@yunsoft/yuncms-api 0.1.11 → 0.1.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yunsoft/yuncms-api",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "Express API runtime and bundled Studio server for YunCMS.",
   "license": "MIT",
   "type": "module",
@@ -35,7 +35,7 @@
     "@modelcontextprotocol/node": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@node-saml/node-saml": "5.1.0",
-    "@yunsoft/yuncms-core": "0.1.11",
+    "@yunsoft/yuncms-core": "0.1.13",
     "express": "5.2.1",
     "ldapts": "9.0.0",
     "openid-client": "6.8.7",

package/src/error-response.js

@@ -5,6 +5,7 @@ const STATUS_BY_CODE = new Map([
   ['UNAUTHORIZED', 401],
   ['FORBIDDEN', 403],
   ['FORBIDDEN_FIELD', 403],
+  ['EMAIL_NOT_VERIFIED', 403],
   ['SELF_ADMIN_MUTATION_FORBIDDEN', 403],
   ['PROTECTED_ROLE', 403],
   ['SYSTEM_SCHEMA_READ_ONLY', 403],

package/src/routes/auth.js

@@ -1,3 +1,4 @@
+import { createSystemAccountability } from '@yunsoft/yuncms-core';
 import express from 'express';
 
 import { createFixedWindowRateLimit } from '../rate-limit.js';
@@ -7,10 +8,20 @@ function service(req, name) {
   const Service = req.context.services[name];
   return new Service(serviceOptionsFromRequest(req));
 }
+function systemService(req, name) {
+  const Service = req.context.services[name];
+  return new Service({
+    ...serviceOptionsFromRequest(req),
+    accountability: createSystemAccountability(),
+  });
+}
 function authService(req) { return service(req, 'AuthService'); }
 function authTokensService(req) { return service(req, 'AuthTokensService'); }
+function systemAuthTokensService(req) { return systemService(req, 'AuthTokensService'); }
 function apiTokensService(req) { return service(req, 'ApiTokensService'); }
 function usersService(req) { return service(req, 'UsersService'); }
+function systemUsersService(req) { return systemService(req, 'UsersService'); }
+function studioSettingsService(req) { return service(req, 'StudioSettingsService'); }
 function externalAuthService(req, registry) {
   const Service = req.context.services.ExternalAuthService;
   return new Service({
@@ -45,6 +56,14 @@ function actionUrl(config, action, token) {
   return `${config.auth.publicUrl}/?auth_action=${encodeURIComponent(action)}&token=${encodeURIComponent(token)}`;
 }
 
+function verificationMessage(config, token) {
+  const url = actionUrl(config, 'verify', token);
+  return {
+    subject: 'Verify your YunCMS email',
+    text: `Verify your YunCMS email address by opening this link:\n${url}\n\nIf you did not request this, you can ignore this message.`,
+  };
+}
+
 function noStore(req, res, next) {
   res.set('cache-control', 'no-store');
   res.set('pragma', 'no-cache');
@@ -97,6 +116,43 @@ export function createAuthRouter({
     res.json({ data: externalAuthRegistry?.publicProviders?.() ?? [] });
   });
 
+  router.post('/register', actionLimit, async (req, res) => {
+    const settings = await studioSettingsService(req).readPublic();
+    const verificationRequired = settings.public_registration_require_email_verification === true;
+    const transport = verificationRequired ? requireMailer(mailer) : null;
+    const data = await usersService(req).registerPublic(req.body ?? {});
+
+    if (verificationRequired) {
+      try {
+        const result = await systemAuthTokensService(req).createEmailVerification(data.id);
+        const message = verificationMessage(config, result.token);
+        await transport.send({ to: data.email, ...message }, {
+          accountability: req.accountability,
+          requestId: req.id,
+        });
+      } catch (error) {
+        try {
+          await systemUsersService(req).deleteOne(data.id);
+        } catch (cleanupError) {
+          logger.error?.('YunCMS public registration cleanup failed', {
+            requestId: req.id,
+            user: data.id,
+            code: cleanupError?.code,
+            message: cleanupError?.message,
+          });
+        }
+        throw error;
+      }
+    }
+
+    res.status(201).json({
+      data: {
+        ...data,
+        email_verification_required: verificationRequired,
+      },
+    });
+  });
+
   router.post('/login', loginLimit, async (req, res) => {
     const result = await authService(req).login({ email: req.body?.email, password: req.body?.password, ip: req.ip ?? null, userAgent: req.get('user-agent') ?? null });
     res.json({ data: result });
@@ -210,12 +266,35 @@ export function createAuthRouter({
     res.status(204).end();
   });
   router.post('/email-verification/request', actionLimit, async (req, res) => {
-    const transport = requireMailer(mailer);
     if (!req.accountability?.user) {
-      const error = new Error('Authentication is required to request email verification');
-      error.code = 'UNAUTHORIZED';
-      throw error;
+      const settings = await studioSettingsService(req).readPublic();
+      if (settings.public_registration_require_email_verification !== true) {
+        res.status(202).json({ data: { accepted: true } });
+        return;
+      }
+
+      const transport = requireMailer(mailer);
+      const result = await systemAuthTokensService(req).requestEmailVerification(req.body?.email);
+      if (result) {
+        try {
+          const message = verificationMessage(config, result.token);
+          await transport.send({ to: result.user.email, ...message }, {
+            accountability: req.accountability,
+            requestId: req.id,
+          });
+        } catch (error) {
+          logger.error?.('YunCMS public email verification mail delivery failed', {
+            requestId: req.id,
+            code: error?.code,
+            message: error?.message,
+          });
+        }
+      }
+      res.status(202).json({ data: { accepted: true } });
+      return;
     }
+
+    const transport = requireMailer(mailer);
     const userId = req.body?.user ?? req.accountability.user;
     const user = await usersService(req).readOne(userId);
     if (!user) {
@@ -224,8 +303,11 @@ export function createAuthRouter({
       throw error;
     }
     const result = await authTokensService(req).createEmailVerification(userId);
-    const url = actionUrl(config, 'verify', result.token);
-    await transport.send({ to: user.email, subject: 'Verify your YunCMS email', text: `Verify your YunCMS email address by opening this link:\n${url}\n\nIf you did not request this, you can ignore this message.` }, { accountability: req.accountability, requestId: req.id });
+    const message = verificationMessage(config, result.token);
+    await transport.send({ to: user.email, ...message }, {
+      accountability: req.accountability,
+      requestId: req.id,
+    });
     res.status(202).json({ data: { accepted: true } });
   });
   router.post('/email-verification/confirm', actionLimit, async (req, res) => {

package/src/routes/studio-settings.js

@@ -26,6 +26,10 @@ export function createStudioSettingsRouter() {
     sendImageAsset(res, await settingsService(req).readFaviconContent());
   });
 
+  router.get('/admin', async (req, res) => {
+    res.json({ data: await settingsService(req).readOne() });
+  });
+
   router.get('/', async (req, res) => {
     res.json({ data: await settingsService(req).readPublic() });
   });