Paddy
7aac07a013
Introduces src/models/admin/, a dedicated identity and permissions module on its own nachklang_admin database, and the shared authenticator that feedback and tickets will move onto in the cutover step. Nothing swaps over yet: feedback.auth.ts and tickets.auth.ts still authenticate against the legacy calendar sessions, so production behaviour is unchanged. - better-auth 1.7 mounted at /admin/auth/*, sessions as httpOnly cookies scoped to .nachklang.art so one sign-in covers every *.nachklang.art app. - Accounts are invite-only: public sign-up is disabled, and the invitations plugin is the only code that creates users. Tokens are stored as SHA-256 hashes and travel in the request body, never in a URL. - Per-app permissions in user_app_permissions; requireAppAccess(app) queries the database on every request (no cookie cache) so disabling a user or revoking a session takes effect immediately. - ADMIN_BOOTSTRAP_EMAIL guarantees a way in on an empty database, idempotently and without crashing the API if the database is unreachable at boot. - Guards prevent an admin from removing their own admin permission, disabling themselves, or stripping the last active admin. The admin pool uses the callback-style mysql2, not mysql2/promise: Kysely's MysqlDialect drives the pool with callbacks, and the promise wrapper ignores them, so every query hangs silently. Only the integration tests caught this. Schema in sql/admin/001_init.sql, derived from getAuthTables() on the installed better-auth rather than the published CLI, which lags the library and omits account.issuer. app.ts is split into src/app.factory.ts so the integration tests drive the real middleware order rather than a copy of it. Tests: 131 unit, plus 41 integration tests against a throwaway MariaDB started by test/integration/setup.ts (docker or podman). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
125 lines
4.1 KiB
TypeScript
125 lines
4.1 KiB
TypeScript
import {MailService} from '../../common/common.mail.js';
|
|
import {ADMIN_APP_URL} from './admin.config.js';
|
|
|
|
/**
|
|
* The two transactional mails the admin module sends. Both go out through the
|
|
* shared MailService (Salesforce relay, see common.mail.ts), which never throws
|
|
* on a delivery failure - the invitation row and the reset token are already
|
|
* committed by the time we get here.
|
|
*
|
|
* HTML plus a plain-text body: the text part is not a fallback afterthought,
|
|
* it is what allowlist-based receivers and text-only clients actually show.
|
|
*/
|
|
|
|
const escapeHtml = (value: string): string => {
|
|
return value
|
|
.replace(/&/g, '&')
|
|
.replace(/</g, '<')
|
|
.replace(/>/g, '>')
|
|
.replace(/"/g, '"');
|
|
};
|
|
|
|
// `heading` is escaped here; `paragraphs` are not, because callers pass markup
|
|
// (a <strong> around the expiry date) and escape their own interpolations.
|
|
const layout = (heading: string, paragraphs: string[], buttonLabel: string, buttonUrl: string): string => {
|
|
const body = paragraphs.map(p => `<p style="margin:0 0 16px;">${p}</p>`).join('');
|
|
return `<!doctype html>
|
|
<html lang="de">
|
|
<body style="margin:0;padding:24px;background:#f5f5f4;font-family:Helvetica,Arial,sans-serif;color:#1c1917;">
|
|
<div style="max-width:520px;margin:0 auto;background:#ffffff;border-radius:8px;padding:32px;">
|
|
<h1 style="margin:0 0 24px;font-size:20px;">${escapeHtml(heading)}</h1>
|
|
${body}
|
|
<p style="margin:24px 0;">
|
|
<a href="${escapeHtml(buttonUrl)}" style="display:inline-block;background:#1c1917;color:#ffffff;text-decoration:none;padding:12px 20px;border-radius:6px;">${escapeHtml(buttonLabel)}</a>
|
|
</p>
|
|
<p style="margin:0;font-size:13px;color:#57534e;">Falls der Button nicht funktioniert, kopiere diesen Link in deinen Browser:<br>
|
|
<span style="word-break:break-all;">${escapeHtml(buttonUrl)}</span></p>
|
|
</div>
|
|
</body>
|
|
</html>`;
|
|
};
|
|
|
|
/**
|
|
* Invitation mail. The link carries the raw token in the query string; the
|
|
* admin app strips it from the URL as soon as it has read it (see the plan's
|
|
* §3b - the token must never reach an API access log or a Referer header).
|
|
*/
|
|
export const sendInvitationMail = async (
|
|
recipientAddress: string,
|
|
name: string,
|
|
token: string,
|
|
expiresAt: Date
|
|
): Promise<boolean> => {
|
|
const url = `${ADMIN_APP_URL}/accept-invite?token=${encodeURIComponent(token)}`;
|
|
const expiry = expiresAt.toLocaleDateString('de-DE', {day: '2-digit', month: '2-digit', year: 'numeric'});
|
|
const subject = 'Dein Zugang zu Nachklang';
|
|
|
|
const text = [
|
|
`Hallo ${name},`,
|
|
'',
|
|
'du wurdest eingeladen, ein Nachklang-Konto anzulegen. Über diesen Link vergibst du dein Passwort:',
|
|
'',
|
|
url,
|
|
'',
|
|
`Der Link ist bis zum ${expiry} gültig.`,
|
|
'',
|
|
'Wenn du damit nichts anfangen kannst, ignoriere diese E-Mail einfach.',
|
|
'',
|
|
'Viele Grüße',
|
|
'Nachklang e.V.'
|
|
].join('\n');
|
|
|
|
const html = layout(
|
|
`Hallo ${name},`,
|
|
[
|
|
'du wurdest eingeladen, ein Nachklang-Konto anzulegen. Über den Button vergibst du dein Passwort.',
|
|
`Der Link ist bis zum <strong>${escapeHtml(expiry)}</strong> gültig.`,
|
|
'Wenn du damit nichts anfangen kannst, ignoriere diese E-Mail einfach.'
|
|
],
|
|
'Konto einrichten',
|
|
url
|
|
);
|
|
|
|
return MailService.sendMail(recipientAddress, subject, text, {html});
|
|
};
|
|
|
|
/**
|
|
* Password reset. better-auth builds the URL (it embeds its own token and the
|
|
* redirectTo the admin app passed), so this only wraps it in our templates.
|
|
*/
|
|
export const sendPasswordResetMail = async (
|
|
recipientAddress: string,
|
|
name: string,
|
|
url: string
|
|
): Promise<boolean> => {
|
|
const subject = 'Passwort zurücksetzen';
|
|
|
|
const text = [
|
|
`Hallo ${name},`,
|
|
'',
|
|
'über diesen Link kannst du ein neues Passwort vergeben:',
|
|
'',
|
|
url,
|
|
'',
|
|
'Der Link ist eine Stunde gültig.',
|
|
'',
|
|
'Wenn du kein neues Passwort angefordert hast, ist nichts passiert - ignoriere diese E-Mail.',
|
|
'',
|
|
'Viele Grüße',
|
|
'Nachklang e.V.'
|
|
].join('\n');
|
|
|
|
const html = layout(
|
|
`Hallo ${name},`,
|
|
[
|
|
'über den Button kannst du ein neues Passwort vergeben.',
|
|
'Der Link ist eine Stunde gültig.',
|
|
'Wenn du kein neues Passwort angefordert hast, ist nichts passiert - ignoriere diese E-Mail.'
|
|
],
|
|
'Neues Passwort vergeben',
|
|
url
|
|
);
|
|
|
|
return MailService.sendMail(recipientAddress, subject, text, {html});
|
|
};
|