golem-kit 0.2.4 → 0.2.5

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.2.5
+
+- A manager resets a member's password from the member list instead of removing and re-inviting them. **Reset password** mints a one-use link, good for 24 hours, that opens the sign-in card in choose-a-new-password mode; the account keeps its id, email, roles and groups, and every session it had is revoked. New: `accounts.reset`, `POST /api/auth/members/<id>/reset` and `POST /api/auth/password`, on golem-ui 0.2.1.
+
 ## 0.2.4
 
 - Chat and builder no longer fight over one Stop hook: the turn-end relay asks tmux which window it ran in instead of trusting the key baked in when it was installed, so a chat message sent after the builder was opened gets its reply and the composer unlocks. `installHooks` also keeps exactly one entry for itself, matched by script name, so a source-pin change between releases replaces it instead of stacking another.

package/docs/app-backend.md

@@ -175,7 +175,7 @@ The roles above are the default. A role with `manages: true` may invite, change
 - **guests: true**: signed-out callers run as `anonymous` through `authorize`. The default `authorize` allows everything, so write one that refuses what guests may not do.
 - **Policy** stays in `authorize`: check `principal.roles`, `principal.groups` and `record`. Without an `authorize`, every signed-in member may do everything.
 - **Build mode** needs a signed-in member who may build; `/api/runtime` and every `/api/sessions` route answer 401 or 403 to anyone else. A build conversation belongs to the member who started it. Conversations saved before accounts were enabled are visible to managers only. Losing build access, or signing out everywhere, interrupts a running build turn.
-- **Managing**: managers get a Admin item in the shell menu row: golem-ui's member list for invites, roles and removal, plus a groups editor. Apps can use `identity` and `setGroups` from `golem-kit/client`.
+- **Managing**: managers get a Admin item in the shell menu row: golem-ui's member list for invites, roles, password resets and removal, plus a groups editor. Apps can use `identity` and `setGroups` from `golem-kit/client`.
 - **Identity in the UI**: `identity` from `golem-kit/client` is golem-ui's `IdentityAdapter`. Pass it to `Auth.Guard` or `Timeline`. It exposes nothing a server rule trusts.
 
 ### First admin and recovery
@@ -194,7 +194,8 @@ When the store has no account yet, `./golem dev` prints a one-use admin invite l
 - Accounts, sessions and invites live in reserved `_` collections. The records operations refuse those collections, and the change stream never names them.
 - Five failed sign-ins lock that email, and separately that client address, for 15 minutes.
 - Browser writes must come from this origin. Without `origin`, the `Origin` header must match the `Host` header. Behind a proxy, set `origin` to the public origin; then it is the only one accepted. Forwarding headers such as `X-Forwarded-For` are never read, so behind a proxy the per-address lockout counts the proxy's address.
-- This protects one app's data between people who use it. It is not a hosted identity provider: there is no email verification, password reset (a manager removes and re-invites), external sign-in or two-factor. Server code and anyone with the data directory can read everything.
+- A member who forgets their password gets a new one from a manager, not by email: **Reset password** in the member list mints a one-use link, good for 24 hours, that opens the sign-in card in "choose a new password" mode. The account keeps its id, email, roles and groups — so whatever the app tied to that id survives — and every session it had is revoked, so an open browser elsewhere is signed out.
+- This protects one app's data between people who use it. It is not a hosted identity provider: there is no email verification, self-service password reset, external sign-in or two-factor. Server code and anyone with the data directory can read everything.
 
 ## Jobs
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "golem-kit",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Starter kit and local CLI for Golem applications.",
   "type": "module",
   "exports": {
@@ -56,7 +56,7 @@
     "@vitejs/plugin-react": "5.0.4",
     "croner": "10.0.1",
     "eslint": "10.11.0",
-    "golem-ui": "0.2.0",
+    "golem-ui": "0.2.1",
     "react": "19.2.0",
     "react-dom": "19.2.0",
     "tsx": "4.23.13",

package/src/backend/accounts.ts

@@ -33,6 +33,7 @@ export const inputs = {
   signIn: z.object({ email, password: z.string().max(256) }),
   signUp: z.object({ name: z.string().trim().min(1).max(120), email, password, invite: z.string().max(128).optional() }),
   invite: z.object({ role: z.string() }),
+  setPassword: z.object({ reset: z.string().max(128), password }),
   role: z.object({ role: z.string() }),
   groups: z.object({ groups: z.array(group).max(64) }),
 }
@@ -127,27 +128,44 @@ export function createAccounts(records: RecordStore, config: AccountsConfig) {
     return user(account)
   }
 
+  /** Spends a one-use link's token and returns the row it carries; `kind` only names it for the reader. */
+  async function claim(token: string, kind: 'invite' | 'reset'): Promise<Row> {
+    const spent = () => new InvalidError(`That ${kind} link has expired or was already used.`)
+    const found = /^[A-Za-z0-9_-]{43}$/.test(token) ? await records.get(INVITES, digest(token)) : null
+    if (!found || Date.parse(String(found.expiresAt)) <= Date.now()) throw spent()
+    // Removing first claims the link: a second use finds it gone.
+    await records.remove(INVITES, found.id).catch(() => { throw spent() })
+    if (!found[kind === 'invite' ? 'role' : 'account']) throw spent()
+    return found
+  }
+
   async function createAccount(name: string, email: string, hashed: string, invite: string | undefined): Promise<Account> {
     if ((await records.list(ACCOUNTS, { filter: { email }, limit: 1 })).rows.length) throw new InvalidError('That email already has an account. Sign in instead.')
     // Without an invite, only a role that neither manages nor builds, whatever the role order.
     let role = config.roles.find(isPlain)?.id
     if (invite) {
-      const found = /^[A-Za-z0-9_-]{43}$/.test(invite) ? await records.get(INVITES, digest(invite)) : null
-      if (!found || Date.parse(String(found.expiresAt)) <= Date.now()) throw new InvalidError('That invite link has expired or was already used.')
-      // Removing first claims the invite: a second sign-up on the same link finds it gone.
-      await records.remove(INVITES, found.id).catch(() => { throw new InvalidError('That invite link has expired or was already used.') })
-      role = String(found.role)
+      role = String((await claim(invite, 'invite')).role)
     } else if (!config.allowSignUp || !role) {
       throw new ForbiddenError('This app is invite-only. Ask an admin for an invite link.')
     }
     return await records.create(ACCOUNTS, { email, name, password: hashed, roles: [role], groups: [] }) as Account
   }
 
+  /** A one-use link: an invite carries the role it grants, a reset carries the account it belongs to. */
+  async function mintLink(carries: { role: string } | { account: string }, origin: string, lifetime: number): Promise<string> {
+    const token = randomBytes(32).toString('base64url')
+    await records.create(INVITES, { id: digest(token), ...carries, expiresAt: new Date(Date.now() + lifetime).toISOString() })
+    return `${origin}/?${'role' in carries ? 'invite' : 'reset'}=${token}`
+  }
+
   async function mintInvite(role: string, origin: string, lifetime: number): Promise<string> {
     if (!roleIds.has(role)) throw new InvalidError(`Unknown role: ${role}`)
-    const token = randomBytes(32).toString('base64url')
-    await records.create(INVITES, { id: digest(token), role, expiresAt: new Date(Date.now() + lifetime).toISOString() })
-    return `${origin}/?invite=${token}`
+    return mintLink({ role }, origin, lifetime)
+  }
+
+  async function endSessions(id: string): Promise<void> {
+    const sessions = await records.list(SESSIONS, { filter: { userId: id }, limit: 500 })
+    for (const session of sessions.rows) await records.remove(SESSIONS, session.id).catch(() => {})
   }
 
   return {
@@ -248,12 +266,31 @@ export function createAccounts(records: RecordStore, config: AccountsConfig) {
       requireManager(actor)
       const account = await target(id)
       await keepsAManager(account, null)
-      const sessions = await records.list(SESSIONS, { filter: { userId: account.id }, limit: 500 })
-      for (const session of sessions.rows) await records.remove(SESSIONS, session.id).catch(() => {})
+      await endSessions(account.id)
       await records.remove(ACCOUNTS, account.id)
       changes.emit('change', account.id)
     },
 
+    /**
+     * A one-use link, good for 24 hours, that lets this member choose a new password. Nothing is
+     * removed, so the last-manager rule does not apply and the account keeps everything but its hash.
+     */
+    async reset(actor: Principal, id: string, origin: string): Promise<string> {
+      requireManager(actor)
+      return mintLink({ account: (await target(id)).id }, origin, day)
+    },
+
+    /** Spends a reset link: the new hash, and every session of that account gone. */
+    async setPassword(input: unknown): Promise<void> {
+      const { reset, password } = parse(inputs.setPassword, input)
+      const hashed = await hash(password)
+      const id = String((await claim(reset, 'reset')).account)
+      const account = await target(id)
+      await records.update(ACCOUNTS, account.id, { password: hashed })
+      await endSessions(account.id)
+      changes.emit('change', account.id)
+    },
+
     /**
      * A one-use invite for the first managing role, for the terminal that starts the server:
      * only while no account exists at all, or when the operator explicitly asks for recovery.

package/src/backend/http.ts

@@ -209,9 +209,12 @@ async function handleAuth({ accounts, config, cookie }: Server, principal: Princ
     return send(response, 200, { result: null }, session('', 0))
   }
   if (route === 'invites') return send(response, 200, { result: await accounts.invite(principal, input, originOf(config, request.headers.host)) })
-  const member = route.match(/^members\/([^/]+)\/(role|groups|remove)$/)
+  // Spending a reset link is the one auth write a signed-out caller makes: the token is the credential.
+  if (route === 'password') { await accounts.setPassword(input); return send(response, 200, { result: null }) }
+  const member = route.match(/^members\/([^/]+)\/(role|groups|remove|reset)$/)
   if (!member) return send(response, 404, { error: 'Unknown API route' })
   const id = decodeURIComponent(member[1])
+  if (member[2] === 'reset') return send(response, 200, { result: await accounts.reset(principal, id, originOf(config, request.headers.host)) })
   if (member[2] === 'role') await accounts.setRole(principal, id, input)
   else if (member[2] === 'groups') await accounts.setGroups(principal, id, input)
   else await accounts.remove(principal, id)

package/src/browser/app.tsx

@@ -70,7 +70,7 @@ export function App() {
       if ((next.user?.id ?? null) !== signedInAs.current) {
         // A used invite link must not reopen sign-up on the next load.
         const url = new URL(window.location.href)
-        url.searchParams.delete('invite')
+        for (const param of ['invite', 'reset']) url.searchParams.delete(param)
         forgetBrowserSession()
         window.location.replace(url)
       }
@@ -115,7 +115,9 @@ export function App() {
   const accounts = me?.accounts
   const authConfig = accounts && { workspaceName: projectConfig.title, mode: 'password' as const, allowSignUp: accounts.allowSignUp, roles: accounts.roles }
   const manages = Boolean(me?.user?.roles.some((role) => accounts?.roles.some((one) => one.id === role && one.manages)))
-  const invited = new URLSearchParams(window.location.search).has('invite')
+  // An invite or a reset link opens the Auth card even before anyone is signed in. Read once, so
+  // spending the link — which takes its token out of the URL — does not swap the card mid-flow.
+  const [invited] = useState(() => ['invite', 'reset'].some((param) => new URLSearchParams(window.location.search).has(param)))
   const shellAdapters = { identity: accounts ? identity : anonymousIdentity, navigation }
   const hasBrain = (projectConfig as { brain?: boolean }).brain === true
   // The bottom menu bar: the app's own screens first, then Brain, then Admin for managers.

package/src/client.ts

@@ -126,6 +126,8 @@ export const identity: IdentityAdapter = {
   invite: (role) => auth<string>('invites', { role }),
   removeMember: async (userId) => { await auth(`members/${encodeURIComponent(userId)}/remove`); await reloadIdentity() },
   setRole: async (userId, role) => { await auth(`members/${encodeURIComponent(userId)}/role`, { role }); await reloadIdentity() },
+  resetPassword: (userId) => auth<string>(`members/${encodeURIComponent(userId)}/reset`),
+  setPassword: async (reset, password) => { await auth('password', { reset, password }); await reloadIdentity() },
 }
 
 /** Re-reads who is signed in and tells identity subscribers; for callers that saw a 401 or 403. */