shutro-erp 0.3.1 → 0.3.3

package/dist/server/auth/service.js

@@ -38,6 +38,7 @@ export class AuthService {
     #cache = new Map();
     #keyCache = new Map();
     #dummy = hashPassword(randomToken());
+    #policy;
     constructor(shutro, options = {}) {
         this.#shutro = shutro;
         this.#options = {
@@ -95,6 +96,8 @@ export class AuthService {
     }
     /** Signs in: a new session (pending second factor when 2FA is on). @throws {HttpProblem} 401 */
     async login(request, login, password) {
+        const { sessionDays } = await this.policy();
+        const lifetimeMs = sessionDays === null ? this.#options.lifetimeMs : sessionDays * 86_400_000;
         const outcome = await this.#system(`login ${login}`, async (env) => {
             const user = one(await fetch(model(env, 'res.users').search({ where: { login } }), ['login']));
             const credential = user === undefined
@@ -119,7 +122,7 @@ export class AuthService {
                     csrfHash: digest(csrfToken),
                     user: user['id'],
                     twoFactorVerified: !twoFactorRequired,
-                    expiresAt: new Date(now + this.#options.lifetimeMs),
+                    expiresAt: new Date(now + lifetimeMs),
                     lastSeenAt: new Date(now),
                     ip: request.ip,
                     userAgent: String(request.headers['user-agent'] ?? '').slice(0, 300),
@@ -230,7 +233,10 @@ export class AuthService {
             return null;
         if (session.twoFactorRequired)
             throw unauthenticated('two-factor-required', 'Enter the code from your authenticator app first.', 'POST /api/v1/auth/2fa/verify.');
-        return this.#identity(request, session.user, { elevated: session.secondFactor });
+        return this.#identity(request, session.user, {
+            elevated: session.secondFactor,
+            session: true,
+        });
     }
     async #identity(request, user, options) {
         const info = await this.#identityOf(user);
@@ -264,6 +270,13 @@ export class AuthService {
             tz: info.tz,
             ...(options.scopes === undefined ? {} : { scopes: options.scopes }),
             ...(options.apiKey === undefined ? {} : { apiKey: options.apiKey }),
+            // A session without the second factor the policy asks of everyone (RFC 0019 §3.5): the server allows only
+            // setting it up. API keys are not sessions: their owner signed in to make them.
+            ...(options.session === true &&
+                !info.twoFactorEnabled &&
+                (await this.policy()).twoFactor === 'everyone'
+                ? { twoFactorMissing: true }
+                : {}),
         };
     }
     /**
@@ -546,9 +559,13 @@ export class AuthService {
             const twoFactorEnabled = credential?.['totpEnabled'] === true;
             const companyIds = user?.['companies'] ?? [];
             const groupings = {};
+            const accents = {};
             if (companyIds.length > 0)
-                for (const c of await fetch(model(env, 'res.company').search({ where: { id: { in: companyIds } } }), ['numberGrouping']))
+                for (const c of await fetch(model(env, 'res.company').search({ where: { id: { in: companyIds } } }), ['numberGrouping', 'accentColor'])) {
                     groupings[String(c['id'])] = c['numberGrouping'] === 'lakh' ? 'lakh' : 'international';
+                    if (typeof c['accentColor'] === 'string' && /^#[0-9a-f]{6}$/i.test(c['accentColor']))
+                        accents[String(c['id'])] = c['accentColor'];
+                }
             return {
                 id: session.user,
                 login: String(user?.['login']),
@@ -556,9 +573,11 @@ export class AuthService {
                 company: typeof user?.['company'] === 'number' ? user['company'] : null,
                 companies: companyIds,
                 groupings,
+                accents,
                 twoFactorEnabled,
                 administrator,
                 administratorNeedsSecondFactor: administrator && !(session.secondFactor && twoFactorEnabled),
+                twoFactorSetupRequired: !twoFactorEnabled && (await this.policy()).twoFactor === 'everyone',
             };
         });
     }
@@ -667,6 +686,8 @@ export class AuthService {
     }
     /** Turns 2FA off (password and a current code required). */
     async disableTwoFactor(session, password, code) {
+        if ((await this.policy()).twoFactor === 'everyone')
+            throw new HttpProblem(409, 'two-factor-required', 'Two-factor sign-in is required', 'This installation requires two-factor sign-in of everyone: it cannot be turned off.');
         await this.#system('2fa disable', async (env) => {
             const credentials = await model(env, 'auth.credential').search({
                 where: { user: session.user },
@@ -708,4 +729,148 @@ export class AuthService {
         this.#forgetUser(session.user);
         this.#cache.clear(); // other sessions of this user, cached by token
     }
+    /** The security policy (cached like sessions; {@link forgetPolicy} after changing it). */
+    async policy() {
+        const cached = this.#policy;
+        if (cached !== undefined && Date.now() - cached.at < this.#options.cacheMs)
+            return cached.policy;
+        const policy = await this.#system('policy', async (env) => {
+            const [row] = await fetch(model(env, 'auth.policy').search({ where: {}, limit: 1 }), [
+                'twoFactor',
+                'sessionDays',
+            ]);
+            const days = row?.['sessionDays'];
+            return {
+                twoFactor: row?.['twoFactor'] === 'everyone' ? 'everyone' : 'administrators',
+                sessionDays: typeof days === 'number' && days > 0 ? days : null,
+            };
+        });
+        this.#policy = { at: Date.now(), policy };
+        return policy;
+    }
+    /** Forgets the cached policy: after Settings › Security changed it. */
+    forgetPolicy() {
+        this.#policy = undefined;
+    }
+    /** Forgets what is cached about `user` (their identity and sessions): after their roles or account changed. */
+    forget(user) {
+        this.#forgetUser(user);
+        this.#cache.clear();
+    }
+    /** The signed-in user's own details (RFC 0019 §3.6). */
+    async profile(session) {
+        return this.#system('profile', async (env) => {
+            const [row] = await fetch(model(env, 'res.users').browse([session.user]), PROFILE_KEYS);
+            return {
+                login: String(row?.['login'] ?? ''),
+                name: String(row?.['name'] ?? ''),
+                email: typeof row?.['email'] === 'string' ? row['email'] : null,
+                phone: typeof row?.['phone'] === 'string' ? row['phone'] : null,
+                lang: String(row?.['lang'] ?? 'en_US'),
+                tz: String(row?.['tz'] ?? 'UTC'),
+                company: typeof row?.['company'] === 'number' ? row['company'] : null,
+            };
+        });
+    }
+    /**
+     * Changes the user's own details: name, email, phone, language, time zone, and the default company (one of
+     * theirs). Audited.
+     */
+    async updateProfile(session, values) {
+        const changes = {};
+        if (values.name !== undefined) {
+            const name = values.name.trim();
+            if (name === '' || name.length > 200)
+                throw new HttpProblem(422, 'invalid-name', 'Invalid name', 'Your name is 1–200 characters.');
+            changes['name'] = name;
+        }
+        if (values.email !== undefined) {
+            const email = values.email === null ? '' : values.email.trim();
+            if (email !== '' && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email))
+                throw new HttpProblem(422, 'invalid-email', 'Invalid email', `'${email}' is not an email address.`);
+            changes['email'] = email === '' ? null : email;
+        }
+        if (values.phone !== undefined)
+            changes['phone'] = values.phone?.trim() || null;
+        if (values.lang !== undefined) {
+            if (!/^[a-z]{2,3}(_[A-Z]{2})?$/.test(values.lang))
+                throw new HttpProblem(422, 'invalid-lang', 'Invalid language', 'A language code such as en_US or bn_BD.');
+            changes['lang'] = values.lang;
+        }
+        if (values.tz !== undefined) {
+            try {
+                new Intl.DateTimeFormat('en', { timeZone: values.tz });
+            }
+            catch {
+                throw new HttpProblem(422, 'invalid-tz', 'Invalid time zone', `'${values.tz}' is not a time zone.`);
+            }
+            changes['tz'] = values.tz;
+        }
+        if (values.company !== undefined && values.company !== null) {
+            const info = await this.#identityOf(session.user);
+            if (info === null || !info.companies.includes(values.company))
+                throw new HttpProblem(422, 'invalid-company', 'Invalid company', 'Choose one of your companies.');
+            changes['company'] = values.company;
+        }
+        if (Object.keys(changes).length > 0)
+            await this.#system('profile change', async (env) => {
+                await model(env, 'res.users').browse([session.user]).write(changes);
+                await audit(env, {
+                    kind: 'auth.profile_changed',
+                    summary: `Changed ${Object.keys(changes).join(', ')}.`,
+                    actor: session.user,
+                });
+            });
+        this.#forgetUser(session.user);
+        return this.profile(session);
+    }
+    /** The user's active sessions, newest use first; the current one marked. */
+    async sessions(session) {
+        return this.#system('sessions', async (env) => {
+            const rows = await fetch(model(env, 'auth.session').search({
+                where: { user: session.user, revoked: false, expiresAt: { gt: new Date() } },
+                order: ['lastSeenAt desc', 'id desc'],
+                limit: 50,
+            }), ['id', 'ip', 'userAgent', 'lastSeenAt', 'createdAt', 'secondFactor']);
+            return rows.map((r) => ({
+                id: r['id'],
+                ip: typeof r['ip'] === 'string' ? r['ip'] : null,
+                userAgent: typeof r['userAgent'] === 'string' ? r['userAgent'] : null,
+                lastSeenAt: new Date(timeOf(r['lastSeenAt']) ?? 0).toISOString(),
+                createdAt: timeOf(r['createdAt']) === null
+                    ? null
+                    : new Date(timeOf(r['createdAt'])).toISOString(),
+                secondFactor: r['secondFactor'] === true,
+                current: r['id'] === session.id,
+            }));
+        });
+    }
+    /** Signs out one of the user's own sessions (or all but this one with `'others'`). Audited. */
+    async revokeSessions(session, which) {
+        const revoked = await this.#system('sign out a session', async (env) => {
+            const set = await model(env, 'auth.session').search({
+                where: {
+                    user: session.user,
+                    revoked: false,
+                    ...(which === 'others' ? { id: { ne: session.id } } : { id: which }),
+                },
+            });
+            if (which !== 'others' && set.length === 0)
+                throw new HttpProblem(404, 'missing-record', 'Not found', `You have no session ${which}.`);
+            if (set.length > 0)
+                await set.write({ revoked: true });
+            await audit(env, {
+                kind: 'auth.session_revoked',
+                summary: which === 'others'
+                    ? `Signed out ${set.length} other session(s).`
+                    : `Signed out session ${which}.`,
+                actor: session.user,
+            });
+            return set.length;
+        });
+        this.#forgetUser(session.user);
+        this.#cache.clear();
+        return { revoked };
+    }
 }
+const PROFILE_KEYS = ['login', 'name', 'email', 'phone', 'lang', 'tz', 'company'];

package/dist/server/identity.d.ts

@@ -24,6 +24,8 @@ export interface RequestIdentity {
     readonly scopes?: readonly string[];
     /** The API key the request carries. */
     readonly apiKey?: number;
+    /** A session without the second factor the security policy asks of everyone (RFC 0019 §3.5). */
+    readonly twoFactorMissing?: true;
 }
 /**
  * The single explicit bypass (CLAUDE.md "superuser mode", RFC 0003 §5.2): the user holds an administrator role

package/dist/server/index.d.ts

@@ -9,7 +9,7 @@ export { IDEMPOTENCY_TABLE, idempotencyTableStatements, idempotent, type Outcome
 export { type ApiField, type ApiModel, apiModels, defaultFields, publicApiModels, schemaName, } from './api/metadata.js';
 export { type FoundRecord, type MenuNode, moduleVisible, Navigation } from './api/navigation.js';
 export { fieldSchema, openApiDocument, openApiOf } from './api/openapi.js';
-export { registerRestApi } from './api/rest.js';
+export { readApiRecord, registerRestApi } from './api/rest.js';
 export { type ServedView, type ViewField, ViewRegistry } from './api/views.js';
 export { APPS_CHANNEL, APPS_LOG_TABLE, APPS_TABLE, type AppLoadContext, type ApplyAppsOptions, type AppsResult, applyApps, appsDigest, appTableStatements, FRAMEWORK_TABLES, installDefaults, installedApps, installedModules, type PrepareAppsOptions, type PreparedApps, prepareApps, readInstalledApps, recordInstalledApps, restoreAppMigrations, } from './apps.js';
 export { type AuditInput, audit } from './audit.js';
@@ -18,7 +18,7 @@ export { base, baseShutro } from './auth/base.js';
 export { digest, hashPassword, newTotpSecret, otpauthUri, randomToken, totp, verifyPassword, verifyTotp, } from './auth/crypto.js';
 export { type InstallBaseOptions, installBase } from './auth/install.js';
 export { registerAuthRoutes } from './auth/routes.js';
-export { type AuthOptions, AuthService, cookieOf, SESSION_COOKIE, type SessionInfo, timeOf, type UserInfo, } from './auth/service.js';
+export { type AuthOptions, AuthService, cookieOf, SESSION_COOKIE, type SecurityPolicy, type SessionInfo, timeOf, type UserInfo, } from './auth/service.js';
 export { DEMO_PASSWORD, type DemoResult, installDemo } from './demo.js';
 export { applyEnvironmentNames } from './env-names.js';
 export { HttpProblem, type Problem, problemOf, ServerConfigError } from './errors.js';

package/dist/server/index.js

@@ -9,7 +9,7 @@ export { IDEMPOTENCY_TABLE, idempotencyTableStatements, idempotent, } from './ap
 export { apiModels, defaultFields, publicApiModels, schemaName, } from './api/metadata.js';
 export { moduleVisible, Navigation } from './api/navigation.js';
 export { fieldSchema, openApiDocument, openApiOf } from './api/openapi.js';
-export { registerRestApi } from './api/rest.js';
+export { readApiRecord, registerRestApi } from './api/rest.js';
 export { ViewRegistry } from './api/views.js';
 export { APPS_CHANNEL, APPS_LOG_TABLE, APPS_TABLE, applyApps, appsDigest, appTableStatements, FRAMEWORK_TABLES, installDefaults, installedApps, installedModules, prepareApps, readInstalledApps, recordInstalledApps, restoreAppMigrations, } from './apps.js';
 export { audit } from './audit.js';

package/dist/server/server.js

@@ -142,11 +142,19 @@ export async function createServer(options) {
                     : null);
             enforceScopes(scopes, request.method, route, owner);
         }
-        // Customers and vendors of the portal (RFC 0015 §5.1): the portal API and signing in, nothing else.
-        if (request.identity !== null &&
+        const externalUser = request.identity !== null &&
             external.size > 0 &&
             request.identity.groups.length > 0 &&
-            request.identity.groups.every((g) => external.has(g)) &&
+            request.identity.groups.every((g) => external.has(g));
+        // Two-factor sign-in required of everyone (RFC 0019 §3.5): until it is set up, only the sign-in routes (setting
+        // it up, signing out, who am I). Portal users are not the company's people: the policy is not theirs.
+        if (request.identity?.twoFactorMissing === true &&
+            !externalUser &&
+            request.url.startsWith('/api/') &&
+            !request.url.startsWith('/api/v1/auth/'))
+            throw new HttpProblem(403, 'two-factor-setup-required', 'Two-factor sign-in required', 'This installation requires two-factor sign-in: set it up first.', 'POST /api/v1/auth/2fa/setup, then POST /api/v1/auth/2fa/enable.');
+        // Customers and vendors of the portal (RFC 0015 §5.1): the portal API and signing in, nothing else.
+        if (externalUser &&
             !PORTAL_PATHS.some((p) => request.url.startsWith(p)) &&
             request.url.startsWith('/api/'))
             throw new HttpProblem(403, 'internal-only', 'For the company’s users only', 'Portal users reach the portal only.');

package/dist/settings/company.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The companies (RFC 0018, RFC 0019 §3.4). The current company's name, number grouping and brand colour (the
+ * back-office's accent), and its details: every simple field the installed apps add to the company (address,
+ * contacts, tax ids, fiscal year…). Administrators and holders of the Settings / Company access level change them;
+ * administrators also add companies, whose defaults (journals, sequences, taxes…) the apps then install.
+ *
+ * - `GET   /api/v1/settings/company`
+ * - `PATCH /api/v1/settings/company`     `{ name?, numberGrouping?, accentColor?, details? }` (`accentColor`:
+ *                                         `#rrggbb` or null; `details`: `{ field: value }`)
+ * - `GET   /api/v1/settings/companies`   every company with its currency and people, the currencies
+ * - `POST  /api/v1/settings/companies`   `{ name, currency }`: a new company (administrators)
+ */
+import { type ModuleContext } from '../server/index.js';
+/** One of the company's details: a field an installed app adds. */
+export interface CompanyDetail {
+    readonly key: string;
+    readonly label: string;
+    readonly kind: string;
+    readonly readonly: boolean;
+    readonly options: readonly {
+        readonly value: string;
+        readonly label: string;
+    }[] | null;
+    readonly value: string | number | boolean | null;
+}
+export interface CompanySettings {
+    readonly id: number;
+    readonly name: string;
+    readonly numberGrouping: 'international' | 'lakh';
+    readonly accentColor: string | null;
+    readonly currency: string;
+    readonly details: readonly CompanyDetail[];
+}
+export declare function registerCompanyRoutes(context: ModuleContext): void;

package/dist/settings/company.js

@@ -0,0 +1,187 @@
+/**
+ * The companies (RFC 0018, RFC 0019 §3.4). The current company's name, number grouping and brand colour (the
+ * back-office's accent), and its details: every simple field the installed apps add to the company (address,
+ * contacts, tax ids, fiscal year…). Administrators and holders of the Settings / Company access level change them;
+ * administrators also add companies, whose defaults (journals, sequences, taxes…) the apps then install.
+ *
+ * - `GET   /api/v1/settings/company`
+ * - `PATCH /api/v1/settings/company`     `{ name?, numberGrouping?, accentColor?, details? }` (`accentColor`:
+ *                                         `#rrggbb` or null; `details`: `{ field: value }`)
+ * - `GET   /api/v1/settings/companies`   every company with its currency and people, the currencies
+ * - `POST  /api/v1/settings/companies`   `{ name, currency }`: a new company (administrators)
+ */
+import { audit, HttpProblem, installDefaults, publicApiModels, } from '../server/index.js';
+const model = (env, name) => env.model(name);
+const find = async (env, name, where, keys) => {
+    const set = await model(env, name).search({ where, order: ['id asc'] });
+    return set.length === 0 ? [] : (await set.load(keys)).read(['id', ...keys]);
+};
+const KEYS = ['name', 'numberGrouping', 'accentColor', 'currency'];
+/** Fields with controls of their own, or not the person's to edit. */
+const OWN = new Set([...KEYS, 'id', 'displayName']);
+const SIMPLE = new Set(['char', 'text', 'integer', 'boolean', 'selection']);
+/** Shown, not changed here: an app's own flow sets them (the chart of accounts of a localization). */
+const SHOWN_ONLY = new Set(['chartTemplate']);
+export function registerCompanyRoutes(context) {
+    const { app, registry } = context;
+    /** The company's details: its stored simple fields, as the generated API serves them. */
+    const detailFields = () => (publicApiModels(registry).get('res.company')?.fields ?? []).filter((f) => f.stored && SIMPLE.has(f.kind) && !OWN.has(f.key));
+    const read = async (env, id) => {
+        const fields = detailFields();
+        const keys = [...KEYS, ...fields.map((f) => f.key)];
+        const [row] = (await model(env, 'res.company').browse([id]).load(keys)).read(['id', ...keys]);
+        const currency = row?.['currency'];
+        const [money] = typeof currency === 'number'
+            ? await find(env, 'res.currency', { id: currency }, ['name'])
+            : [];
+        return {
+            id,
+            name: String(row?.['name'] ?? ''),
+            numberGrouping: row?.['numberGrouping'] === 'lakh' ? 'lakh' : 'international',
+            accentColor: typeof row?.['accentColor'] === 'string' ? row['accentColor'] : null,
+            currency: String(money?.['name'] ?? ''),
+            details: fields.map((f) => ({
+                key: f.key,
+                label: f.label,
+                kind: f.kind,
+                readonly: f.readonly || SHOWN_ONLY.has(f.key),
+                options: f.options?.map((o) => ({ value: String(o[0]), label: String(o[1]) })) ?? null,
+                value: (row?.[f.key] ?? null),
+            })),
+        };
+    };
+    const guarded = (request, fn, write = false) => request.env(async (env) => {
+        if (!env.administrator && !env.groups.has('settings.company'))
+            throw new HttpProblem(403, 'access', 'Company settings', 'Changing the company needs the Administrator role or the Settings / Company access.');
+        if (env.companyId === null || env.companyId === undefined)
+            throw new HttpProblem(409, 'no-company', 'No company', 'Choose a company first.');
+        return env.asSuperuser({ reason: 'company settings' }, async (su) => {
+            const out = await fn(su, env.companyId, env);
+            if (write)
+                await su.flush();
+            return out;
+        });
+    }, 
+    // The superuser scope is audited: even a read writes its audit record.
+    { write: true });
+    app.get('/api/v1/settings/company', async (request) => guarded(request, (su, company) => read(su, company)));
+    app.patch('/api/v1/settings/company', async (request) => {
+        const body = (request.body ?? {});
+        const values = {};
+        const invalid = (code, title, detail) => new HttpProblem(422, code, title, detail);
+        if (body['name'] !== undefined) {
+            const name = String(body['name']).trim();
+            if (name === '')
+                throw invalid('invalid-name', 'Invalid name', 'The company needs a name.');
+            values['name'] = name;
+        }
+        if (body['numberGrouping'] !== undefined) {
+            if (body['numberGrouping'] !== 'international' && body['numberGrouping'] !== 'lakh')
+                throw invalid('invalid-grouping', 'Invalid grouping', "Number grouping is 'international' or 'lakh'.");
+            values['numberGrouping'] = body['numberGrouping'];
+        }
+        if (body['accentColor'] !== undefined) {
+            const color = body['accentColor'];
+            if (color !== null && !(typeof color === 'string' && /^#[0-9a-fA-F]{6}$/.test(color)))
+                throw invalid('invalid-color', 'Invalid colour', 'The brand colour is a hex colour such as #4f46e5, or empty for the default.');
+            values['accentColor'] = color === null ? null : color.toLowerCase();
+        }
+        // The details: only the fields offered, each with a value of its kind (Shutro checks sizes and constraints).
+        const details = body['details'];
+        if (details !== undefined) {
+            if (typeof details !== 'object' || details === null || Array.isArray(details))
+                throw invalid('invalid-details', 'Invalid details', 'details is { field: value }.');
+            const offered = new Map(detailFields().map((f) => [f.key, f]));
+            for (const [key, value] of Object.entries(details)) {
+                const f = offered.get(key);
+                if (f === undefined || f.readonly || SHOWN_ONLY.has(key))
+                    throw invalid('invalid-details', 'Invalid details', `'${key}' is not changed here.`);
+                const fits = value === null ||
+                    (f.kind === 'boolean'
+                        ? typeof value === 'boolean'
+                        : f.kind === 'integer'
+                            ? Number.isSafeInteger(value)
+                            : f.kind === 'selection'
+                                ? (f.options ?? []).some((o) => o[0] === value)
+                                : typeof value === 'string' && value.length <= 4000);
+                if (!fits)
+                    throw invalid('invalid-details', 'Invalid details', `'${f.label}' has an invalid value.`);
+                values[key] = typeof value === 'string' && value.trim() === '' ? null : value;
+            }
+        }
+        return guarded(request, async (su, company) => {
+            if (Object.keys(values).length > 0)
+                await model(su, 'res.company').browse([company]).write(values);
+            return read(su, company);
+        }, true);
+    });
+    app.get('/api/v1/settings/companies', async (request) => guarded(request, async (su, current, env) => {
+        const all = await find(su, 'res.company', {}, ['name', 'currency']);
+        const currencies = await find(su, 'res.currency', {}, ['name']);
+        const currencyName = new Map(currencies.map((c) => [c['id'], String(c['name'])]));
+        return {
+            canCreate: env.administrator,
+            companies: (await Promise.all(all.map(async (c) => ({
+                id: c['id'],
+                name: String(c['name']),
+                currency: currencyName.get(c['currency']) ?? '',
+                people: (await model(su, 'res.users').search({
+                    where: { isService: { ne: true }, companies: { any: { id: c['id'] } } },
+                })).length,
+                current: c['id'] === current,
+                // The person can switch to it: it is one of their companies.
+                member: (await model(su, 'res.users').search({
+                    where: { id: env.uid, companies: { any: { id: c['id'] } } },
+                })).length > 0,
+            })))).sort((a, b) => a.name.localeCompare(b.name)),
+            currencies: currencies
+                .map((c) => ({ id: c['id'], name: String(c['name']) }))
+                .sort((a, b) => a.name.localeCompare(b.name)),
+        };
+    }));
+    app.post('/api/v1/settings/companies', async (request, reply) => {
+        const body = (request.body ?? {});
+        const name = String(body['name'] ?? '').trim();
+        const currency = Number(body['currency']);
+        if (name === '' || name.length > 200)
+            throw new HttpProblem(422, 'invalid-name', 'Invalid name', 'The company needs a name.');
+        if (!Number.isSafeInteger(currency) || currency <= 0)
+            throw new HttpProblem(422, 'invalid-currency', 'Invalid currency', 'Choose its currency.');
+        const made = await request.env(async (env) => {
+            if (!env.administrator)
+                throw new HttpProblem(403, 'access', 'Administrators only', 'Only an administrator adds companies.');
+            return env.asSuperuser({ reason: 'new company' }, async (su) => {
+                if ((await find(su, 'res.currency', { id: currency }, ['name'])).length === 0)
+                    throw new HttpProblem(422, 'invalid-currency', 'Invalid currency', 'Choose its currency.');
+                const company = (await model(su, 'res.company').create([{ name, currency }]))
+                    .ids[0];
+                // The administrators and the person who made it can switch to it at once.
+                const admins = [...su.access.administratorGroups()];
+                const holders = admins.length === 0
+                    ? []
+                    : await find(su, 'auth.user_group', { group: { in: admins } }, ['user']);
+                const users = [...new Set([env.uid, ...holders.map((h) => h['user'])])];
+                await model(su, 'res.users')
+                    .browse(users)
+                    .write({ companies: { link: [company] } });
+                await audit(env, {
+                    kind: 'settings.company_created',
+                    summary: `Company ${name} created.`,
+                    targetModel: 'res.company',
+                    targetId: company,
+                    ip: request.ip,
+                });
+                await su.flush();
+                return { company, users };
+            });
+        }, { write: true });
+        for (const user of made.users)
+            context.auth?.forget(user);
+        // The apps' defaults for it, once it exists (after the commit), as for a company made at install.
+        const defaults = await installDefaults(context.shutro, registry.loaded.modules, {
+            company: made.company,
+            reason: `defaults of company ${name}`,
+        });
+        return reply.code(201).send({ id: made.company, name, defaults });
+    });
+}

package/dist/settings/index.d.ts

@@ -1,18 +1,18 @@
-/**
- * @packageDocumentation
- * `shutro-erp/settings` (RFC 0008): the Settings app. Its App manager lists the installed, disabled and available apps and
- * installs, enables or disables them (`/api/v1/settings/apps`, the Settings → Apps page). Every installation has it;
- * it cannot be disabled. Changing apps needs the Administrator role or the `settings.apps` access level.
- */
-import { defineModule } from '../modules-sdk/index.js';
+import { type KoshModule } from '../modules-sdk/index.js';
 import { orm } from '../server/orm.js';
+import { type PeopleOptions } from './people.js';
+export { type CompanyDetail, type CompanySettings, registerCompanyRoutes } from './company.js';
+export { type Assignment, INVITATION_DAYS, type PeopleOptions, registerPeopleRoutes, } from './people.js';
 export { type AppInfo, type PlanInfo, PROTECTED_APPS, registerAppRoutes } from './routes.js';
+export { registerSecurityRoutes } from './security.js';
 /** Package identity. */
 export declare const PACKAGE: {
     readonly name: string;
     readonly rfc: string;
 };
-/** The Shutro module: the App manager group. */
+/** The Shutro module: the Settings groups and invitations. */
 export declare const settingsShutro: ReturnType<typeof orm.defineModule>;
-/** The Settings app. */
-export declare const settings: ReturnType<typeof defineModule>;
+/** The Settings app with explicit options (tests): the back-office's address and the mailer of invitations. */
+export declare function settingsModule(options?: Partial<PeopleOptions>): KoshModule;
+/** The Settings app (the back-office's address and the mailer from the environment). */
+export declare const settings: KoshModule;