npm - ghost - Versions diffs - 5.114.1 → 5.115.1 - Mend

ghost 5.114.1 → 5.115.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (201) hide show

package/core/server/services/audience-feedback/index.js CHANGED Viewed

@@ -1,5 +1,9 @@
 const urlUtils = require('../../../shared/url-utils');
 const urlService = require('../../services/url');
+const AudienceFeedbackService = require('./AudienceFeedbackService');
+const AudienceFeedbackController = require('./AudienceFeedbackController');
+const Feedback = require('./Feedback');
 const FeedbackRepository = require('./FeedbackRepository');
 class AudienceFeedbackServiceWrapper {
@@ -12,8 +16,6 @@ class AudienceFeedbackServiceWrapper {
         // Wire up all the dependencies
         const models = require('../../models');
-        const {AudienceFeedbackService, AudienceFeedbackController, Feedback} = require('@tryghost/audience-feedback');
         this.repository = new FeedbackRepository({
             Member: models.Member,
             MemberFeedback: models.MemberFeedback,

package/core/server/services/auth/session/emails/signin.js ADDED Viewed

@@ -0,0 +1,168 @@
+module.exports = ({t, siteTitle, email, siteDomain, siteUrl, siteLogo, token, deviceDetails, is2FARequired}) => `
+<!doctype html>
+<html>
+  <head>
+    <meta name="viewport" content="width=device-width">
+    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+    <title>🔑 ${t('Your verification code for {{siteTitle}}', {siteTitle, interpolation: {escapeValue: false}})}</title>
+    <style>
+    /* -------------------------------------
+        RESPONSIVE AND MOBILE FRIENDLY STYLES
+    ------------------------------------- */
+    @media only screen and (max-width: 620px) {
+      table[class=body] h1 {
+        font-size: 28px !important;
+        margin-bottom: 10px !important;
+      }
+      table[class=body] p,
+            table[class=body] ul,
+            table[class=body] ol,
+            table[class=body] td,
+            table[class=body] span,
+            table[class=body] a {
+        font-size: 16px !important;
+      }
+      table[class=body] .wrapper,
+            table[class=body] .article {
+        padding: 10px !important;
+      }
+      table[class=body] .content {
+        padding: 0 !important;
+      }
+      table[class=body] .container {
+        padding: 0 !important;
+        width: 100% !important;
+      }
+      table[class=body] .main {
+        border-left-width: 0 !important;
+        border-radius: 0 !important;
+        border-right-width: 0 !important;
+      }
+      table[class=body] .btn table {
+        width: 100% !important;
+      }
+      table[class=body] .btn a {
+        width: 100% !important;
+      }
+      table[class=body] .img-responsive {
+        height: auto !important;
+        max-width: 100% !important;
+        width: auto !important;
+      }
+      table[class=body] p[class=small],
+      table[class=body] a[class=small] {
+        font-size: 11px !important;
+      }
+    }
+    /* -------------------------------------
+        PRESERVE THESE STYLES IN THE HEAD
+    ------------------------------------- */
+    @media all {
+      .ExternalClass {
+        width: 100%;
+      }
+      .ExternalClass,
+            .ExternalClass p,
+            .ExternalClass span,
+            .ExternalClass font,
+            .ExternalClass td,
+            .ExternalClass div {
+        line-height: 100%;
+      }
+      .recipient-link a {
+        color: inherit !important;
+        font-family: inherit !important;
+        font-size: inherit !important;
+        font-weight: inherit !important;
+        line-height: inherit !important;
+        text-decoration: none !important;
+      }
+      #MessageViewBody a {
+        color: inherit;
+        text-decoration: none;
+        font-size: inherit;
+        font-family: inherit;
+        font-weight: inherit;
+        line-height: inherit;
+      }
+    }
+    hr {
+      border-width: 0;
+      height: 0;
+      margin-top: 34px;
+      margin-bottom: 34px;
+      border-bottom-width: 1px;
+      border-bottom-color: #EEF5F8;
+    }
+    a {
+      color: #3A464C;
+    }
+    </style>
+  </head>
+  <body style="background-color: #ffffff; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; -webkit-font-smoothing: antialiased; font-size: 14px; line-height: 1.5em; margin: 0; padding: 0; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;">
+    <table border="0" cellpadding="0" cellspacing="0" class="body" style="border-collapse: separate; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100%;">
+      <tr>
+        <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top;">&nbsp;</td>
+        <td class="container" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top; display: block; Margin: 0 auto; max-width: 540px; padding: 10px; width: 540px;">
+          <div class="content" style="box-sizing: border-box; display: block; Margin: 0 auto; max-width: 600px; padding: 30px 20px;">
+            <!-- START CENTERED CONTAINER -->
+            <span class="preheader" style="color: transparent; display: none; height: 0; max-height: 0; max-width: 0; opacity: 0; overflow: hidden; mso-hide: all; visibility: hidden; width: 0;">${t('Here\'s your code to login to {{siteTitle}}', {siteTitle, interpolation: {escapeValue: false}})}</span>
+            <table class="main" style="border-collapse: separate; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100%; background: #ffffff; border-radius: 8px;">
+              <!-- START MAIN CONTENT AREA -->
+              <tr>
+                <td class="wrapper" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top; box-sizing: border-box;">
+                  <table border="0" cellpadding="0" cellspacing="0" style="border-collapse: separate; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100%;">
+                    <tr>
+                        <td align="center" style="padding-top: 20px; padding-bottom: 12px;"><img src="${siteLogo}" width="60" height="60" style="width: 60px; height: 60px;" /></td>
+                    </tr>
+                    <tr>
+                      <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top;">
+                        <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 20px; color: #15212A; font-weight: 600; line-height: 24px; margin: 0; margin-bottom: 15px; margin-top: 50px;">${t('Sign in verification')}</p>
+                        <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; margin: 0; line-height: 24px; margin-bottom: 32px;">${is2FARequired ? '' : t('You just tried to access your account from a new device.')} ${t('For security verification, enter the code below to sign in to {{siteTitle}}:', {siteTitle, interpolation: {escapeValue: false}})}</p>
+                      </td>
+                    </tr>
+                    <tr>
+                      <td style="padding: 16px; background-color: #F4F5F6; border-radius: 8px; text-align: center; vertical-align: middle;" valign="middle">
+                        <h2 style="text-align: center; vertical-align: center; letter-spacing: 5px; font-size: 24px; color: #15212A; font-weight: 600; line-height: 24px; margin: 0;">${token}</h2>
+                      </td>
+                    </tr>
+                    <tr>
+                      <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top;">
+                        <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; line-height: 24px; margin: 0; margin-bottom: 4px; margin-top: 24px;">${t('Device:')} <strong style="font-weight: 600;">${deviceDetails.device}</strong></p>
+                        <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; line-height: 24px; margin: 0; margin-bottom: 4px; margin-top: 0px;">${t('Where:')} <strong style="font-weight: 600;">${deviceDetails.location}</strong></p>
+                        <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; line-height: 24px; margin: 0; margin-bottom: 4px; margin-top: 0px;">${t('When:')} <strong style="font-weight: 600;">${deviceDetails.time}</strong></p>
+                      </td>
+                    </tr>
+                    <tr>
+                      <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top;">
+                        <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; line-height: 24px;   margin: 0; margin-bottom: 11px; margin-top: 24px;">${t('If you didn\'t try to sign in recently, you can safely ignore this email to deny access.')}</p>
+                      </td>
+                    </tr>
+                    <!-- START FOOTER -->
+                    <tr>
+                      <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top; padding-top: 80px;">
+                        <p class="small" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; line-height: 16px; font-size: 11px; color: #738A94; font-weight: normal; margin: 0;">This message was sent from <a class="small" href="${siteUrl}" style="text-decoration: underline; color: #738A94; font-size: 11px;">${siteDomain}</a> to <a class="small" href="mailto:${email}" style="text-decoration: underline; color: #738A94; font-size: 11px;">${email}</a></p>
+                      </td>
+                    </tr>
+                    <!-- END FOOTER -->
+                  </table>
+                </td>
+              </tr>
+            <!-- END MAIN CONTENT AREA -->
+            </table>
+          <!-- END CENTERED CONTAINER -->
+          </div>
+        </td>
+        <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top;">&nbsp;</td>
+      </tr>
+    </table>
+  </body>
+</html>
+`;

package/core/server/services/auth/session/index.js CHANGED Viewed

@@ -1,6 +1,6 @@
 const adapterManager = require('../../adapter-manager');
-const createSessionService = require('@tryghost/session-service');
-const sessionFromToken = require('@tryghost/mw-session-from-token');
+const createSessionService = require('./session-service');
+const sessionFromToken = require('./session-from-token');
 const createSessionMiddleware = require('./middleware');
 const settingsCache = require('../../../../shared/settings-cache');
 const {GhostMailer} = require('../../mail');

package/core/server/services/auth/session/session-from-token.js ADDED Viewed

@@ -0,0 +1,69 @@
+module.exports = SessionFromToken;
+/**
+ * @typedef {object} User
+ * @prop {string} id
+ */
+/**
+ * @typedef {import('express').Request} Req
+ * @typedef {import('express').Response} Res
+ * @typedef {import('express').NextFunction} Next
+ * @typedef {import('express').RequestHandler} RequestHandler
+ */
+/**
+ * Returns a connect middleware function which exchanges a token for a session
+ *
+ * @template Token
+ * @template Lookup
+ *
+ * @param { object } deps
+ * @param { (req: Req) => Promise<Token> } deps.getTokenFromRequest
+ * @param { (token: Token) => Promise<Lookup> } deps.getLookupFromToken
+ * @param { (lookup: Lookup) => Promise<User> } deps.findUserByLookup
+ * @param { (req: Req, res: Res, user: User) => Promise<void> } deps.createSession
+ * @param { boolean } deps.callNextWithError - Whether next should be call with an error or just pass through
+ *
+ * @returns {RequestHandler}
+ */
+function SessionFromToken({
+    getTokenFromRequest,
+    getLookupFromToken,
+    findUserByLookup,
+    createSession,
+    callNextWithError
+}) {
+    /**
+     * @param {Req} req
+     * @param {Res} res
+     * @param {Next} next
+     * @returns {Promise<void>}
+     */
+    async function handler(req, res, next) {
+        try {
+            const token = await getTokenFromRequest(req);
+            if (!token) {
+                return next();
+            }
+            const email = await getLookupFromToken(token);
+            if (!email) {
+                return next();
+            }
+            const user = await findUserByLookup(email);
+            if (!user) {
+                return next();
+            }
+            await createSession(req, res, user);
+            next();
+        } catch (err) {
+            if (callNextWithError) {
+                next(err);
+            } else {
+                next();
+            }
+        }
+    }
+    return handler;
+}

package/core/server/services/auth/session/session-service.js ADDED Viewed

@@ -0,0 +1,364 @@
+const {
+    BadRequestError
+} = require('@tryghost/errors');
+const errors = require('@tryghost/errors');
+const emailTemplate = require('./emails/signin');
+const UAParser = require('ua-parser-js');
+const got = require('got');
+const IPV4_REGEX = /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/;
+const IPV6_REGEX = /^(?:[A-F0-9]{1,4}:){7}[A-F0-9]{1,4}$/i;
+const {totp} = require('otplib');
+totp.options = {
+    digits: 6,
+    step: 60,
+    window: [10, 10]
+};
+/**
+ * @typedef {object} User
+ * @prop {string} id
+ * @prop {(attr: string) => string} get
+ */
+/**
+ * @typedef {object} Session
+ * @prop {(cb: (err: Error | null) => any) => void} destroy
+ * @prop {string} user_id
+ * @prop {string} origin
+ * @prop {string} user_agent
+ * @prop {string} ip
+ * @prop {boolean} verified
+ */
+/**
+ * @typedef {import('express').Request} Req
+ * @typedef {import('express').Response} Res
+ */
+/**
+ * @typedef {object} SessionService
+ * @prop {(req: Req, res: Res) => Promise<User | null>} getUserForSession
+ * @prop {(req: Req, res: Res) => Promise<void>} removeUserForSession
+ * @prop {(req: Req, res: Res, user: User) => Promise<void>} createSessionForUser
+ * @prop {(req: Req, res: Res) => Promise<void>} createVerifiedSessionForUser
+ * @prop {(req: Req, res: Res) => Promise<void>} verifySession
+ * @prop {(req: Req, res: Res) => Promise<void>} sendAuthCodeToUser
+ * @prop {(req: Req, res: Res) => Promise<boolean>} verifyAuthCodeForUser
+ * @prop {(req: Req, res: Res) => Promise<boolean>} isVerifiedSession
+ */
+/**
+ * @param {object} deps
+ * @param {(req: Req, res: Res) => Promise<Session>} deps.getSession
+ * @param {(data: {id: string}) => Promise<User>} deps.findUserById
+ * @param {(req: Req) => string} deps.getOriginOfRequest
+ * @param {(key: string) => string} deps.getSettingsCache
+ * @param {() => string} deps.getBlogLogo
+ * @param {import('../../core/core/server/services/mail').GhostMailer} deps.mailer
+ * @param {import('../../core/core/shared/labs')} deps.labs
+ * @param {import('../../core/core/server/services/i18n').t} deps.t
+ * @param {import('../../core/core/shared/url-utils')} deps.urlUtils
+ * @returns {SessionService}
+ */
+module.exports = function createSessionService({
+    getSession,
+    findUserById,
+    getOriginOfRequest,
+    getSettingsCache,
+    getBlogLogo,
+    mailer,
+    urlUtils,
+    labs,
+    t
+}) {
+    /**
+     * cookieCsrfProtection
+     *
+     * @param {Req} req
+     * @param {Session} session
+     * @returns {Promise<void>}
+     */
+    function cookieCsrfProtection(req, session) {
+        // If there is no origin on the session object it means this is a *new*
+        // session, that hasn't been initialised yet. So we don't need CSRF protection
+        if (!session.origin) {
+            return;
+        }
+        const origin = getOriginOfRequest(req);
+        if (session.origin !== origin) {
+            throw new BadRequestError({
+                message: `Request made from incorrect origin. Expected '${session.origin}' received '${origin}'.`
+            });
+        }
+    }
+    /**
+     * createSessionForUser
+     *
+     * @param {Req} req
+     * @param {Res} res
+     * @param {User} user
+     * @returns {Promise<void>}
+     */
+    async function createSessionForUser(req, res, user) {
+        const session = await getSession(req, res);
+        const origin = getOriginOfRequest(req);
+        if (!origin) {
+            throw new BadRequestError({
+                message: 'Could not determine origin of request. Please ensure an Origin or Referrer header is present.'
+            });
+        }
+        session.user_id = user.id;
+        session.origin = origin;
+        session.user_agent = req.get('user-agent');
+        session.ip = req.ip;
+        if (!labs.isSet('staff2fa')) {
+            session.verified = true;
+        }
+    }
+    /**
+     * createVerifiedSessionForUser
+     *
+     * @param {Req} req
+     * @param {Res} res
+     * @param {User} user
+     * @returns {Promise<void>}
+     */
+    async function createVerifiedSessionForUser(req, res, user) {
+        await createSessionForUser(req, res, user);
+        await verifySession(req, res);
+    }
+    /**
+     * generateAuthCodeForUser
+     *
+     * @param {Req} req
+     * @param {Res} res
+     * @returns {Promise<string>}
+     */
+    async function generateAuthCodeForUser(req, res) {
+        const session = await getSession(req, res);
+        const secret = getSettingsCache('admin_session_secret') + session.user_id;
+        const token = totp.generate(secret);
+        return token;
+    }
+    /**
+     * verifyAuthCodeForUser
+     *
+     * @param {Req} req
+     * @param {Res} res
+     * @returns {Promise<boolean>}
+     */
+    async function verifyAuthCodeForUser(req, res) {
+        const session = await getSession(req, res);
+        const secret = getSettingsCache('admin_session_secret') + session.user_id;
+        const isValid = totp.check(req.body.token, secret);
+        return isValid;
+    }
+    const formatTime = new Intl.DateTimeFormat('en-GB', {
+        day: '2-digit',
+        month: 'short',
+        year: 'numeric',
+        hour: '2-digit',
+        minute: '2-digit',
+        timeZone: 'UTC',
+        timeZoneName: 'short'
+    }).format;
+    /**
+     * Get a readable location string from an IP address.
+     * @param {string} ip - The IP address to look up.
+     * @returns {Promise<string>} - A readable location string or 'Unknown'.
+     */
+    async function getGeolocationFromIP(ip) {
+        if (!ip || (!IPV4_REGEX.test(ip) && !IPV6_REGEX.test(ip))) {
+            return 'Unknown';
+        }
+        const gotOpts = {
+            timeout: 500
+        };
+        if (process.env.NODE_ENV?.startsWith('test')) {
+            gotOpts.retry = 0;
+        }
+        const geojsUrl = `https://get.geojs.io/v1/ip/geo/${encodeURIComponent(ip)}.json`;
+        try {
+            const response = await got(geojsUrl, gotOpts).json();
+            const {city, region, country} = response || {};
+            // Only include non-empty parts in the result
+            const locationParts = [city, region, country].filter(Boolean);
+            // If no valid parts, return 'Unknown'
+            return locationParts.length > 0 ? locationParts.join(', ').trim() : 'Unknown';
+        } catch (error) {
+            return 'Unknown';
+        }
+    }
+    async function getDeviceDetails(userAgent, ip) {
+        const parser = new UAParser();
+        parser.setUA(userAgent);
+        const result = parser.getResult();
+        const deviceParts = [
+            result.browser?.name || '',
+            result.os?.name || ''
+        ].filter(Boolean);
+        return {
+            device: deviceParts.join(', '),
+            location: await getGeolocationFromIP(ip),
+            time: formatTime(new Date())
+        };
+    }
+    /**
+     * sendAuthCodeToUser
+     *
+     * @param {Req} req
+     * @param {Res} res
+     * @returns {Promise<void>}
+     */
+    async function sendAuthCodeToUser(req, res) {
+        const session = await getSession(req, res);
+        const token = await generateAuthCodeForUser(req, res);
+        let user;
+        try {
+            user = await findUserById({id: session.user_id});
+        } catch (error) {
+            // User session likely doesn't contain a valid user ID
+            throw new BadRequestError({
+                message: 'Could not fetch user from the session.'
+            });
+        }
+        const recipient = user.get('email');
+        const siteTitle = getSettingsCache('title');
+        const siteLogo = getBlogLogo();
+        const siteUrl = urlUtils.urlFor('home', true);
+        const domain = urlUtils.urlFor('home', true).match(new RegExp('^https?://([^/:?#]+)(?:[/:?#]|$)', 'i'));
+        const siteDomain = (domain && domain[1]);
+        const email = emailTemplate({
+            t,
+            siteTitle: siteTitle,
+            email: recipient,
+            siteDomain: siteDomain,
+            siteUrl: siteUrl,
+            siteLogo: siteLogo,
+            token: token,
+            deviceDetails: await getDeviceDetails(session.user_agent, session.ip),
+            is2FARequired: getSettingsCache('require_email_mfa')
+        });
+        try {
+            await mailer.send({
+                to: recipient,
+                subject: `${token} is your Ghost sign in verification code`,
+                html: email
+            });
+        } catch (error) {
+            throw new errors.EmailError({
+                ...error,
+                message: 'Failed to send email. Please check your site configuration and try again.'
+            });
+        }
+    }
+    /**
+     * verifySession
+     *
+     * @param {Req} req
+     * @param {Res} res
+     */
+    async function verifySession(req, res) {
+        const session = await getSession(req, res);
+        session.verified = true;
+    }
+    /**
+     * isVerifiedSession
+     *
+     * @param {Req} req
+     * @param {Res} res
+     */
+    async function isVerifiedSession(req, res) {
+        const session = await getSession(req, res);
+        return session.verified;
+    }
+    /**
+     * removeUserForSession
+     *
+     * @param {Req} req
+     * @param {Res} res
+     * @returns {Promise<void>}
+     */
+    async function removeUserForSession(req, res) {
+        const session = await getSession(req, res);
+        const requireMfa = getSettingsCache('require_email_mfa');
+        if (requireMfa) {
+            session.verified = undefined;
+        }
+        session.user_id = undefined;
+    }
+    /**
+     * getUserForSession
+     *
+     * @param {Req} req
+     * @param {Res} res
+     * @returns {Promise<User | null>}
+     */
+    async function getUserForSession(req, res) {
+        // CASE: we don't have a cookie header so allow fallthrough to other
+        // auth middleware or final "ensure authenticated" check
+        if (!req.headers || !req.headers.cookie) {
+            return null;
+        }
+        const session = await getSession(req, res);
+        // Enable CSRF bypass (useful for OAuth for example)
+        if (!res || !res.locals || !res.locals.bypassCsrfProtection) {
+            cookieCsrfProtection(req, session);
+        }
+        if (!session || !session.user_id) {
+            return null;
+        }
+        try {
+            const user = await findUserById({id: session.user_id});
+            return user;
+        } catch (err) {
+            return null;
+        }
+    }
+    return {
+        getUserForSession,
+        createSessionForUser,
+        createVerifiedSessionForUser,
+        removeUserForSession,
+        verifySession,
+        isVerifiedSession,
+        sendAuthCodeToUser,
+        verifyAuthCodeForUser,
+        generateAuthCodeForUser
+    };
+};