shutro-erp 0.3.2 → 0.3.3

package/dist/sales/.kosh/schema.d.ts

@@ -1,4 +1,4 @@
-// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: b513566045fc25a0
+// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 2d9d91e59673d178
 // Schema view of module `sales` (RFC 0002 §7.7): the models it owns or depends on, with the extensions it can see.
 import type { F } from '../../server/orm.js';
 
@@ -8,6 +8,7 @@ export interface SchemaView {
   readonly 'audit.event': AuditEvent;
   readonly 'auth.api_key': AuthApiKey;
   readonly 'auth.credential': AuthCredential;
+  readonly 'auth.policy': AuthPolicy;
   readonly 'auth.session': AuthSession;
   readonly 'auth.user_grant': AuthUserGrant;
   readonly 'auth.user_group': AuthUserGroup;
@@ -136,6 +137,26 @@ export interface AuthCredential {
 export interface AuthCredentialMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'auth.credential'> {
 }
 
+/** `auth.policy` (owner: base). */
+export interface AuthPolicy {
+  readonly name: 'auth.policy';
+  readonly fields: {
+    readonly id: F.Id<'auth.policy'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly twoFactor: F.Selection<'administrators' | 'everyone', { readonly required: true; readonly default: true }>;
+    readonly sessionDays: F.Integer;
+  };
+  readonly methods: AuthPolicyMethods;
+}
+
+/** Methods of `auth.policy`: declared ones and transitions. */
+export interface AuthPolicyMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'auth.policy'> {
+}
+
 /** `auth.session` (owner: base). */
 export interface AuthSession {
   readonly name: 'auth.session';
@@ -477,6 +498,13 @@ export interface ResCompany {
     readonly name: F.Char<{ readonly required: true }>;
     readonly currency: F.Many2one<'res.currency', { readonly required: true }>;
     readonly numberGrouping: F.Selection<'international' | 'lakh', { readonly required: true; readonly default: true }>;
+    readonly accentColor: F.Char;
+    readonly street: F.Char;
+    readonly city: F.Char;
+    readonly zip: F.Char;
+    readonly email: F.Char;
+    readonly phone: F.Char;
+    readonly website: F.Char;
   };
   readonly methods: ResCompanyMethods;
 }

package/dist/server/auth/base.js

@@ -22,6 +22,15 @@ const ResCompany = defineModel('res.company', {
         currency: f.many2one('res.currency', { required: true }),
         /** How numbers are grouped on screen and in documents (RFC 0016): 1,234,567 or 12,34,567 (lakh and crore). */
         numberGrouping: f.selection({ international: 'International (1,234,567)', lakh: 'Lakh and crore (12,34,567)' }, { required: true, default: 'international', label: 'Number grouping' }),
+        /** The company's brand colour (`#4f46e5`), the back-office's accent (RFC 0018); the default when empty. */
+        accentColor: f.char({ size: 7, label: 'Brand colour' }),
+        /** Its address and how to reach it (RFC 0019 §3.4): on documents, e-invoices and the portal. */
+        street: f.char({ label: 'Address' }),
+        city: f.char({ label: 'City' }),
+        zip: f.char({ size: 12, label: 'Postal code' }),
+        email: f.char({ label: 'Email' }),
+        phone: f.char({ label: 'Phone' }),
+        website: f.char({ label: 'Website' }),
     },
 });
 const readRows = async (env, model, ids, keys) => env.asSuperuser({ reason: 'check administrators' }, async (su) => {
@@ -127,6 +136,17 @@ const AuthUserGrant = defineModel('auth.user_grant', {
         reason: f.char({ required: true }),
     },
 });
+/**
+ * The installation's security policy (RFC 0019 §3.5): one row, read by the auth service, changed in Settings ›
+ * Security. Without a row: two-factor sign-in for administrators only, sessions as the server is configured.
+ */
+const AuthPolicy = defineModel('auth.policy', {
+    fields: {
+        twoFactor: f.selection({ administrators: 'Administrators', everyone: 'Everyone' }, { required: true, default: 'administrators', label: 'Two-factor sign-in required for' }),
+        /** Days a sign-in lasts at most; empty: the server's setting. */
+        sessionDays: f.integer({ label: 'Session lifetime (days)' }),
+    },
+});
 /**
  * The security audit log (CLAUDE.md: logins, permission changes, exports, sensitive actions). Append-only: no one
  * may change or delete events (administrators included: the REST API never serves it, and the admin API only reads).
@@ -196,6 +216,7 @@ export const baseShutro = defineModule({
         AuthApiKey,
         AuthUserGroup,
         AuthUserGrant,
+        AuthPolicy,
         AuditEvent,
         SavedView,
     ],
@@ -214,6 +235,7 @@ export const base = defineKoshModule({
         'auth.api_key',
         'auth.user_group',
         'auth.user_grant',
+        'auth.policy',
         'audit.event',
     ],
 });

package/dist/server/auth/routes.d.ts

@@ -10,6 +10,9 @@
  * - `POST /api/v1/auth/2fa/verify`    `{ code }` (TOTP or recovery code) completes a pending sign-in
  * - `POST /api/v1/auth/2fa/disable`   `{ password, code }`
  * - `POST /api/v1/auth/password`      `{ current, next }`; other sessions are revoked
+ * - `GET  /api/v1/auth/profile`       your details (RFC 0019); `PATCH` `{ name?, email?, phone?, lang?, tz?, company? }`
+ * - `GET  /api/v1/auth/sessions`      your signed-in devices; `DELETE …/sessions/:id` signs one out
+ * - `POST /api/v1/auth/sessions/sign-out-others`
  */
 import type { FastifyInstance } from 'fastify';
 import type { AuthService } from './service.js';

package/dist/server/auth/routes.js

@@ -52,4 +52,33 @@ export function registerAuthRoutes(app, auth, options = {}) {
         await auth.changePassword(await auth.requireSession(request), text(request, 'current'), text(request, 'next'));
         return { ok: true };
     });
+    // Your own profile and sessions (RFC 0019 §3.6): a session's, never an API key's.
+    app.get('/api/v1/auth/profile', { config: { auth: false } }, async (request) => auth.profile(await auth.requireSession(request)));
+    app.patch('/api/v1/auth/profile', { config: { auth: false } }, async (request) => {
+        const body = (request.body ?? {});
+        const values = {};
+        for (const key of ['name', 'email', 'phone', 'lang', 'tz'])
+            if (body[key] !== undefined) {
+                if (body[key] !== null &&
+                    (typeof body[key] !== 'string' || body[key].length > 200))
+                    throw new HttpProblem(400, 'invalid-body', 'Invalid body', `'${key}' is a short text.`);
+                values[key] = body[key];
+            }
+        if (body['company'] !== undefined) {
+            if (!Number.isSafeInteger(body['company']))
+                throw new HttpProblem(400, 'invalid-body', 'Invalid body', "'company' is a company id.");
+            values['company'] = body['company'];
+        }
+        return auth.updateProfile(await auth.requireSession(request), values);
+    });
+    app.get('/api/v1/auth/sessions', { config: { auth: false } }, async (request) => ({
+        sessions: await auth.sessions(await auth.requireSession(request)),
+    }));
+    app.delete('/api/v1/auth/sessions/:id', { config: { auth: false } }, async (request) => {
+        const id = Number(request.params.id);
+        if (!Number.isSafeInteger(id) || id <= 0)
+            throw new HttpProblem(400, 'invalid-id', 'Invalid id', 'The id is a positive integer.');
+        return auth.revokeSessions(await auth.requireSession(request), id);
+    });
+    app.post('/api/v1/auth/sessions/sign-out-others', { config: { auth: false } }, async (request) => auth.revokeSessions(await auth.requireSession(request), 'others'));
 }

package/dist/server/auth/service.d.ts

@@ -39,11 +39,22 @@ export interface UserInfo {
     readonly companies: readonly number[];
     /** The number grouping of each of the user's companies (RFC 0016): `lakh` or `international`. */
     readonly groupings: Readonly<Record<string, 'international' | 'lakh'>>;
+    /** The brand colour of each of the user's companies that has one (RFC 0018): `#rrggbb`. */
+    readonly accents: Readonly<Record<string, string>>;
     readonly twoFactorEnabled: boolean;
     /** Holds an administrator role (in some company). */
     readonly administrator: boolean;
     /** Administrator rights are withheld until this session has a second factor (enable or verify 2FA). */
     readonly administratorNeedsSecondFactor: boolean;
+    /** The policy requires two-factor sign-in of everyone and it is not on: nothing but setting it up is allowed. */
+    readonly twoFactorSetupRequired: boolean;
+}
+/** The installation's security policy (RFC 0019 §3.5). */
+export interface SecurityPolicy {
+    /** Who must sign in with a second factor: administrators only (the default), or everyone. */
+    readonly twoFactor: 'administrators' | 'everyone';
+    /** Days a sign-in lasts at most; null: the server's `lifetimeMs`. */
+    readonly sessionDays: number | null;
 }
 /** An API key as listed (never its secret). */
 export interface ApiKeyInfo {
@@ -162,4 +173,45 @@ export declare class AuthService {
     disableTwoFactor(session: SessionInfo, password: string, code: string): Promise<void>;
     /** Changes the password; every other session of the user is revoked. */
     changePassword(session: SessionInfo, current: string, next: string): Promise<void>;
+    /** The security policy (cached like sessions; {@link forgetPolicy} after changing it). */
+    policy(): Promise<SecurityPolicy>;
+    /** Forgets the cached policy: after Settings › Security changed it. */
+    forgetPolicy(): void;
+    /** Forgets what is cached about `user` (their identity and sessions): after their roles or account changed. */
+    forget(user: number): void;
+    /** The signed-in user's own details (RFC 0019 §3.6). */
+    profile(session: SessionInfo): Promise<Profile>;
+    /**
+     * Changes the user's own details: name, email, phone, language, time zone, and the default company (one of
+     * theirs). Audited.
+     */
+    updateProfile(session: SessionInfo, values: Partial<Omit<Profile, 'login'>>): Promise<Profile>;
+    /** The user's active sessions, newest use first; the current one marked. */
+    sessions(session: SessionInfo): Promise<SessionEntry[]>;
+    /** Signs out one of the user's own sessions (or all but this one with `'others'`). Audited. */
+    revokeSessions(session: SessionInfo, which: number | 'others'): Promise<{
+        revoked: number;
+    }>;
+}
+/** The user's own details (RFC 0019 §3.6). */
+export interface Profile {
+    readonly login: string;
+    readonly name: string;
+    readonly email: string | null;
+    readonly phone: string | null;
+    readonly lang: string;
+    readonly tz: string;
+    /** The default company. */
+    readonly company: number | null;
+}
+/** One of the user's sessions (a signed-in device). */
+export interface SessionEntry {
+    readonly id: number;
+    readonly ip: string | null;
+    readonly userAgent: string | null;
+    readonly lastSeenAt: string;
+    readonly createdAt: string | null;
+    readonly secondFactor: boolean;
+    /** This browser. */
+    readonly current: boolean;
 }

package/dist/server/auth/service.js

@@ -38,6 +38,7 @@ export class AuthService {
     #cache = new Map();
     #keyCache = new Map();
     #dummy = hashPassword(randomToken());
+    #policy;
     constructor(shutro, options = {}) {
         this.#shutro = shutro;
         this.#options = {
@@ -95,6 +96,8 @@ export class AuthService {
     }
     /** Signs in: a new session (pending second factor when 2FA is on). @throws {HttpProblem} 401 */
     async login(request, login, password) {
+        const { sessionDays } = await this.policy();
+        const lifetimeMs = sessionDays === null ? this.#options.lifetimeMs : sessionDays * 86_400_000;
         const outcome = await this.#system(`login ${login}`, async (env) => {
             const user = one(await fetch(model(env, 'res.users').search({ where: { login } }), ['login']));
             const credential = user === undefined
@@ -119,7 +122,7 @@ export class AuthService {
                     csrfHash: digest(csrfToken),
                     user: user['id'],
                     twoFactorVerified: !twoFactorRequired,
-                    expiresAt: new Date(now + this.#options.lifetimeMs),
+                    expiresAt: new Date(now + lifetimeMs),
                     lastSeenAt: new Date(now),
                     ip: request.ip,
                     userAgent: String(request.headers['user-agent'] ?? '').slice(0, 300),
@@ -230,7 +233,10 @@ export class AuthService {
             return null;
         if (session.twoFactorRequired)
             throw unauthenticated('two-factor-required', 'Enter the code from your authenticator app first.', 'POST /api/v1/auth/2fa/verify.');
-        return this.#identity(request, session.user, { elevated: session.secondFactor });
+        return this.#identity(request, session.user, {
+            elevated: session.secondFactor,
+            session: true,
+        });
     }
     async #identity(request, user, options) {
         const info = await this.#identityOf(user);
@@ -264,6 +270,13 @@ export class AuthService {
             tz: info.tz,
             ...(options.scopes === undefined ? {} : { scopes: options.scopes }),
             ...(options.apiKey === undefined ? {} : { apiKey: options.apiKey }),
+            // A session without the second factor the policy asks of everyone (RFC 0019 §3.5): the server allows only
+            // setting it up. API keys are not sessions: their owner signed in to make them.
+            ...(options.session === true &&
+                !info.twoFactorEnabled &&
+                (await this.policy()).twoFactor === 'everyone'
+                ? { twoFactorMissing: true }
+                : {}),
         };
     }
     /**
@@ -546,9 +559,13 @@ export class AuthService {
             const twoFactorEnabled = credential?.['totpEnabled'] === true;
             const companyIds = user?.['companies'] ?? [];
             const groupings = {};
+            const accents = {};
             if (companyIds.length > 0)
-                for (const c of await fetch(model(env, 'res.company').search({ where: { id: { in: companyIds } } }), ['numberGrouping']))
+                for (const c of await fetch(model(env, 'res.company').search({ where: { id: { in: companyIds } } }), ['numberGrouping', 'accentColor'])) {
                     groupings[String(c['id'])] = c['numberGrouping'] === 'lakh' ? 'lakh' : 'international';
+                    if (typeof c['accentColor'] === 'string' && /^#[0-9a-f]{6}$/i.test(c['accentColor']))
+                        accents[String(c['id'])] = c['accentColor'];
+                }
             return {
                 id: session.user,
                 login: String(user?.['login']),
@@ -556,9 +573,11 @@ export class AuthService {
                 company: typeof user?.['company'] === 'number' ? user['company'] : null,
                 companies: companyIds,
                 groupings,
+                accents,
                 twoFactorEnabled,
                 administrator,
                 administratorNeedsSecondFactor: administrator && !(session.secondFactor && twoFactorEnabled),
+                twoFactorSetupRequired: !twoFactorEnabled && (await this.policy()).twoFactor === 'everyone',
             };
         });
     }
@@ -667,6 +686,8 @@ export class AuthService {
     }
     /** Turns 2FA off (password and a current code required). */
     async disableTwoFactor(session, password, code) {
+        if ((await this.policy()).twoFactor === 'everyone')
+            throw new HttpProblem(409, 'two-factor-required', 'Two-factor sign-in is required', 'This installation requires two-factor sign-in of everyone: it cannot be turned off.');
         await this.#system('2fa disable', async (env) => {
             const credentials = await model(env, 'auth.credential').search({
                 where: { user: session.user },
@@ -708,4 +729,148 @@ export class AuthService {
         this.#forgetUser(session.user);
         this.#cache.clear(); // other sessions of this user, cached by token
     }
+    /** The security policy (cached like sessions; {@link forgetPolicy} after changing it). */
+    async policy() {
+        const cached = this.#policy;
+        if (cached !== undefined && Date.now() - cached.at < this.#options.cacheMs)
+            return cached.policy;
+        const policy = await this.#system('policy', async (env) => {
+            const [row] = await fetch(model(env, 'auth.policy').search({ where: {}, limit: 1 }), [
+                'twoFactor',
+                'sessionDays',
+            ]);
+            const days = row?.['sessionDays'];
+            return {
+                twoFactor: row?.['twoFactor'] === 'everyone' ? 'everyone' : 'administrators',
+                sessionDays: typeof days === 'number' && days > 0 ? days : null,
+            };
+        });
+        this.#policy = { at: Date.now(), policy };
+        return policy;
+    }
+    /** Forgets the cached policy: after Settings › Security changed it. */
+    forgetPolicy() {
+        this.#policy = undefined;
+    }
+    /** Forgets what is cached about `user` (their identity and sessions): after their roles or account changed. */
+    forget(user) {
+        this.#forgetUser(user);
+        this.#cache.clear();
+    }
+    /** The signed-in user's own details (RFC 0019 §3.6). */
+    async profile(session) {
+        return this.#system('profile', async (env) => {
+            const [row] = await fetch(model(env, 'res.users').browse([session.user]), PROFILE_KEYS);
+            return {
+                login: String(row?.['login'] ?? ''),
+                name: String(row?.['name'] ?? ''),
+                email: typeof row?.['email'] === 'string' ? row['email'] : null,
+                phone: typeof row?.['phone'] === 'string' ? row['phone'] : null,
+                lang: String(row?.['lang'] ?? 'en_US'),
+                tz: String(row?.['tz'] ?? 'UTC'),
+                company: typeof row?.['company'] === 'number' ? row['company'] : null,
+            };
+        });
+    }
+    /**
+     * Changes the user's own details: name, email, phone, language, time zone, and the default company (one of
+     * theirs). Audited.
+     */
+    async updateProfile(session, values) {
+        const changes = {};
+        if (values.name !== undefined) {
+            const name = values.name.trim();
+            if (name === '' || name.length > 200)
+                throw new HttpProblem(422, 'invalid-name', 'Invalid name', 'Your name is 1–200 characters.');
+            changes['name'] = name;
+        }
+        if (values.email !== undefined) {
+            const email = values.email === null ? '' : values.email.trim();
+            if (email !== '' && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email))
+                throw new HttpProblem(422, 'invalid-email', 'Invalid email', `'${email}' is not an email address.`);
+            changes['email'] = email === '' ? null : email;
+        }
+        if (values.phone !== undefined)
+            changes['phone'] = values.phone?.trim() || null;
+        if (values.lang !== undefined) {
+            if (!/^[a-z]{2,3}(_[A-Z]{2})?$/.test(values.lang))
+                throw new HttpProblem(422, 'invalid-lang', 'Invalid language', 'A language code such as en_US or bn_BD.');
+            changes['lang'] = values.lang;
+        }
+        if (values.tz !== undefined) {
+            try {
+                new Intl.DateTimeFormat('en', { timeZone: values.tz });
+            }
+            catch {
+                throw new HttpProblem(422, 'invalid-tz', 'Invalid time zone', `'${values.tz}' is not a time zone.`);
+            }
+            changes['tz'] = values.tz;
+        }
+        if (values.company !== undefined && values.company !== null) {
+            const info = await this.#identityOf(session.user);
+            if (info === null || !info.companies.includes(values.company))
+                throw new HttpProblem(422, 'invalid-company', 'Invalid company', 'Choose one of your companies.');
+            changes['company'] = values.company;
+        }
+        if (Object.keys(changes).length > 0)
+            await this.#system('profile change', async (env) => {
+                await model(env, 'res.users').browse([session.user]).write(changes);
+                await audit(env, {
+                    kind: 'auth.profile_changed',
+                    summary: `Changed ${Object.keys(changes).join(', ')}.`,
+                    actor: session.user,
+                });
+            });
+        this.#forgetUser(session.user);
+        return this.profile(session);
+    }
+    /** The user's active sessions, newest use first; the current one marked. */
+    async sessions(session) {
+        return this.#system('sessions', async (env) => {
+            const rows = await fetch(model(env, 'auth.session').search({
+                where: { user: session.user, revoked: false, expiresAt: { gt: new Date() } },
+                order: ['lastSeenAt desc', 'id desc'],
+                limit: 50,
+            }), ['id', 'ip', 'userAgent', 'lastSeenAt', 'createdAt', 'secondFactor']);
+            return rows.map((r) => ({
+                id: r['id'],
+                ip: typeof r['ip'] === 'string' ? r['ip'] : null,
+                userAgent: typeof r['userAgent'] === 'string' ? r['userAgent'] : null,
+                lastSeenAt: new Date(timeOf(r['lastSeenAt']) ?? 0).toISOString(),
+                createdAt: timeOf(r['createdAt']) === null
+                    ? null
+                    : new Date(timeOf(r['createdAt'])).toISOString(),
+                secondFactor: r['secondFactor'] === true,
+                current: r['id'] === session.id,
+            }));
+        });
+    }
+    /** Signs out one of the user's own sessions (or all but this one with `'others'`). Audited. */
+    async revokeSessions(session, which) {
+        const revoked = await this.#system('sign out a session', async (env) => {
+            const set = await model(env, 'auth.session').search({
+                where: {
+                    user: session.user,
+                    revoked: false,
+                    ...(which === 'others' ? { id: { ne: session.id } } : { id: which }),
+                },
+            });
+            if (which !== 'others' && set.length === 0)
+                throw new HttpProblem(404, 'missing-record', 'Not found', `You have no session ${which}.`);
+            if (set.length > 0)
+                await set.write({ revoked: true });
+            await audit(env, {
+                kind: 'auth.session_revoked',
+                summary: which === 'others'
+                    ? `Signed out ${set.length} other session(s).`
+                    : `Signed out session ${which}.`,
+                actor: session.user,
+            });
+            return set.length;
+        });
+        this.#forgetUser(session.user);
+        this.#cache.clear();
+        return { revoked };
+    }
 }
+const PROFILE_KEYS = ['login', 'name', 'email', 'phone', 'lang', 'tz', 'company'];

package/dist/server/identity.d.ts

@@ -24,6 +24,8 @@ export interface RequestIdentity {
     readonly scopes?: readonly string[];
     /** The API key the request carries. */
     readonly apiKey?: number;
+    /** A session without the second factor the security policy asks of everyone (RFC 0019 §3.5). */
+    readonly twoFactorMissing?: true;
 }
 /**
  * The single explicit bypass (CLAUDE.md "superuser mode", RFC 0003 §5.2): the user holds an administrator role

package/dist/server/index.d.ts

@@ -18,7 +18,7 @@ export { base, baseShutro } from './auth/base.js';
 export { digest, hashPassword, newTotpSecret, otpauthUri, randomToken, totp, verifyPassword, verifyTotp, } from './auth/crypto.js';
 export { type InstallBaseOptions, installBase } from './auth/install.js';
 export { registerAuthRoutes } from './auth/routes.js';
-export { type AuthOptions, AuthService, cookieOf, SESSION_COOKIE, type SessionInfo, timeOf, type UserInfo, } from './auth/service.js';
+export { type AuthOptions, AuthService, cookieOf, SESSION_COOKIE, type SecurityPolicy, type SessionInfo, timeOf, type UserInfo, } from './auth/service.js';
 export { DEMO_PASSWORD, type DemoResult, installDemo } from './demo.js';
 export { applyEnvironmentNames } from './env-names.js';
 export { HttpProblem, type Problem, problemOf, ServerConfigError } from './errors.js';

package/dist/server/server.js

@@ -142,11 +142,19 @@ export async function createServer(options) {
                     : null);
             enforceScopes(scopes, request.method, route, owner);
         }
-        // Customers and vendors of the portal (RFC 0015 §5.1): the portal API and signing in, nothing else.
-        if (request.identity !== null &&
+        const externalUser = request.identity !== null &&
             external.size > 0 &&
             request.identity.groups.length > 0 &&
-            request.identity.groups.every((g) => external.has(g)) &&
+            request.identity.groups.every((g) => external.has(g));
+        // Two-factor sign-in required of everyone (RFC 0019 §3.5): until it is set up, only the sign-in routes (setting
+        // it up, signing out, who am I). Portal users are not the company's people: the policy is not theirs.
+        if (request.identity?.twoFactorMissing === true &&
+            !externalUser &&
+            request.url.startsWith('/api/') &&
+            !request.url.startsWith('/api/v1/auth/'))
+            throw new HttpProblem(403, 'two-factor-setup-required', 'Two-factor sign-in required', 'This installation requires two-factor sign-in: set it up first.', 'POST /api/v1/auth/2fa/setup, then POST /api/v1/auth/2fa/enable.');
+        // Customers and vendors of the portal (RFC 0015 §5.1): the portal API and signing in, nothing else.
+        if (externalUser &&
             !PORTAL_PATHS.some((p) => request.url.startsWith(p)) &&
             request.url.startsWith('/api/'))
             throw new HttpProblem(403, 'internal-only', 'For the company’s users only', 'Portal users reach the portal only.');

package/dist/settings/company.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The companies (RFC 0018, RFC 0019 §3.4). The current company's name, number grouping and brand colour (the
+ * back-office's accent), and its details: every simple field the installed apps add to the company (address,
+ * contacts, tax ids, fiscal year…). Administrators and holders of the Settings / Company access level change them;
+ * administrators also add companies, whose defaults (journals, sequences, taxes…) the apps then install.
+ *
+ * - `GET   /api/v1/settings/company`
+ * - `PATCH /api/v1/settings/company`     `{ name?, numberGrouping?, accentColor?, details? }` (`accentColor`:
+ *                                         `#rrggbb` or null; `details`: `{ field: value }`)
+ * - `GET   /api/v1/settings/companies`   every company with its currency and people, the currencies
+ * - `POST  /api/v1/settings/companies`   `{ name, currency }`: a new company (administrators)
+ */
+import { type ModuleContext } from '../server/index.js';
+/** One of the company's details: a field an installed app adds. */
+export interface CompanyDetail {
+    readonly key: string;
+    readonly label: string;
+    readonly kind: string;
+    readonly readonly: boolean;
+    readonly options: readonly {
+        readonly value: string;
+        readonly label: string;
+    }[] | null;
+    readonly value: string | number | boolean | null;
+}
+export interface CompanySettings {
+    readonly id: number;
+    readonly name: string;
+    readonly numberGrouping: 'international' | 'lakh';
+    readonly accentColor: string | null;
+    readonly currency: string;
+    readonly details: readonly CompanyDetail[];
+}
+export declare function registerCompanyRoutes(context: ModuleContext): void;