created when the email policy refuses
+                auth.applyPolicy(base);
+                const safeProfile = sanitizeProfile(auth.getUserModel(), profile);
+                const user = await runAsSystem(() => auth.getUserModel().create({ ...safeProfile, email: normalized }, false));
+                await user.password.set(password);
+                const identity = { ...base, user };
+                await auth.emit("Authentication.PasswordCreate", {
+                    context: ctx,
+                    user,
+                    password: user.password.__hash
+                });
+                await auth.emit("Authentication.Register", {
+                    context: ctx,
+                    user,
+                    data: safeProfile,
+                    identId: `${normalized}:email`,
+                    identity
+                });
+                await runAsSystem(() => user.save());
+                let result;
+                try {
+                    result = await auth.complete(identity, { newUser: true });
+                }
+                catch (err) {
+                    await runAsSystem(() => user.delete());
+                    throw err;
+                }
+                if (mode === "after") {
+                    const t = await signEmailToken("verify", { email: normalized, sub: user.getUUID() });
+                    await this.sendMail("EMAIL_REGISTER", normalized, this.buildLink("/verify", t), t);
+                }
+                return result;
+            }
+            /**
+             * Send (or resend) a verification link
+             *
+             * Logged in: the link proves the email for the current account (`sub` is only in the token, the ident stays
+             * unowned until Auth.Email.Verify is called by the same session). Logged out: always answers with no content and
+             * never reveals anything; a link is only sent for an unowned or unknown email.
+             * @param email - email
+             */
+            async startVerification(email) {
+                const ctx = useContext();
+                const normalized = Ident.normalizeEmail(email);
+                const userId = ctx.getSession()?.isLogged() ? ctx.getCurrentUserId() : undefined;
+                if (!userId) {
+                    await this.sendUnownedLink(normalized);
+                    return;
+                }
+                const token = await runAsSystem(() => this.prepareLink(normalized, userId));
+                if (!token)
+                    throw new TokenInvalid();
+                await this.sendMail("EMAIL_REGISTER", normalized, this.buildLink("/verify", token), token);
+            }
+            /**
+             * Logged-out link: a register link is emailed, without awaiting the mail, only for an unknown or unowned and
+             * unverified email whose send throttle allows it; anything else is silently ignored
+             * @param normalized - normalised email
+             */
+            async sendUnownedLink(normalized) {
+                const token = await runAsSystem(() => this.prepareLink(normalized, undefined));
+                if (!token)
+                    return;
+                // Not awaited: the answer must not depend on whether a mail was sent. The link is built in the request context
+                this.sendMailDetached("EMAIL_REGISTER", normalized, this.buildLink("/verify", token), token);
+            }
+            /**
+             * Check and mark the send throttle of an email ident, then sign the token to email; runs as system
+             * @param normalized - normalised email
+             * @param userId - logged user (verify token), undefined for a logged-out register token
+             * @returns the token to send, undefined when nothing must be sent (logged out only)
+             * @throws IdentLinkedElsewhere / PreconditionFailed / Throttled (logged in only)
+             */
+            async prepareLink(normalized, userId) {
+                const { resendDelay } = this.parameters.throttle;
+                const auth = useAuthentication();
+                let ident = await this.getIdent(normalized);
+                const owner = ident?.getUser()?.toString();
+                if (!userId && (owner || ident?.isVerified())) {
+                    return undefined;
+                }
+                if (userId) {
+                    if (owner && owner !== userId) {
+                        throw new IdentLinkedElsewhere();
+                    }
+                    if (ident?.isVerified()) {
+                        throw new WebdaError.PreconditionFailed("Email already verified");
+                    }
+                }
+                if (ident && !canSend(ident._throttle, resendDelay)) {
+                    if (userId)
+                        throw new Throttled();
+                    return undefined;
+                }
+                if (!ident) {
+                    // Unowned: only tracks the send throttle
+                    ident = new (auth.getIdentModel())({ ...Ident.key(normalized, "email"), email: normalized });
+                    ident._throttle = markSent(undefined);
+                    try {
+                        await ident.getRepository().create(ident);
+                    }
+                    catch (err) {
+                        // A concurrent request just created it, and sends the mail: stay silent when logged out
+                        if (userId)
+                            throw err;
+                        return undefined;
+                    }
+                }
+                else {
+                    await ident.ref().patch({ _throttle: markSent(ident._throttle) });
+                }
+                return signEmailToken(userId ? "verify" : "register", { email: normalized, sub: userId });
+            }
+            /**
+             * Send a mail without awaiting it; failures are logged without any secret
+             * @param template - mail template
+             * @param to - recipient
+             * @param url - link
+             * @param token - token
+             */
+            sendMailDetached(template, to, url, token) {
+                const pending = this.sendMail(template, to, url, token)
+                    .catch(err => this.log("ERROR", `Cannot send ${template} mail`, err?.code ?? err?.name))
+                    .finally(() => this.pendingMails.delete(pending));
+                this.pendingMails.add(pending);
+            }
+            /**
+             * Wait for the mails sent without being awaited (logged out verification, recovery)
+             */
+            async flushMails() {
+                while (this.pendingMails.size) {
+                    await Promise.all([...this.pendingMails]);
+                }
+            }
+            /**
+             * Mark an email as verified: only the session of the user named by the token can complete it
+             * @param token - verify token
+             * @returns status
+             */
+            async verify(token) {
+                return this.verifyWith(token, useContext());
+            }
+            /**
+             * Verify with an explicit context
+             * @param token - verify token
+             * @param ctx - context whose session must match the token
+             * @returns status
+             */
+            async verifyWith(token, ctx) {
+                const claims = await verifyEmailToken(token, "verify");
+                await this.completeVerify(claims, ctx);
+                return { status: "verified" };
+            }
+            /**
+             * @param claims - verified token claims
+             * @param claims.sub - user id
+             * @param ctx - context
+             * @returns true when the session is logged as the user of the token
+             */
+            sessionMatches(claims, ctx) {
+                return !!claims.sub && !!ctx?.getSession?.()?.isLogged() && ctx.getCurrentUserId() === claims.sub;
+            }
+            /**
+             * Complete a verification; nothing changes unless every check passes
+             * @param claims - verified token claims
+             * @param claims.email - email of the token
+             * @param claims.sub - user id
+             * @param ctx - context
+             */
+            async completeVerify(claims, ctx) {
+                if (!ctx?.getSession?.()?.isLogged()) {
+                    throw new WebdaError.Unauthorized("Login required");
+                }
+                if (!claims.sub || !this.sessionMatches(claims, ctx)) {
+                    throw new IdentLinkedElsewhere();
+                }
+                const userId = claims.sub;
+                await runAsSystem(async () => {
+                    const ident = await this.getIdent(claims.email);
+                    if (!ident) {
+                        throw new TokenInvalid();
+                    }
+                    const owner = ident.getUser()?.toString();
+                    if (owner && owner !== claims.sub) {
+                        throw new IdentLinkedElsewhere();
+                    }
+                    const patch = {};
+                    if (!ident.isVerified())
+                        patch.verifiedAt = new Date();
+                    if (!owner) {
+                        ident.setUser(userId);
+                        patch._user = ident._user;
+                    }
+                    if (Object.keys(patch).length)
+                        await ident.ref().patch(patch);
+                });
+            }
+            /**
+             * Start password recovery; always succeeds to avoid revealing accounts
+             * @param email - email
+             */
+            async startRecovery(email) {
+                const normalized = Ident.normalizeEmail(email);
+                await runAsSystem(async () => {
+                    const ident = await this.getIdent(normalized);
+                    if (!ident?.getUser() || !canSend(ident._throttle, this.parameters.throttle.resendDelay))
+                        return;
+                    const user = await useAuthentication()
+                        .getUserModel()
+                        .ref(ident.getUser().toString())
+                        .get()
+                        .catch(() => undefined);
+                    if (!user || !user?.password?.hasPassword())
+                        return;
+                    await ident.ref().patch({ _throttle: markSent(ident._throttle) });
+                    const t = await signEmailToken("recover", {
+                        email: normalized,
+                        sub: user.getUUID(),
+                        pwdAt: user.password.changedAt
+                    });
+                    this.sendMailDetached("EMAIL_RECOVERY", normalized, this.buildLink("/recover", t), t);
+                });
+            }
+            /**
+             * Set a new password from a recovery link (does not log in): revokes the refresh tokens and ends every session of
+             * the user (see `Session.authAt`), resets the login attempts of the email ident
+             * @param token - recover token
+             * @param password - new password
+             */
+            async recover(token, password) {
+                const claims = await verifyEmailToken(token, "recover");
+                const userId = claims.sub;
+                if (!userId)
+                    throw new TokenInvalid();
+                await runAsSystem(async () => {
+                    const auth = useAuthentication();
+                    const user = await auth
+                        .getUserModel()
+                        .ref(userId)
+                        .get()
+                        .catch(() => undefined);
+                    if (!user || !user.password || user.password.changedAt !== claims.pwdAt) {
+                        throw new TokenInvalid();
+                    }
+                    // Checked before anything changes: a recovery that cannot revoke the sessions must not set the password
+                    const tokens = useDynamicService("TokenService");
+                    if (!tokens) {
+                        throw new Error("Password recovery requires the TokenService to revoke sessions");
+                    }
+                    await user.password.set(password);
+                    await user.save();
+                    await tokens.revokeUser(user.getUUID());
+                    // Receiving the mail proves possession of the address; the new password also ends any login lock
+                    const ident = await this.getIdent(claims.email);
+                    if (ident && ident.getUser()?.toString() === user.getUUID()) {
+                        await ident.ref().setAttribute("_loginAttempts", 0);
+                        if (!ident.isVerified())
+                            await ident.ref().patch({ verifiedAt: new Date() });
+                    }
+                    await auth.emit("Authentication.PasswordUpdate", {
+                        context: useContext(),
+                        user,
+                        password: user.password.__hash
+                    });
+                });
+            }
+            /**
+             * Change the current user's password: revokes the refresh tokens and ends the other sessions of the user, the
+             * calling cookie session is re-stamped and stays logged in
+             * @param current - current password
+             * @param next - new password
+             */
+            async changePassword(current, next) {
+                const ctx = useContext();
+                if (!ctx.getSession()?.isLogged()) {
+                    throw new WebdaError.Unauthorized("Login required");
+                }
+                const user = await ctx.getCurrentUser();
+                await runAsSystem(() => user.password.change(current, next));
+                // Every session authenticated before the change ends, except this one (a Bearer caller logs in again)
+                ctx.getSession().authAt = Date.now();
+                await useAuthentication().emit("Authentication.PasswordUpdate", {
+                    context: ctx,
+                    user,
+                    password: user.password.__hash
+                });
+            }
+            /**
+             * Browser landing for recovery links: redirects a valid recover token to `redirects.recover` without consuming it,
+             * anything else to `redirects.failure`; never throws
+             * @param ctx - web context
+             */
+            async recoverRedirect(ctx) {
+                const { recover, failure } = this.parameters.redirects;
+                const token = ctx.parameter("token");
+                try {
+                    await verifyEmailToken(token, "recover");
+                    ctx.writeHead(302, { Location: `${recover}?token=${encodeURIComponent(token)}` });
+                }
+                catch (err) {
+                    ctx.writeHead(302, {
+                        Location: `${failure}?reason=${encodeURIComponent(err?.code ?? "TOKEN_INVALID")}`
+                    });
+                }
+            }
+            /**
+             * Browser landing for emailed links: verifies then redirects, never throws
+             * @param ctx - web context
+             */
+            async verifyRedirect(ctx) {
+                const { verified, failure, register } = this.parameters.redirects;
+                const confirm = this.parameters.redirects.confirm ?? failure;
+                const token = ctx.parameter("token");
+                const redirect = (url) => ctx.writeHead(302, { Location: url });
+                try {
+                    const claims = await verifyEmailToken(token, "verify");
+                    if (!claims.sub || !this.sessionMatches(claims, ctx)) {
+                        // Nothing changes: a mail scanner prefetching the link must not verify anything
+                        redirect(`${confirm}?reason=LOGIN_REQUIRED&token=${encodeURIComponent(token)}`);
+                        return;
+                    }
+                    await this.completeVerify(claims, ctx);
+                    redirect(`${verified}?validation=email`);
+                }
+                catch (err) {
+                    try {
+                        const claims = await verifyEmailToken(token, "register");
+                        redirect(`${register}?token=${encodeURIComponent(token)}&email=${encodeURIComponent(claims.email)}`);
+                    }
+                    catch {
+                        redirect(`${failure}?reason=${encodeURIComponent(err?.code ?? "TOKEN_INVALID")}`);
+                    }
+                }
+            }
+        },
+        (() => {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _login_decorators = [Operation({
+                    id: "Auth.Email.Login",
+                    input: "EmailPasswordProvider.login.input",
+                    output: "EmailPasswordProvider.login.output",
+                    rest: { method: "post", path: "auth/email/login" }
+                })];
+            _register_decorators = [Operation({
+                    id: "Auth.Email.Register",
+                    input: "EmailPasswordProvider.register.input",
+                    output: "EmailPasswordProvider.register.output",
+                    rest: { method: "post", path: "auth/email/register" }
+                })];
+            _startVerification_decorators = [Operation({
+                    id: "Auth.Email.StartVerification",
+                    input: "EmailPasswordProvider.startVerification.input",
+                    rest: { method: "post", path: "auth/email/verification" }
+                })];
+            _verify_decorators = [Operation({
+                    id: "Auth.Email.Verify",
+                    input: "EmailPasswordProvider.verify.input",
+                    output: "EmailPasswordProvider.verify.output",
+                    rest: { method: "post", path: "auth/email/verify" }
+                })];
+            _startRecovery_decorators = [Operation({
+                    id: "Auth.Password.StartRecovery",
+                    input: "EmailPasswordProvider.startRecovery.input",
+                    rest: { method: "post", path: "auth/password/recovery" }
+                })];
+            _recover_decorators = [Operation({
+                    id: "Auth.Password.Recover",
+                    input: "EmailPasswordProvider.recover.input",
+                    rest: { method: "post", path: "auth/password/recover" }
+                })];
+            _changePassword_decorators = [Operation({
+                    id: "Auth.Password.Change",
+                    input: "EmailPasswordProvider.changePassword.input",
+                    rest: { method: "post", path: "auth/password/change" }
+                })];
+            _recoverRedirect_decorators = [Route("./recover{?token}", ["GET"], { hidden: true })];
+            _verifyRedirect_decorators = [Route("./verify{?token}", ["GET"], { hidden: true })];
+            __esDecorate(_a, null, _login_decorators, { kind: "method", name: "login", static: false, private: false, access: { has: obj => "login" in obj, get: obj => obj.login }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _register_decorators, { kind: "method", name: "register", static: false, private: false, access: { has: obj => "register" in obj, get: obj => obj.register }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _startVerification_decorators, { kind: "method", name: "startVerification", static: false, private: false, access: { has: obj => "startVerification" in obj, get: obj => obj.startVerification }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _verify_decorators, { kind: "method", name: "verify", static: false, private: false, access: { has: obj => "verify" in obj, get: obj => obj.verify }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _startRecovery_decorators, { kind: "method", name: "startRecovery", static: false, private: false, access: { has: obj => "startRecovery" in obj, get: obj => obj.startRecovery }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _recover_decorators, { kind: "method", name: "recover", static: false, private: false, access: { has: obj => "recover" in obj, get: obj => obj.recover }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _changePassword_decorators, { kind: "method", name: "changePassword", static: false, private: false, access: { has: obj => "changePassword" in obj, get: obj => obj.changePassword }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _recoverRedirect_decorators, { kind: "method", name: "recoverRedirect", static: false, private: false, access: { has: obj => "recoverRedirect" in obj, get: obj => obj.recoverRedirect }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _verifyRedirect_decorators, { kind: "method", name: "verifyRedirect", static: false, private: false, access: { has: obj => "verifyRedirect" in obj, get: obj => obj.verifyRedirect }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(_a, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        })(),
+        _a.Parameters = EmailPasswordParameters,
+        _a;
+})();
+export { EmailPasswordProvider };
+//# sourceMappingURL=emailpassword.service.js.map