hazo_auth 7.0.1 → 8.0.1

package/cli-src/lib/legal/legal_docs_service.ts

@@ -0,0 +1,196 @@
+// file_description: service functions for the legal document acceptance system
+// section: imports
+import { createCrudService } from 'hazo_connect/server';
+import type { LegalAcceptanceMap } from './legal_docs_types';
+
+// section: helpers
+
+function generate_id(): string {
+  return crypto.randomUUID();
+}
+
+// section: exports
+
+/**
+ * Write legal acceptance records. Call from:
+ * - registration_service (bundled with register POST, pre-session)
+ * - legal_docs_accept route (authenticated, post-login)
+ *
+ * Inserts one row per doc into hazo_legal_acceptances (audit history) and
+ * merges the result into the denormalised hazo_users.legal_acceptance JSONB
+ * column for fast "has this user accepted the current version?" queries.
+ */
+export async function write_legal_acceptance(
+  adapter: any,
+  user_id: string,
+  accepted: Record<string, { hash: string }>,
+  ip: string | null,
+  user_agent: string | null,
+): Promise<void> {
+  const now = new Date().toISOString();
+
+  // 1. Insert one history row per doc
+  const history_service = createCrudService(adapter, 'hazo_legal_acceptances');
+  for (const [doc_key, { hash }] of Object.entries(accepted)) {
+    await history_service.insert({
+      id: generate_id(),
+      user_id,
+      doc_key,
+      doc_hash: hash,
+      accepted_at: now,
+      ip,
+      user_agent,
+    });
+  }
+
+  // 2. Merge into denormalized JSONB on hazo_users
+  const users_service = createCrudService(adapter, 'hazo_users');
+  const rows = await users_service.findBy({ id: user_id });
+
+  const existing_raw = rows[0]?.legal_acceptance;
+  let existing: LegalAcceptanceMap = {};
+  if (existing_raw) {
+    try {
+      existing = typeof existing_raw === 'string'
+        ? JSON.parse(existing_raw)
+        : (existing_raw as LegalAcceptanceMap);
+    } catch { /* corrupt — start fresh */ }
+  }
+
+  const updated: LegalAcceptanceMap = { ...existing };
+  for (const [doc_key, { hash }] of Object.entries(accepted)) {
+    updated[doc_key] = { hash, accepted_at: now, ip, user_agent };
+  }
+
+  await users_service.updateById(user_id, {
+    legal_acceptance: JSON.stringify(updated),
+    changed_at: now,
+  });
+}
+
+/**
+ * Publish a doc version as the new required version (admin action).
+ * Upserts hazo_legal_doc_versions keyed on doc_key.
+ */
+export async function publish_doc_version(
+  adapter: any,
+  doc_key: string,
+  required_hash: string,
+  published_by_user_id: string,
+): Promise<{ published_at: string }> {
+  const now = new Date().toISOString();
+
+  // createCrudService with doc_key as primary key so updateById works correctly
+  const versions_service = createCrudService(adapter, 'hazo_legal_doc_versions', {
+    primaryKeys: ['doc_key'],
+    autoId: false,
+  });
+
+  const existing = await versions_service.findBy({ doc_key });
+
+  if (existing.length > 0) {
+    await versions_service.updateById(doc_key, {
+      required_hash,
+      published_at: now,
+      published_by_user_id,
+    });
+  } else {
+    await versions_service.insert({
+      doc_key,
+      required_hash,
+      published_at: now,
+      published_by_user_id,
+    });
+  }
+
+  return { published_at: now };
+}
+
+/**
+ * Return required version info keyed by doc_key.
+ */
+export async function get_required_versions(
+  adapter: any,
+  doc_keys: string[],
+): Promise<Record<string, { required_hash: string; published_at: string }>> {
+  if (doc_keys.length === 0) return {};
+
+  const versions_service = createCrudService(adapter, 'hazo_legal_doc_versions', {
+    primaryKeys: ['doc_key'],
+    autoId: false,
+  });
+
+  const rows = await versions_service.list((qb) =>
+    qb.whereIn('doc_key', doc_keys).select(['doc_key', 'required_hash', 'published_at'])
+  );
+
+  const result: Record<string, { required_hash: string; published_at: string }> = {};
+  for (const row of rows) {
+    result[String(row.doc_key)] = {
+      required_hash: String(row.required_hash),
+      published_at: String(row.published_at),
+    };
+  }
+  return result;
+}
+
+/**
+ * Return acceptance history for a user across all doc keys, newest first.
+ */
+export async function get_user_acceptance_history(
+  adapter: any,
+  user_id: string,
+): Promise<Array<{
+  doc_key: string;
+  doc_hash: string;
+  accepted_at: string;
+  ip: string | null;
+  user_agent: string | null;
+}>> {
+  const history_service = createCrudService(adapter, 'hazo_legal_acceptances');
+
+  return history_service.list((qb) =>
+    qb
+      .where('user_id', 'eq', user_id)
+      .select(['doc_key', 'doc_hash', 'accepted_at', 'ip', 'user_agent'])
+      .order('accepted_at', 'desc')
+  ) as Promise<Array<{
+    doc_key: string;
+    doc_hash: string;
+    accepted_at: string;
+    ip: string | null;
+    user_agent: string | null;
+  }>>;
+}
+
+/**
+ * Count how many users have accepted the current required hash for a doc key.
+ * Returns { current, total } where current is users on the required_hash and
+ * total is all users in the system (including those with no legal_acceptance data).
+ *
+ * Note: This performs an in-process scan over all users.  For large user bases
+ * consider a dedicated SQL query in a future optimisation.
+ */
+export async function get_compliance_count(
+  adapter: any,
+  doc_key: string,
+  required_hash: string,
+): Promise<{ current: number; total: number }> {
+  const users_service = createCrudService(adapter, 'hazo_users');
+  const all_users = await users_service.list((qb) =>
+    qb.select(['id', 'legal_acceptance'])
+  );
+
+  let current = 0;
+  for (const user of all_users) {
+    let map: LegalAcceptanceMap = {};
+    try {
+      map = typeof user.legal_acceptance === 'string'
+        ? JSON.parse(user.legal_acceptance as string)
+        : ((user.legal_acceptance ?? {}) as LegalAcceptanceMap);
+    } catch { /* ignore corrupt rows */ }
+    if (map[doc_key]?.hash === required_hash) current++;
+  }
+
+  return { current, total: all_users.length };
+}

package/cli-src/lib/legal/legal_docs_types.ts

@@ -0,0 +1,31 @@
+// file_description: shared types for the legal document acceptance system
+
+export interface LegalDocConfig {
+  key: string;
+  title: string;
+  path: string;
+}
+
+export interface LegalDocsConfig {
+  docs: LegalDocConfig[];
+  display_mode: 'separate' | 'combined';
+}
+
+export interface LegalDoc {
+  key: string;
+  title: string;
+  content: string;
+  hash: string;
+  required_hash: string | null;
+  required_published_at: string | null;
+}
+
+export interface LegalAcceptanceRecord {
+  hash: string;
+  accepted_at: string;
+  ip: string | null;
+  user_agent: string | null;
+}
+
+// Shape of hazo_users.legal_acceptance JSONB
+export type LegalAcceptanceMap = Record<string, LegalAcceptanceRecord>;

package/cli-src/lib/login_config.server.ts

@@ -7,6 +7,9 @@ import { get_config_value, get_config_value_allow_empty } from "./config/config_
 import { get_already_logged_in_config } from "./already_logged_in_config.server.js";
 import { get_oauth_config, type OAuthConfig } from "./oauth_config.server.js";
 
+// Assets served via the package's own API route — no manual copy needed.
+const DEFAULT_LOGIN_IMAGE_PATH = "/api/hazo_auth/assets/login_default.jpg";
+
 // section: types
 export type LoginConfig = {
   redirectRoute?: string;
@@ -21,14 +24,11 @@ export type LoginConfig = {
   createAccountPath: string;
   createAccountLabel: string;
   showCreateAccountLink: boolean;
+  imageSrc: string;
+  imageAlt: string;
+  imageBackgroundColor: string;
   /** OAuth configuration */
   oauth: OAuthConfig;
-  /** Whether the OTP sign-in link is shown below the login form */
-  otpSigninEnabled: boolean;
-  /** Label for the OTP sign-in link */
-  otpSigninLabel: string;
-  /** href for the OTP sign-in link */
-  otpSigninHref: string;
 };
 
 // section: helpers
@@ -69,14 +69,29 @@ export function get_login_config(): LoginConfig {
   // Get shared already logged in config
   const alreadyLoggedInConfig = get_already_logged_in_config();
 
+  // Read image configuration
+  // If not set in config, falls back to default path-based image
+  // Consuming apps should copy images to public/hazo_auth/images/ or configure their own image_src
+  const imageSrc = get_config_value(
+    section,
+    "image_src",
+    DEFAULT_LOGIN_IMAGE_PATH
+  );
+
+  const imageAlt = get_config_value(
+    section,
+    "image_alt",
+    "Secure login illustration"
+  );
+  const imageBackgroundColor = get_config_value(
+    section,
+    "image_background_color",
+    "#f1f5f9"
+  );
+
   // Get OAuth configuration
   const oauth = get_oauth_config();
 
-  // OTP sign-in link
-  const otpSigninEnabled = get_config_value(section, "otp_signin_enabled", "false") === "true";
-  const otpSigninLabel = get_config_value(section, "otp_signin_label", "Sign in with email code");
-  const otpSigninHref = get_config_value(section, "otp_signin_href", "/hazo_auth/otp");
-
   return {
     redirectRoute,
     successMessage,
@@ -90,10 +105,10 @@ export function get_login_config(): LoginConfig {
     createAccountPath,
     createAccountLabel,
     showCreateAccountLink,
+    imageSrc,
+    imageAlt,
+    imageBackgroundColor,
     oauth,
-    otpSigninEnabled,
-    otpSigninLabel,
-    otpSigninHref,
   };
 }
 

package/cli-src/lib/my_settings_config.server.ts

@@ -34,6 +34,7 @@ export type MySettingsConfig = {
     user_photo_default_priority2?: "library" | "gravatar";
     library_photo_path: string;
   };
+  heading?: string;
   subHeading?: string;
   profilePhotoLabel?: string;
   profilePhotoRecommendation?: string;
@@ -94,6 +95,7 @@ export function get_my_settings_config(): MySettingsConfig {
   const fileTypes = get_file_types_config();
 
   // Read optional labels with defaults
+  const heading = get_config_value(section, "heading", "Account Settings");
   const subHeading = get_config_value(section, "sub_heading", "Manage your profile, password, and email preferences.");
   const profilePhotoLabel = get_config_value(section, "profile_photo_label", "Profile Photo");
   const profilePhotoRecommendation = get_config_value(section, "profile_photo_recommendation", "Recommended size: 200x200px. JPG, PNG.");
@@ -113,6 +115,7 @@ export function get_my_settings_config(): MySettingsConfig {
     userFields,
     passwordRequirements,
     profilePicture,
+    heading,
     subHeading,
     profilePhotoLabel,
     profilePhotoRecommendation,

package/cli-src/lib/oauth_config.server.ts

@@ -10,20 +10,12 @@ import { DEFAULT_OAUTH } from "./config/default_config.js";
 export type OAuthConfig = {
   /** Enable Google OAuth login */
   enable_google: boolean;
-  /** Enable Facebook OAuth login */
-  enable_facebook: boolean;
   /** Enable traditional email/password login */
   enable_email_password: boolean;
   /** Auto-link Google login to existing unverified email/password accounts */
   auto_link_unverified_accounts: boolean;
-  /** Auto-link Google login to existing unverified email/password accounts (per-provider override) */
-  auto_link_unverified_accounts_google: boolean;
-  /** Auto-link Facebook login to existing unverified email/password accounts */
-  auto_link_unverified_accounts_facebook: boolean;
   /** Text displayed on the Google sign-in button */
   google_button_text: string;
-  /** Text displayed on the Facebook sign-in button */
-  facebook_button_text: string;
   /** Text displayed on the divider between OAuth and email/password form */
   oauth_divider_text: string;
   /** NextAuth signIn page path */
@@ -38,10 +30,14 @@ export type OAuthConfig = {
   skip_invitation_check: boolean;
   /** Redirect when skip_invitation_check=true and user has no scope */
   no_scope_redirect: string;
-  /** Facebook App ID from env HAZO_AUTH_FACEBOOK_APP_ID */
-  facebook_client_id: string | undefined;
-  /** Facebook App Secret from env HAZO_AUTH_FACEBOOK_APP_SECRET */
-  facebook_client_secret: string | undefined;
+  /** Enable Facebook OAuth login */
+  enable_facebook_oauth: boolean;
+  /** Facebook App ID (env: HAZO_AUTH_FACEBOOK_APP_ID overrides config) */
+  facebook_app_id: string;
+  /** Facebook App Secret (env: HAZO_AUTH_FACEBOOK_APP_SECRET overrides config) */
+  facebook_app_secret: string;
+  /** Text displayed on the Facebook sign-in button */
+  facebook_button_text: string;
 };
 
 // section: constants
@@ -60,51 +56,24 @@ export function get_oauth_config(): OAuthConfig {
     DEFAULT_OAUTH.enable_google
   );
 
-  const enable_facebook = get_config_boolean(
-    SECTION_NAME,
-    "enable_facebook",
-    false
-  );
-
   const enable_email_password = get_config_boolean(
     SECTION_NAME,
     "enable_email_password",
     DEFAULT_OAUTH.enable_email_password
   );
 
-  // Generic key (backward compat)
   const auto_link_unverified_accounts = get_config_boolean(
     SECTION_NAME,
     "auto_link_unverified_accounts",
     DEFAULT_OAUTH.auto_link_unverified_accounts
   );
 
-  // Per-provider Google key (falls back to generic)
-  const auto_link_unverified_accounts_google = get_config_boolean(
-    SECTION_NAME,
-    "auto_link_unverified_accounts_google",
-    auto_link_unverified_accounts
-  );
-
-  // Per-provider Facebook key (defaults to false — don't auto-link Facebook unverified)
-  const auto_link_unverified_accounts_facebook = get_config_boolean(
-    SECTION_NAME,
-    "auto_link_unverified_accounts_facebook",
-    false
-  );
-
   const google_button_text = get_config_value(
     SECTION_NAME,
     "google_button_text",
     DEFAULT_OAUTH.google_button_text
   );
 
-  const facebook_button_text = get_config_value(
-    SECTION_NAME,
-    "facebook_button_text",
-    "Continue with Facebook"
-  );
-
   const oauth_divider_text = get_config_value(
     SECTION_NAME,
     "oauth_divider_text",
@@ -147,18 +116,31 @@ export function get_oauth_config(): OAuthConfig {
     DEFAULT_OAUTH.no_scope_redirect
   );
 
-  const facebook_client_id = process.env.HAZO_AUTH_FACEBOOK_APP_ID;
-  const facebook_client_secret = process.env.HAZO_AUTH_FACEBOOK_APP_SECRET;
+  const enable_facebook_oauth = get_config_boolean(
+    SECTION_NAME,
+    "enable_facebook_oauth",
+    false
+  );
+
+  const facebook_app_id =
+    process.env.HAZO_AUTH_FACEBOOK_APP_ID ||
+    get_config_value(SECTION_NAME, "facebook_app_id", "");
+
+  const facebook_app_secret =
+    process.env.HAZO_AUTH_FACEBOOK_APP_SECRET ||
+    get_config_value(SECTION_NAME, "facebook_app_secret", "");
+
+  const facebook_button_text = get_config_value(
+    SECTION_NAME,
+    "facebook_button_text",
+    "Continue with Facebook"
+  );
 
   return {
     enable_google,
-    enable_facebook,
     enable_email_password,
     auto_link_unverified_accounts,
-    auto_link_unverified_accounts_google,
-    auto_link_unverified_accounts_facebook,
     google_button_text,
-    facebook_button_text,
     oauth_divider_text,
     sign_in_page,
     error_page,
@@ -166,8 +148,10 @@ export function get_oauth_config(): OAuthConfig {
     default_redirect,
     skip_invitation_check,
     no_scope_redirect,
-    facebook_client_id,
-    facebook_client_secret,
+    enable_facebook_oauth,
+    facebook_app_id,
+    facebook_app_secret,
+    facebook_button_text,
   };
 }
 
@@ -190,13 +174,3 @@ export function is_email_password_enabled(): boolean {
     DEFAULT_OAUTH.enable_email_password
   );
 }
-
-/**
- * Helper to check if Facebook OAuth is enabled and credentials are present
- * @returns true if Facebook OAuth is enabled and env vars are set
- */
-export function is_facebook_oauth_enabled(): boolean {
-  const enabled = get_config_boolean(SECTION_NAME, "enable_facebook", false);
-  if (!enabled) return false;
-  return !!(process.env.HAZO_AUTH_FACEBOOK_APP_ID && process.env.HAZO_AUTH_FACEBOOK_APP_SECRET);
-}

package/cli-src/lib/register_config.server.ts

@@ -9,6 +9,11 @@ import { get_already_logged_in_config } from "./already_logged_in_config.server.
 import { get_user_fields_config } from "./user_fields_config.server.js";
 import { get_oauth_config } from "./oauth_config.server.js";
 
+// Default image path - consuming apps should either:
+// 1. Configure their own image_src in hazo_auth_config.ini
+// 2. Copy the default images from node_modules/hazo_auth/public/hazo_auth/images/ to their public folder
+const DEFAULT_REGISTER_IMAGE_PATH = "/hazo_auth/images/register_default.jpg";
+
 // section: types
 export type RegisterConfig = {
   showNameField: boolean;
@@ -26,14 +31,17 @@ export type RegisterConfig = {
   returnHomePath: string;
   signInPath: string;
   signInLabel: string;
+  imageSrc: string;
+  imageAlt: string;
+  imageBackgroundColor: string;
   /** OAuth configuration */
   oauth: {
     enable_google: boolean;
-    enable_facebook: boolean;
     enable_email_password: boolean;
     google_button_text: string;
-    facebook_button_text: string;
     oauth_divider_text: string;
+    enable_facebook_oauth: boolean;
+    facebook_button_text: string;
   };
 };
 
@@ -71,6 +79,26 @@ export function get_register_config(): RegisterConfig {
     "Sign in"
   );
 
+  // Read image configuration
+  // If not set in config, falls back to default path-based image
+  // Consuming apps should copy images to public/hazo_auth/images/ or configure their own image_src
+  const imageSrc = get_config_value(
+    "hazo_auth__register_layout",
+    "image_src",
+    DEFAULT_REGISTER_IMAGE_PATH
+  );
+
+  const imageAlt = get_config_value(
+    "hazo_auth__register_layout",
+    "image_alt",
+    "Modern building representing user registration"
+  );
+  const imageBackgroundColor = get_config_value(
+    "hazo_auth__register_layout",
+    "image_background_color",
+    "#e2e8f0"
+  );
+
   // Get OAuth configuration (shared with login)
   const oauthConfig = get_oauth_config();
 
@@ -81,13 +109,6 @@ export function get_register_config(): RegisterConfig {
     "Sign up with Google"
   );
 
-  // For the register page, default Facebook button text to "Sign up with Facebook" unless overridden
-  const registerFacebookButtonText = get_config_value(
-    "hazo_auth__oauth",
-    "facebook_button_text_register",
-    "Sign up with Facebook"
-  );
-
   return {
     showNameField,
     passwordRequirements,
@@ -98,13 +119,16 @@ export function get_register_config(): RegisterConfig {
     returnHomePath: alreadyLoggedInConfig.returnHomePath,
     signInPath,
     signInLabel,
+    imageSrc,
+    imageAlt,
+    imageBackgroundColor,
     oauth: {
       enable_google: oauthConfig.enable_google,
-      enable_facebook: oauthConfig.enable_facebook,
       enable_email_password: oauthConfig.enable_email_password,
       google_button_text: registerGoogleButtonText,
-      facebook_button_text: registerFacebookButtonText,
       oauth_divider_text: oauthConfig.oauth_divider_text,
+      enable_facebook_oauth: oauthConfig.enable_facebook_oauth,
+      facebook_button_text: oauthConfig.facebook_button_text,
     },
   };
 }

package/cli-src/lib/reset_password_config.server.ts

@@ -7,6 +7,11 @@ import { get_config_value } from "./config/config_loader.server.js";
 import { get_already_logged_in_config } from "./already_logged_in_config.server.js";
 import { get_password_requirements_config } from "./password_requirements_config.server.js";
 
+// Default image path - consuming apps should either:
+// 1. Configure their own image_src in hazo_auth_config.ini
+// 2. Copy the default images from node_modules/hazo_auth/public/hazo_auth/images/ to their public folder
+const DEFAULT_RESET_PASSWORD_IMAGE_PATH = "/hazo_auth/images/reset_password_default.jpg";
+
 // section: types
 export type ResetPasswordConfig = {
   errorMessage: string;
@@ -25,6 +30,9 @@ export type ResetPasswordConfig = {
     require_number: boolean;
     require_special: boolean;
   };
+  imageSrc: string;
+  imageAlt: string;
+  imageBackgroundColor: string;
 };
 
 // section: helpers
@@ -62,6 +70,26 @@ export function get_reset_password_config(): ResetPasswordConfig {
   // Get shared password requirements
   const passwordRequirements = get_password_requirements_config();
 
+  // Read image configuration
+  // If not set in config, falls back to default path-based image
+  // Consuming apps should copy images to public/hazo_auth/images/ or configure their own image_src
+  const imageSrc = get_config_value(
+    section,
+    "image_src",
+    DEFAULT_RESET_PASSWORD_IMAGE_PATH
+  );
+
+  const imageAlt = get_config_value(
+    section,
+    "image_alt",
+    "Reset password illustration"
+  );
+  const imageBackgroundColor = get_config_value(
+    section,
+    "image_background_color",
+    "#f1f5f9"
+  );
+
   return {
     errorMessage,
     successMessage,
@@ -73,6 +101,9 @@ export function get_reset_password_config(): ResetPasswordConfig {
     returnHomeButtonLabel: alreadyLoggedInConfig.returnHomeButtonLabel,
     returnHomePath: alreadyLoggedInConfig.returnHomePath,
     passwordRequirements,
+    imageSrc,
+    imageAlt,
+    imageBackgroundColor,
   };
 }
 

package/cli-src/lib/services/email_template_manifest.ts

@@ -101,21 +101,4 @@ export const hazo_auth_template_manifest: SystemTemplateManifest[] = [
       },
     ],
   },
-  {
-    template_name: "otp_signin_code",
-    template_label: "OTP sign-in code",
-    category: SYSTEM_CATEGORY,
-    html: read_template("otp_signin_code", "html"),
-    text: read_template("otp_signin_code", "txt"),
-    variables: [
-      {
-        variable_name: "otp_code",
-        variable_description: "6-digit OTP code for email sign-in (v6.1.0+)",
-      },
-      {
-        variable_name: "expires_in_minutes",
-        variable_description: "Number of minutes until the OTP code expires",
-      },
-    ],
-  },
 ];

package/cli-src/lib/services/index.ts

@@ -20,11 +20,5 @@ export * from "./scope_service.js";
 export * from "./user_scope_service.js";
 export * from "./oauth_service.js";
 export * from "./branding_service.js";
-export {
-  request_email_otp,
-  verify_email_otp,
-  generate_otp_code,
-  hash_otp_code,
-  verify_otp_code,
-} from "./otp_service.js";
-export type { RequestEmailOTPResult, VerifyEmailOTPResult } from "./otp_service";
+
+