shutro-erp 0.3.2 → 0.3.4

package/dist/server/auth/service.d.ts

@@ -39,11 +39,26 @@ export interface UserInfo {
     readonly companies: readonly number[];
     /** The number grouping of each of the user's companies (RFC 0016): `lakh` or `international`. */
     readonly groupings: Readonly<Record<string, 'international' | 'lakh'>>;
+    /** The brand colour of each of the user's companies that has one (RFC 0018): `#rrggbb`. */
+    readonly accents: Readonly<Record<string, string>>;
+    /** The user's photo version (`/api/v1/images/user/<id>?v=<version>`), or null without one. */
+    readonly avatar: string | null;
+    /** Each of the user's companies' logo version, when it has one. */
+    readonly logos: Readonly<Record<string, string>>;
     readonly twoFactorEnabled: boolean;
     /** Holds an administrator role (in some company). */
     readonly administrator: boolean;
     /** Administrator rights are withheld until this session has a second factor (enable or verify 2FA). */
     readonly administratorNeedsSecondFactor: boolean;
+    /** The policy requires two-factor sign-in of everyone and it is not on: nothing but setting it up is allowed. */
+    readonly twoFactorSetupRequired: boolean;
+}
+/** The installation's security policy (RFC 0019 §3.5). */
+export interface SecurityPolicy {
+    /** Who must sign in with a second factor: administrators only (the default), or everyone. */
+    readonly twoFactor: 'administrators' | 'everyone';
+    /** Days a sign-in lasts at most; null: the server's `lifetimeMs`. */
+    readonly sessionDays: number | null;
 }
 /** An API key as listed (never its secret). */
 export interface ApiKeyInfo {
@@ -162,4 +177,45 @@ export declare class AuthService {
     disableTwoFactor(session: SessionInfo, password: string, code: string): Promise<void>;
     /** Changes the password; every other session of the user is revoked. */
     changePassword(session: SessionInfo, current: string, next: string): Promise<void>;
+    /** The security policy (cached like sessions; {@link forgetPolicy} after changing it). */
+    policy(): Promise<SecurityPolicy>;
+    /** Forgets the cached policy: after Settings › Security changed it. */
+    forgetPolicy(): void;
+    /** Forgets what is cached about `user` (their identity and sessions): after their roles or account changed. */
+    forget(user: number): void;
+    /** The signed-in user's own details (RFC 0019 §3.6). */
+    profile(session: SessionInfo): Promise<Profile>;
+    /**
+     * Changes the user's own details: name, email, phone, language, time zone, and the default company (one of
+     * theirs). Audited.
+     */
+    updateProfile(session: SessionInfo, values: Partial<Omit<Profile, 'login'>>): Promise<Profile>;
+    /** The user's active sessions, newest use first; the current one marked. */
+    sessions(session: SessionInfo): Promise<SessionEntry[]>;
+    /** Signs out one of the user's own sessions (or all but this one with `'others'`). Audited. */
+    revokeSessions(session: SessionInfo, which: number | 'others'): Promise<{
+        revoked: number;
+    }>;
+}
+/** The user's own details (RFC 0019 §3.6). */
+export interface Profile {
+    readonly login: string;
+    readonly name: string;
+    readonly email: string | null;
+    readonly phone: string | null;
+    readonly lang: string;
+    readonly tz: string;
+    /** The default company. */
+    readonly company: number | null;
+}
+/** One of the user's sessions (a signed-in device). */
+export interface SessionEntry {
+    readonly id: number;
+    readonly ip: string | null;
+    readonly userAgent: string | null;
+    readonly lastSeenAt: string;
+    readonly createdAt: string | null;
+    readonly secondFactor: boolean;
+    /** This browser. */
+    readonly current: boolean;
 }

package/dist/server/auth/service.js

@@ -1,7 +1,9 @@
 import { audit } from '../audit.js';
 import { HttpProblem } from '../errors.js';
+import { imageVersions } from '../images.js';
 import { keepingAdministrator } from './admins.js';
 import { digest, hashPassword, newTotpSecret, otpauthUri, randomToken, verifyPassword, verifyTotp, } from './crypto.js';
+import { resolveAccessToken } from './oauth.js';
 export const SESSION_COOKIE = 'kosh_session';
 const MIN_PASSWORD = 12;
 const model = (env, name) => env.model(name);
@@ -38,6 +40,7 @@ export class AuthService {
     #cache = new Map();
     #keyCache = new Map();
     #dummy = hashPassword(randomToken());
+    #policy;
     constructor(shutro, options = {}) {
         this.#shutro = shutro;
         this.#options = {
@@ -95,6 +98,8 @@ export class AuthService {
     }
     /** Signs in: a new session (pending second factor when 2FA is on). @throws {HttpProblem} 401 */
     async login(request, login, password) {
+        const { sessionDays } = await this.policy();
+        const lifetimeMs = sessionDays === null ? this.#options.lifetimeMs : sessionDays * 86_400_000;
         const outcome = await this.#system(`login ${login}`, async (env) => {
             const user = one(await fetch(model(env, 'res.users').search({ where: { login } }), ['login']));
             const credential = user === undefined
@@ -119,7 +124,7 @@ export class AuthService {
                     csrfHash: digest(csrfToken),
                     user: user['id'],
                     twoFactorVerified: !twoFactorRequired,
-                    expiresAt: new Date(now + this.#options.lifetimeMs),
+                    expiresAt: new Date(now + lifetimeMs),
                     lastSeenAt: new Date(now),
                     ip: request.ip,
                     userAgent: String(request.headers['user-agent'] ?? '').slice(0, 300),
@@ -225,12 +230,27 @@ export class AuthService {
                 scopes: key.scopes,
                 apiKey: key.id,
             });
+        // An OAuth access token (RFC 0017 §5.2): the consenting user, within the grant's scopes.
+        const bearer = /^Bearer\s+(oat_\S+)$/i.exec(String(request.headers.authorization ?? ''))?.[1];
+        if (bearer !== undefined) {
+            const access = await this.#system('oauth token', (env) => resolveAccessToken(env, bearer));
+            if (access === null)
+                throw unauthenticated('invalid-token', 'The access token is unknown, expired or revoked.', 'Refresh it, or ask the user to allow the app again.');
+            return this.#identity(request, access.user, {
+                elevated: false,
+                scopes: access.scopes,
+                oauthToken: access.token,
+            });
+        }
         const session = await this.session(request);
         if (session === null)
             return null;
         if (session.twoFactorRequired)
             throw unauthenticated('two-factor-required', 'Enter the code from your authenticator app first.', 'POST /api/v1/auth/2fa/verify.');
-        return this.#identity(request, session.user, { elevated: session.secondFactor });
+        return this.#identity(request, session.user, {
+            elevated: session.secondFactor,
+            session: true,
+        });
     }
     async #identity(request, user, options) {
         const info = await this.#identityOf(user);
@@ -264,6 +284,14 @@ export class AuthService {
             tz: info.tz,
             ...(options.scopes === undefined ? {} : { scopes: options.scopes }),
             ...(options.apiKey === undefined ? {} : { apiKey: options.apiKey }),
+            ...(options.oauthToken === undefined ? {} : { oauthToken: options.oauthToken }),
+            // A session without the second factor the policy asks of everyone (RFC 0019 §3.5): the server allows only
+            // setting it up. API keys are not sessions: their owner signed in to make them.
+            ...(options.session === true &&
+                !info.twoFactorEnabled &&
+                (await this.policy()).twoFactor === 'everyone'
+                ? { twoFactorMissing: true }
+                : {}),
         };
     }
     /**
@@ -546,9 +574,13 @@ export class AuthService {
             const twoFactorEnabled = credential?.['totpEnabled'] === true;
             const companyIds = user?.['companies'] ?? [];
             const groupings = {};
+            const accents = {};
             if (companyIds.length > 0)
-                for (const c of await fetch(model(env, 'res.company').search({ where: { id: { in: companyIds } } }), ['numberGrouping']))
+                for (const c of await fetch(model(env, 'res.company').search({ where: { id: { in: companyIds } } }), ['numberGrouping', 'accentColor'])) {
                     groupings[String(c['id'])] = c['numberGrouping'] === 'lakh' ? 'lakh' : 'international';
+                    if (typeof c['accentColor'] === 'string' && /^#[0-9a-f]{6}$/i.test(c['accentColor']))
+                        accents[String(c['id'])] = c['accentColor'];
+                }
             return {
                 id: session.user,
                 login: String(user?.['login']),
@@ -556,9 +588,13 @@ export class AuthService {
                 company: typeof user?.['company'] === 'number' ? user['company'] : null,
                 companies: companyIds,
                 groupings,
+                accents,
+                avatar: (await imageVersions(env, 'user', [session.user]))[String(session.user)] ?? null,
+                logos: await imageVersions(env, 'company', companyIds),
                 twoFactorEnabled,
                 administrator,
                 administratorNeedsSecondFactor: administrator && !(session.secondFactor && twoFactorEnabled),
+                twoFactorSetupRequired: !twoFactorEnabled && (await this.policy()).twoFactor === 'everyone',
             };
         });
     }
@@ -667,6 +703,8 @@ export class AuthService {
     }
     /** Turns 2FA off (password and a current code required). */
     async disableTwoFactor(session, password, code) {
+        if ((await this.policy()).twoFactor === 'everyone')
+            throw new HttpProblem(409, 'two-factor-required', 'Two-factor sign-in is required', 'This installation requires two-factor sign-in of everyone: it cannot be turned off.');
         await this.#system('2fa disable', async (env) => {
             const credentials = await model(env, 'auth.credential').search({
                 where: { user: session.user },
@@ -708,4 +746,148 @@ export class AuthService {
         this.#forgetUser(session.user);
         this.#cache.clear(); // other sessions of this user, cached by token
     }
+    /** The security policy (cached like sessions; {@link forgetPolicy} after changing it). */
+    async policy() {
+        const cached = this.#policy;
+        if (cached !== undefined && Date.now() - cached.at < this.#options.cacheMs)
+            return cached.policy;
+        const policy = await this.#system('policy', async (env) => {
+            const [row] = await fetch(model(env, 'auth.policy').search({ where: {}, limit: 1 }), [
+                'twoFactor',
+                'sessionDays',
+            ]);
+            const days = row?.['sessionDays'];
+            return {
+                twoFactor: row?.['twoFactor'] === 'everyone' ? 'everyone' : 'administrators',
+                sessionDays: typeof days === 'number' && days > 0 ? days : null,
+            };
+        });
+        this.#policy = { at: Date.now(), policy };
+        return policy;
+    }
+    /** Forgets the cached policy: after Settings › Security changed it. */
+    forgetPolicy() {
+        this.#policy = undefined;
+    }
+    /** Forgets what is cached about `user` (their identity and sessions): after their roles or account changed. */
+    forget(user) {
+        this.#forgetUser(user);
+        this.#cache.clear();
+    }
+    /** The signed-in user's own details (RFC 0019 §3.6). */
+    async profile(session) {
+        return this.#system('profile', async (env) => {
+            const [row] = await fetch(model(env, 'res.users').browse([session.user]), PROFILE_KEYS);
+            return {
+                login: String(row?.['login'] ?? ''),
+                name: String(row?.['name'] ?? ''),
+                email: typeof row?.['email'] === 'string' ? row['email'] : null,
+                phone: typeof row?.['phone'] === 'string' ? row['phone'] : null,
+                lang: String(row?.['lang'] ?? 'en_US'),
+                tz: String(row?.['tz'] ?? 'UTC'),
+                company: typeof row?.['company'] === 'number' ? row['company'] : null,
+            };
+        });
+    }
+    /**
+     * Changes the user's own details: name, email, phone, language, time zone, and the default company (one of
+     * theirs). Audited.
+     */
+    async updateProfile(session, values) {
+        const changes = {};
+        if (values.name !== undefined) {
+            const name = values.name.trim();
+            if (name === '' || name.length > 200)
+                throw new HttpProblem(422, 'invalid-name', 'Invalid name', 'Your name is 1–200 characters.');
+            changes['name'] = name;
+        }
+        if (values.email !== undefined) {
+            const email = values.email === null ? '' : values.email.trim();
+            if (email !== '' && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email))
+                throw new HttpProblem(422, 'invalid-email', 'Invalid email', `'${email}' is not an email address.`);
+            changes['email'] = email === '' ? null : email;
+        }
+        if (values.phone !== undefined)
+            changes['phone'] = values.phone?.trim() || null;
+        if (values.lang !== undefined) {
+            if (!/^[a-z]{2,3}(_[A-Z]{2})?$/.test(values.lang))
+                throw new HttpProblem(422, 'invalid-lang', 'Invalid language', 'A language code such as en_US or bn_BD.');
+            changes['lang'] = values.lang;
+        }
+        if (values.tz !== undefined) {
+            try {
+                new Intl.DateTimeFormat('en', { timeZone: values.tz });
+            }
+            catch {
+                throw new HttpProblem(422, 'invalid-tz', 'Invalid time zone', `'${values.tz}' is not a time zone.`);
+            }
+            changes['tz'] = values.tz;
+        }
+        if (values.company !== undefined && values.company !== null) {
+            const info = await this.#identityOf(session.user);
+            if (info === null || !info.companies.includes(values.company))
+                throw new HttpProblem(422, 'invalid-company', 'Invalid company', 'Choose one of your companies.');
+            changes['company'] = values.company;
+        }
+        if (Object.keys(changes).length > 0)
+            await this.#system('profile change', async (env) => {
+                await model(env, 'res.users').browse([session.user]).write(changes);
+                await audit(env, {
+                    kind: 'auth.profile_changed',
+                    summary: `Changed ${Object.keys(changes).join(', ')}.`,
+                    actor: session.user,
+                });
+            });
+        this.#forgetUser(session.user);
+        return this.profile(session);
+    }
+    /** The user's active sessions, newest use first; the current one marked. */
+    async sessions(session) {
+        return this.#system('sessions', async (env) => {
+            const rows = await fetch(model(env, 'auth.session').search({
+                where: { user: session.user, revoked: false, expiresAt: { gt: new Date() } },
+                order: ['lastSeenAt desc', 'id desc'],
+                limit: 50,
+            }), ['id', 'ip', 'userAgent', 'lastSeenAt', 'createdAt', 'secondFactor']);
+            return rows.map((r) => ({
+                id: r['id'],
+                ip: typeof r['ip'] === 'string' ? r['ip'] : null,
+                userAgent: typeof r['userAgent'] === 'string' ? r['userAgent'] : null,
+                lastSeenAt: new Date(timeOf(r['lastSeenAt']) ?? 0).toISOString(),
+                createdAt: timeOf(r['createdAt']) === null
+                    ? null
+                    : new Date(timeOf(r['createdAt'])).toISOString(),
+                secondFactor: r['secondFactor'] === true,
+                current: r['id'] === session.id,
+            }));
+        });
+    }
+    /** Signs out one of the user's own sessions (or all but this one with `'others'`). Audited. */
+    async revokeSessions(session, which) {
+        const revoked = await this.#system('sign out a session', async (env) => {
+            const set = await model(env, 'auth.session').search({
+                where: {
+                    user: session.user,
+                    revoked: false,
+                    ...(which === 'others' ? { id: { ne: session.id } } : { id: which }),
+                },
+            });
+            if (which !== 'others' && set.length === 0)
+                throw new HttpProblem(404, 'missing-record', 'Not found', `You have no session ${which}.`);
+            if (set.length > 0)
+                await set.write({ revoked: true });
+            await audit(env, {
+                kind: 'auth.session_revoked',
+                summary: which === 'others'
+                    ? `Signed out ${set.length} other session(s).`
+                    : `Signed out session ${which}.`,
+                actor: session.user,
+            });
+            return set.length;
+        });
+        this.#forgetUser(session.user);
+        this.#cache.clear();
+        return { revoked };
+    }
 }
+const PROFILE_KEYS = ['login', 'name', 'email', 'phone', 'lang', 'tz', 'company'];

package/dist/server/identity.d.ts

@@ -24,6 +24,10 @@ export interface RequestIdentity {
     readonly scopes?: readonly string[];
     /** The API key the request carries. */
     readonly apiKey?: number;
+    /** The OAuth access token the request carries (RFC 0017 §5.2): its app acts for the user, within `scopes`. */
+    readonly oauthToken?: number;
+    /** A session without the second factor the security policy asks of everyone (RFC 0019 §3.5). */
+    readonly twoFactorMissing?: true;
 }
 /**
  * The single explicit bypass (CLAUDE.md "superuser mode", RFC 0003 §5.2): the user holds an administrator role

package/dist/server/images.d.ts

@@ -0,0 +1,12 @@
+import type { FastifyInstance } from 'fastify';
+import type { AuthService } from './auth/service.js';
+import type { Env } from './orm.js';
+declare const KINDS: {
+    readonly user: 'res.users';
+    readonly company: 'res.company';
+};
+type Kind = keyof typeof KINDS;
+/** The image versions of `ids` of a kind (a short digest), for URLs that change when the image does. */
+export declare function imageVersions(env: Env, kind: Kind, ids: readonly number[]): Promise<Record<string, string>>;
+export declare function registerImageRoutes(app: FastifyInstance, auth: AuthService): void;
+export {};

package/dist/server/images.js

@@ -0,0 +1,139 @@
+/**
+ * Profile photos and company logos: small images (resized to 256 px in the browser) kept in the database, so they
+ * work with or without file storage. PNG, JPEG or WebP only — checked by their bytes, never trusted from the name or
+ * the type given; at most 300 KB. Served to signed-in users with a version in the URL, so browsers cache them.
+ *
+ * - `GET    /api/v1/images/:kind/:id`        `kind`: `user` or `company`; the image, or 404
+ * - `PUT    /api/v1/auth/profile/avatar`     `{ image: 'data:image/…;base64,…' }`: your photo; `DELETE` removes it
+ * - `PUT    /api/v1/images/company/:id`      a company's logo (Administrator or Settings / Company, one of your
+ *                                            companies); `DELETE` removes it
+ */
+import { createHash } from 'node:crypto';
+import { audit } from './audit.js';
+import { HttpProblem } from './errors.js';
+const MAX_BYTES = 300 * 1024;
+const KINDS = { user: 'res.users', company: 'res.company' };
+const images = (env) => env.model('kosh.image');
+/** The image's type from its first bytes: PNG, JPEG or WebP; anything else (SVG included) is refused. */
+function sniff(bytes) {
+    if (bytes.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])))
+        return 'image/png';
+    if (bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff)
+        return 'image/jpeg';
+    if (bytes.subarray(0, 4).toString('latin1') === 'RIFF' &&
+        bytes.subarray(8, 12).toString('latin1') === 'WEBP')
+        return 'image/webp';
+    return null;
+}
+/** The bytes of a `data:` URL, checked. @throws {HttpProblem} 422 */
+function decode(input) {
+    const bad = (detail) => new HttpProblem(422, 'invalid-image', 'Invalid image', detail);
+    const match = typeof input === 'string'
+        ? /^data:image\/[a-z+.-]+;base64,([A-Za-z0-9+/=]+)$/.exec(input)
+        : null;
+    if (match === null)
+        throw bad('Send the image as a data URL (PNG, JPEG or WebP).');
+    const bytes = Buffer.from(match[1], 'base64');
+    if (bytes.length === 0 || bytes.length > MAX_BYTES)
+        throw bad('The image must be under 300 KB.');
+    const mime = sniff(bytes);
+    if (mime === null)
+        throw bad('Only PNG, JPEG or WebP images.');
+    return { bytes, mime };
+}
+/** The image versions of `ids` of a kind (a short digest), for URLs that change when the image does. */
+export async function imageVersions(env, kind, ids) {
+    if (ids.length === 0)
+        return {};
+    const found = await images(env).search({
+        where: { ownerModel: KINDS[kind], ownerId: { in: [...ids] } },
+    });
+    const rows = found.length === 0 ? [] : (await found.load(['ownerId', 'hash'])).read(['ownerId', 'hash']);
+    return Object.fromEntries(rows.map((r) => [String(r['ownerId']), String(r['hash'])]));
+}
+async function store(env, kind, id, input) {
+    const existing = await images(env).search({ where: { ownerModel: KINDS[kind], ownerId: id } });
+    if (input === null) {
+        if (existing.length > 0)
+            await existing.unlink();
+        return null;
+    }
+    const { bytes, mime } = decode(input);
+    const hash = createHash('sha256').update(bytes).digest('hex').slice(0, 16);
+    const values = { mime, data: bytes.toString('base64'), hash };
+    if (existing.length > 0)
+        await existing.write(values);
+    else
+        await images(env).create([{ ownerModel: KINDS[kind], ownerId: id, ...values }]);
+    return hash;
+}
+export function registerImageRoutes(app, auth) {
+    app.get('/api/v1/images/:kind/:id', async (request, reply) => {
+        const { kind, id } = request.params;
+        const owner = Number(id);
+        if (!(kind === 'user' || kind === 'company') || !Number.isSafeInteger(owner) || owner <= 0)
+            throw new HttpProblem(404, 'not-found', 'Not found', 'No such image.');
+        const row = await request.env((env) => env.asSuperuser({ reason: 'image' }, async (su) => {
+            const found = await images(su).search({
+                where: { ownerModel: KINDS[kind], ownerId: owner },
+            });
+            return found.length === 0
+                ? undefined
+                : (await found.load(['mime', 'data', 'hash'])).read(['mime', 'data', 'hash'])[0];
+        }), { write: true });
+        if (row === undefined)
+            throw new HttpProblem(404, 'not-found', 'Not found', 'No image.');
+        const etag = `"${String(row['hash'])}"`;
+        reply
+            .header('content-type', String(row['mime']))
+            .header('etag', etag)
+            .header('x-content-type-options', 'nosniff')
+            // Versioned URLs (`?v=<hash>`) never change; plain ones are checked again after a minute.
+            .header('cache-control', request.query.v === undefined
+            ? 'private, max-age=60'
+            : 'private, max-age=31536000, immutable');
+        if (request.headers['if-none-match'] === etag)
+            return reply.status(304).send();
+        return reply.send(Buffer.from(String(row['data']), 'base64'));
+    });
+    const own = async (request, image) => {
+        const session = await auth.requireSession(request);
+        const hash = await request.env((env) => env.asSuperuser({ reason: 'profile photo' }, async (su) => {
+            const out = await store(su, 'user', session.user, image);
+            await audit(env, {
+                kind: 'auth.avatar',
+                summary: image === null ? 'Profile photo removed.' : 'Profile photo changed.',
+                targetModel: 'res.users',
+                targetId: session.user,
+            });
+            await su.flush();
+            return out;
+        }), { write: true });
+        auth.forget(session.user);
+        return { avatar: hash };
+    };
+    app.put('/api/v1/auth/profile/avatar', async (request) => own(request, request.body?.['image'] ?? ''));
+    app.delete('/api/v1/auth/profile/avatar', async (request) => own(request, null));
+    const logo = async (request, image) => {
+        const company = Number(request.params.id);
+        return request.env(async (env) => {
+            if (!env.administrator && !env.groups.has('settings.company'))
+                throw new HttpProblem(403, 'access', 'Company settings', 'Changing the logo needs the Administrator role or the Settings / Company access.');
+            if (!env.administrator && !env.companyIds.includes(company))
+                throw new HttpProblem(403, 'access', 'Company settings', 'Not one of your companies.');
+            return env.asSuperuser({ reason: 'company logo' }, async (su) => {
+                const hash = await store(su, 'company', company, image);
+                await audit(env, {
+                    kind: 'settings.logo',
+                    summary: image === null ? 'Company logo removed.' : 'Company logo changed.',
+                    targetModel: 'res.company',
+                    targetId: company,
+                });
+                await su.flush();
+                return { logo: hash };
+            });
+        }, { write: true });
+    };
+    app.put('/api/v1/images/company/:id', async (request) => logo(request, request.body?.['image'] ?? ''));
+    app.delete('/api/v1/images/company/:id', async (request) => logo(request, null));
+}

package/dist/server/index.d.ts

@@ -18,12 +18,13 @@ export { base, baseShutro } from './auth/base.js';
 export { digest, hashPassword, newTotpSecret, otpauthUri, randomToken, totp, verifyPassword, verifyTotp, } from './auth/crypto.js';
 export { type InstallBaseOptions, installBase } from './auth/install.js';
 export { registerAuthRoutes } from './auth/routes.js';
-export { type AuthOptions, AuthService, cookieOf, SESSION_COOKIE, type SessionInfo, timeOf, type UserInfo, } from './auth/service.js';
+export { type AuthOptions, AuthService, cookieOf, SESSION_COOKIE, type SecurityPolicy, type SessionInfo, timeOf, type UserInfo, } from './auth/service.js';
 export { DEMO_PASSWORD, type DemoResult, installDemo } from './demo.js';
 export { applyEnvironmentNames } from './env-names.js';
 export { HttpProblem, type Problem, problemOf, ServerConfigError } from './errors.js';
 export { type AppHost, type AppHostOptions, createAppHost, startAppHost } from './host.js';
 export { type Authenticator, denyAll, isSuperuser, languageOf, type RequestIdentity, type RequestRunOptions, runOptionsOf, } from './identity.js';
+export { imageVersions, registerImageRoutes } from './images.js';
 export { migrate, orm, pg } from './orm.js';
 export { buildKoshRegistry, KOSH_VERSION, type KoshRegistry } from './registry.js';
 export { type AppsContext, createServer, type KoshServer, type ModuleContext, type ServerOptions, startServer, } from './server.js';

package/dist/server/index.js

@@ -24,6 +24,7 @@ export { applyEnvironmentNames } from './env-names.js';
 export { HttpProblem, problemOf, ServerConfigError } from './errors.js';
 export { createAppHost, startAppHost } from './host.js';
 export { denyAll, isSuperuser, languageOf, runOptionsOf, } from './identity.js';
+export { imageVersions, registerImageRoutes } from './images.js';
 export { migrate, orm, pg } from './orm.js';
 export { buildKoshRegistry, KOSH_VERSION } from './registry.js';
 export { createServer, startServer, } from './server.js';

package/dist/server/server.d.ts

@@ -47,6 +47,10 @@ export interface ServerOptions {
         /** Sign-in attempts per 15 minutes per IP and login (default 10; 0 turns the limit off). */
         readonly loginLimit?: number;
     };
+    /** OAuth 2.0 provider (RFC 0017 §5.2): the back-office's address, where the consent page is (`KOSH_BASE_URL`). */
+    readonly oauth?: {
+        readonly baseUrl?: string;
+    };
     /**
      * Shutro's identity loader checks every request's user (active, companies, groups) against `base`'s data. Default:
      * on with the built-in authentication; custom authenticators opt in.

package/dist/server/server.js

@@ -13,12 +13,14 @@ import { openApiDocument } from './api/openapi.js';
 import { registerRestApi } from './api/rest.js';
 import { ViewRegistry } from './api/views.js';
 import { registerApiKeyRoutes } from './auth/api-keys.js';
+import { registerOAuthRoutes } from './auth/oauth.js';
 import { registerAuthRoutes } from './auth/routes.js';
 import { enforceScopes } from './auth/scopes.js';
 import { AuthService } from './auth/service.js';
 import { applyEnvironmentNames } from './env-names.js';
 import { HttpProblem, problemOf, ServerConfigError } from './errors.js';
 import { denyAll, runOptionsOf } from './identity.js';
+import { registerImageRoutes } from './images.js';
 import { orm, pg } from './orm.js';
 import { buildKoshRegistry, KOSH_VERSION } from './registry.js';
 import { endSpan, tracer } from './telemetry.js';
@@ -142,11 +144,19 @@ export async function createServer(options) {
                     : null);
             enforceScopes(scopes, request.method, route, owner);
         }
-        // Customers and vendors of the portal (RFC 0015 §5.1): the portal API and signing in, nothing else.
-        if (request.identity !== null &&
+        const externalUser = request.identity !== null &&
             external.size > 0 &&
             request.identity.groups.length > 0 &&
-            request.identity.groups.every((g) => external.has(g)) &&
+            request.identity.groups.every((g) => external.has(g));
+        // Two-factor sign-in required of everyone (RFC 0019 §3.5): until it is set up, only the sign-in routes (setting
+        // it up, signing out, who am I). Portal users are not the company's people: the policy is not theirs.
+        if (request.identity?.twoFactorMissing === true &&
+            !externalUser &&
+            request.url.startsWith('/api/') &&
+            !request.url.startsWith('/api/v1/auth/'))
+            throw new HttpProblem(403, 'two-factor-setup-required', 'Two-factor sign-in required', 'This installation requires two-factor sign-in: set it up first.', 'POST /api/v1/auth/2fa/setup, then POST /api/v1/auth/2fa/enable.');
+        // Customers and vendors of the portal (RFC 0015 §5.1): the portal API and signing in, nothing else.
+        if (externalUser &&
             !PORTAL_PATHS.some((p) => request.url.startsWith(p)) &&
             request.url.startsWith('/api/'))
             throw new HttpProblem(403, 'internal-only', 'For the company’s users only', 'Portal users reach the portal only.');
@@ -161,7 +171,9 @@ export async function createServer(options) {
                 ? `ip:${request.ip}`
                 : request.identity.apiKey !== undefined
                     ? `key:${request.identity.apiKey}`
-                    : `user:${request.identity.user}`,
+                    : request.identity.oauthToken !== undefined
+                        ? `oauth:${request.identity.oauthToken}`
+                        : `user:${request.identity.user}`,
             allowList: (request) => request.routeOptions.config.public === true,
             errorResponseBuilder: (_request, context) => new HttpProblem(429, 'rate-limited', 'Too many requests', `Limit of ${context.max} requests per ${context.after} reached.`, `Retry after ${context.after}.`),
         });
@@ -201,6 +213,10 @@ export async function createServer(options) {
     if (auth !== undefined) {
         registerAuthRoutes(app, auth, { loginLimit: options.auth?.loginLimit ?? 10 });
         registerApiKeyRoutes(app, auth, registry);
+        registerImageRoutes(app, auth);
+        registerOAuthRoutes(app, auth, () => shutro, registry, {
+            baseUrl: options.oauth?.baseUrl ?? process.env['KOSH_BASE_URL'] ?? 'http://localhost:5173',
+        });
     }
     // The generated REST API and its OpenAPI document (RFC 0002 §6.3–6.4).
     for (const statement of idempotencyTableStatements())

package/dist/settings/company.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The companies (RFC 0018, RFC 0019 §3.4). The current company's name, number grouping and brand colour (the
+ * back-office's accent), and its details: every simple field the installed apps add to the company (address,
+ * contacts, tax ids, fiscal year…). Administrators and holders of the Settings / Company access level change them;
+ * administrators also add companies, whose defaults (journals, sequences, taxes…) the apps then install.
+ *
+ * - `GET   /api/v1/settings/company`
+ * - `PATCH /api/v1/settings/company`     `{ name?, numberGrouping?, accentColor?, details? }` (`accentColor`:
+ *                                         `#rrggbb` or null; `details`: `{ field: value }`)
+ * - `GET   /api/v1/settings/companies`   every company with its currency and people, the currencies
+ * - `POST  /api/v1/settings/companies`   `{ name, currency }`: a new company (administrators)
+ */
+import { type ModuleContext } from '../server/index.js';
+/** One of the company's details: a field an installed app adds. */
+export interface CompanyDetail {
+    readonly key: string;
+    readonly label: string;
+    readonly kind: string;
+    readonly readonly: boolean;
+    readonly options: readonly {
+        readonly value: string;
+        readonly label: string;
+    }[] | null;
+    readonly value: string | number | boolean | null;
+}
+export interface CompanySettings {
+    readonly id: number;
+    readonly name: string;
+    readonly numberGrouping: 'international' | 'lakh';
+    readonly accentColor: string | null;
+    readonly currency: string;
+    readonly details: readonly CompanyDetail[];
+}
+export declare function registerCompanyRoutes(context: ModuleContext): void;