@yunsoft/yuncms-core 0.1.11 → 0.1.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yunsoft/yuncms-core",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "Core services, schema, authentication, permissions and storage primitives for YunCMS.",
   "license": "MIT",
   "type": "module",

package/src/bootstrap.js

@@ -17,6 +17,8 @@ import { aiSettingsMigration } from './migrations/0014-ai-settings.js';
 import { navigationGroupsMigration } from './migrations/0015-navigation-groups.js';
 import { navigationGroupCollapseMigration } from './migrations/0016-navigation-group-collapse.js';
 import { mcpSettingsMigration } from './migrations/0017-mcp-settings.js';
+import { publicRegistrationSettingsMigration } from './migrations/0018-public-registration-settings.js';
+import { publicRegistrationEmailVerificationMigration } from './migrations/0019-public-registration-email-verification.js';
 import { readSchemaVersion } from './schema-version.js';
 import { ensurePublicRole } from './setup.js';
 
@@ -38,6 +40,8 @@ export const CORE_MIGRATIONS = Object.freeze([
   navigationGroupsMigration,
   navigationGroupCollapseMigration,
   mcpSettingsMigration,
+  publicRegistrationSettingsMigration,
+  publicRegistrationEmailVerificationMigration,
 ]);
 
 export const REQUIRED_CORE_MIGRATION_IDS = Object.freeze(

package/src/migrations/0018-public-registration-settings.js

@@ -0,0 +1,10 @@
+export const publicRegistrationSettingsMigration = {
+  id: '0018-public-registration-settings',
+  statements: [
+    `ALTER TABLE yuncms_studio_settings
+      ADD COLUMN public_registration_enabled TINYINT(1) NOT NULL DEFAULT 0 AFTER default_locale,
+      ADD COLUMN public_registration_role CHAR(36) NULL AFTER public_registration_enabled,
+      ADD CONSTRAINT fk_yuncms_studio_settings_public_registration_role
+        FOREIGN KEY (public_registration_role) REFERENCES yuncms_roles(id) ON DELETE SET NULL`,
+  ],
+};

package/src/migrations/0019-public-registration-email-verification.js

@@ -0,0 +1,8 @@
+export const publicRegistrationEmailVerificationMigration = {
+  id: '0019-public-registration-email-verification',
+  statements: [
+    `ALTER TABLE yuncms_studio_settings
+      ADD COLUMN public_registration_require_email_verification TINYINT(1) NOT NULL DEFAULT 0
+      AFTER public_registration_role`,
+  ],
+};

package/src/services/auth-service.js

@@ -13,6 +13,12 @@ function invalidLogin() {
   return error;
 }
 
+function emailNotVerified() {
+  const error = new Error('Email verification is required before sign in');
+  error.code = 'EMAIL_NOT_VERIFIED';
+  return error;
+}
+
 function invalidToken() {
   const error = new Error('Invalid or expired authentication token');
   error.code = 'INVALID_CREDENTIALS';
@@ -95,6 +101,23 @@ export class AuthService extends BaseService {
       throw invalidLogin();
     }
 
+    if (!user.email_verified_at) {
+      const [settingsRows] = await this.database.query(
+        `SELECT public_registration_require_email_verification
+         FROM yuncms_studio_settings
+         WHERE id = 1
+         LIMIT 1`,
+      );
+      if (settingsRows[0]?.public_registration_require_email_verification) {
+        await this.action('auth.login.failed', {
+          method: 'local',
+          reason: 'email_not_verified',
+          user: user.id,
+        }, { ip });
+        throw emailNotVerified();
+      }
+    }
+
     const tokens = await this.createSessionsService().createForUser(user, { ip, userAgent });
     await this.action('auth.login.success', {
       method: 'local',

package/src/services/auth-tokens-service.js

@@ -30,6 +30,13 @@ function assertPositiveTtl(ttlMs) {
   }
 }
 
+function assertVerificationManager(accountability) {
+  if (accountability.system === true || accountability.admin === true) return;
+  const error = new Error('Email verification lookup requires administrator accountability');
+  error.code = 'FORBIDDEN';
+  throw error;
+}
+
 export class AuthTokensService extends BaseService {
   async createForUser(userId, type, { ttlMs = DEFAULT_TTL_MS[type] } = {}) {
     if (!TOKEN_TYPES[type]) {
@@ -162,6 +169,28 @@ export class AuthTokensService extends BaseService {
     return this.createForUser(userId, 'verify', options);
   }
 
+  async requestEmailVerification(email, options = {}) {
+    assertVerificationManager(this.accountability);
+
+    let normalized;
+    try {
+      normalized = normalizeEmail(email);
+    } catch {
+      return null;
+    }
+
+    const user = await readAuthenticationUserByEmail(this.database, normalized);
+    if (!user || user.status !== 'active' || user.email_verified_at) return null;
+    const result = await this.createForUser(user.id, 'verify', options);
+    return {
+      ...result,
+      user: {
+        id: user.id,
+        email: user.email,
+      },
+    };
+  }
+
   async verifyEmail(token) {
     if (tokenType(token) !== 'verify') throw invalidActionToken();
     const connection = await this.database.getConnection();

package/src/services/studio-settings-service.js

@@ -68,6 +68,18 @@ function normalizeLocale(value) {
   return normalized;
 }
 
+function normalizeBoolean(value, label) {
+  if (value === true || value === false) return value;
+  throw invalid(`${label} must be a boolean`);
+}
+
+function normalizeRegistrationRole(value) {
+  if (value == null || value === '') return null;
+  const normalized = String(value).trim();
+  if (!UUID_PATTERN.test(normalized)) throw invalid('Public registration role id must be a UUID');
+  return normalized;
+}
+
 function publicSettings(row) {
   return {
     brand_name: row.brand_name,
@@ -77,14 +89,25 @@ function publicSettings(row) {
     accent_color: row.accent_color,
     theme: row.theme,
     default_locale: row.default_locale,
+    public_registration_enabled: Boolean(row.public_registration_enabled),
+    public_registration_require_email_verification: Boolean(row.public_registration_require_email_verification),
     updated_at: row.updated_at ?? null,
   };
 }
 
+function managedSettings(row) {
+  return {
+    ...publicSettings(row),
+    public_registration_role: row.public_registration_role ?? null,
+  };
+}
+
 export class StudioSettingsService extends BaseService {
-  async readPublic() {
+  async #readSettingsRow() {
     const [rows] = await this.database.query(
-      `SELECT brand_name, logo_url, logo_file, favicon_file, accent_color, theme, default_locale, updated_at
+      `SELECT brand_name, logo_url, logo_file, favicon_file, accent_color, theme, default_locale,
+              public_registration_enabled, public_registration_role,
+              public_registration_require_email_verification, updated_at
        FROM yuncms_studio_settings
        WHERE id = 1
        LIMIT 1`,
@@ -95,12 +118,16 @@ export class StudioSettingsService extends BaseService {
       error.code = 'DATABASE_MIGRATION_REQUIRED';
       throw error;
     }
-    return publicSettings(row);
+    return row;
+  }
+
+  async readPublic() {
+    return publicSettings(await this.#readSettingsRow());
   }
 
   async readOne() {
     assertManager(this.accountability);
-    return this.readPublic();
+    return managedSettings(await this.#readSettingsRow());
   }
 
   async readImageAssetContent(settingKey, label) {
@@ -147,16 +174,55 @@ export class StudioSettingsService extends BaseService {
     }
   }
 
+  async validateRegistrationRole(roleId) {
+    if (!roleId) return;
+    const [roles] = await this.database.query(
+      'SELECT id, admin, public FROM yuncms_roles WHERE id = ? LIMIT 1',
+      [roleId],
+    );
+    const role = roles[0];
+    if (!role) throw invalid('Selected public registration role does not exist');
+    if (role.admin) throw invalid('Administrator roles cannot be used for public registration');
+    if (role.public) throw invalid('The unauthenticated public role cannot be used for registered users');
+  }
+
   async updateOne(patch = {}) {
     assertManager(this.accountability);
     if (!patch || typeof patch !== 'object' || Array.isArray(patch)) throw invalid('Studio settings patch must be an object');
 
     const keys = Object.keys(patch);
-    const allowed = new Set(['brand_name', 'logo_url', 'logo_file', 'favicon_file', 'accent_color', 'theme', 'default_locale']);
+    const allowed = new Set([
+      'brand_name',
+      'logo_url',
+      'logo_file',
+      'favicon_file',
+      'accent_color',
+      'theme',
+      'default_locale',
+      'public_registration_enabled',
+      'public_registration_role',
+      'public_registration_require_email_verification',
+    ]);
     if (keys.length === 0 || keys.some((key) => !allowed.has(key))) {
       throw invalid('Studio settings patch contains unsupported properties');
     }
 
+    let normalizedRegistrationEnabled;
+    let normalizedRegistrationRole;
+    if (Object.hasOwn(patch, 'public_registration_enabled') || Object.hasOwn(patch, 'public_registration_role')) {
+      const current = await this.readOne();
+      normalizedRegistrationEnabled = Object.hasOwn(patch, 'public_registration_enabled')
+        ? normalizeBoolean(patch.public_registration_enabled, 'Public registration enabled')
+        : current.public_registration_enabled;
+      normalizedRegistrationRole = Object.hasOwn(patch, 'public_registration_role')
+        ? normalizeRegistrationRole(patch.public_registration_role)
+        : current.public_registration_role;
+      await this.validateRegistrationRole(normalizedRegistrationRole);
+      if (normalizedRegistrationEnabled && !normalizedRegistrationRole) {
+        throw invalid('A non-administrator role must be selected before public registration can be enabled');
+      }
+    }
+
     const assignments = [];
     const params = [];
     if (Object.hasOwn(patch, 'brand_name')) {
@@ -191,13 +257,28 @@ export class StudioSettingsService extends BaseService {
       assignments.push('default_locale = ?');
       params.push(normalizeLocale(patch.default_locale));
     }
+    if (Object.hasOwn(patch, 'public_registration_enabled')) {
+      assignments.push('public_registration_enabled = ?');
+      params.push(normalizedRegistrationEnabled ? 1 : 0);
+    }
+    if (Object.hasOwn(patch, 'public_registration_role')) {
+      assignments.push('public_registration_role = ?');
+      params.push(normalizedRegistrationRole);
+    }
+    if (Object.hasOwn(patch, 'public_registration_require_email_verification')) {
+      assignments.push('public_registration_require_email_verification = ?');
+      params.push(normalizeBoolean(
+        patch.public_registration_require_email_verification,
+        'Public registration email verification requirement',
+      ) ? 1 : 0);
+    }
 
     params.push(1);
     await this.database.query(
       `UPDATE yuncms_studio_settings SET ${assignments.join(', ')} WHERE id = ?`,
       params,
     );
-    return this.readPublic();
+    return this.readOne();
   }
 }
 
@@ -209,4 +290,7 @@ export const STUDIO_SETTING_DEFAULTS = Object.freeze({
   accent_color: '#2563eb',
   theme: 'system',
   default_locale: 'en',
+  public_registration_enabled: false,
+  public_registration_role: null,
+  public_registration_require_email_verification: false,
 });

package/src/services/users-service.js

@@ -7,6 +7,7 @@ import { resolveSystemResourceAccess } from './system-resource-access.js';
 
 const USER_STATUSES = new Set(['active', 'suspended', 'disabled']);
 const USER_UPDATE_KEYS = new Set(['email', 'role', 'status']);
+const PUBLIC_REGISTRATION_KEYS = new Set(['email', 'password']);
 
 function normalizeEmail(email) {
   if (typeof email !== 'string') {
@@ -29,6 +30,12 @@ function forbidden(message) {
   return error;
 }
 
+function invalid(message) {
+  const error = new Error(message);
+  error.code = 'INVALID_PAYLOAD';
+  return error;
+}
+
 function assertStatus(status) {
   if (!USER_STATUSES.has(status)) {
     const error = new Error(`Unsupported user status: ${status}`);
@@ -154,6 +161,63 @@ export class UsersService extends BaseService {
     return user;
   }
 
+  async registerPublic(input = {}) {
+    if (this.accountability.public !== true) {
+      throw forbidden('Public registration is available only to unauthenticated requests');
+    }
+
+    const [settingsRows] = await this.database.query(
+      `SELECT public_registration_enabled, public_registration_role,
+              public_registration_require_email_verification
+       FROM yuncms_studio_settings
+       WHERE id = 1
+       LIMIT 1`,
+    );
+    const settings = settingsRows[0];
+    if (!settings) {
+      const error = new Error('Studio settings are missing; run YunCMS bootstrap');
+      error.code = 'DATABASE_MIGRATION_REQUIRED';
+      throw error;
+    }
+    if (!settings.public_registration_enabled) {
+      throw forbidden('Public registration is disabled');
+    }
+    if (!settings.public_registration_role) {
+      throw forbidden('Public registration has no assigned user role');
+    }
+
+    const [roleRows] = await this.database.query(
+      'SELECT id, admin, public FROM yuncms_roles WHERE id = ? LIMIT 1',
+      [settings.public_registration_role],
+    );
+    const role = roleRows[0];
+    if (!role || role.admin || role.public) {
+      throw forbidden('Public registration role is invalid');
+    }
+
+    if (!input || typeof input !== 'object' || Array.isArray(input)) {
+      throw invalid('Public registration payload must be an object');
+    }
+    const keys = Object.keys(input);
+    if (keys.some((key) => !PUBLIC_REGISTRATION_KEYS.has(key))) {
+      throw invalid('Public registration accepts email and password only');
+    }
+
+    const email = normalizeEmail(input.email);
+    const passwordHash = await hashPassword(input.password);
+    const id = randomUUID();
+    const verifiedAt = settings.public_registration_require_email_verification ? null : new Date();
+    await this.database.query(
+      `INSERT INTO yuncms_users (id, email, password_hash, role, status, email_verified_at)
+       VALUES (?, ?, ?, ?, 'active', ?)`,
+      [id, email, passwordHash, role.id, verifiedAt],
+    );
+
+    const user = await this.#readOneUnsafe(id);
+    await this.action('users.create', { key: id, item: user, publicRegistration: true });
+    return user;
+  }
+
   async updateOne(id, patch = {}) {
     await resolveSystemResourceAccess(this, 'update', 'yuncms_users');
     await assertTargetManageable(this.database, id, this.accountability);