slauthjs 1.0.0 → 2.0.0

package/src/orgs.js

@@ -0,0 +1,184 @@
+import { randomId } from './util.js'
+import { normalizeEmail } from './users.js'
+
+const INVITE_DAYS = 7
+/** Roles that can manage an organization. Any other role string is just a label for your app. */
+const MANAGERS = new Set(['owner', 'admin'])
+
+/**
+ * Organizations (teams, workspaces, families: whatever your app calls them).
+ *
+ *   org:<orgId>         { id, name, metadata, createdAt, createdBy }
+ *   members:<orgId>     [{ userId, role, joinedAt }]
+ *   orgs:<userId>       [orgId, ...]
+ *   invite:<inviteId>   { id, orgId, email, role, invitedBy, createdAt, expiresAt }
+ *   invites:<email>     [inviteId, ...]
+ *   org-invites:<orgId> [inviteId, ...]
+ *
+ * Roles: "owner" (everything, including deleting the org), "admin" (members and
+ * invitations), and anything else you like ("member", "billing", "viewer").
+ *
+ * @param {import('./index.js').Store} store
+ */
+export function createOrgs(store) {
+  const list = async (key) => (await store.get(key)) ?? []
+  const save = async (key, items) => (items.length ? store.put(key, items) : store.delete(key))
+
+  async function get(orgId) {
+    return typeof orgId === 'string' ? store.get(`org:${orgId}`) : null
+  }
+
+  async function members(orgId) {
+    return list(`members:${orgId}`)
+  }
+
+  async function role(orgId, userId) {
+    return (await members(orgId)).find((m) => m.userId === userId)?.role ?? null
+  }
+
+  async function addMember(orgId, userId, memberRole = 'member') {
+    const current = await members(orgId)
+    if (current.some((m) => m.userId === userId)) return setRole(orgId, userId, memberRole)
+    await store.put(`members:${orgId}`, [...current, { userId, role: memberRole, joinedAt: Date.now() }])
+    const mine = await list(`orgs:${userId}`)
+    if (!mine.includes(orgId)) await store.put(`orgs:${userId}`, [...mine, orgId])
+    return true
+  }
+
+  async function setRole(orgId, userId, memberRole) {
+    const current = await members(orgId)
+    const member = current.find((m) => m.userId === userId)
+    if (!member) return false
+    if (member.role === 'owner' && memberRole !== 'owner' && current.filter((m) => m.role === 'owner').length === 1) {
+      throw new OrgError('An organization needs at least one owner.', 'last-owner')
+    }
+    await store.put(`members:${orgId}`, current.map((m) => (m.userId === userId ? { ...m, role: memberRole } : m)))
+    return true
+  }
+
+  async function removeMember(orgId, userId) {
+    const current = await members(orgId)
+    const member = current.find((m) => m.userId === userId)
+    if (!member) return false
+    if (member.role === 'owner' && current.filter((m) => m.role === 'owner').length === 1 && current.length > 1) {
+      throw new OrgError('Make someone else an owner first.', 'last-owner')
+    }
+    await save(`members:${orgId}`, current.filter((m) => m.userId !== userId))
+    await save(`orgs:${userId}`, (await list(`orgs:${userId}`)).filter((id) => id !== orgId))
+    // The last person out turns off the lights.
+    if (current.length === 1) await remove(orgId)
+    return true
+  }
+
+  async function remove(orgId) {
+    for (const m of await members(orgId)) await save(`orgs:${m.userId}`, (await list(`orgs:${m.userId}`)).filter((id) => id !== orgId))
+    for (const id of await list(`org-invites:${orgId}`)) await revokeInvite(id)
+    await store.delete(`members:${orgId}`)
+    await store.delete(`org-invites:${orgId}`)
+    await store.delete(`org:${orgId}`)
+  }
+
+  async function invite(orgId, email, memberRole = 'member', invitedBy = null) {
+    const to = normalizeEmail(email)
+    const id = randomId('inv')
+    const now = Date.now()
+    const doc = { id, orgId, email: to, role: memberRole, invitedBy, createdAt: now, expiresAt: now + INVITE_DAYS * 86_400_000 }
+    await store.put(`invite:${id}`, doc, { ttl: INVITE_DAYS * 86_400 })
+    await store.put(`invites:${to}`, [...(await list(`invites:${to}`)), id])
+    await store.put(`org-invites:${orgId}`, [...(await list(`org-invites:${orgId}`)), id])
+    return doc
+  }
+
+  async function revokeInvite(inviteId) {
+    const doc = typeof inviteId === 'string' ? await store.get(`invite:${inviteId}`) : null
+    if (!doc) return false
+    await store.delete(`invite:${inviteId}`)
+    await save(`invites:${doc.email}`, (await list(`invites:${doc.email}`)).filter((id) => id !== inviteId))
+    await save(`org-invites:${doc.orgId}`, (await list(`org-invites:${doc.orgId}`)).filter((id) => id !== inviteId))
+    return true
+  }
+
+  async function live(ids) {
+    const out = []
+    for (const id of ids) {
+      const doc = await store.get(`invite:${id}`)
+      if (doc && doc.expiresAt > Date.now()) out.push(doc)
+    }
+    return out
+  }
+
+  return {
+    get,
+    members,
+    role,
+    addMember,
+    setRole,
+    removeMember,
+    remove,
+    invite,
+    revokeInvite,
+
+    async create({ name, metadata = {} }, ownerId) {
+      const org = { id: randomId('org'), name: String(name).trim().slice(0, 100), metadata, createdAt: Date.now(), createdBy: ownerId ?? null }
+      await store.put(`org:${org.id}`, org)
+      if (ownerId) await addMember(org.id, ownerId, 'owner')
+      return org
+    },
+
+    async update(orgId, patch) {
+      const org = await get(orgId)
+      if (!org) return null
+      const next = { ...org }
+      if (typeof patch.name === 'string' && patch.name.trim()) next.name = patch.name.trim().slice(0, 100)
+      if (patch.metadata !== undefined) next.metadata = patch.metadata
+      await store.put(`org:${orgId}`, next)
+      return next
+    },
+
+    /** The organizations someone belongs to, each with their role. */
+    async forUser(userId) {
+      const out = []
+      for (const id of await list(`orgs:${userId}`)) {
+        const org = await get(id)
+        const r = org && (await role(id, userId))
+        if (r) out.push({ ...org, role: r })
+      }
+      return out
+    },
+
+    invitesFor: async (email) => live(await list(`invites:${normalizeEmail(email)}`)),
+    invitesOf: async (orgId) => live(await list(`org-invites:${orgId}`)),
+    getInvite: async (inviteId) => (typeof inviteId === 'string' ? store.get(`invite:${inviteId}`) : null),
+
+    /** Accepts an invitation addressed to this user's email. */
+    async accept(inviteId, user) {
+      const doc = typeof inviteId === 'string' ? await store.get(`invite:${inviteId}`) : null
+      if (!doc || doc.email !== user.email || doc.expiresAt <= Date.now() || !(await get(doc.orgId))) return null
+      await addMember(doc.orgId, user.id, doc.role)
+      await revokeInvite(inviteId)
+      return doc
+    },
+
+    /** Called when a user is deleted. */
+    async forget(userId) {
+      for (const id of await list(`orgs:${userId}`)) {
+        const current = await members(id)
+        const rest = current.filter((m) => m.userId !== userId)
+        // Hand ownership on to the longest-standing member rather than leave it ownerless.
+        if (rest.length && !rest.some((m) => m.role === 'owner')) rest[0] = { ...rest[0], role: 'owner' }
+        if (rest.length) await store.put(`members:${id}`, rest)
+        else await remove(id)
+      }
+      await store.delete(`orgs:${userId}`)
+    },
+
+    canManage: (memberRole) => MANAGERS.has(memberRole),
+  }
+}
+
+export class OrgError extends Error {
+  constructor(message, code) {
+    super(message)
+    this.code = code
+  }
+}

package/src/password.js

@@ -0,0 +1,81 @@
+import { base64Url, fromBase64Url, safeEqual } from './util.js'
+
+const MAX_FAILURES = 10
+const FAILURE_WINDOW_SECONDS = 15 * 60
+
+/**
+ * Optional passwords, hashed with PBKDF2-SHA256 from Web Crypto. 100,000 rounds by
+ * default: the most Cloudflare Workers allows. Raise `iterations` elsewhere if you like;
+ * old hashes keep working because each one records its own count.
+ *
+ *   password:<userId>   { hash: "pbkdf2-sha256$<iterations>$<salt>$<hash>", updatedAt }
+ *   pwfail:<email>      { count }   (10 wrong guesses → wait 15 minutes)
+ *
+ * People only get a password after proving their email (a code, a link or a provider),
+ * so "forgot password" is just "sign in with a code, then set a new one".
+ *
+ * @param {{ store: import('./index.js').Store, iterations?: number, minLength?: number, validate?: (password: string) => string | null | Promise<string | null> }} options
+ */
+export function createPasswords({ store, iterations = 100_000, minLength = 8, validate }) {
+  // Run a real hash even for unknown emails, so timing doesn't reveal who has an account.
+  let decoy = null
+
+  return {
+    /** An error message when the password won't do, else null. */
+    async problem(password) {
+      if (typeof password !== 'string' || password.length < minLength) return `Passwords need at least ${minLength} characters.`
+      if (password.length > 256) return 'That password is too long.'
+      return validate ? ((await validate(password)) ?? null) : null
+    },
+
+    hash: (password) => hashPassword(password, iterations),
+
+    async set(userId, password) {
+      await store.put(`password:${userId}`, { hash: await hashPassword(password, iterations), updatedAt: Date.now() })
+    },
+
+    async has(userId) {
+      return Boolean(await store.get(`password:${userId}`))
+    },
+
+    async remove(userId) {
+      await store.delete(`password:${userId}`)
+    },
+
+    /** Checks a guess for a user (or null for "no such user"), counting failures per email. */
+    async check(email, userId, password) {
+      const failures = (await store.get(`pwfail:${email}`)) ?? { count: 0 }
+      if (failures.count >= MAX_FAILURES) return { ok: false, code: 'too-many-tries' }
+      const stored = userId ? await store.get(`password:${userId}`) : null
+      decoy ??= await hashPassword('decoy-password', iterations)
+      const ok = await verifyPassword(String(password ?? ''), stored?.hash ?? decoy)
+      if (ok && stored) {
+        await store.delete(`pwfail:${email}`)
+        return { ok: true }
+      }
+      await store.put(`pwfail:${email}`, { count: failures.count + 1 }, { ttl: FAILURE_WINDOW_SECONDS })
+      return { ok: false, code: 'bad-password' }
+    },
+
+    async verify(userId, password) {
+      const stored = await store.get(`password:${userId}`)
+      return Boolean(stored) && verifyPassword(String(password ?? ''), stored.hash)
+    },
+  }
+}
+
+export async function hashPassword(password, iterations = 100_000) {
+  const salt = crypto.getRandomValues(new Uint8Array(16))
+  return `pbkdf2-sha256$${iterations}$${base64Url(salt)}$${base64Url(await derive(password, salt, iterations))}`
+}
+
+export async function verifyPassword(password, stored) {
+  const [scheme, rounds, salt, hash] = String(stored).split('$')
+  if (scheme !== 'pbkdf2-sha256') return false
+  return safeEqual(base64Url(await derive(password, fromBase64Url(salt), Number(rounds))), hash)
+}
+
+async function derive(password, salt, iterations) {
+  const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(password.normalize('NFKC')), 'PBKDF2', false, ['deriveBits'])
+  return crypto.subtle.deriveBits({ name: 'PBKDF2', hash: 'SHA-256', salt, iterations }, key, 256)
+}

package/src/providers.d.ts

@@ -0,0 +1,28 @@
+import type { Profile, Provider } from './index.js'
+
+interface Common {
+  clientId: string
+  clientSecret?: string
+  /** Count the provider's email as verified even when it doesn't say so. */
+  trustEmail?: boolean
+  /** Save access and refresh tokens, for auth.accounts.list(). */
+  keepTokens?: boolean
+  scope?: string
+  params?: Record<string, string>
+}
+
+export function oauth2(options: Common & {
+  id: string
+  name: string
+  authorization: string
+  token: string
+  pkce?: boolean
+  tokenAuth?: 'post' | 'basic'
+  profile(tokens: Record<string, any>, fetch: typeof globalThis.fetch): Promise<Profile>
+}): Provider
+export function oidc(options: Common & { id: string; name: string; issuer: string; tokenAuth?: 'post' | 'basic' }): Provider
+export function github(options: Common): Provider
+export function google(options: Common): Provider
+export function discord(options: Common): Provider
+export function gitlab(options: Common & { baseUrl?: string }): Provider
+export function microsoft(options: Common & { tenant?: string }): Provider

package/src/providers.js

@@ -0,0 +1 @@
+export { oauth2, oidc, github, google, discord, gitlab, microsoft } from './oauth/providers.js'

package/src/rate-limit.js

@@ -0,0 +1,41 @@
+import { clientIp } from './util.js'
+
+/** Per-IP limits on the routes that send email or check a guess: [requests, per seconds]. */
+export const DEFAULT_LIMITS = {
+  'email/start': [10, 600],
+  'password/signin': [20, 600],
+  'password/signup': [10, 600],
+  'two-factor/verify': [20, 600],
+}
+
+/**
+ * A fixed-window counter per IP and route, kept in the store.
+ *
+ *   rate:<route>:<ip>:<window>  count
+ *
+ * Off when no IP can be trusted (see `ip` in the config): the per-email and per-code
+ * limits still apply then.
+ *
+ * @param {import('./index.js').Store} store
+ * @param {false | { limits?: Record<string, [number, number]>, ip?: (request: Request) => string | null }} [options]
+ */
+export function createRateLimit(store, options = {}) {
+  if (options === false) return { check: async () => null }
+  const limits = { ...DEFAULT_LIMITS, ...options.limits }
+  const ipOf = options.ip ?? clientIp
+
+  return {
+    /** Null when it's fine, or how many seconds to wait. */
+    async check(route, request) {
+      const limit = limits[route]
+      const ip = limit && ipOf(request)
+      if (!ip) return null
+      const [max, seconds] = limit
+      const window = Math.floor(Date.now() / 1000 / seconds)
+      const key = `rate:${route}:${ip}:${window}`
+      const count = ((await store.get(key)) ?? 0) + 1
+      await store.put(key, count, { ttl: seconds })
+      return count > max ? (window + 1) * seconds - Math.floor(Date.now() / 1000) : null
+    },
+  }
+}

package/src/routes/account.js

@@ -0,0 +1,130 @@
+import { publicUser } from '../users.js'
+import { json } from '../util.js'
+
+/**
+ * The signed-in person's own account: the session, their profile, their other
+ * sessions, linked providers, and tokens for your APIs.
+ *
+ * @param {object} app  the shared context from core.js
+ */
+export function accountRoutes(app) {
+  const { store, sessions, users, lock, tokens } = app
+
+  return async function route({ route, method, request, url, body }) {
+    if (route === 'session' && method === 'GET') {
+      const me = await app.current(request)
+      const headers = {}
+      if (me?.session) {
+        const refreshed = await sessions.refresh(me.session, request)
+        if (refreshed) headers['Set-Cookie'] = refreshed
+      }
+      const out = { user: me ? publicUser(me.user) : null }
+      if (me?.session?.impersonatorId) out.impersonatorId = me.session.impersonatorId
+      if (!me && app.twoFactor && (await app.pending(request))) out.twoFactor = 'pending'
+      if (lock && me) out.lock = (await lock.handle('session', 'GET', body, { email: me.user.email, userId: me.user.id }, request.headers.get('cookie'), url.protocol === 'https:')).body
+      return json(out, 200, headers)
+    }
+
+    // What the sign-in box should offer.
+    if (route === 'config' && method === 'GET') {
+      return json({
+        appName: app.appName,
+        emailCodes: true,
+        magicLinks: Boolean(app.magicLinks),
+        passkeys: app.passkeys !== false,
+        passwords: Boolean(app.passwords),
+        twoFactor: Boolean(app.twoFactor),
+        organizations: Boolean(app.orgs),
+        providers: app.providers.map((p) => ({ id: p.id, name: p.name })),
+      })
+    }
+
+    if (route === 'signout' && method === 'POST') {
+      const me = await app.current(request)
+      const cookie = await sessions.destroy(request)
+      if (me) await app.emit('signOut', { user: publicUser(me.user), request })
+      return json({ ok: true }, 200, { 'Set-Cookie': cookie })
+    }
+
+    if (route === 'jwks.json' && method === 'GET' && tokens) {
+      return new Response(JSON.stringify(await tokens.jwks()), { headers: { 'Content-Type': 'application/json', 'Cache-Control': 'public, max-age=300', 'Access-Control-Allow-Origin': '*' } })
+    }
+
+    const mine = new Set(['sessions', 'sessions/revoke', 'sessions/revoke-others', 'user', 'user/delete', 'accounts', 'accounts/unlink', 'token'])
+    if (!mine.has(route)) return
+
+    const me = await app.signedIn(request)
+    if (me instanceof Response) return me
+    const { user, session } = me
+
+    if (route === 'token' && method === 'GET' && tokens) {
+      return json(await tokens.create(publicUser(user)))
+    }
+
+    if (route === 'sessions' && method === 'GET') {
+      const list = await sessions.list(user.id)
+      return json({ sessions: list.map((s) => ({ ...s, current: s.id === session?.id })) })
+    }
+
+    if (route === 'sessions/revoke' && method === 'POST') {
+      const { id } = await body()
+      if (!(await sessions.revoke(user.id, id))) return json({ error: 'No such session.', code: 'not-found' }, 404)
+      return json({ ok: true })
+    }
+
+    if (route === 'sessions/revoke-others' && method === 'POST') {
+      await sessions.revokeAll(user.id, session?.id)
+      return json({ ok: true })
+    }
+
+    if (route === 'user' && method === 'POST') {
+      const input = await body()
+      const patch = {}
+      if (input.name !== undefined) {
+        if (input.name !== null && typeof input.name !== 'string') return json({ error: 'A name is text.', code: 'bad-request' }, 400)
+        patch.name = input.name?.trim().slice(0, 100) || null
+      }
+      if (input.image !== undefined) {
+        if (input.image !== null && !(typeof input.image === 'string' && /^https:\/\/\S+$/.test(input.image) && input.image.length <= 2000)) {
+          return json({ error: 'A picture is an https:// link.', code: 'bad-request' }, 400)
+        }
+        patch.image = input.image
+      }
+      const updated = await users.update(user.id, patch)
+      await app.emit('userUpdated', { user: publicUser(updated) })
+      return json({ user: publicUser(updated) })
+    }
+
+    if (route === 'user/delete' && method === 'POST') {
+      if (app.config.allowDeletion === false) return json({ error: "Accounts can't be deleted here.", code: 'not-found' }, 404)
+      if (!app.fresh(session)) return app.reauth()
+      await app.deleteUser(user.id)
+      return json({ ok: true }, 200, { 'Set-Cookie': sessions.clear(request) })
+    }
+
+    if (route === 'accounts' && method === 'GET') {
+      const out = []
+      for (const key of (await store.get(`accounts:${user.id}`)) ?? []) {
+        const doc = await store.get(`account:${key}`)
+        if (doc) out.push({ provider: doc.provider, name: app.providers.find((p) => p.id === doc.provider)?.name ?? doc.provider, email: doc.email ?? null, username: doc.name ?? null, createdAt: doc.createdAt })
+      }
+      return json({
+        accounts: out,
+        password: app.passwords ? await app.passwords.has(user.id) : false,
+        twoFactor: app.twoFactor ? await app.twoFactor.enabled(user.id) : false,
+      })
+    }
+
+    if (route === 'accounts/unlink' && method === 'POST') {
+      const { provider } = await body()
+      const keys = (await store.get(`accounts:${user.id}`)) ?? []
+      const key = keys.find((k) => k.split(':')[0] === provider)
+      if (!key) return json({ error: "That account isn't linked.", code: 'not-found' }, 404)
+      await store.delete(`account:${key}`)
+      const rest = keys.filter((k) => k !== key)
+      if (rest.length) await store.put(`accounts:${user.id}`, rest)
+      else await store.delete(`accounts:${user.id}`)
+      return json({ ok: true })
+    }
+  }
+}

package/src/routes/email.js

@@ -0,0 +1,147 @@
+import { CODE_MINUTES } from '../email-code.js'
+import { normalizeEmail, publicUser, validEmail } from '../users.js'
+import { base64Url, escapeHtml, json, randomToken, safeRedirect, sha256 } from '../util.js'
+
+const MESSAGES = { expired: 'That code has expired. Ask for a new one.', 'too-many-tries': 'Too many tries. Ask for a new code.', 'bad-code': 'That code is wrong.' }
+
+/**
+ * Email codes (and, with magicLinks on, a link in the same email), and changing the
+ * address on an account.
+ *
+ *   link:<sha256 of token>  { email, redirect }   (lives as long as the code)
+ *   signup:<email>          { hash }              (a password to set once the code is used)
+ *
+ * @param {object} app  the shared context from core.js
+ */
+export function emailRoutes(app) {
+  const { store, users, codes, limits } = app
+  const notAllowed = () => json({ error: "That email isn't on the list for this app.", code: 'not-allowed' }, 403)
+  const badEmail = () => json({ error: "That doesn't look like an email address.", code: 'bad-email' }, 400)
+  const slowDown = (retryAfter) => json({ error: `Please wait ${retryAfter}s before trying again.`, code: 'slow-down', retryAfter }, 429)
+  const failed = (result) => json({ error: MESSAGES[result.code], code: result.code, triesLeft: result.triesLeft }, result.code === 'bad-code' ? 400 : 410)
+
+  /** Sends a sign-in code (and link) to an address that's allowed in. Shared with password sign-up. */
+  async function sendSignInCode(email, url, redirect) {
+    let link
+    let data = {}
+    if (app.magicLinks) {
+      const token = randomToken()
+      const linkId = base64Url(await sha256(token))
+      link = `${app.origin(url)}${app.prefix}/email/link?token=${token}`
+      data = { linkId }
+      const sent = await codes.start(email, { link, data })
+      if (sent.ok) await store.put(`link:${linkId}`, { email, redirect: safeRedirect(redirect, null) }, { ttl: CODE_MINUTES * 60 })
+      return sent
+    }
+    return codes.start(email, { data })
+  }
+  app.sendSignInCode = sendSignInCode
+
+  return async function route({ route, method, request, url, body }) {
+    if (route === 'email/start' && method === 'POST') {
+      const input = await body()
+      const email = normalizeEmail(input.email)
+      if (!validEmail(email)) return badEmail()
+      const wait = await limits.check('email/start', request)
+      if (wait) return slowDown(wait)
+      if (!(await users.allowed(email, { method: 'email' }))) return notAllowed()
+      const sent = await sendSignInCode(email, url, input.redirect)
+      if (!sent.ok) return slowDown(sent.retryAfter)
+      return json({ ok: true })
+    }
+
+    if (route === 'email/verify' && method === 'POST') {
+      const input = await body()
+      const email = normalizeEmail(input.email)
+      if (!validEmail(email)) return badEmail()
+      const result = await codes.verify(email, input.code)
+      if (!result.ok) return failed(result)
+      if (result.entry.linkId) await store.delete(`link:${result.entry.linkId}`)
+      const found = await users.signIn(email, { method: 'email' })
+      if (!found) return notAllowed()
+      await finishSignup(found)
+      return app.reply(await app.complete(found, request, { method: 'email' }), {}, request)
+    }
+
+    // The link in the email opens a page with a button, rather than signing in on GET:
+    // mail scanners open links to check them, and would use the link up.
+    if (route === 'email/link' && method === 'GET') {
+      return new Response(linkPage(app.appName, `${app.prefix}/email/link`), {
+        headers: { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store', 'Referrer-Policy': 'no-referrer', 'Content-Security-Policy': "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'" },
+      })
+    }
+
+    if (route === 'email/link' && method === 'POST') {
+      const { token } = await body()
+      const linkId = typeof token === 'string' && token.length <= 128 ? base64Url(await sha256(token)) : null
+      const link = linkId ? await store.get(`link:${linkId}`) : null
+      if (!link) return json({ error: 'That link has expired or was already used. Ask for a new one.', code: 'expired' }, 410)
+      await store.delete(`link:${linkId}`)
+      const code = await store.get(`code:${link.email}`)
+      if (code?.linkId === linkId) await store.delete(`code:${link.email}`)
+      const found = await users.signIn(link.email, { method: 'link' })
+      if (!found) return notAllowed()
+      await finishSignup(found)
+      const result = await app.complete(found, request, { method: 'link' })
+      const to = result.kind === 'two-factor' ? (app.signInPage ?? link.redirect ?? '/') : (link.redirect ?? '/')
+      return app.reply(result, { redirect: to }, request)
+    }
+
+    if (route === 'email/change/start' && method === 'POST') {
+      const me = await app.signedIn(request)
+      if (me instanceof Response) return me
+      if (!app.fresh(me.session)) return app.reauth()
+      const email = normalizeEmail((await body()).email)
+      if (!validEmail(email)) return badEmail()
+      if (email === me.user.email) return json({ error: "That's already your email.", code: 'same-email' }, 400)
+      if (!(await users.allowed(email, { method: 'email-change', user: publicUser(me.user) }))) return notAllowed()
+      if (await users.byEmail(email)) return json({ error: 'Another account uses that email.', code: 'email-taken' }, 409)
+      const sent = await codes.start(email, { key: `code-change:${me.user.id}`, kind: 'email-change' })
+      if (!sent.ok) return slowDown(sent.retryAfter)
+      return json({ ok: true })
+    }
+
+    if (route === 'email/change/verify' && method === 'POST') {
+      const me = await app.signedIn(request)
+      if (me instanceof Response) return me
+      const input = await body()
+      const email = normalizeEmail(input.email)
+      if (!validEmail(email)) return badEmail()
+      const result = await codes.verify(email, input.code, { key: `code-change:${me.user.id}` })
+      if (!result.ok) return failed(result)
+      if (await users.byEmail(email)) return json({ error: 'Another account uses that email.', code: 'email-taken' }, 409)
+      const updated = await users.update(me.user.id, { email })
+      await app.emit('userUpdated', { user: publicUser(updated) })
+      return json({ user: publicUser(updated) })
+    }
+  }
+
+  /** Someone who signed up with a password has now proved their email: save the password. */
+  async function finishSignup(found) {
+    const pending = await store.get(`signup:${found.email}`)
+    if (!pending) return
+    await store.delete(`signup:${found.email}`)
+    await store.put(`password:${found.id}`, { hash: pending.hash, updatedAt: Date.now() })
+  }
+}
+
+function linkPage(appName, endpoint) {
+  const name = escapeHtml(appName)
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sign in to ${name}</title>
+<style>body{margin:0;min-height:100vh;display:grid;place-items:center;background:#fdf6ec;color:#2b2118;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif}
+main{max-width:360px;margin:16px;background:#fff;border:2px solid #2b2118;border-radius:16px;padding:28px;box-shadow:4px 4px 0 #2b2118;text-align:center}
+button{font:inherit;font-weight:700;font-size:16px;background:#f59e0b;color:#2b2118;border:2px solid #2b2118;border-radius:10px;padding:12px 18px;width:100%;cursor:pointer}
+p{opacity:.8}.error{color:#c2410c;font-weight:600;opacity:1}</style></head>
+<body><main><h1 style="font-size:22px;margin:0 0 8px">Sign in to ${name}</h1><p>You're one tap away.</p>
+<button id="go">Continue</button><p id="msg" class="error" role="alert"></p></main>
+<script>
+const token = new URLSearchParams(location.search).get('token')
+document.getElementById('go').addEventListener('click', async (e) => {
+  e.target.disabled = true
+  const res = await fetch(${JSON.stringify(endpoint)}, { method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ token }) }).catch(() => null)
+  const data = res ? await res.json().catch(() => ({})) : { error: "Couldn't reach the server." }
+  if (res && res.ok) location.replace(data.redirect || '/')
+  else { document.getElementById('msg').textContent = data.error || 'Something went wrong.'; e.target.disabled = false }
+})
+</script></body></html>`
+}