adapt-authoring-auth-local 2.4.1 → 2.6.0

package/conf/config.schema.json

@@ -35,6 +35,11 @@
       "isTimeMs": true,
       "default": "7d"
     },
+    "resetUrl": {
+      "description": "Reset link path appended to the server root URL, matching the UI's reset route. Supports {{token}} and {{email}}.",
+      "type": "string",
+      "default": "#user/reset?token={{token}}&email={{email}}"
+    },
     "minPasswordLength": {
       "description": "Minimum password length",
       "type": "number",

package/lib/LocalAuthModule.js

@@ -1,6 +1,6 @@
 import _ from 'lodash'
 import { AbstractAuthModule } from 'adapt-authoring-auth'
-import { compare, getRandomHex, validate } from './utils.js'
+import { compare, getRandomHex, isSmtpConnectionError, validate } from './utils.js'
 import { formatDistanceToNowStrict as toNow } from 'date-fns'
 import PasswordUtils from './PasswordUtils.js'
 /**
@@ -88,9 +88,42 @@ class LocalAuthModule extends AbstractAuthModule {
 
   /** @override */
   async register (data) {
+    const passwordProvided = Boolean(data.password)
     data.password = data.password ?? await getRandomHex()
     await validate(data.password)
-    return super.register({ ...data, password: await PasswordUtils.generate(data.password) })
+    const user = await super.register({ ...data, password: await PasswordUtils.generate(data.password) })
+    // No password supplied: the generated one is unusable, so invite the user to
+    // set their own — but a mail failure must not fail registration, hence catch.
+    if (!passwordProvided) {
+      try {
+        await this.sendInvite(data.email)
+      } catch (e) {
+        this.log('warn', `failed to send invite to ${data.email}: ${e.message}`)
+      }
+    }
+    return user
+  }
+
+  /**
+   * Emails a set-password invite to a user, reusing the invite password-reset
+   * flow. No-op when no mailer is configured. Throws on send failure — callers
+   * that shouldn't fail on a mail error (e.g. registration) must catch.
+   * @param {String} email
+   */
+  async sendInvite (email) {
+    const mailer = await this.app.waitForModule('mailer')
+    if (!mailer.isEnabled) return
+    const appName = this.app.config.get('adapt-authoring-core.appName')
+    const t = (k) => this.app.lang.translate(undefined, `app.${k}`, { appName })
+    await this.createPasswordReset(email, {
+      subject: t('email_invite_subject'),
+      content: {
+        emblem: 'spark',
+        title: t('email_invite_title'),
+        body: t('email_invite_body'),
+        button: { label: t('email_invite_button') }
+      }
+    }, this.getConfig('inviteTokenLifespan'))
   }
 
   /**
@@ -147,11 +180,20 @@ class LocalAuthModule extends AbstractAuthModule {
 
     await this.disavowUser({ userId: user._id, authType: this.type })
 
-    const subject = this.app.lang.translate(undefined, 'app.updateusersubject')
-    const text = this.app.lang.translate(undefined, 'app.updateusertext')
-    const html = this.app.lang.translate(undefined, 'app.updateuserhtml')
+    const appName = this.app.config.get('adapt-authoring-core.appName')
+    const t = (k) => this.app.lang.translate(undefined, `app.${k}`, { appName })
     try {
-      if (mailer.isEnabled) await mailer.send({ to: user.email, subject, text, html })
+      if (mailer.isEnabled) {
+        await mailer.sendTemplated({
+          to: user.email,
+          subject: t('email_passwordupdated_subject'),
+          content: {
+            emblem: 'check',
+            title: t('email_passwordupdated_title'),
+            body: t('email_passwordupdated_body')
+          }
+        })
+      }
     } catch (e) {
       this.log('error', e)
     }
@@ -160,29 +202,34 @@ class LocalAuthModule extends AbstractAuthModule {
   }
 
   /**
-   * Creates a new password reset token and sends an email
+   * Creates a new password reset token and sends a templated email. The reset URL
+   * is built here and injected into the content's button.
    * @param {String} email
-   * @param {String} subject
-   * @param {String} textContent
-   * @param {String} htmlContent
+   * @param {Object} message
+   * @param {String} message.subject Email subject (already translated)
+   * @param {Object} message.content Templated-email content ({ emblem?, title, body, button? }) — the button's url is set here
    * @param {Number} lifespan The lifespan of the reset
    */
-  async createPasswordReset (email, subject, textContent, htmlContent, lifespan) {
+  async createPasswordReset (email, { subject, content } = {}, lifespan) {
     if (!email) {
       throw this.app.errors.INVALID_PARAMS.setData({ params: ['email'] })
     }
     try {
       const [mailer, server] = await this.app.waitForModule('mailer', 'server')
       const token = await PasswordUtils.createReset(email, lifespan)
-      const url = `${server.root.url}#user/reset?token=${token}&email=${email}`
-      await mailer.send({
-        to: email,
-        subject,
-        text: textContent.replace(/{{url}}/g, url),
-        html: htmlContent.replace(/{{url}}/g, url)
-      })
+      // resetUrl supplies the path; host comes from the server.
+      const path = this.getConfig('resetUrl')
+        .replace(/{{token}}/g, token)
+        .replace(/{{email}}/g, email)
+      if (content?.button) content.button.url = `${server.root.url}${path}`
+      await mailer.sendTemplated({ to: email, subject, content })
     } catch (e) {
-      this.log('error', `Failed to create user password reset, ${e}`)
+      const cause = e?.data?.error ?? e
+      if (isSmtpConnectionError(e)) {
+        this.log('error', `Could not reach the SMTP server — check adapt-authoring-mailer is enabled with a valid connectionUrl and the server is running. Cause: ${cause.message ?? cause}`)
+      } else {
+        this.log('error', `Failed to create user password reset: ${cause.message ?? cause}`)
+      }
       throw e
     }
   }
@@ -196,10 +243,7 @@ class LocalAuthModule extends AbstractAuthModule {
   async inviteHandler (req, res, next) {
     try {
       const { email } = req.body
-      const subject = req.translate('app.invitepasswordsubject')
-      const text = req.translate('app.invitepasswordtext')
-      const html = req.translate('app.invitepasswordhtml')
-      await this.createPasswordReset(email, subject, text, html, this.getConfig('inviteTokenLifespan'))
+      await this.sendInvite(email)
       this.log('debug', 'INVITE_SENT', email, req?.auth?.user?._id?.toString())
     } catch (e) {
       return next(e)
@@ -231,10 +275,17 @@ class LocalAuthModule extends AbstractAuthModule {
   async forgotPasswordHandler (req, res, next) {
     try {
       const { email } = req.body
-      const subject = req.translate('app.forgotpasswordsubject')
-      const text = req.translate('app.forgotpasswordtext')
-      const html = req.translate('app.forgotpasswordhtml')
-      await this.createPasswordReset(email, subject, text, html)
+      const appName = this.app.config.get('adapt-authoring-core.appName')
+      const t = (k) => this.app.lang.translate(undefined, `app.${k}`, { appName })
+      await this.createPasswordReset(email, {
+        subject: t('email_reset_subject'),
+        content: {
+          emblem: 'key',
+          title: t('email_reset_title'),
+          body: t('email_reset_body'),
+          button: { label: t('email_reset_button') }
+        }
+      })
       this.log('debug', 'RESET_SENT', email, req?.auth?.user?._id?.toString())
     } catch (e) { // don't return an error to avoid signifying correct user/pass combinations
       this.log('error', 'RESET_PASS_FAILED', e)

package/lib/utils/isSmtpConnectionError.js

@@ -0,0 +1,16 @@
+/**
+ * Whether a mailer failure stems from being unable to reach the SMTP server
+ * (vs. a rejected/invalid message). MailerModule wraps the underlying transport
+ * error in err.data.error, so inspect that as well as the error itself.
+ * @param {Error} err Error thrown by the mailer
+ * @returns {Boolean}
+ * @memberof localauth
+ */
+const CONNECTION_CODES = ['ECONNREFUSED', 'ECONNRESET', 'ECONNECTION', 'ETIMEDOUT', 'ESOCKET', 'ENOTFOUND', 'EAI_AGAIN', 'EHOSTUNREACH', 'EDNS']
+
+export function isSmtpConnectionError (err) {
+  const cause = err?.data?.error ?? err
+  if (!cause) return false
+  if (CONNECTION_CODES.includes(cause.code)) return true
+  return typeof cause.message === 'string' && CONNECTION_CODES.some(code => cause.message.includes(code))
+}

package/lib/utils.js

@@ -1,3 +1,4 @@
 export { compare } from './utils/compare.js'
 export { getRandomHex } from './utils/getRandomHex.js'
+export { isSmtpConnectionError } from './utils/isSmtpConnectionError.js'
 export { validate } from './utils/validate.js'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "adapt-authoring-auth-local",
-  "version": "2.4.1",
+  "version": "2.6.0",
   "description": "Module which implements username/password (local) authentication",
   "homepage": "https://github.com/adapt-security/adapt-authoring-auth-local",
   "license": "GPL-3.0",
@@ -19,7 +19,7 @@
   },
   "peerDependencies": {
     "adapt-authoring-jsonschema": "^1.2.0",
-    "adapt-authoring-mailer": "^1.0.2",
+    "adapt-authoring-mailer": "^1.6.0",
     "adapt-authoring-mongodb": "^3.0.0",
     "adapt-authoring-roles": "^1.1.3",
     "adapt-authoring-server": "^2.1.0",

package/routes.json

@@ -141,6 +141,7 @@
                   "type": "object",
                   "properties": {
                     "email": { "type": "string" },
+                    "oldPassword": { "type": "string" },
                     "password": { "type": "string" },
                     "token": { "type": "string" }
                   }

package/tests/LocalAuthModule.spec.js

@@ -46,6 +46,7 @@ let disavowCalls = []
 let secureRouteCalls = []
 let unsecureRouteCalls = []
 let mailerSendCalls = []
+let mailerSendTemplatedCalls = []
 
 const mockUsers = {
   find: async (query) => usersStore.filter(u => {
@@ -72,7 +73,8 @@ const mockRoles = {
 
 const mockMailer = {
   isEnabled: true,
-  send: async (opts) => { mailerSendCalls.push(opts) }
+  send: async (opts) => { mailerSendCalls.push(opts) },
+  sendTemplated: async (opts) => { mailerSendTemplatedCalls.push(opts) }
 }
 
 const mockServer = {
@@ -114,6 +116,7 @@ const mockApp = {
     if (names.length === 1) return moduleMap[names[0]]
     return names.map(n => moduleMap[n])
   },
+  config: { get: () => 'Adapt' },
   lang: {
     translate: (_, key) => 'translated:' + key
   }
@@ -570,10 +573,20 @@ describe('LocalAuthModule', () => {
     })
 
     it('should send email notification after password update when mailer is enabled', async () => {
-      mailerSendCalls = []
+      mailerSendTemplatedCalls = []
       await mod.updateUser('user-id-1', { password: 'newpassword' })
-      assert.ok(mailerSendCalls.length > 0)
-      assert.equal(mailerSendCalls[0].to, 'test@example.com')
+      assert.ok(mailerSendTemplatedCalls.length > 0)
+      assert.equal(mailerSendTemplatedCalls[0].to, 'test@example.com')
+    })
+
+    it('should send a templated password-updated email (check emblem, no button)', async () => {
+      mailerSendTemplatedCalls = []
+      await mod.updateUser('user-id-1', { password: 'newpassword' })
+      const sent = mailerSendTemplatedCalls[0]
+      assert.equal(sent.content.emblem, 'check')
+      assert.ok(sent.subject)
+      assert.ok(sent.content.title)
+      assert.equal(sent.content.button, undefined)
     })
 
     it('should pass useDefaults:false and ignoreRequired:true for non-password updates', async () => {
@@ -581,6 +594,31 @@ describe('LocalAuthModule', () => {
     })
   })
 
+  describe('#sendInvite()', () => {
+    it('should build invite content (spark emblem + set-password button) for createPasswordReset', async () => {
+      let captured
+      const original = mod.createPasswordReset.bind(mod)
+      mod.createPasswordReset = async (email, message) => { captured = { email, message } }
+      await mod.sendInvite('invite@example.com')
+      mod.createPasswordReset = original
+      assert.equal(captured.email, 'invite@example.com')
+      assert.equal(captured.message.content.emblem, 'spark')
+      assert.ok(captured.message.subject)
+      assert.ok(captured.message.content.button.label)
+    })
+
+    it('should be a no-op when the mailer is disabled', async () => {
+      mockMailer.isEnabled = false
+      let called = false
+      const original = mod.createPasswordReset.bind(mod)
+      mod.createPasswordReset = async () => { called = true }
+      await mod.sendInvite('invite@example.com')
+      mod.createPasswordReset = original
+      mockMailer.isEnabled = true
+      assert.equal(called, false)
+    })
+  })
+
   describe('#createPasswordReset()', () => {
     it('should throw when email is not provided', async () => {
       await assert.rejects(
@@ -648,7 +686,7 @@ describe('LocalAuthModule', () => {
     it('should pass inviteTokenLifespan to createPasswordReset', async () => {
       let receivedLifespan
       const original = mod.createPasswordReset.bind(mod)
-      mod.createPasswordReset = async (email, subject, text, html, lifespan) => {
+      mod.createPasswordReset = async (email, message, lifespan) => {
         receivedLifespan = lifespan
       }
       const req = {

package/tests/utils-isSmtpConnectionError.spec.js

@@ -0,0 +1,22 @@
+import { describe, it } from 'node:test'
+import assert from 'node:assert/strict'
+import { isSmtpConnectionError } from '../lib/utils/isSmtpConnectionError.js'
+
+describe('isSmtpConnectionError()', () => {
+  const cases = [
+    ['wrapped code (mailer err.data.error.code)', { data: { error: { code: 'ECONNREFUSED' } } }, true],
+    ['direct code', { code: 'ETIMEDOUT' }, true],
+    ['code embedded in message', { message: 'connect ECONNREFUSED 127.0.0.1:1025' }, true],
+    ['wrapped code embedded in message', { data: { error: { message: 'getaddrinfo ENOTFOUND smtp.example.com' } } }, true],
+    ['ESOCKET', { code: 'ESOCKET' }, true],
+    ['rejected message, not a connection error', { code: 'EENVELOPE', message: 'Invalid recipient' }, false],
+    ['generic error', new Error('something else'), false],
+    ['null', null, false],
+    ['undefined', undefined, false]
+  ]
+  for (const [name, input, expected] of cases) {
+    it(`returns ${expected} for ${name}`, () => {
+      assert.equal(isSmtpConnectionError(input), expected)
+    })
+  }
+})