diff --git a/CHANGELOG.md b/CHANGELOG.md index eafc9c0..42e3367 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,60 @@ All notable changes to this project will be documented in this file. +## 2.11.1 - 2026-09-02 + +### Added + +- Added secure administrator invitations that create accounts only after the recipient accepts the invitation. +- Added configurable API progress-bar placeholders with AdminLTE and announcement palette colors, custom colors, striped and animated variants, and quoted numeric literals. +- Added an optional `textless` progress-bar modifier to hide the visible percentage while retaining progress accessibility metadata. +- Added configurable progress-bar radius options including `square`, `pill`, `rounded`, and validated `radius(...)` values. +- Added arithmetic API placeholder transforms for adding, subtracting, multiplying, and dividing numeric values. +- Added time-based progress bars using start and end date/time fields to show elapsed timetable-item progress. +- Added audit events for invitation sending and acceptance, email verification, password-reset requests, and account email changes. +- Added a pending invitations page with invitation-specific Read, Create, Delete, and Allow permissions. +- Added invitation deletion and resend actions with confirmation prompts. +- Added an opt-in Weather audit category for weather-location changes and manually queued refreshes. +- Added opt-in per-command Screen Controls auditing, with forward and back navigation grouped together and disabled by default. + +### Changed + +- Updated the invitation registration page to show fields only for valid tokens, use the themed failure state for invalid links, and pre-fill the invited email and display name. +- Made the invited email visibly disabled, kept the display name editable and required, and aligned invitation actions with the existing user forms. +- Added shared pagination, search, and sorting to the pending invitations list and grouped Users, Roles, and Invitations under expandable User management navigation. +- Updated API progress bars to inherit the surrounding WYSIWYG text size and text color, preserve rounded corners, and render consistently in the editor preview, player, and thumbnails. +- Added support for object-wrapped API amounts in player-side progress calculations. + +## 2.11.0 - 2026-09-02 + +### Added + +- Added optional account emails with administrator verification bypass, email verification, password recovery, and confirmed email changes. +- Added SMTP configuration and mail delivery for account notifications. + +### Changed + +- Added autofill restrictions for Bitwarden, LastPass, and 1Password on account profile and new-password fields while preserving current-password autofill. +- Updated account email templates and previews to support both line breaks and paragraph spacing. + +## 2.10.7 - 2026-09-02 + +### Added + +- API token authentication now reuses access tokens until their expiry and can renew them with a refresh token, including refresh-token rotation. +- API sources can configure a refresh URL, JSON request body, and refresh-token response path. + +### Changed + +- Reorganized the API source editor into compact Connection, Authentication, and Latest response cards, with authentication collapsed by default on edit pages. +- Redesigned the Connected clients page for responsive mobile cards with compact controls, expandable search, pairing access, two-line detail clamping, and aligned desktop screen-group controls. + +### Fixed + +- Fixed client screen moves from mobile cards so the next move disables the client’s current screen group rather than its previous one. +- Added Live, Paused, and Blackout client status badges to the responsive Connected clients view. +- Removed unused Bootstrap Icons font preloads that triggered browser warnings on pages where icons were not rendered. + ## 2.10.6 - 2026-08-29 ### Changed diff --git a/build/package.player.json b/build/package.player.json index a607638..5e5f43c 100644 --- a/build/package.player.json +++ b/build/package.player.json @@ -1,6 +1,6 @@ { "name": "pulse-signage-player", - "version": "2.10.6", + "version": "2.11.1", "private": false, "description": "Pulse Signage player application bundle", "engines": { diff --git a/build/package.web.json b/build/package.web.json index 820f4fd..1a30bb6 100644 --- a/build/package.web.json +++ b/build/package.web.json @@ -1,6 +1,6 @@ { "name": "pulse-signage-web", - "version": "2.10.6", + "version": "2.11.1", "private": false, "description": "Pulse Signage web and bridge application bundle", "engines": { @@ -18,6 +18,7 @@ "handlebars": "^4.7.8", "multer": "^2.2.0", "mysql2": "^3.23.3", + "nodemailer": "^9.1.1", "puppeteer-core": "^25.7.0", "sharp": "^0.35.3", "jsqr": "^1.4.0", diff --git a/docs/schema.md b/docs/schema.md index efdfc8f..7b38a4f 100644 --- a/docs/schema.md +++ b/docs/schema.md @@ -183,7 +183,7 @@ Tables generally use a numeric auto-increment `id` primary key. The relationship ### `i_api_sources` -- `id`, `name`, `api_url`, `auth_method`, `auth_username`, `auth_password`, `auth_bearer_token`, `auth_header_name`, `auth_header_value`, `items_path`, `update_interval_value`, `update_interval_unit`, `enabled`, `last_pulled_at`, `last_pull_error`, `last_response_status`, `last_response_content_type`, `last_response_json`, `created_at`, `created_by`, `modified_at`, `modified_by` +- `id`, `name`, `api_url`, `auth_method`, `auth_username`, `auth_password`, `auth_bearer_token`, `auth_header_name`, `auth_header_value`, `token_url`, `token_request_body_json`, `token_response_path`, `token_refresh_url`, `token_refresh_request_body_json`, `token_refresh_response_path`, `token_header_name`, `token_header_prefix`, `items_path`, `update_interval_value`, `update_interval_unit`, `enabled`, `last_pulled_at`, `last_pull_error`, `last_response_status`, `last_response_content_type`, `last_response_json`, `created_at`, `created_by`, `modified_at`, `modified_by` ### `i_weather_locations` diff --git a/package-lock.json b/package-lock.json index a838b43..6420a4a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "pulse-signage", - "version": "2.10.6", + "version": "2.11.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "pulse-signage", - "version": "2.10.6", + "version": "2.11.1", "dependencies": { "@sparticuz/chromium": "^149.0.0", "animate.css": "^4.1.1", @@ -19,6 +19,7 @@ "jsqr": "^1.4.0", "multer": "^2.2.0", "mysql2": "^3.23.3", + "nodemailer": "^9.1.1", "puppeteer-core": "^25.7.0", "sharp": "^0.35.3", "ws": "^8.21.3" @@ -1989,6 +1990,15 @@ "integrity": "sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==", "license": "MIT" }, + "node_modules/nodemailer": { + "version": "9.1.1", + "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.1.1.tgz", + "integrity": "sha512-izw9mVKFix6YSnC9eLgV6g1opl9DUlRio9ZNcq+Wu9Ujn2UwF+8Nl0B8nz22kEC+CTZCvinkxwJ0DeFbb6NwcQ==", + "license": "MIT-0", + "engines": { + "node": ">=6.0.0" + } + }, "node_modules/nodemon": { "version": "3.1.14", "resolved": "https://registry.npmjs.org/nodemon/-/nodemon-3.1.14.tgz", diff --git a/package.json b/package.json index 6539c9f..c760fd9 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "pulse-signage", - "version": "2.10.6", + "version": "2.11.1", "private": false, "description": "Pulse Signage application with MySQL and media storage", "engines": { @@ -31,6 +31,7 @@ "jsqr": "^1.4.0", "multer": "^2.2.0", "mysql2": "^3.23.3", + "nodemailer": "^9.1.1", "puppeteer-core": "^25.7.0", "sharp": "^0.35.3", "ws": "^8.21.3" diff --git a/src/auth.js b/src/auth.js index 7de8d3f..b83c14d 100644 --- a/src/auth.js +++ b/src/auth.js @@ -7,6 +7,10 @@ const PASSWORD_KEY_LENGTH = 32; const PASSWORD_DIGEST = 'sha256'; const SESSION_BYTES = 32; +function createOneTimeToken() { + return crypto.randomBytes(32).toString('hex'); +} + function validatePasswordStrength(password, options) { const value = String(password || ''); const requirements = options && options.policy @@ -91,5 +95,6 @@ module.exports = { verifyPassword, validatePasswordStrength, createSessionToken, - hashSessionToken + hashSessionToken, + createOneTimeToken }; \ No newline at end of file diff --git a/src/data/account-email-templates.js b/src/data/account-email-templates.js new file mode 100644 index 0000000..a892413 --- /dev/null +++ b/src/data/account-email-templates.js @@ -0,0 +1,46 @@ +const DEFAULT_ACCOUNT_EMAIL_TEMPLATES = { + verificationSubject: 'Verify your Pulse Signage email address', + verificationBody: 'Hello [[display_name]]!\n\nConfirm this email address:\n\n[[action_button]]\n\nThis link expires in 30 minutes.', + resetSubject: 'Reset your Pulse Signage password', + resetBody: 'Hello [[display_name]]!\n\nUse this link to choose a new password:\n\n[[action_button]]\n\nThis link expires in 30 minutes.' +}; + +function renderAccountEmailTemplate(subject, body, variables) { + const values = variables || {}; + const replaceVariables = function (value) { + return String(value || '').replace(/\[\[([a-z_]+)\]\]/g, function (_match, key) { + return Object.prototype.hasOwnProperty.call(values, key) ? String(values[key]) : _match; + }); + }; + const renderedSubject = replaceVariables(subject); + const renderedText = replaceVariables(body); + const plainText = renderedText.replace(/\[(?:b|i|u)\]([\s\S]*?)\[\/(?:b|i|u)\]/gi, '$1'); + const escapedBody = renderedText.replace(/&/g, '&').replace(//g, '>').replace(/"/g, '"').replace(/\[b\]([\s\S]*?)\[\/b\]/gi, '$1').replace(/\[i\]([\s\S]*?)\[\/i\]/gi, '$1').replace(/\[u\]([\s\S]*?)\[\/u\]/gi, '$1'); + const actionLabel = String(values.action_label || 'Continue').replace(/&/g, '&').replace(//g, '>').replace(/"/g, '"'); + const actionUrl = values.url ? String(values.url).replace(/&/g, '&').replace(/"/g, '"') : ''; + const actionAlignment = values.action_alignment === 'left' || values.action_alignment === 'right' ? values.action_alignment : 'center'; + const actionButton = actionUrl ? '' + actionLabel + '' : ''; + const actionBlock = actionButton ? '
' + actionButton + '
' : ''; + const plainLink = actionUrl ? '' + actionUrl + '' : ''; + const hasButtonPlaceholder = escapedBody.indexOf('[[action_button]]') !== -1; + const hasUrlPlaceholder = String(body || '').indexOf('[[url]]') !== -1; + const bodyWithAction = hasButtonPlaceholder + ? escapedBody.replace(/\[\[action_button\]\]/g, actionBlock) + : hasUrlPlaceholder + ? escapedBody.split(actionUrl).join(actionBlock + plainLink) + : escapedBody.replace(/\[\[action_link\]\]/g, plainLink).replace(actionUrl, plainLink); + const bodyHtml = bodyWithAction.split(/\r?\n(?:[ \t]*\r?\n)+/).map(function (paragraph) { + const paragraphHtml = paragraph.replace(/\r?\n/g, '
'); + if (paragraphHtml.indexOf(actionBlock) !== -1 && actionBlock) { + return paragraphHtml.split(actionBlock).map(function (part, index, parts) { + const text = part ? '

' + part + '

' : ''; + return text + (index < parts.length - 1 ? actionBlock : ''); + }).join(''); + } + return paragraphHtml ? '

' + paragraphHtml + '

' : ''; + }).join(''); + const html = '
Pulse Signage
' + bodyHtml + '
'; + return { subject: renderedSubject, text: plainText, html: html }; +} + +module.exports = { DEFAULT_ACCOUNT_EMAIL_TEMPLATES, renderAccountEmailTemplate }; diff --git a/src/data/api-sources.js b/src/data/api-sources.js index b375aa2..c7991f2 100644 --- a/src/data/api-sources.js +++ b/src/data/api-sources.js @@ -13,6 +13,7 @@ const TOKEN_URL_MAX_LENGTH = 1024; const TOKEN_RESPONSE_PATH_MAX_LENGTH = 255; const TOKEN_HEADER_PREFIX_MAX_LENGTH = 64; const tokenCache = new Map(); +const tokenRequests = new Map(); function normalizeUpdateIntervalUnit(value) { const unit = String(value || '').trim().toLowerCase(); @@ -59,7 +60,7 @@ function buildAuthHeaders(source) { async function fetchApiSourcesData(pool) { const [apiSources] = await pool.query( - 'SELECT id, name, api_url, request_method, request_body_json, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, token_url, token_request_body_json, token_response_path, token_header_name, token_header_prefix, items_path, enabled, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_at, modified_at, created_by, modified_by FROM i_api_sources ORDER BY modified_at DESC, id DESC' + 'SELECT id, name, api_url, request_method, request_body_json, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, token_url, token_request_body_json, token_response_path, token_refresh_url, token_refresh_request_body_json, token_refresh_response_path, token_header_name, token_header_prefix, items_path, enabled, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_at, modified_at, created_by, modified_by FROM i_api_sources ORDER BY modified_at DESC, id DESC' ); return { apiSources: apiSources }; @@ -67,7 +68,7 @@ async function fetchApiSourcesData(pool) { async function fetchApiSourcesPage(pool, page, pageSize, searchTerm, sortKey, sortDirection) { const paged = await fetchPagedRows(pool, { - selectSql: 'SELECT id, name, api_url, request_method, request_body_json, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, token_url, token_request_body_json, token_response_path, token_header_name, token_header_prefix, items_path, enabled, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_at, modified_at, created_by, modified_by FROM i_api_sources ORDER BY modified_at DESC, id DESC', + selectSql: 'SELECT id, name, api_url, request_method, request_body_json, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, token_url, token_request_body_json, token_response_path, token_refresh_url, token_refresh_request_body_json, token_refresh_response_path, token_header_name, token_header_prefix, items_path, enabled, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_at, modified_at, created_by, modified_by FROM i_api_sources ORDER BY modified_at DESC, id DESC', countSql: 'SELECT COUNT(*) AS count FROM i_api_sources', searchColumns: ['name', 'api_url', 'last_pull_error'], searchTerm: searchTerm, @@ -91,7 +92,7 @@ async function fetchApiSourcesPage(pool, page, pageSize, searchTerm, sortKey, so async function fetchApiSourceById(pool, id) { const [rows] = await pool.query( - 'SELECT id, name, api_url, request_method, request_body_json, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, token_url, token_request_body_json, token_response_path, token_header_name, token_header_prefix, items_path, enabled, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_at, modified_at, created_by, modified_by FROM i_api_sources WHERE id = ?', + 'SELECT id, name, api_url, request_method, request_body_json, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, token_url, token_request_body_json, token_response_path, token_refresh_url, token_refresh_request_body_json, token_refresh_response_path, token_header_name, token_header_prefix, items_path, enabled, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_at, modified_at, created_by, modified_by FROM i_api_sources WHERE id = ?', [id] ); @@ -184,6 +185,9 @@ function getTokenCacheKey(source) { source && (source.token_url || source.tokenUrl) || '', source && (source.token_request_body_json || source.tokenRequestBodyJson) || '', source && (source.token_response_path || source.tokenResponsePath) || 'access_token', + source && (source.token_refresh_url || source.tokenRefreshUrl) || '', + source && (source.token_refresh_request_body_json || source.tokenRefreshRequestBodyJson) || '', + source && (source.token_refresh_response_path || source.tokenRefreshResponsePath) || 'refresh_token', source && (source.token_header_name || source.tokenHeaderName) || 'Authorization', source && (source.token_header_prefix || source.tokenHeaderPrefix) || 'Bearer' ]); @@ -193,11 +197,118 @@ function clearCachedToken(source) { tokenCache.delete(getTokenCacheKey(source)); } -async function fetchLoginToken(source) { +function replaceRefreshToken(value, refreshToken) { + if (typeof value === 'string') { + return value.split('{{refresh_token}}').join(refreshToken); + } + if (Array.isArray(value)) { + return value.map(function (item) { + return replaceRefreshToken(item, refreshToken); + }); + } + if (value && typeof value === 'object') { + return Object.keys(value).reduce(function (result, key) { + result[key] = replaceRefreshToken(value[key], refreshToken); + return result; + }, {}); + } + return value; +} + +function resolveTokenExpiry(parsed, token) { + const expiresIn = Number(parsed && (parsed.expires_in || parsed.expiresIn)); + if (Number.isFinite(expiresIn) && expiresIn > 0) { + return { lifetimeMs: expiresIn * 1000 }; + } + + const explicitExpiry = parsed && (parsed.expires_at || parsed.expiresAt); + if (explicitExpiry !== undefined && explicitExpiry !== null) { + const expiryNumber = Number(explicitExpiry); + const expiryMs = Number.isFinite(expiryNumber) + ? (expiryNumber < 100000000000 ? expiryNumber * 1000 : expiryNumber) + : Date.parse(String(explicitExpiry)); + if (Number.isFinite(expiryMs) && expiryMs > Date.now()) { + return { expiresAt: expiryMs }; + } + } + + const tokenParts = String(token).split('.'); + if (tokenParts.length === 3) { + try { + const payload = JSON.parse(Buffer.from(tokenParts[1], 'base64url').toString('utf8')); + const expiryMs = Number(payload.exp) * 1000; + if (Number.isFinite(expiryMs) && expiryMs > Date.now()) { + return { expiresAt: expiryMs }; + } + } catch (_error) { + // Opaque tokens do not contain a readable JWT expiry. + } + } + + return { lifetimeMs: 300000 }; +} + +function cacheTokenResponse(source, parsed, previousRefreshToken) { + const tokenPath = source.token_response_path || source.tokenResponsePath || 'access_token'; + const token = resolveResponsePath(parsed, tokenPath); + if (token === undefined || token === null || String(token).trim() === '') { + throw new Error('Token response did not contain a token at the configured path.'); + } + + const refreshPath = source.token_refresh_response_path || source.tokenRefreshResponsePath || 'refresh_token'; + const responseRefreshToken = resolveResponsePath(parsed, refreshPath); + const refreshToken = responseRefreshToken === undefined || responseRefreshToken === null || String(responseRefreshToken).trim() === '' + ? previousRefreshToken + : String(responseRefreshToken); + const expiry = resolveTokenExpiry(parsed, token); + const expiresAt = expiry.expiresAt || Date.now() + Math.max(1000, expiry.lifetimeMs - Math.min(60000, expiry.lifetimeMs * 0.1)); + const record = { value: String(token), refreshToken: refreshToken, expiresAt: expiresAt }; + tokenCache.set(getTokenCacheKey(source), record); + return record; +} + +async function parseTokenResponse(response, source, previousRefreshToken) { + if (!response.ok) { + return null; + } + let parsed; + try { + parsed = JSON.parse(String(response.bodyText || '').trim()); + } catch (_error) { + throw new Error('Token response was not valid JSON.'); + } + return cacheTokenResponse(source, parsed, previousRefreshToken); +} + +async function refreshLoginToken(source, cached) { + const refreshUrl = source.token_refresh_url || source.tokenRefreshUrl || source.token_url || source.tokenUrl; + if (!cached || !cached.refreshToken) { + return null; + } + const configuredBody = parseJsonRequestBody(source.token_refresh_request_body_json || source.tokenRefreshRequestBodyJson, 'Refresh request body'); + const refreshBody = configuredBody === undefined + ? { grant_type: 'refresh_token', refresh_token: cached.refreshToken } + : replaceRefreshToken(configuredBody, cached.refreshToken); + const response = await loadUrlText(refreshUrl, { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify(refreshBody) + }); + return parseTokenResponse(response, source, cached.refreshToken); +} + +async function fetchLoginTokenUncached(source) { const cacheKey = getTokenCacheKey(source); const cached = tokenCache.get(cacheKey); if (cached && cached.expiresAt > Date.now()) { - return cached.value; + return cached; + } + + if (cached && cached.refreshToken) { + const refreshed = await refreshLoginToken(source, cached); + if (refreshed) { + return refreshed; + } } const tokenUrl = source.token_url || source.tokenUrl; @@ -208,29 +319,25 @@ async function fetchLoginToken(source) { headers: tokenHeaders, body: tokenBody === undefined ? undefined : JSON.stringify(tokenBody) }); - if (!response.ok) { + const record = await parseTokenResponse(response, source, cached && cached.refreshToken); + if (!record) { throw new Error(`Unable to obtain API token (${response.statusCode}).`); } + return record; +} - let parsed; - try { - parsed = JSON.parse(String(response.bodyText || '').trim()); - } catch (_error) { - throw new Error('Token response was not valid JSON.'); +async function fetchLoginToken(source) { + const cacheKey = getTokenCacheKey(source); + const cached = tokenCache.get(cacheKey); + if (cached && cached.expiresAt > Date.now()) { + return cached.value; } - - const tokenPath = source.token_response_path || source.tokenResponsePath || 'access_token'; - const token = resolveResponsePath(parsed, tokenPath); - if (token === undefined || token === null || String(token).trim() === '') { - throw new Error('Token response did not contain a token at the configured path.'); + if (!tokenRequests.has(cacheKey)) { + tokenRequests.set(cacheKey, fetchLoginTokenUncached(source).finally(function () { + tokenRequests.delete(cacheKey); + })); } - - const expiresIn = Number(parsed && (parsed.expires_in || parsed.expiresIn)); - const lifetimeMs = Number.isFinite(expiresIn) && expiresIn > 0 - ? Math.max(30000, expiresIn * 1000 - 60000) - : 300000; - tokenCache.set(cacheKey, { value: String(token), expiresAt: Date.now() + lifetimeMs }); - return String(token); + return (await tokenRequests.get(cacheKey)).value; } async function buildRequestHeaders(source) { @@ -310,6 +417,9 @@ function buildApiSourcePayload(req, existingApiSource) { const tokenUrl = validateMaxLength(readBodyValue('token_url', readBodyValue('tokenUrl', fallback.token_url || '')) || '', TOKEN_URL_MAX_LENGTH, 'API token URL'); const tokenRequestBodyJson = validateMaxLength(readBodyValue('token_request_body_json', readBodyValue('tokenRequestBodyJson', fallback.token_request_body_json || '')) || '', REQUEST_BODY_MAX_LENGTH, 'Login request body'); const tokenResponsePath = validateMaxLength(readBodyValue('token_response_path', readBodyValue('tokenResponsePath', fallback.token_response_path || 'access_token')) || 'access_token', TOKEN_RESPONSE_PATH_MAX_LENGTH, 'Token response path'); + const tokenRefreshUrl = validateMaxLength(readBodyValue('token_refresh_url', readBodyValue('tokenRefreshUrl', fallback.token_refresh_url || '')) || '', TOKEN_URL_MAX_LENGTH, 'API refresh URL'); + const tokenRefreshRequestBodyJson = validateMaxLength(readBodyValue('token_refresh_request_body_json', readBodyValue('tokenRefreshRequestBodyJson', fallback.token_refresh_request_body_json || '')) || '', REQUEST_BODY_MAX_LENGTH, 'Refresh request body'); + const tokenRefreshResponsePath = validateMaxLength(readBodyValue('token_refresh_response_path', readBodyValue('tokenRefreshResponsePath', fallback.token_refresh_response_path || 'refresh_token')) || 'refresh_token', TOKEN_RESPONSE_PATH_MAX_LENGTH, 'Refresh token response path'); const tokenHeaderName = validateMaxLength(readBodyValue('token_header_name', readBodyValue('tokenHeaderName', fallback.token_header_name || 'Authorization')) || 'Authorization', AUTH_MAX_LENGTH, 'Token header name'); const tokenHeaderPrefix = validateMaxLength(readBodyValue('token_header_prefix', readBodyValue('tokenHeaderPrefix', fallback.token_header_prefix || 'Bearer')) || '', TOKEN_HEADER_PREFIX_MAX_LENGTH, 'Token prefix'); const itemsPath = validateMaxLength(readBodyValue('items_path', readBodyValue('itemsPath', fallback.items_path || '')) || '', ITEMS_PATH_MAX_LENGTH, 'API source items path'); @@ -369,6 +479,7 @@ function buildApiSourcePayload(req, existingApiSource) { parseJsonRequestBody(requestBodyJson, 'API request body'); parseJsonRequestBody(tokenRequestBodyJson, 'Login request body'); + parseJsonRequestBody(tokenRefreshRequestBodyJson, 'Refresh request body'); if (authMethod === 'token_login') { if (!tokenUrl) { @@ -393,6 +504,19 @@ function buildApiSourcePayload(req, existingApiSource) { } } + if (tokenRefreshUrl) { + try { + const refreshParsedUrl = new URL(tokenRefreshUrl); + if (refreshParsedUrl.protocol !== 'http:' && refreshParsedUrl.protocol !== 'https:') { + throw new Error('invalid protocol'); + } + } catch (_error) { + const error = new Error('Enter a valid API refresh URL.'); + error.statusCode = 400; + throw error; + } + } + return { name: name, apiUrl: parsedUrl.toString(), @@ -407,6 +531,9 @@ function buildApiSourcePayload(req, existingApiSource) { tokenUrl: tokenUrl, tokenRequestBodyJson: tokenRequestBodyJson, tokenResponsePath: tokenResponsePath, + tokenRefreshUrl: tokenRefreshUrl, + tokenRefreshRequestBodyJson: tokenRefreshRequestBodyJson, + tokenRefreshResponsePath: tokenRefreshResponsePath, tokenHeaderName: tokenHeaderName, tokenHeaderPrefix: tokenHeaderPrefix, itemsPath: itemsPath, diff --git a/src/data/app-settings.js b/src/data/app-settings.js index 261e39c..3757e9b 100644 --- a/src/data/app-settings.js +++ b/src/data/app-settings.js @@ -21,8 +21,30 @@ const SETTING_DEFINITIONS = [ { key: 'security.login_max_attempts', type: 'integer', min: 1, defaultValue: 5 }, { key: 'security.login_lockout_minutes', type: 'integer', min: 1, defaultValue: 15 }, { key: 'security.login_rate_limit_scope', type: 'enum', values: ['both', 'username', 'ip'], defaultValue: 'both' }, + { key: 'security.allow_admin_email_verification_bypass', type: 'boolean', defaultValue: true }, + { key: 'email.smtp_enabled', type: 'boolean', defaultValue: false }, + { key: 'email.smtp_host', type: 'string', defaultValue: '' }, + { key: 'email.smtp_port', type: 'integer', min: 1, defaultValue: 587 }, + { key: 'email.smtp_security', type: 'enum', values: ['none', 'starttls', 'tls'], defaultValue: 'starttls' }, + { key: 'email.smtp_username', type: 'string', defaultValue: '' }, + { key: 'email.smtp_password', type: 'string', defaultValue: '' }, + { key: 'email.from_address', type: 'string', defaultValue: '' }, + { key: 'email.from_name', type: 'string', defaultValue: 'Pulse Signage' }, + { key: 'email.verification_subject', type: 'string', defaultValue: 'Verify your Pulse Signage email address' }, + { key: 'email.verification_body', type: 'string', defaultValue: 'Hello [[display_name]]!\n\nConfirm this email address:\n\n[[action_button]]\n\nThis link expires in 30 minutes.' }, + { key: 'email.reset_subject', type: 'string', defaultValue: 'Reset your Pulse Signage password' }, + { key: 'email.reset_body', type: 'string', defaultValue: 'Hello [[display_name]]!\n\nUse this link to choose a new password:\n\n[[action_button]]\n\nThis link expires in 30 minutes.' }, + { key: 'email.verification_button_alignment', type: 'enum', values: ['left', 'center', 'right'], defaultValue: 'center' }, + { key: 'email.verification_button_text', type: 'string', defaultValue: 'Verify email address' }, + { key: 'email.reset_button_alignment', type: 'enum', values: ['left', 'center', 'right'], defaultValue: 'center' }, + { key: 'email.reset_button_text', type: 'string', defaultValue: 'Reset password' }, + { key: 'email.invitation_subject', type: 'string', defaultValue: 'You have been invited to Pulse Signage' }, + { key: 'email.invitation_body', type: 'string', defaultValue: 'Hello [[display_name]]!\n\nYou have been invited to create a Pulse Signage account.\n\n[[action_button]]\n\nThis invitation expires in 24 hours.' }, + { key: 'email.invitation_button_alignment', type: 'enum', values: ['left', 'center', 'right'], defaultValue: 'center' }, + { key: 'email.invitation_button_text', type: 'string', defaultValue: 'Accept invitation' }, { key: 'audit.enabled', type: 'boolean', defaultValue: true }, { key: 'audit.categories', type: 'string_array', defaultValue: ['authentication', 'security', 'sessions', 'users', 'roles', 'system-settings'] }, + { key: 'audit.screen_control_commands', type: 'string_array', defaultValue: [] }, { key: 'audit.include_request_metadata', type: 'boolean', defaultValue: true }, { key: 'audit.retention_days', type: 'integer', min: 0, defaultValue: 180 }, { key: 'uploads.image_max_bytes', type: 'integer', min: 1, defaultValue: 100 * 1024 * 1024 }, diff --git a/src/data/audit-log.js b/src/data/audit-log.js index a91f643..2705b3a 100644 --- a/src/data/audit-log.js +++ b/src/data/audit-log.js @@ -15,7 +15,9 @@ const AUDIT_EVENT_CATEGORIES = Object.freeze({ CANVAS_SIZES: 'canvas-sizes', API_SOURCES: 'api-sources', RSS_FEEDS: 'rss-feeds', - TIMETABLES: 'timetables' + TIMETABLES: 'timetables', + WEATHER: 'weather', + SCREEN_CONTROLS: 'screen-controls' }); const AUDIT_CATEGORY_KEYS = Object.freeze(Object.values(AUDIT_EVENT_CATEGORIES)); const AUDIT_CATEGORY_LABELS = Object.freeze({ @@ -33,7 +35,18 @@ const AUDIT_CATEGORY_LABELS = Object.freeze({ 'canvas-sizes': 'Canvas Sizes', 'api-sources': 'API Sources', 'rss-feeds': 'RSS Feeds', - timetables: 'Timetables' + timetables: 'Timetables', + weather: 'Weather', + 'screen-controls': 'Screen Controls' +}); +const SCREEN_CONTROL_COMMAND_KEYS = Object.freeze(['pause', 'blackout', 'reload', 'navigation', 'moveclient', 'setclientname']); +const SCREEN_CONTROL_COMMAND_LABELS = Object.freeze({ + pause: 'Pause / Resume', + blackout: 'Blackout / Restore', + reload: 'Reload', + navigation: 'Forward / Back', + moveclient: 'Move client', + setclientname: 'Rename client' }); const { fetchAppSettings } = require('./app-settings'); @@ -101,6 +114,14 @@ async function recordRequestAuditEvent(pool, req, event) { if (!settings['audit.enabled'] || !enabledCategories.includes(category)) { return; } + if (category === 'screen-controls') { + const command = String(event && event.eventType || '').replace(/^screen-control\./, '').trim().toLowerCase(); + const commandGroup = command === 'previous' || command === 'next' ? 'navigation' : command; + const enabledCommands = Array.isArray(settings['audit.screen_control_commands']) ? settings['audit.screen_control_commands'] : []; + if (!enabledCommands.includes(commandGroup)) { + return; + } + } const metadata = settings['audit.include_request_metadata'] ? getRequestMetadata(req) : {}; await recordAuditEvent(pool, Object.assign({}, event, metadata)); } catch (error) { @@ -113,6 +134,8 @@ module.exports = { AUDIT_EVENT_CATEGORIES, AUDIT_CATEGORY_KEYS, AUDIT_CATEGORY_LABELS, + SCREEN_CONTROL_COMMAND_KEYS, + SCREEN_CONTROL_COMMAND_LABELS, getRequestMetadata, buildAuditChanges, recordAuditEvent, diff --git a/src/data/mailer.js b/src/data/mailer.js new file mode 100644 index 0000000..1050b88 --- /dev/null +++ b/src/data/mailer.js @@ -0,0 +1,43 @@ +// SMTP delivery for account notifications. + +const nodemailer = require('nodemailer'); + +function getSmtpConfig(settings) { + return { + enabled: Boolean(settings['email.smtp_enabled']), + host: String(settings['email.smtp_host'] || '').trim(), + port: Number(settings['email.smtp_port']) || 587, + security: String(settings['email.smtp_security'] || 'starttls'), + username: String(settings['email.smtp_username'] || '').trim(), + password: String(settings['email.smtp_password'] || ''), + fromAddress: String(settings['email.from_address'] || '').trim(), + fromName: String(settings['email.from_name'] || '').trim() + }; +} + +function createMailTransport(settings) { + const config = getSmtpConfig(settings); + if (!config.enabled || !config.host || !config.fromAddress) { + return null; + } + return nodemailer.createTransport({ + host: config.host, + port: config.port, + secure: config.security === 'tls', + requireTLS: config.security === 'starttls', + auth: config.username ? { user: config.username, pass: config.password } : undefined + }); +} + +async function sendAccountEmail(settings, message) { + const transport = createMailTransport(settings); + if (!transport) { + throw new Error('Email delivery is not configured.'); + } + const config = getSmtpConfig(settings); + return transport.sendMail(Object.assign({}, message, { + from: config.fromName ? '"' + config.fromName.replace(/"/g, '') + '" <' + config.fromAddress + '>' : config.fromAddress, + })); +} + +module.exports = { getSmtpConfig, createMailTransport, sendAccountEmail }; \ No newline at end of file diff --git a/src/db/index.js b/src/db/index.js index 7ecb867..7b63bbb 100644 --- a/src/db/index.js +++ b/src/db/index.js @@ -249,6 +249,9 @@ async function ensureSchema(pool, options) { token_url VARCHAR(1024) NULL, token_request_body_json MEDIUMTEXT NULL, token_response_path VARCHAR(255) NULL DEFAULT 'access_token', + token_refresh_url VARCHAR(1024) NULL, + token_refresh_request_body_json MEDIUMTEXT NULL, + token_refresh_response_path VARCHAR(255) NULL DEFAULT 'refresh_token', token_header_name VARCHAR(255) NULL DEFAULT 'Authorization', token_header_prefix VARCHAR(64) NULL DEFAULT 'Bearer', items_path VARCHAR(255) NULL, @@ -343,11 +346,18 @@ async function ensureSchema(pool, options) { id INT AUTO_INCREMENT PRIMARY KEY, name VARCHAR(255) NULL, username VARCHAR(255) NOT NULL UNIQUE, + email VARCHAR(320) NULL, + email_verified_at DATETIME NULL, + pending_email VARCHAR(320) NULL, + pending_email_token_hash CHAR(64) NULL, + pending_email_expires_at DATETIME NULL, password_hash CHAR(64) NOT NULL, password_salt VARCHAR(64) NOT NULL, password_iterations INT NOT NULL, must_change_password TINYINT(1) NOT NULL DEFAULT 0, account_locked TINYINT(1) NOT NULL DEFAULT 0, + last_login_at DATETIME NULL, + last_login_ip VARCHAR(255) NULL, created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP, created_by INT NULL, modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP, @@ -355,6 +365,37 @@ async function ensureSchema(pool, options) { ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci `); + await pool.query(` + CREATE TABLE IF NOT EXISTS a_account_tokens ( + id BIGINT AUTO_INCREMENT PRIMARY KEY, + user_id INT NOT NULL, + token_type VARCHAR(32) NOT NULL, + token_hash CHAR(64) NOT NULL UNIQUE, + expires_at DATETIME NOT NULL, + used_at DATETIME NULL, + created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP, + CONSTRAINT fk_account_tokens_user FOREIGN KEY (user_id) REFERENCES a_users(id) ON DELETE CASCADE, + INDEX idx_account_tokens_lookup (token_type, token_hash, expires_at), + INDEX idx_account_tokens_user_type (user_id, token_type) + ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci + `); + + await pool.query(` + CREATE TABLE IF NOT EXISTS a_user_invitations ( + id BIGINT AUTO_INCREMENT PRIMARY KEY, + email VARCHAR(320) NOT NULL, + name VARCHAR(255) NULL, + role_ids_json TEXT NOT NULL, + token_hash CHAR(64) NOT NULL UNIQUE, + expires_at DATETIME NOT NULL, + used_at DATETIME NULL, + created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP, + created_by INT NULL, + INDEX idx_user_invitations_email (email, used_at, expires_at), + INDEX idx_user_invitations_created_by (created_by, created_at) + ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci + `); + await pool.query(` CREATE TABLE IF NOT EXISTS a_roles ( id INT AUTO_INCREMENT PRIMARY KEY, diff --git a/src/db/migrations.js b/src/db/migrations.js index 4d1b882..ebf3218 100644 --- a/src/db/migrations.js +++ b/src/db/migrations.js @@ -504,7 +504,10 @@ const VERSIONED_MIGRATIONS = [ await ensureColumn(pool, 'i_api_sources', 'token_url', 'VARCHAR(1024) NULL', 'auth_header_value'); await ensureColumn(pool, 'i_api_sources', 'token_request_body_json', 'MEDIUMTEXT NULL', 'token_url'); await ensureColumn(pool, 'i_api_sources', 'token_response_path', "VARCHAR(255) NULL DEFAULT 'access_token'", 'token_request_body_json'); - await ensureColumn(pool, 'i_api_sources', 'token_header_name', "VARCHAR(255) NULL DEFAULT 'Authorization'", 'token_response_path'); + await ensureColumn(pool, 'i_api_sources', 'token_refresh_url', 'VARCHAR(1024) NULL', 'token_response_path'); + await ensureColumn(pool, 'i_api_sources', 'token_refresh_request_body_json', 'MEDIUMTEXT NULL', 'token_refresh_url'); + await ensureColumn(pool, 'i_api_sources', 'token_refresh_response_path', "VARCHAR(255) NULL DEFAULT 'refresh_token'", 'token_refresh_request_body_json'); + await ensureColumn(pool, 'i_api_sources', 'token_header_name', "VARCHAR(255) NULL DEFAULT 'Authorization'", 'token_refresh_response_path'); await ensureColumn(pool, 'i_api_sources', 'token_header_prefix', "VARCHAR(64) NULL DEFAULT 'Bearer'", 'token_header_name'); } }, @@ -561,6 +564,63 @@ const VERSIONED_MIGRATIONS = [ run: async function (pool) { await ensureColumn(pool, 'd_onboarding_devices', 'last_seen_at', 'TIMESTAMP NULL', 'screen_id'); } + }, + { + version: '2.10.7', + label: 'v2.10.7 API token refresh settings schema', + run: async function (pool) { + await ensureColumn(pool, 'i_api_sources', 'token_refresh_url', 'VARCHAR(1024) NULL', 'token_response_path'); + await ensureColumn(pool, 'i_api_sources', 'token_refresh_request_body_json', 'MEDIUMTEXT NULL', 'token_refresh_url'); + await ensureColumn(pool, 'i_api_sources', 'token_refresh_response_path', "VARCHAR(255) NULL DEFAULT 'refresh_token'", 'token_refresh_request_body_json'); + } + }, + { + version: '2.11.0', + label: 'v2.11.0 account email and password reset schema', + run: async function (pool) { + await ensureColumn(pool, 'a_users', 'email', 'VARCHAR(320) NULL', 'username'); + await ensureColumn(pool, 'a_users', 'email_verified_at', 'DATETIME NULL', 'email'); + await ensureColumn(pool, 'a_users', 'pending_email', 'VARCHAR(320) NULL', 'email_verified_at'); + await ensureColumn(pool, 'a_users', 'pending_email_token_hash', 'CHAR(64) NULL', 'pending_email'); + await ensureColumn(pool, 'a_users', 'pending_email_expires_at', 'DATETIME NULL', 'pending_email_token_hash'); + await ensureColumn(pool, 'a_users', 'last_login_at', 'DATETIME NULL', 'modified_by'); + await ensureColumn(pool, 'a_users', 'last_login_ip', 'VARCHAR(255) NULL', 'last_login_at'); + await pool.query(` + CREATE TABLE IF NOT EXISTS a_account_tokens ( + id BIGINT AUTO_INCREMENT PRIMARY KEY, + user_id INT NOT NULL, + token_type VARCHAR(32) NOT NULL, + token_hash CHAR(64) NOT NULL UNIQUE, + expires_at DATETIME NOT NULL, + used_at DATETIME NULL, + created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP, + CONSTRAINT fk_account_tokens_user FOREIGN KEY (user_id) REFERENCES a_users(id) ON DELETE CASCADE, + INDEX idx_account_tokens_lookup (token_type, token_hash, expires_at), + INDEX idx_account_tokens_user_type (user_id, token_type) + ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci + `); + } + }, + { + version: '2.11.1', + label: 'v2.11.1 user invitations schema', + run: async function (pool) { + await pool.query(` + CREATE TABLE IF NOT EXISTS a_user_invitations ( + id BIGINT AUTO_INCREMENT PRIMARY KEY, + email VARCHAR(320) NOT NULL, + name VARCHAR(255) NULL, + role_ids_json TEXT NOT NULL, + token_hash CHAR(64) NOT NULL UNIQUE, + expires_at DATETIME NOT NULL, + used_at DATETIME NULL, + created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP, + created_by INT NULL, + INDEX idx_user_invitations_email (email, used_at, expires_at), + INDEX idx_user_invitations_created_by (created_by, created_at) + ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci + `); + } } ]; diff --git a/src/player/public/css/player.css b/src/player/public/css/player.css index 1f4e5a2..1a7aef1 100644 --- a/src/player/public/css/player.css +++ b/src/player/public/css/player.css @@ -32,6 +32,45 @@ body.onboarding-page #app { position: relative; } +.api-progress { + --bs-progress-height: 1rem; + --bs-progress-font-size: 0.75rem; + --bs-border-radius: 0.375rem; + --bs-progress-border-radius: 0.375rem; + display: flex; + width: 100%; + box-sizing: border-box; + height: var(--bs-progress-height); + overflow: hidden; + font-size: var(--bs-progress-font-size); + border-radius: var(--bs-progress-border-radius); +} + +.api-progress > .progress-bar { + display: flex; + flex-direction: column; + justify-content: center; + overflow: hidden; + color: #fff; + text-align: center; + white-space: nowrap; + background-color: #0d6efd; +} + +.api-progress > .progress-bar-striped { + background-image: linear-gradient(45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent); + background-size: var(--bs-progress-height) var(--bs-progress-height); +} + +.api-progress > .progress-bar-animated { + animation: api-progress-bar-stripes 1s linear infinite; +} + +@keyframes api-progress-bar-stripes { + from { background-position-x: var(--bs-progress-height); } + to { background-position-x: 0; } +} + .onboarding-shell { min-height: 100%; display: flex; diff --git a/src/player/regions/api.js b/src/player/regions/api.js index 447a7ba..fe0db28 100644 --- a/src/player/regions/api.js +++ b/src/player/regions/api.js @@ -68,6 +68,9 @@ function substituteApiVariables(html, item, sourceId) { } var resolved = placeholderUtils.resolvePlaceholderExpression(item, expression); + if (typeof placeholderUtils.isProgressPlaceholderExpression === 'function' && placeholderUtils.isProgressPlaceholderExpression(expression)) { + return placeholderUtils.renderProgressPlaceholder(item, expression); + } if (typeof placeholderUtils.isImagePlaceholderExpression === 'function' && placeholderUtils.isImagePlaceholderExpression(expression)) { var imageSource = placeholderUtils.formatPlaceholderValue(resolved); var source = getApiSourceById(sourceId); diff --git a/src/player/regions/rss.js b/src/player/regions/rss.js index f17d538..6fd3992 100644 --- a/src/player/regions/rss.js +++ b/src/player/regions/rss.js @@ -74,6 +74,9 @@ function substituteRssVariables(html, item, feedId) { return ''; } var resolved = placeholderUtils.resolvePlaceholderExpression(item, expression); + if (typeof placeholderUtils.isProgressPlaceholderExpression === 'function' && placeholderUtils.isProgressPlaceholderExpression(expression)) { + return placeholderUtils.renderProgressPlaceholder(item, expression); + } if (typeof placeholderUtils.isImagePlaceholderExpression === 'function' && placeholderUtils.isImagePlaceholderExpression(expression)) { var imageSource = placeholderUtils.formatPlaceholderValue(resolved); var feed = getRssFeedById(feedId); diff --git a/src/player/regions/timetable.js b/src/player/regions/timetable.js index 1eceb47..a1f4342 100644 --- a/src/player/regions/timetable.js +++ b/src/player/regions/timetable.js @@ -13,6 +13,9 @@ function substituteTimetableVariables(html, entry) { return ''; } + if (typeof window.placeholderUtils.isProgressPlaceholderExpression === 'function' && window.placeholderUtils.isProgressPlaceholderExpression(expression)) { + return window.placeholderUtils.renderProgressPlaceholder(entry, expression); + } return escapeHtml(window.placeholderUtils.formatPlaceholderValue(window.placeholderUtils.resolvePlaceholderExpression(entry, expression))); }); } diff --git a/src/player/regions/weather.js b/src/player/regions/weather.js index b5809f7..3091bf3 100644 --- a/src/player/regions/weather.js +++ b/src/player/regions/weather.js @@ -51,6 +51,9 @@ function substituteWeatherVariables(html, value) { if (!value || typeof value !== 'object' || typeof weatherPlaceholderUtils.resolvePlaceholderExpression !== 'function' || typeof weatherPlaceholderUtils.formatPlaceholderValue !== 'function') return ''; var rawExpression = String(expression).trim(); var normalizedExpression = normalizeWeatherExpression(rawExpression); + if (typeof weatherPlaceholderUtils.isProgressPlaceholderExpression === 'function' && weatherPlaceholderUtils.isProgressPlaceholderExpression(rawExpression)) { + return weatherPlaceholderUtils.renderProgressPlaceholder(value, rawExpression); + } var iconMatch = normalizedExpression.match(/^(?:current\.weather_code|daily\.weather_code\.\d+|hourly\.weather_code\.\d+)\.icon(?:\((\d+)(?:\s*,\s*(\d+))?\))?$/); if (iconMatch) { var codeExpression = normalizedExpression.replace(/\.icon(?:\(.*\))?$/, ''); diff --git a/src/rbac.js b/src/rbac.js index 80c4c19..1be34c9 100644 --- a/src/rbac.js +++ b/src/rbac.js @@ -191,6 +191,17 @@ const PERMISSION_SECTIONS = [ { key: 'delete', name: 'Delete', description: 'Delete users.' } ] }, + { + key: 'invitations', + order: 15, + name: 'Invitations', + permissions: [ + { key: 'read', name: 'Read', description: 'View pending user invitations.' }, + { key: 'create', name: 'Create', description: 'Send new user invitations.' }, + { key: 'delete', name: 'Delete', description: 'Delete pending user invitations.' }, + { key: 'allow', name: 'Allow', description: 'Resend pending user invitations.' } + ] + }, { key: 'rbac', order: 20, diff --git a/src/web.js b/src/web.js index 42a1bab..e89e2ac 100644 --- a/src/web.js +++ b/src/web.js @@ -6,7 +6,7 @@ const multer = require('multer'); const fs = require('fs'); const crypto = require('crypto'); const common = require('./common'); -const { verifyPassword, createSessionToken, hashSessionToken, hashPassword, validatePasswordStrength } = require('#src/auth'); +const { verifyPassword, createSessionToken, hashSessionToken, hashPassword, validatePasswordStrength, createOneTimeToken } = require('#src/auth'); const pages = require('#src/web/pages'); const registerMiddleware = require('#src/web/middleware'); const registerNotFoundHandler = require('#src/web/middleware/not-found'); @@ -23,8 +23,9 @@ const { requirePermission: createRequirePermission, PERMISSION_DENIED_MESSAGE } const { rbacData } = require('#src/web/lib/auth'); const { createPlayerActionService } = require('#src/web/lib/player-actions'); const { isClientNameAvailable, withClientNameReservation } = require('#src/data/client-name-check'); -const { createSessionService } = require('#src/web/lib/auth'); +const { createSessionService, getRequestOrigin } = require('#src/web/lib/auth'); const { fetchAppSettings } = require('#src/data/app-settings'); +const { sendAccountEmail } = require('#src/data/mailer'); const { recordRequestAuditEvent } = require('#src/data/audit-log'); const { hasAnyPermission } = require('#src/rbac'); const { ensureFontLibrary } = require('#src/web/lib/media/font-library'); @@ -150,7 +151,10 @@ async function start() { sessionCookieName: webConfig.sessionCookieName, formatDashboardDate: formatDashboardDate, getAuditUserId: getAuditUserId, + getRequestOrigin: getRequestOrigin, recordRequestAuditEvent: recordRequestAuditEvent, + sendAccountEmail: function (settings, message) { return sendAccountEmail(settings, message); }, + createOneTimeToken: createOneTimeToken, hashPassword: hashPassword, validatePasswordStrength: validatePasswordStrength, readArrayField: readArrayField, diff --git a/src/web/lib/auth/index.js b/src/web/lib/auth/index.js index ed712bb..a26509f 100644 --- a/src/web/lib/auth/index.js +++ b/src/web/lib/auth/index.js @@ -2,5 +2,6 @@ module.exports = { createSessionService: require('./session').createSessionService, + getRequestOrigin: require('./session').getRequestOrigin, rbacData: require('./rbac-data') }; \ No newline at end of file diff --git a/src/web/lib/auth/rbac-data.js b/src/web/lib/auth/rbac-data.js index 6ece63e..6c78deb 100644 --- a/src/web/lib/auth/rbac-data.js +++ b/src/web/lib/auth/rbac-data.js @@ -57,6 +57,32 @@ async function fetchRolesPage(pool, page, pageSize, searchTerm, sortKey, sortDir return Object.assign({ roles: paged.rows }, paged); } +async function fetchInvitationsPage(pool, page, pageSize, searchTerm, sortKey, sortDirection) { + const paged = await fetchPagedRows(pool, { + selectSql: `SELECT i.id, i.email, i.name, i.role_ids_json, i.created_at, i.expires_at, u.username AS created_by_username + FROM a_user_invitations i + LEFT JOIN a_users u ON u.id = i.created_by + WHERE i.used_at IS NULL AND i.expires_at > NOW() + ORDER BY i.created_at DESC`, + countSql: 'SELECT COUNT(*) AS count FROM a_user_invitations WHERE used_at IS NULL AND expires_at > NOW()', + searchColumns: ['i.email', 'i.name', 'u.username'], + searchTerm: searchTerm, + sortColumns: { + email: 'i.email', + name: 'i.name', + created: 'i.created_at', + expires: 'i.expires_at', + createdBy: 'u.username' + }, + sortKey: sortKey, + sortDirection: sortDirection, + page: page, + pageSize: pageSize + }); + + return Object.assign({ invitations: paged.rows }, paged); +} + async function fetchRoleById(pool, roleId) { const [rows] = await pool.query( `SELECT r.id, r.role_key, r.name, r.description, r.created_at, r.modified_at, @@ -142,7 +168,7 @@ async function fetchUsersWithRolesPage(pool, page, pageSize, searchTerm, sortKey const whereSql = hasExcludedUserId ? 'WHERE u.id <> ?' : ''; const queryArgs = hasExcludedUserId ? [excludedUserId] : []; const paged = await fetchPagedRows(pool, { - selectSql: `SELECT u.id, u.name, u.username, u.account_locked, u.created_at, u.modified_at, + selectSql: `SELECT u.id, u.name, u.username, u.email, u.email_verified_at, u.account_locked, u.created_at, u.modified_at, COALESCE(role_data.role_names, '') AS role_names, COALESCE(role_data.role_ids_csv, '') AS role_ids_csv FROM a_users u @@ -189,7 +215,7 @@ async function fetchUsersWithRolesPage(pool, page, pageSize, searchTerm, sortKey async function fetchUserWithRoles(pool, userId) { const [rows] = await pool.query( - `SELECT u.id, u.name, u.username, u.account_locked, u.created_at, u.modified_at, + `SELECT u.id, u.name, u.username, u.email, u.email_verified_at, u.account_locked, u.created_at, u.modified_at, COALESCE(role_data.role_names, '') AS role_names, COALESCE(role_data.role_ids_csv, '') AS role_ids_csv FROM a_users u @@ -299,6 +325,7 @@ module.exports = { fetchPermissions, fetchRoles, fetchRolesPage, + fetchInvitationsPage, fetchRoleById, fetchRolePermissionKeys, fetchRoleUserIds, diff --git a/src/web/lib/auth/session.js b/src/web/lib/auth/session.js index ec5e859..47ccbc9 100644 --- a/src/web/lib/auth/session.js +++ b/src/web/lib/auth/session.js @@ -128,7 +128,7 @@ function createSessionService(options) { const tokenHash = hashSessionToken(token); const [rows] = await pool.query( - `SELECT s.user_id, u.id, u.name, u.username, u.must_change_password + `SELECT s.user_id, u.id, u.name, u.username, u.email, u.email_verified_at, u.pending_email, u.must_change_password FROM a_sessions s JOIN a_users u ON u.id = s.user_id WHERE s.session_hash = ? diff --git a/src/web/lib/media/slide-thumbnails.js b/src/web/lib/media/slide-thumbnails.js index c9ebae9..2ca5f57 100644 --- a/src/web/lib/media/slide-thumbnails.js +++ b/src/web/lib/media/slide-thumbnails.js @@ -184,6 +184,9 @@ function substitutePlaceholders(html, regionContent, options) { const resolved = typeof placeholderUtils.resolvePlaceholderExpression === 'function' ? placeholderUtils.resolvePlaceholderExpression(item, weatherExpression, { timeZone: item.timezone }) : resolvePlaceholderPath(item, expression); + if (typeof placeholderUtils.isProgressPlaceholderExpression === 'function' && placeholderUtils.isProgressPlaceholderExpression(expression)) { + return placeholderUtils.renderProgressPlaceholder(item, expression); + } if (type === 'weather' && /(?:^|\.)weather_code\.\d+\.icon(?:\(|$)|^current\.weather_code\.icon/.test(weatherExpression)) { const codeExpression = weatherExpression.replace(/\.icon(?:\(.*\))?$/, ''); const iconSize = String(expression).match(/\.icon\(\s*(\d+)(?:\s*,\s*(\d+))?\s*\)$/); diff --git a/src/web/middleware.js b/src/web/middleware.js index 7b64a49..42c033d 100644 --- a/src/web/middleware.js +++ b/src/web/middleware.js @@ -29,7 +29,7 @@ module.exports = function registerMiddleware(app, deps) { }); app.use(function (req, res, next) { - if (req.path === '/' || req.path === '/login' || req.path === '/logout' || req.path === '/slides/popup-preview' || req.path.indexOf('/api/internal/slide-thumbnails/') === 0 || req.path === '/api/internal/sync/player-media' || req.path === '/api/internal/sync/player-font') { + if (req.path === '/' || req.path === '/login' || req.path === '/logout' || req.path === '/forgot-password' || req.path === '/reset-password' || req.path === '/verify-email' || req.path === '/slides/popup-preview' || req.path.indexOf('/api/internal/slide-thumbnails/') === 0 || req.path === '/api/internal/sync/player-media' || req.path === '/api/internal/sync/player-font') { return next(); } diff --git a/src/web/pages/index.js b/src/web/pages/index.js index 9f11cd2..d4ef1b3 100644 --- a/src/web/pages/index.js +++ b/src/web/pages/index.js @@ -8,11 +8,18 @@ function routePath(...segments) { module.exports = { renderLoginPage: require(routePath('auth', 'login')), + renderForgotPasswordPage: require(routePath('auth', 'forgot-password')), + renderResetPasswordPage: require(routePath('auth', 'reset-password')), + renderAcceptInvitePage: require(routePath('auth', 'accept-invite')), + renderEmailVerifiedPage: require(routePath('auth', 'email-verified')), + renderEmailVerificationErrorPage: require(routePath('auth', 'email-verification-error')), renderAccountPage: require(routePath('account', 'password')), renderSettingsPage: require(routePath('settings', 'index')), renderAboutPage: require(routePath('settings', 'about', 'index')), renderUsersPage: require(routePath('settings', 'users', 'list')), + renderInvitationsPage: require(routePath('settings', 'invitations', 'list')), renderUsersAddPage: require(routePath('settings', 'users', 'add')), + renderUsersInvitePage: require(routePath('settings', 'users', 'invite')), renderUsersEditPage: require(routePath('settings', 'users', 'edit')), renderDashboardPage: require(routePath('signage', 'dashboard', 'index')), renderConnectedClientsPage: require(routePath('signage', 'clients', 'list')), diff --git a/src/web/public/css/theme-custom.css b/src/web/public/css/theme-custom.css index 5d9ea97..ee55cf0 100644 --- a/src/web/public/css/theme-custom.css +++ b/src/web/public/css/theme-custom.css @@ -104,7 +104,7 @@ } .user-menu-dropdown .user-header small { - display: block; + display: table; margin-top: 0.25rem; opacity: 0.85; } @@ -198,15 +198,115 @@ box-shadow: none; } -.card-header { - position: relative; +.login-card { + border-radius: var(--bs-border-radius-lg); + overflow: hidden; } -.card-header .card-tools { - position: absolute; - right: 20px; - top: 50%; - transform: translateY(-50%); +.email-verified-card { + max-width: 26rem; +} + +.email-verified-card__header { + align-items: center; + background: #111827; + color: #fff; + display: flex; + flex-direction: column; + gap: 0.75rem; + padding: 1.75rem 1.5rem; + text-align: center; +} + +.email-verified-card__icon { + align-items: center; + background: #198754; + border: 4px solid rgba(255, 255, 255, 0.2); + border-radius: 50%; + display: flex; + font-size: 1.75rem; + height: 4rem; + justify-content: center; + width: 4rem; +} + +.email-verification-error-card { + max-width: 26rem; +} + +.email-verification-error-card__header { + align-items: center; + background: #111827; + color: #fff; + display: flex; + flex-direction: column; + gap: 0.75rem; + padding: 1.75rem 1.5rem; + text-align: center; +} + +.email-verification-error-card__icon { + align-items: center; + background: #dc3545; + border: 4px solid rgba(255, 255, 255, 0.2); + border-radius: 50%; + display: flex; + font-size: 1.75rem; + height: 4rem; + justify-content: center; + width: 4rem; +} + +.email-template-preview { + background: #f4f4f5; + border: 1px solid var(--bs-border-color); + border-radius: var(--bs-border-radius); + padding: 1rem; +} + +.email-template-preview__shell { + background: #fff; + border-radius: 0.25rem; + color: #27364b; + min-height: 220px; + padding: 1.5rem; +} + +.email-template-preview__brand { + color: #111827; + font-size: 1.05rem; + font-weight: 700; + margin-bottom: 1.25rem; + text-align: center; +} + +.email-template-preview__subject { + color: #111827; + font-weight: 600; + margin-bottom: 1rem; +} + +.email-template-preview__message p { + margin-bottom: 0.75rem; + white-space: pre-wrap; +} + +.email-template-preview__button-wrap { + margin-top: 1.25rem; + text-align: center; +} + +.email-template-preview__button { + background: #111827; + border-radius: 0.25rem; + color: #fff; + display: inline-block; + font-weight: 600; + padding: 0.65rem 1.1rem; +} + +.card-header { + position: relative; } .card-header .card-tools > .btn, @@ -221,6 +321,15 @@ max-width: 14rem; } +[data-table-search-container] > .card-header:has(> .card-tools) { + display: flex; + align-items: center; +} + +[data-table-search-container] > .card-header:has(> .card-tools) > .card-tools { + margin-left: auto; +} + .template-preview-card .card-body { gap: 0.75rem 1rem; } @@ -873,22 +982,97 @@ border-top: 1px solid var(--bs-border-color); } +.table-search-group .input-group-text[data-table-search-toggle] { + cursor: pointer; +} + +@media (max-width: 767.98px) { + [data-table-search-container] > .card-header > .card-tools, + [data-table-search-container] > .card-header > .background-tasks-task-tools, + [data-table-search-container] > .card-header > .background-tasks-recurring-tools { + position: relative; + width: auto; + margin-left: auto; + flex-shrink: 0; + } + + [data-table-search-container] > .card-header > .card-tools .table-search-group, + [data-table-search-container] > .card-header > .background-tasks-task-tools .table-search-group, + [data-table-search-container] > .card-header > .background-tasks-recurring-tools .table-search-group { + position: absolute; + top: 50%; + right: var(--table-search-action-offset, 0px); + z-index: 2; + transform: translateY(-50%); + flex: 0 0 2.25rem; + height: 100%; + margin: 0 !important; + min-width: 0 !important; + width: 2.25rem !important; + max-width: 2.25rem; + overflow: hidden; + border: var(--bs-border-width) solid var(--bs-border-color); + border-radius: var(--bs-border-radius); + background: var(--bs-tertiary-bg); + transition: width 160ms ease; + } + + [data-table-search-container] .table-search-group .input-group-text[data-table-search-toggle] { + flex: 1 0 100%; + width: 100%; + justify-content: center; + padding: 0; + border: 0; + color: var(--bs-body-color); + background: transparent; + } + + [data-table-search-container] > .card-header > .card-tools .table-search-group:focus-within, + [data-table-search-container] > .card-header > .background-tasks-task-tools .table-search-group:focus-within, + [data-table-search-container] > .card-header > .background-tasks-recurring-tools .table-search-group:focus-within { + flex: 1 1 auto; + width: min(14rem, calc(100vw - 6rem)) !important; + height: auto; + max-width: none; + overflow: visible; + border-color: var(--bs-border-color); + border-radius: var(--bs-border-radius-sm); + background: var(--bs-body-bg); + } + + [data-table-search-container] .table-search-group input { + min-width: 0; + width: 0; + flex: 0 0 0; + padding: 0 !important; + border: 0; + opacity: 0; + } + + [data-table-search-container] .table-search-group:focus-within input { + width: auto; + flex: 1 1 auto; + padding-right: 0.5rem; + padding-left: 0.5rem; + border-left: var(--bs-border-width) solid var(--bs-border-color); + opacity: 1; + } + + [data-table-search-container] .table-search-group:focus-within .input-group-text[data-table-search-toggle] { + flex: 0 0 auto; + width: auto; + padding: 0.25rem 0.5rem; + } + + [data-table-search-container] .table-action-context { + display: none; + } +} + .admin-form-card { box-shadow: none; } -.account-lock-label-locked { - display: none; -} - -.btn-check:checked + label .account-lock-label-unlocked { - display: none; -} - -.btn-check:checked + label .account-lock-label-locked { - display: inline; -} - .admin-form-card .card-header { background: var(--bs-tertiary-bg); } @@ -1022,7 +1206,7 @@ display: flex; align-items: center; gap: 0.5rem; - margin: 0 0 1rem; + margin: 0 0 0.5rem; padding-bottom: 0.35rem; border-bottom: 1px solid var(--bs-border-color); color: var(--bs-primary); @@ -1209,7 +1393,7 @@ display: grid; grid-template-columns: minmax(0, 1.2fr) minmax(0, 0.8fr) minmax(12rem, 0.7fr); gap: 1rem; - align-items: start; + align-items: stretch; } .screen-command-panel-pairing-only { @@ -1314,6 +1498,203 @@ margin: 0; } +.clients-mobile-clients { + display: none; +} + +@media (max-width: 767.98px) { + .clients-page-header p { + display: none; + } + + .clients-screen-command-card .screen-command-panel-right { + display: none; + } + + .clients-screen-command-card .screen-command-pairing { + display: flex; + align-items: center; + justify-content: flex-end; + padding: 0; + border: 0; + } + + .clients-screen-command-card .screen-command-pairing > div { + display: none; + } + + .clients-screen-command-card .screen-command-pairing .btn { + width: 100%; + } + + .clients-screen-command-card .screen-command-actions { + display: grid; + grid-template-columns: repeat(3, minmax(0, 1fr)); + gap: 0.5rem; + } + + .clients-screen-command-card .screen-command-actions .btn { + width: 100%; + } + + .clients-client-table-card { + display: none; + } + + .clients-mobile-clients { + display: block; + } + + .clients-mobile-client-tools { + position: relative; + display: flex; + align-items: center; + justify-content: space-between; + gap: 0.75rem; + margin-bottom: 0.65rem; + } + + .clients-mobile-client-tools > div:first-child { + display: flex; + align-items: baseline; + gap: 0.5rem; + min-width: 0; + } + + .clients-mobile-client-tools h3 { + margin: 0; + font-size: 1.25rem; + line-height: 1.15; + white-space: nowrap; + } + + .clients-mobile-client-search { + position: absolute; + top: 50%; + right: 0; + z-index: 2; + display: flex; + flex-wrap: nowrap; + align-items: center; + width: 2.25rem; + min-width: 0; + height: 2.25rem; + overflow: hidden; + transform: translateY(-50%); + border: var(--bs-border-width) solid var(--bs-border-color); + border-radius: var(--bs-border-radius); + background: var(--bs-tertiary-bg); + transition: width 160ms ease; + } + + .clients-mobile-client-search:focus-within { + left: 0; + width: auto; + overflow: visible; + background: var(--bs-body-bg); + } + + .clients-mobile-client-search label { + display: none; + } + + .clients-mobile-client-search .input-group-text { + flex: 1 0 100%; + width: 100%; + justify-content: center; + padding: 0; + border: 0; + color: var(--bs-body-color); + background: transparent; + cursor: pointer; + } + + .clients-mobile-client-search:focus-within .input-group-text { + flex: 0 0 auto; + width: auto; + padding: 0.25rem 0.5rem; + } + + .clients-mobile-client-search input { + min-width: 0; + width: 0; + flex: 0 0 0; + padding: 0 !important; + border: 0; + opacity: 0; + } + + .clients-mobile-client-search:focus-within input { + width: auto; + flex: 1 1 auto; + padding-right: 0.5rem !important; + padding-left: 0.5rem !important; + border-left: var(--bs-border-width) solid var(--bs-border-color); + opacity: 1; + } + + .clients-mobile-client { + margin-bottom: 0.75rem; + } + + .clients-mobile-client-header { + display: flex; + align-items: start; + justify-content: space-between; + gap: 0.75rem; + } + + .clients-mobile-client-header h4 { + margin: 0; + font-size: 1rem; + } + + .clients-mobile-client-details { + display: grid; + grid-template-columns: 1fr 1fr; + gap: 0.75rem; + margin: 0.9rem 0; + padding: 0.75rem 0; + border-top: 1px solid var(--bs-border-color); + border-bottom: 1px solid var(--bs-border-color); + } + + .clients-mobile-client-details small { + display: block; + margin-bottom: 0.2rem; + color: var(--bs-secondary-color); + font-size: 0.7rem; + font-weight: 700; + text-transform: uppercase; + } + + .clients-mobile-client-details strong { + display: -webkit-box; + min-height: 2.5em; + overflow: hidden; + overflow-wrap: anywhere; + font-size: 0.875rem; + line-height: 1.25; + -webkit-box-orient: vertical; + -webkit-line-clamp: 2; + } + + .clients-mobile-client-actions { + display: grid; + grid-template-columns: repeat(4, minmax(0, 1fr)); + gap: 0.4rem; + } + + .clients-mobile-client-actions .wide { + grid-column: span 2; + } + + .clients-mobile-client-actions .btn { + width: 100%; + min-height: 2.4rem; + } +} + @media (max-width: 767.98px) { .screen-command-panel { grid-template-columns: 1fr; diff --git a/src/web/public/js/account/account-page.js b/src/web/public/js/account/account-page.js new file mode 100644 index 0000000..a80e0cf --- /dev/null +++ b/src/web/public/js/account/account-page.js @@ -0,0 +1,56 @@ +(function () { + var currentPasswordInput = document.querySelector('[data-account-current-password]'); + var profileFormInput = document.querySelector('[data-account-profile-current-password]'); + var passwordFormInput = document.querySelector('[data-account-password-current-password]'); + var profileForm = profileFormInput && profileFormInput.form; + var passwordForm = passwordFormInput && passwordFormInput.form; + + if (!currentPasswordInput || !profileFormInput || !passwordFormInput || !profileForm || !passwordForm) { + return; + } + + function syncCurrentPassword() { + profileFormInput.value = currentPasswordInput.value; + passwordFormInput.value = currentPasswordInput.value; + } + + function clearCurrentPassword() { + currentPasswordInput.value = ''; + currentPasswordInput.setCustomValidity(''); + currentPasswordInput.removeAttribute('required'); + profileFormInput.value = ''; + passwordFormInput.value = ''; + passwordForm.querySelectorAll('input[type="password"]').forEach(function (input) { + input.value = ''; + input.setCustomValidity(''); + }); + profileForm.classList.remove('was-validated'); + passwordForm.classList.remove('was-validated'); + } + + currentPasswordInput.addEventListener('input', syncCurrentPassword); + currentPasswordInput.addEventListener('input', function () { + currentPasswordInput.setCustomValidity(''); + }); + document.addEventListener('submit', function (event) { + if (event.target !== profileForm && event.target !== passwordForm) { + return; + } + if (!currentPasswordInput.value) { + event.preventDefault(); + event.stopImmediatePropagation(); + currentPasswordInput.setCustomValidity('Current password is required.'); + currentPasswordInput.reportValidity(); + return; + } + currentPasswordInput.setCustomValidity(''); + syncCurrentPassword(); + }, true); + passwordForm.addEventListener('submit', syncCurrentPassword); + document.addEventListener('web-async-save:success', function (event) { + if (event.detail && event.detail.form !== profileForm && event.detail.form !== passwordForm) { + return; + } + clearCurrentPassword(); + }); +})(); diff --git a/src/web/public/js/dashboard/dashboard-page.js b/src/web/public/js/dashboard/dashboard-page.js index d0dd622..8a9c0fc 100644 --- a/src/web/public/js/dashboard/dashboard-page.js +++ b/src/web/public/js/dashboard/dashboard-page.js @@ -72,9 +72,13 @@ var allBlackout = hasClients && clients.every(function (client) { return Boolean(client && client.blackout); }); + var isClientsMobile = Boolean(document.querySelector('.clients-screen-command-card')); + var useShortMobileLabels = isClientsMobile && window.innerWidth < 768; if (action === 'pause') { - var pauseLabel = allPaused ? 'Resume ' + (isAllScreens ? 'all clients' : 'screen') : 'Pause ' + (isAllScreens ? 'all clients' : 'screen'); + var pauseLabel = useShortMobileLabels + ? (allPaused ? 'Resume' : 'Pause') + : (allPaused ? 'Resume ' + (isAllScreens ? 'all clients' : 'screen') : 'Pause ' + (isAllScreens ? 'all clients' : 'screen')); var pauseConfirm = allPaused ? 'Resume ' + (isAllScreens ? 'all connected clients' : selectedLabel) + '?' : 'Pause ' + (isAllScreens ? 'all connected clients' : selectedLabel) + '?'; var pauseIcon = allPaused ? 'bi-play-fill' : 'bi-pause-fill'; button.innerHTML = '' + escapeHtml(pauseLabel); @@ -92,7 +96,9 @@ } if (action === 'blackout') { - var blackoutLabel = allBlackout ? 'Restore ' + (isAllScreens ? 'all clients' : 'screen') : 'Blackout ' + (isAllScreens ? 'all clients' : 'screen'); + var blackoutLabel = useShortMobileLabels + ? (allBlackout ? 'Restore' : 'Blackout') + : (allBlackout ? 'Restore ' + (isAllScreens ? 'all clients' : 'screen') : 'Blackout ' + (isAllScreens ? 'all clients' : 'screen')); var blackoutConfirm = allBlackout ? 'Restore ' + (isAllScreens ? 'all connected clients' : selectedLabel) + '?' : 'Blackout ' + (isAllScreens ? 'all connected clients' : selectedLabel) + '?'; var blackoutIcon = allBlackout ? 'bi-eye' : 'bi-eye-slash'; button.innerHTML = '' + escapeHtml(blackoutLabel); @@ -147,6 +153,9 @@ } if (button) { + if (Boolean(document.querySelector('.clients-screen-command-card')) && window.innerWidth < 768) { + button.innerHTML = 'Reload'; + } button.setAttribute('aria-label', selectedName ? selectedName : 'Selected screen group'); } }); @@ -372,7 +381,7 @@ var connectionId = String(row.getAttribute('data-client-client-id') || row.getAttribute('data-client-id') || '').trim(); var clientId = String(row.getAttribute('data-client-client-id') || '').trim(); var playerBaseUrl = String(row.getAttribute('data-client-player-base-url') || '').trim(); - var clientNameCell = row.querySelector('td[data-label="Client"] > div'); + var clientNameCell = row.querySelector('td[data-label="Client"] > div, [data-mobile-client-name]'); var clientName = String(clientNameCell && clientNameCell.textContent || '').trim(); var options = Array.prototype.slice.call(elements.targetSelect.options || []); @@ -826,7 +835,7 @@ if (typeof elements.modal.addEventListener === 'function') { elements.modal.addEventListener('show.bs.modal', function (event) { var trigger = event && event.relatedTarget ? event.relatedTarget : null; - var row = trigger && trigger.closest ? trigger.closest('tr[data-client-key]') : null; + var row = trigger && trigger.closest ? trigger.closest('tr[data-client-key], article[data-mobile-client-key]') : null; if (row) { updateClientMoveModalFromRow(row); } @@ -843,7 +852,7 @@ event.preventDefault(); } - var row = moveButton.closest ? moveButton.closest('tr[data-client-key]') : null; + var row = moveButton.closest ? moveButton.closest('tr[data-client-key], article[data-mobile-client-key]') : null; if (!row) { return; } @@ -1038,6 +1047,60 @@ blackoutButton.setAttribute('aria-label', label); } + function updateMobileClientCards(state) { + document.querySelectorAll('[data-mobile-client-id]').forEach(function (card) { + var id = String(card.getAttribute('data-mobile-client-id') || '').trim(); + var clientId = String(card.getAttribute('data-mobile-client-client-id') || '').trim(); + var client = (state.clients || []).find(function (candidate) { + return String(candidate.id || '').trim() === id || String(candidate.clientId || '').trim() === clientId; + }); + if (!client) { + return; + } + var paused = Boolean(client.paused); + var blackout = Boolean(client.blackout); + var badge = card.querySelector('.badge'); + var heading = card.querySelector('h4'); + var details = card.querySelectorAll('.clients-mobile-client-details strong'); + var pauseButton = card.querySelector('button[type="submit"].btn-info'); + var blackoutButton = card.querySelector('button[type="submit"].btn-secondary, button[type="submit"].btn-success'); + card.setAttribute('data-client-screen-slug', client.screen_slug || ''); + card.setAttribute('data-client-client-id', client.clientId || client.id || ''); + card.setAttribute('data-client-player-base-url', client.player_url || ''); + card.classList.toggle('card-warning', paused); + card.classList.toggle('card-primary', !paused); + if (badge) { + badge.className = 'badge ' + (blackout ? 'text-bg-secondary' : paused ? 'text-bg-warning' : 'text-bg-success'); + badge.textContent = blackout ? 'Blackout' : paused ? 'Paused' : 'Live'; + } + if (heading) { + heading.textContent = client.client_name || 'Unknown'; + } + if (details[0]) { + details[0].textContent = client.screen_name || client.screen_slug || 'Unknown'; + } + if (details[1]) { + details[1].textContent = client.currentSlideTitle || 'No slide currently showing'; + } + if (pauseButton) { + pauseButton.innerHTML = '' + (paused ? 'Resume' : 'Pause'); + } + if (blackoutButton) { + blackoutButton.innerHTML = '' + (blackout ? 'Restore' : 'Blackout'); + blackoutButton.className = 'btn btn-sm ' + (blackout ? 'btn-success' : 'btn-secondary') + ' w-100'; + } + card.querySelectorAll('form').forEach(function (form) { + var connectionInput = form.querySelector('input[name="connectionId"]'); + var baseUrlInput = form.querySelector('input[name="playerBaseUrl"]'); + if (connectionInput) connectionInput.value = client.clientId || client.id || ''; + if (baseUrlInput) baseUrlInput.value = client.player_url || ''; + form.action = '/clients/' + encodeURIComponent(client.screen_slug || '') + '/commands'; + var blackoutInput = form.querySelector('input[name="blackout"]'); + if (blackoutInput) blackoutInput.value = blackout ? 'false' : 'true'; + }); + }); + } + function handleDashboardState(state) { if (!state) { return; @@ -1047,6 +1110,7 @@ updateStats(state); updateScreenGrid(state); updateClientTable(state); + updateMobileClientCards(state); updateKioskLauncherModal(state); updateDashboardQuickActions(state); updateScreenCommandControls(); @@ -1142,10 +1206,24 @@ return; } + document.querySelectorAll('article[data-mobile-client-key] .clients-mobile-client-actions').forEach(function (actions) { + if (actions.querySelector('button[data-action="move-screen"]')) { + return; + } + var button = document.createElement('button'); + button.type = 'button'; + button.className = 'btn btn-sm btn-danger'; + button.setAttribute('data-action', 'move-screen'); + button.setAttribute('aria-label', 'Change screen'); + button.setAttribute('title', 'Change screen'); + button.innerHTML = ''; + actions.insertBefore(button, actions.children[1] || null); + }); + if (typeof elements.modal.addEventListener === 'function') { elements.modal.addEventListener('show.bs.modal', function (event) { var trigger = event && event.relatedTarget ? event.relatedTarget : null; - var row = trigger && trigger.closest ? trigger.closest('tr[data-client-key]') : null; + var row = trigger && trigger.closest ? trigger.closest('tr[data-client-key], article[data-mobile-client-key]') : null; if (row) { updateClientMoveModalFromRow(row); } @@ -1162,7 +1240,7 @@ event.preventDefault(); } - var row = moveButton.closest ? moveButton.closest('tr[data-client-key]') : null; + var row = moveButton.closest ? moveButton.closest('tr[data-client-key], article[data-mobile-client-key]') : null; if (!row) { return; } diff --git a/src/web/public/js/data-sources/api-source-form.js b/src/web/public/js/data-sources/api-source-form.js index b3b496e..601a4a8 100644 --- a/src/web/public/js/data-sources/api-source-form.js +++ b/src/web/public/js/data-sources/api-source-form.js @@ -7,6 +7,7 @@ } var methodSelect = form.querySelector('[data-api-source-auth-method]'); + var authCard = form.querySelector('[data-api-source-auth-card]'); var authDetailsSection = form.querySelector('[data-api-source-auth-details-section]'); var panels = Array.prototype.slice.call(form.querySelectorAll('[data-api-source-auth-panel]')); var bearerTokenInput = form.querySelector('[data-api-source-bearer-token-input]'); @@ -36,10 +37,20 @@ bearerTokenInput.focus(); } - function updatePanels() { + function updatePanels(shouldExpandAuth) { var method = String(methodSelect && methodSelect.value || 'none').trim(); var hasAuth = method !== 'none'; + if (authCard) { + authCard.hidden = !hasAuth; + if (shouldExpandAuth && hasAuth && authCard.classList.contains('collapsed-card')) { + var collapseButton = authCard.querySelector('[data-lte-toggle="card-collapse"]'); + if (collapseButton) { + collapseButton.click(); + } + } + } + if (authDetailsSection) { authDetailsSection.hidden = !hasAuth; } @@ -60,7 +71,9 @@ } if (methodSelect) { - methodSelect.addEventListener('change', updatePanels); + methodSelect.addEventListener('change', function () { + updatePanels(true); + }); } if (requestMethodSelect) { @@ -72,6 +85,6 @@ updateBearerTokenToggle(); } - updatePanels(); + updatePanels(false); updateRequestBodyVisibility(); }()); \ No newline at end of file diff --git a/src/web/public/js/regions/type/api.js b/src/web/public/js/regions/type/api.js index 8598594..e2c87be 100644 --- a/src/web/public/js/regions/type/api.js +++ b/src/web/public/js/regions/type/api.js @@ -106,6 +106,9 @@ } var resolved = placeholderUtils.resolvePlaceholderExpression(item, expression); + if (typeof placeholderUtils.isProgressPlaceholderExpression === 'function' && placeholderUtils.isProgressPlaceholderExpression(expression)) { + return placeholderUtils.renderProgressPlaceholder(item, expression); + } if (typeof placeholderUtils.isImagePlaceholderExpression === 'function' && placeholderUtils.isImagePlaceholderExpression(expression)) { var imageSource = placeholderUtils.formatPlaceholderValue(resolved); if (!/^(?:https?:\/\/|\/media\/|\/assets\/|\/[^/])/i.test(imageSource)) { @@ -164,8 +167,11 @@ '
' + '

Placeholders read values from the selected API item. Nested fields use dots.

' + (window.placeholderInfo ? window.placeholderInfo.renderTextTransforms() : '') + + (window.placeholderInfo ? window.placeholderInfo.renderMathTransforms() : '') + (window.placeholderInfo ? window.placeholderInfo.renderDateFormatTokens() : '') + (window.placeholderInfo ? window.placeholderInfo.renderImageTransform() : '') + + '

Progress bar

' + + '

Use {{progress(current,total,success,light,striped,animated,textless)}} to render a configurable bar, or use start and end date/time fields such as {{progress(start_datetime,end_datetime)}} to show elapsed time. The first color controls the bar and the second controls its background. Choose AdminLTE or announcement colors such as orange or midnight, a hex color, striped, animated, or textless in any order. Set the radius with square, pill, or radius(12px). The bar height follows the API region text size, and all options after the two field paths are optional.

' + '
' + ''; } diff --git a/src/web/public/js/regions/type/rss.js b/src/web/public/js/regions/type/rss.js index c506a31..d9ba190 100644 --- a/src/web/public/js/regions/type/rss.js +++ b/src/web/public/js/regions/type/rss.js @@ -125,6 +125,9 @@ return ''; } var resolved = placeholderUtils.resolvePlaceholderExpression(item, expression); + if (typeof placeholderUtils.isProgressPlaceholderExpression === 'function' && placeholderUtils.isProgressPlaceholderExpression(expression)) { + return placeholderUtils.renderProgressPlaceholder(item, expression); + } if (typeof placeholderUtils.isImagePlaceholderExpression === 'function' && placeholderUtils.isImagePlaceholderExpression(expression)) { var imageSource = placeholderUtils.formatPlaceholderValue(resolved); if (!/^(?:https?:\/\/|\/media\/|\/assets\/|\/[^/])/i.test(imageSource)) { @@ -224,6 +227,7 @@ '

Placeholder paths

' + '

Nested values use dots. Missing values render as empty text.

' + (window.placeholderInfo ? window.placeholderInfo.renderTextTransforms() : '') + + (window.placeholderInfo ? window.placeholderInfo.renderMathTransforms() : '') + '

Date formatting

' + '

Use format("MMM D, YYYY") with date fields. Use tz() for a short timezone name and tz_long() for the full timezone name.

' + (window.placeholderInfo ? window.placeholderInfo.renderDateFormatTokens() : '') + diff --git a/src/web/public/js/regions/type/timetable.js b/src/web/public/js/regions/type/timetable.js index 595162a..e2dc799 100644 --- a/src/web/public/js/regions/type/timetable.js +++ b/src/web/public/js/regions/type/timetable.js @@ -140,6 +140,9 @@ if (placeholderUtils && typeof placeholderUtils.resolvePlaceholderExpression === 'function' && typeof placeholderUtils.formatPlaceholderValue === 'function') { return source.replace(/\{\{\s*([^{}]+?)\s*\}\}/g, function (_match, expression) { + if (typeof placeholderUtils.isProgressPlaceholderExpression === 'function' && placeholderUtils.isProgressPlaceholderExpression(expression)) { + return placeholderUtils.renderProgressPlaceholder(context, expression); + } return escapeHtml(placeholderUtils.formatPlaceholderValue(placeholderUtils.resolvePlaceholderExpression(context, expression))); }); } @@ -248,6 +251,7 @@ '

Placeholder paths

' + '

Use the available field chips. Nested values use dots, and missing values render as empty text.

' + window.placeholderInfo.renderTextTransforms() + + window.placeholderInfo.renderMathTransforms() + '

Date and time formatting

' + '

Use format("MMM D, YYYY h:mm A") with date fields. Use tz() for a short timezone name and tz_long() for the full timezone name.

' + window.placeholderInfo.renderDateFormatTokens() + diff --git a/src/web/public/js/regions/type/weather.js b/src/web/public/js/regions/type/weather.js index 74d34b5..07fea63 100644 --- a/src/web/public/js/regions/type/weather.js +++ b/src/web/public/js/regions/type/weather.js @@ -114,6 +114,9 @@ if (!value || typeof value !== 'object' || typeof placeholderUtils.resolvePlaceholderExpression !== 'function' || typeof placeholderUtils.formatPlaceholderValue !== 'function') return ''; var rawExpression = String(expression).trim(); var normalizedExpression = normalizeWeatherExpression(rawExpression); + if (typeof placeholderUtils.isProgressPlaceholderExpression === 'function' && placeholderUtils.isProgressPlaceholderExpression(rawExpression)) { + return placeholderUtils.renderProgressPlaceholder(value, rawExpression); + } var iconMatch = normalizedExpression.match(/^(?:current\.weather_code|daily\.weather_code\.\d+|hourly\.weather_code\.\d+)\.icon(?:\((\d+)(?:\s*,\s*(\d+))?\))?$/); if (iconMatch) { var codeExpression = normalizedExpression.replace(/\.icon(?:\(.*\))?$/, ''); @@ -137,6 +140,7 @@ '

Placeholders read values from the selected weather snapshot. Nested fields use dots.

' + '

Weather icons

Use the icon property to insert a Bootstrap weather icon. Add width and height in pixels when sizing is needed.

' + (window.placeholderInfo ? window.placeholderInfo.renderTextTransforms() : '') + + (window.placeholderInfo ? window.placeholderInfo.renderMathTransforms() : '') + (window.placeholderInfo ? window.placeholderInfo.renderDateFormatTokens() : '') + '
' + ''; diff --git a/src/web/public/js/settings/settings-page.js b/src/web/public/js/settings/settings-page.js index 86a9937..50b5054 100644 --- a/src/web/public/js/settings/settings-page.js +++ b/src/web/public/js/settings/settings-page.js @@ -384,9 +384,106 @@ setActiveSection(initialSection); } + function initEmailTemplatePreviews() { + var previewUser = document.querySelector('[data-email-preview-user]'); + var signedInUser = { + username: previewUser ? previewUser.getAttribute('data-username') : '', + display_name: previewUser ? previewUser.getAttribute('data-display-name') : '', + email: previewUser ? previewUser.getAttribute('data-email') : '' + }; + document.querySelectorAll('[data-email-template-editor]').forEach(function (editor) { + var subject = editor.querySelector('[data-email-template-subject]'); + var body = editor.querySelector('[data-email-template-body]'); + var alignment = editor.querySelector('[data-email-template-alignment]'); + var buttonText = editor.querySelector('[data-email-template-button-text]'); + var preview = editor.querySelector('[data-email-template-preview]'); + if (!subject || !body || !preview) return; + + function render() { + preview.innerHTML = ''; + var shell = document.createElement('div'); + shell.className = 'email-template-preview__shell'; + var brand = document.createElement('div'); + brand.className = 'email-template-preview__brand'; + brand.textContent = 'Pulse Signage'; + var message = document.createElement('div'); + message.className = 'email-template-preview__message'; + var sampleValues = { + username: signedInUser.username || 'username', + display_name: signedInUser.display_name || signedInUser.username || 'Your name', + email: signedInUser.email || 'your-email@example.com' + }; + var button = document.createElement('div'); + button.className = 'email-template-preview__button'; + var buttonAlignment = alignment ? alignment.value : 'center'; + var buttonWrap = document.createElement('div'); + buttonWrap.className = 'email-template-preview__button-wrap'; + buttonWrap.style.textAlign = buttonAlignment; + buttonWrap.appendChild(button); + var isVerificationTemplate = Boolean(editor.querySelector('[name="verification_subject"]')); + var isInvitationTemplate = Boolean(editor.querySelector('[name="invitation_subject"]')); + var previewActionPlaceholder = '[[url]]'; + button.textContent = buttonText && buttonText.value ? buttonText.value : (isVerificationTemplate ? 'Verify email address' : (isInvitationTemplate ? 'Accept invitation' : 'Reset password')); + var previewOrigin = window.location.origin || 'https://pulse-signage.example'; + var previewVerificationUrl = previewOrigin + '/verify-email?token=preview-token'; + var previewResetUrl = previewOrigin + '/reset-password?token=preview-token'; + var previewActionUrl = isVerificationTemplate ? previewVerificationUrl : (isInvitationTemplate ? previewOrigin + '/accept-invite?token=preview-token' : previewResetUrl); + var hasExplicitButton = body.value.indexOf('[[action_button]]') !== -1; + body.value.split(/\r?\n(?:[ \t]*\r?\n)+/).forEach(function (sourceParagraph) { + var line = sourceParagraph.replace(/\[\[(username|display_name|email)\]\]/g, function (_match, key) { return sampleValues[key]; }).replace(previewActionPlaceholder, previewActionUrl); + var hasButtonToken = sourceParagraph.indexOf('[[action_button]]') !== -1; + var hasUrlToken = !hasExplicitButton && sourceParagraph.indexOf(previewActionPlaceholder) !== -1; + if (hasButtonToken) { + var buttonParts = line.split('[[action_button]]'); + if (buttonParts[0]) appendPreviewParagraph(buttonParts[0]); + message.appendChild(buttonWrap); + if (buttonParts[1]) appendPreviewParagraph(buttonParts[1]); + return; + } + if (hasUrlToken) { + var legacyParts = sourceParagraph.split(previewActionPlaceholder); + if (legacyParts[0]) appendPreviewParagraph(legacyParts[0]); + message.appendChild(buttonWrap); + appendPreviewParagraph(previewActionUrl + legacyParts[1]); + return; + } + appendPreviewParagraph(line); + }); + function appendPreviewParagraph(line) { + var paragraph = document.createElement('p'); + paragraph.innerHTML = (line || '\u00a0').replace(/&/g, '&').replace(//g, '>').replace(/\r?\n/g, '
').replace(/(https?:\/\/[^\s<]+)/g, '$1').replace(/\[b\]([\s\S]*?)\[\/b\]/gi, '$1').replace(/\[i\]([\s\S]*?)\[\/i\]/gi, '$1').replace(/\[u\]([\s\S]*?)\[\/u\]/gi, '$1'); + message.appendChild(paragraph); + } + preview.appendChild(brand); + shell.appendChild(message); + preview.appendChild(shell); + } + + subject.addEventListener('input', render); + body.addEventListener('input', render); + if (alignment) alignment.addEventListener('change', render); + if (buttonText) buttonText.addEventListener('input', render); + editor.querySelectorAll('[data-email-format]').forEach(function (formatButton) { + formatButton.addEventListener('click', function () { + var tag = formatButton.getAttribute('data-email-format'); + var start = body.selectionStart; + var end = body.selectionEnd; + var selected = body.value.slice(start, end) || 'text'; + var markerPattern = new RegExp('^\\[' + tag + '\\]([\\s\\S]*)\\[\\/' + tag + '\\]$'); + var replacement = markerPattern.test(selected) ? markerPattern.exec(selected)[1] : '[' + tag + ']' + selected + '[/' + tag + ']'; + body.setRangeText(replacement, start, end, 'select'); + body.dispatchEvent(new Event('input', { bubbles: true })); + body.focus(); + }); + }); + render(); + }); + } + document.addEventListener('DOMContentLoaded', function () { initIconSuggestions(); initDefaultAnnouncementIconPicker(); initSettingsSectionNavigation(); + initEmailTemplatePreviews(); }); }()); diff --git a/src/web/public/js/shared/placeholder-info.js b/src/web/public/js/shared/placeholder-info.js index 600be6d..7975345 100644 --- a/src/web/public/js/shared/placeholder-info.js +++ b/src/web/public/js/shared/placeholder-info.js @@ -36,6 +36,11 @@ ''; } + function renderMathTransforms() { + return '

Math transforms

' + + '

Use add(number), subtract(number), multiply(number), or divide(number), for example {{amount.multiply(10)}}. Transforms can be chained, such as {{amount.add(3).multiply(10)}}.

'; + } + function renderDateFormatTokens() { return '

Date format tokens

' + '

Use the format("...") transform with these tokens. Text inside square brackets is treated as a literal.

' + @@ -61,6 +66,7 @@ escapeHtml: escapeHtml, render: render, renderTextTransforms: renderTextTransforms, + renderMathTransforms: renderMathTransforms, renderDateFormatTokens: renderDateFormatTokens, renderImageTransform: renderImageTransform }; diff --git a/src/web/public/js/shared/placeholder-utils.js b/src/web/public/js/shared/placeholder-utils.js index cdfb714..861da37 100644 --- a/src/web/public/js/shared/placeholder-utils.js +++ b/src/web/public/js/shared/placeholder-utils.js @@ -27,9 +27,30 @@ return current === undefined || current === null ? '' : current; } + function splitExpressionSegments(value) { + var segments = []; + var current = ''; + var depth = 0; + String(value || '').split('').forEach(function (character) { + if (character === '(') { + depth += 1; + } else if (character === ')' && depth > 0) { + depth -= 1; + } + if (character === '.' && depth === 0) { + segments.push(current); + current = ''; + return; + } + current += character; + }); + segments.push(current); + return segments; + } + function parsePlaceholderExpression(expression) { var raw = String(expression || '').trim(); - var segments = raw ? raw.split('.') : []; + var segments = raw ? splitExpressionSegments(raw) : []; var transforms = []; while (segments.length) { @@ -57,13 +78,33 @@ if (!source) { return []; } - - if ((source[0] === '"' && source[source.length - 1] === '"') || (source[0] === '\'' && source[source.length - 1] === '\'')) { - return [source.slice(1, -1)]; + var args = []; + var current = ''; + var quote = ''; + source.split('').forEach(function (character) { + if ((character === '"' || character === '\'') && (!quote || quote === character)) { + quote = quote ? '' : character; + current += character; + return; + } + if (character === ',' && !quote) { + if (current.trim()) { + args.push(current.trim()); + } + current = ''; + return; + } + current += character; + }); + if (current.trim()) { + args.push(current.trim()); } - - return source.split(',').map(function (item) { - return String(item || '').trim(); + return args.map(function (item) { + var normalized = String(item || '').trim(); + if ((normalized[0] === '"' && normalized[normalized.length - 1] === '"') || (normalized[0] === '\'' && normalized[normalized.length - 1] === '\'')) { + return normalized.slice(1, -1); + } + return normalized; }).filter(Boolean); } @@ -253,6 +294,26 @@ return resolveTimeZone((args && args[0]) || (options && options.timeZone) || ''); } + function toNumericValue(value) { + if (value && typeof value === 'object') { + var numericKeys = ['value', 'amount', 'current', 'total', 'goal', 'raised']; + for (var keyIndex = 0; keyIndex < numericKeys.length; keyIndex += 1) { + var nestedValue = value[numericKeys[keyIndex]]; + if (nestedValue !== undefined && nestedValue !== null && nestedValue !== value) { + var nestedNumber = toNumericValue(nestedValue); + if (Number.isFinite(nestedNumber)) { + return nestedNumber; + } + } + } + return NaN; + } + + var normalized = String(value === undefined || value === null ? '' : value).replace(/[^0-9.eE+-]/g, ''); + var number = Number(normalized); + return Number.isFinite(number) ? number : NaN; + } + function applyTransform(value, transform, options) { var text = String(value === undefined || value === null ? '' : value); var name = String(transform && transform.name || '').trim().toLowerCase(); @@ -284,6 +345,18 @@ return getTimeZoneLongName(getTransformTimeZone(args, options)); } + if (name === 'add' || name === 'subtract' || name === 'multiply' || name === 'divide') { + var arithmeticValue = toNumericValue(value); + var operand = toNumericValue(args[0]); + if (!Number.isFinite(arithmeticValue) || !Number.isFinite(operand) || (name === 'divide' && operand === 0)) { + return value; + } + if (name === 'add') return arithmeticValue + operand; + if (name === 'subtract') return arithmeticValue - operand; + if (name === 'multiply') return arithmeticValue * operand; + return arithmeticValue / operand; + } + return text; } @@ -319,6 +392,147 @@ }; } + function isProgressPlaceholderExpression(expression) { + var parsed = parsePlaceholderExpression(expression); + return parsed.transforms.some(function (transform) { + return transform && transform.name === 'progress'; + }); + } + + function renderProgressPlaceholder(value, expression) { + var parsed = parsePlaceholderExpression(expression); + var transform = parsed.transforms.find(function (candidate) { + return candidate && candidate.name === 'progress'; + }); + if (!transform || !value || typeof value !== 'object' || transform.args.length < 2) { + return ''; + } + + function toNumber(raw) { + if (raw && typeof raw === 'object') { + var numericKeys = ['value', 'amount', 'current', 'total', 'goal', 'raised']; + for (var keyIndex = 0; keyIndex < numericKeys.length; keyIndex += 1) { + var nestedValue = raw[numericKeys[keyIndex]]; + if (nestedValue !== undefined && nestedValue !== null && nestedValue !== raw) { + var nestedNumber = toNumber(nestedValue); + if (Number.isFinite(nestedNumber)) { + return nestedNumber; + } + } + } + return 0; + } + var normalized = String(raw === undefined || raw === null ? '' : raw).replace(/[^0-9.eE+-]/g, ''); + var number = Number(normalized); + return Number.isFinite(number) ? number : 0; + } + + function resolveProgressValue(argument) { + var raw = String(argument === undefined || argument === null ? '' : argument).trim(); + var literal = raw.replace(/^(?:"([\s\S]*)"|'([\s\S]*)')$/, '$1$2'); + if (/^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i.test(literal)) { + return literal; + } + return resolvePath(value, raw); + } + + var startValue = resolveProgressValue(transform.args[0]); + var endValue = resolveProgressValue(transform.args[1]); + var startDate = startValue instanceof Date ? startValue : new Date(startValue); + var endDate = endValue instanceof Date ? endValue : new Date(endValue); + var percentage; + if (typeof startValue === 'string' && typeof endValue === 'string' && /[-T]/.test(startValue) && /[-T]/.test(endValue) && !Number.isNaN(startDate.getTime()) && !Number.isNaN(endDate.getTime()) && endDate.getTime() > startDate.getTime()) { + percentage = Math.max(0, Math.min(100, ((Date.now() - startDate.getTime()) / (endDate.getTime() - startDate.getTime())) * 100)); + } else { + var current = toNumber(startValue); + var goal = toNumber(endValue); + percentage = goal > 0 ? Math.max(0, Math.min(100, (current / goal) * 100)) : 0; + } + var roundedPercentage = Math.round(percentage * 10) / 10; + var label = roundedPercentage + '%'; + var variants = ['primary', 'secondary', 'success', 'danger', 'warning', 'info', 'light', 'dark']; + var variantColors = { + primary: '#0d6efd', + secondary: '#6c757d', + success: '#198754', + danger: '#dc3545', + warning: '#ffc107', + info: '#0dcaf0', + light: '#f8f9fa', + dark: '#212529' + }; + var announcementColors = { + orange: '#c84e10', + amber: '#a56710', + olive: '#5f7f0f', + teal: '#12827d', + sky: '#127caf', + indigo: '#6f60ea', + violet: '#9553db', + fuchsia: '#b347be', + pink: '#cd388d', + navy: '#1d2d4c', + steel: '#3a4860', + slate: '#566577', + graphite: '#32363c', + midnight: '#1e1d2d' + }; + var variant = 'primary'; + var barVariant = ''; + var customColor = ''; + var backgroundColor = ''; + var colorCount = 0; + var modifiers = []; + var textless = false; + var borderRadius = 'var(--bs-border-radius)'; + transform.args.slice(2).forEach(function (argument) { + var option = String(argument || '').trim().toLowerCase(); + var isNamedColor = variants.indexOf(option) !== -1 || Object.prototype.hasOwnProperty.call(announcementColors, option); + var isHexColor = /^#[0-9a-f]{3}(?:[0-9a-f]{3})?$/i.test(option); + if (isNamedColor || isHexColor) { + var color = isHexColor ? option : (variantColors[option] || announcementColors[option]); + if (colorCount === 0) { + if (variants.indexOf(option) !== -1) { + variant = option; + barVariant = option; + } + customColor = color; + } else if (colorCount === 1) { + backgroundColor = color; + } + colorCount += 1; + } + if (option === 'striped' || option === 'animated') { + modifiers.push('progress-bar-' + option); + } + if (option === 'textless') { + textless = true; + } + if (option === 'square') { + borderRadius = '0'; + } else if (option === 'pill') { + borderRadius = '50rem'; + } else if (option === 'rounded') { + borderRadius = 'var(--bs-border-radius)'; + } else { + var radiusMatch = option.match(/^radius\((0|[0-9]+(?:\.[0-9]+)?(?:px|rem|em|%)?)\)$/); + if (radiusMatch) { + borderRadius = radiusMatch[1]; + } + } + }); + var progressClass = 'progress'; + var barClass = 'progress-bar' + (barVariant ? ' bg-' + barVariant : '') + (modifiers.length ? ' ' + modifiers.join(' ') : ''); + var barStyle = 'width:' + roundedPercentage + '%;color:inherit;'; + if (customColor) { + barStyle += 'background-color:' + customColor + ';'; + } + var progressStyleValue = (backgroundColor ? 'background-color:' + backgroundColor + ';' : '') + 'font-size:inherit;--bs-progress-font-size:inherit;--bs-progress-height:1em;height:1em;border-radius:' + borderRadius + ';'; + var progressStyle = progressStyleValue ? ' style="' + progressStyleValue + '"' : ''; + return '' + + '' + (textless ? '' : label) + ''; + } + function formatPlaceholderValue(value) { if (value === undefined || value === null) { return ''; @@ -372,6 +586,8 @@ resolvePlaceholderExpression: resolvePlaceholderExpression, isImagePlaceholderExpression: isImagePlaceholderExpression, getImagePlaceholderConfig: getImagePlaceholderConfig, + isProgressPlaceholderExpression: isProgressPlaceholderExpression, + renderProgressPlaceholder: renderProgressPlaceholder, formatPlaceholderValue: formatPlaceholderValue, collectPlaceholderFieldPaths: collectPlaceholderFieldPaths }; diff --git a/src/web/public/js/slides/slide-form-regions.js b/src/web/public/js/slides/slide-form-regions.js index fa0dcdd..29518cb 100644 --- a/src/web/public/js/slides/slide-form-regions.js +++ b/src/web/public/js/slides/slide-form-regions.js @@ -138,7 +138,7 @@ export function createSlideFormRegionHelpers(options) { ? placeholderChips.renderChip(field) : '{{' + escapeHtml(field) + '}}'; }).join(''); - var transformHint = includeTransformHint === false ? '' : '
Placeholder values support transforms, for example {{title.upper()}}, {{title.title()}}, {{title.lower()}}, {{publishedAt.format("MMM D, YYYY")}}.
'; + var transformHint = includeTransformHint === false ? '' : '
Placeholder values support transforms, for example {{title.upper()}}, {{title.title()}}, {{title.lower()}}, {{publishedAt.format("MMM D, YYYY")}}, or {{amount.multiply(10)}}.
'; if (!overflowFields.length) { return visibleMarkup + transformHint; diff --git a/src/web/public/js/table/table-search.js b/src/web/public/js/table/table-search.js index 689f791..6ae48a0 100644 --- a/src/web/public/js/table/table-search.js +++ b/src/web/public/js/table/table-search.js @@ -129,6 +129,26 @@ input.value = String(currentUrl.searchParams.get(searchParam) || '').trim(); + var searchGroup = input.closest('.table-search-group'); + if (searchGroup) { + var actionButton = searchGroup.parentNode ? searchGroup.parentNode.querySelector('.btn:not(.table-search-group .btn)') : null; + if (actionButton && actionButton.getBoundingClientRect) { + searchGroup.style.setProperty('--table-search-action-offset', (actionButton.getBoundingClientRect().width + 8) + 'px'); + } + var searchToggle = searchGroup.querySelector('[data-table-search-toggle]'); + if (searchToggle) { + searchToggle.addEventListener('click', function () { + focusSearchInput(input); + }); + searchToggle.addEventListener('keydown', function (event) { + if (event.key === 'Enter' || event.key === ' ') { + event.preventDefault(); + focusSearchInput(input); + } + }); + } + } + function updateSearch() { var query = String(input.value || '').trim(); var nextUrl = new URL(window.location.href); diff --git a/src/web/routes/account/password.js b/src/web/routes/account/password.js index 3e02953..34281e8 100644 --- a/src/web/routes/account/password.js +++ b/src/web/routes/account/password.js @@ -33,17 +33,22 @@ module.exports = function renderAccountPage(currentUser, message, returnUrl, all ? 'Use at least ' + requirements.minimumLength + ' characters and include uppercase, lowercase, number, and symbol.' : 'Use at least ' + requirements.minimumLength + ' characters and include ' + requirements.minimumCategories + ' of: uppercase, lowercase, number, and symbol.'; - return renderView('account/password', { + return renderView('account/index', { title: 'My account', active: 'account', currentUser: currentUser || null, message: message || '', username: currentUser ? currentUser.username : '', name: currentUser ? String(currentUser.name || '') : '', + email: currentUser ? String(currentUser.email || '') : '', + emailPending: Boolean(currentUser && currentUser.pending_email), + pendingEmail: currentUser ? String(currentUser.pending_email || '') : '', + emailVerified: Boolean(currentUser && currentUser.email_verified_at), returnUrl: normalizeReturnUrl(returnUrl), allowUserSessionRevocation: Boolean(allowUserSessionRevocation), sessions: Array.isArray(sessions) ? sessions : [], passwordMinimumLength: requirements.minimumLength, - passwordRequirementsText: passwordRequirementsText + passwordRequirementsText: passwordRequirementsText, + scripts: ['js/account/account-page.js'] }); }; \ No newline at end of file diff --git a/src/web/routes/admin/account.js b/src/web/routes/admin/account.js index f7ef555..6191590 100644 --- a/src/web/routes/admin/account.js +++ b/src/web/routes/admin/account.js @@ -1,6 +1,7 @@ // Admin account route registration and profile helpers. const { fetchAppSettings } = require('#src/data/app-settings'); +const { renderAccountEmailTemplate } = require('#src/data/account-email-templates'); module.exports = function registerAccountRoutes(app, deps) { const pool = deps.pool; @@ -18,6 +19,8 @@ module.exports = function registerAccountRoutes(app, deps) { const hashSessionToken = deps.hashSessionToken; const sessionCookieName = deps.sessionCookieName; const recordRequestAuditEvent = deps.recordRequestAuditEvent; + const sendAccountEmail = deps.sendAccountEmail; + const createOneTimeToken = deps.createOneTimeToken; async function getPasswordRequirements() { const settings = await fetchAppSettings(pool); @@ -43,6 +46,29 @@ module.exports = function registerAccountRoutes(app, deps) { }; } + function getRequestOrigin(req) { + const forwardedProto = String(req.headers['x-forwarded-proto'] || req.protocol || 'http').split(',')[0].trim(); + const forwardedHost = String(req.headers['x-forwarded-host'] || req.headers.host || '').split(',')[0].trim(); + return forwardedHost ? forwardedProto + '://' + forwardedHost : ''; + } + + app.post('/account/email', async function (req, res, next) { + try { + const email = String(req.body.email || '').trim().toLowerCase(); + if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) return res.status(400).send('Email address is invalid.'); + const settings = await fetchAppSettings(pool); + if (!settings['email.smtp_enabled'] || typeof sendAccountEmail !== 'function') return res.status(400).send('Email delivery is not configured.'); + const token = createOneTimeToken(); + await pool.query('UPDATE a_users SET pending_email = ?, pending_email_token_hash = ?, pending_email_expires_at = DATE_ADD(NOW(), INTERVAL 30 MINUTE) WHERE id = ?', [email, hashSessionToken(token), req.currentUser.id]); + const url = getRequestOrigin(req) + '/verify-email?token=' + encodeURIComponent(token); + await sendAccountEmail(settings, Object.assign({ to: email }, renderAccountEmailTemplate(settings['email.verification_subject'], settings['email.verification_body'], { url: url, username: req.currentUser.username, display_name: req.currentUser.name, email: email, action_alignment: settings['email.verification_button_alignment'], action_label: settings['email.verification_button_text'] }))); + if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'users', eventType: 'user.email_change_requested', actorUserId: req.currentUser.id, targetType: 'user', targetId: req.currentUser.id, targetLabel: email }); + res.redirect('/account?message=' + encodeURIComponent('Check your new email address for a verification link.')); + } catch (error) { + next(error); + } + }); + app.get('/account', function (req, res) { fetchAppSettings(pool).then(function (settings) { const passwordRequirements = buildPasswordRequirements(settings); @@ -74,6 +100,52 @@ module.exports = function registerAccountRoutes(app, deps) { }); }); + app.post('/account/profile', async function (req, res, next) { + try { + const name = String(req.body.name || '').trim(); + const username = common.validateMaxLength(req.body.username || '', 64, 'Username'); + const email = String(req.body.email || '').trim().toLowerCase(); + const currentPassword = String(req.body.current_password || ''); + if (!name) return res.status(400).send('Name is required.'); + if (!username) return res.status(400).send('Username is required.'); + if (email && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) return res.status(400).send('Email address is invalid.'); + if (!currentPassword) return res.status(400).send('Current password is required.'); + + const [rows] = await pool.query('SELECT id, username, name, email, password_hash, password_salt, password_iterations FROM a_users WHERE id = ? LIMIT 1', [req.currentUser.id]); + const user = rows[0] || null; + if (!user) return res.status(404).send('User not found.'); + if (!verifyPassword(currentPassword, user)) return res.status(400).send('Current password is incorrect.'); + if (username !== user.username && await common.fetchDuplicateName(pool, 'a_users', username, user.id, 'username')) return res.status(400).send('That username already exists.'); + if (name !== user.name && await common.fetchDuplicateName(pool, 'a_users', name, user.id)) return res.status(400).send('That name already exists.'); + + const confirmedEmail = String(user.email || '').trim().toLowerCase(); + const pendingEmail = String(user.pending_email || '').trim().toLowerCase(); + const emailChanged = email !== confirmedEmail && email !== pendingEmail; + const pendingEmailCleared = Boolean(pendingEmail && email === confirmedEmail); + const settings = emailChanged ? await fetchAppSettings(pool) : null; + if (emailChanged && email && (!settings['email.smtp_enabled'] || typeof sendAccountEmail !== 'function')) return res.status(400).send('Email delivery is not configured.'); + + const actorId = getAuditUserId(req); + await pool.query('UPDATE a_users SET username = ?, name = ?, modified_by = ? WHERE id = ?', [username, name, actorId, user.id]); + if (emailChanged || pendingEmailCleared) { + if (!email) { + await pool.query('UPDATE a_users SET email = NULL, email_verified_at = NULL, pending_email = NULL, pending_email_token_hash = NULL, pending_email_expires_at = NULL WHERE id = ?', [user.id]); + } else if (pendingEmailCleared) { + await pool.query('UPDATE a_users SET pending_email = NULL, pending_email_token_hash = NULL, pending_email_expires_at = NULL WHERE id = ?', [user.id]); + } else { + const token = createOneTimeToken(); + await pool.query('UPDATE a_users SET pending_email = ?, pending_email_token_hash = ?, pending_email_expires_at = DATE_ADD(NOW(), INTERVAL 30 MINUTE) WHERE id = ?', [email, hashSessionToken(token), user.id]); + const url = getRequestOrigin(req) + '/verify-email?token=' + encodeURIComponent(token); + await sendAccountEmail(settings, Object.assign({ to: email }, renderAccountEmailTemplate(settings['email.verification_subject'], settings['email.verification_body'], { url: url, username: req.currentUser.username, display_name: req.currentUser.name, email: email, action_alignment: settings['email.verification_button_alignment'], action_label: settings['email.verification_button_text'] }))); + } + } + if (emailChanged && typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'users', eventType: email ? 'user.email_change_requested' : 'user.email_cleared', actorUserId: user.id, targetType: 'user', targetId: user.id, targetLabel: email || user.email, details: { previousEmail: confirmedEmail || null, email: email || null, verificationRequired: Boolean(email) } }); + res.redirect('/account?message=' + encodeURIComponent(emailChanged && email ? 'Account details updated. Check your new email address for a verification link.' : 'Account details updated.')); + } catch (error) { + next(error); + } + }); + app.post('/account/sessions/:id/revoke', async function (req, res, next) { try { const sessionId = Number(req.params.id); @@ -161,6 +233,26 @@ module.exports = function registerAccountRoutes(app, deps) { } }); + app.post('/account/username', async function (req, res, next) { + try { + const username = common.validateMaxLength(req.body.username || '', 255, 'Username'); + const currentPassword = String(req.body.current_password || ''); + if (!username) return res.status(400).send('Username is required.'); + if (!currentPassword) return res.status(400).send('Current password is required.'); + const [rows] = await pool.query('SELECT id, username, password_hash, password_salt, password_iterations FROM a_users WHERE id = ? LIMIT 1', [req.currentUser.id]); + const user = rows[0] || null; + if (!user) return res.status(404).send('User not found.'); + if (!verifyPassword(currentPassword, user)) return res.status(400).send('Current password is incorrect.'); + const [existingRows] = await pool.query('SELECT id FROM a_users WHERE username = ? AND id <> ? LIMIT 1', [username, user.id]); + if (existingRows.length) return res.status(400).send('That username already exists.'); + await pool.query('UPDATE a_users SET username = ?, modified_by = ? WHERE id = ?', [username, getAuditUserId(req), user.id]); + if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'users', eventType: 'user.username_updated', actorUserId: user.id, targetType: 'user', targetId: user.id, targetLabel: username, details: { previousUsername: user.username, username: username } }); + res.redirect('/account?message=' + encodeURIComponent('Username updated.')); + } catch (error) { + next(error); + } + }); + app.post('/account/password', async function (req, res, next) { try { const currentPassword = String(req.body.current_password || ''); diff --git a/src/web/routes/admin/client-commands.js b/src/web/routes/admin/client-commands.js index f0c2426..857bef6 100644 --- a/src/web/routes/admin/client-commands.js +++ b/src/web/routes/admin/client-commands.js @@ -14,6 +14,21 @@ module.exports = function registerScreenCommandRoutes(app, deps) { const withClientNameReservation = deps.withClientNameReservation; const broadcastDashboardState = deps.broadcastDashboardState; const requirePermission = deps.requirePermission; + const recordRequestAuditEvent = deps.recordRequestAuditEvent; + + async function recordScreenControlAudit(req, screenSlug, command, details) { + if (typeof recordRequestAuditEvent !== 'function') { + return; + } + await recordRequestAuditEvent(pool, req, { + category: 'screen-controls', + eventType: 'screen-control.' + command, + actorUserId: req.currentUser && req.currentUser.id, + targetType: screenSlug === '__all__' ? 'all-screens' : 'screen', + targetLabel: screenSlug === '__all__' ? 'All screens' : screenSlug, + details: details || {} + }); + } function normalizeExplicitPlayerBaseUrl(value) { return String(value || '').trim().replace(/\/$/, ''); @@ -250,6 +265,13 @@ module.exports = function registerScreenCommandRoutes(app, deps) { await broadcastDashboardState(); } + await recordScreenControlAudit(req, '__all__', command, { + targetScreenCount: targets.length, + targetPlayerCount: sentCount, + blackout: command === 'blackout' ? Boolean(commandPayload.blackout) : undefined, + paused: command === 'pause' ? Boolean(commandPayload.paused) : undefined + }); + return res.json({ ok: true, allScreens: true, @@ -364,6 +386,8 @@ module.exports = function registerScreenCommandRoutes(app, deps) { await broadcastDashboardState(); } + await recordScreenControlAudit(req, slug, command, { clientName: selectedClientName, deviceId: deviceId }); + return res.json({ screen: screenRows[0], screenSlug: slug, @@ -386,6 +410,8 @@ module.exports = function registerScreenCommandRoutes(app, deps) { return res.status(404).json({ error: 'Client not found' }); } + await recordScreenControlAudit(req, slug, command, { clientName: selectedClientName, deviceId: deviceId }); + return res.json({ screen: screenRows[0], screenSlug: slug, @@ -604,6 +630,13 @@ module.exports = function registerScreenCommandRoutes(app, deps) { await broadcastDashboardState(); } + await recordScreenControlAudit(req, slug, command, { + connectionId: connectionId || null, + deviceId: physicalPlayerId, + targetScreenSlug: targetScreenSlug, + clientName: status ? status.client_name : resolvedClientName + }); + return res.json({ screen: screenRows[0], screenSlug: slug, @@ -645,6 +678,12 @@ module.exports = function registerScreenCommandRoutes(app, deps) { await broadcastDashboardState(); } + await recordScreenControlAudit(req, slug, command, { + connectionId: connectionId || null, + blackout: command === 'blackout' ? Boolean(commandPayload.blackout) : undefined, + paused: command === 'pause' ? Boolean(commandPayload.paused) : undefined + }); + return res.json(Object.assign({ screen: screenRows[0], screenSlug: slug, diff --git a/src/web/routes/admin/users.js b/src/web/routes/admin/users.js index 0a9e8fb..8c824c5 100644 --- a/src/web/routes/admin/users.js +++ b/src/web/routes/admin/users.js @@ -1,6 +1,7 @@ // Admin user route registration and user-role management. const { fetchAppSettings } = require('#src/data/app-settings'); + const { renderAccountEmailTemplate } = require('#src/data/account-email-templates'); const { buildAuditChanges } = require('#src/data/audit-log'); module.exports = function registerUsersRoutes(app, deps) { @@ -10,6 +11,10 @@ const formatDashboardDate = deps.formatDashboardDate; const getAuditUserId = deps.getAuditUserId; const recordRequestAuditEvent = deps.recordRequestAuditEvent; + const sendAccountEmail = deps.sendAccountEmail; + const createOneTimeToken = deps.createOneTimeToken; + const hashSessionToken = deps.hashSessionToken; + const getRequestOrigin = deps.getRequestOrigin; const hashPassword = deps.hashPassword; const validatePasswordStrength = deps.validatePasswordStrength; const readArrayField = deps.readArrayField; @@ -20,6 +25,8 @@ const USER_NAME_MAX_LENGTH = 255; const USER_USERNAME_MAX_LENGTH = 255; + const USER_EMAIL_MAX_LENGTH = 320; + const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/; const LIST_PAGE_SIZE = 25; @@ -78,6 +85,23 @@ return { ok: true, roleIds: normalizedRoleIds }; } + function mapInvitationForView(invitation, roleNamesById) { + let roleIds = []; + try { + roleIds = JSON.parse(invitation.role_ids_json || '[]'); + } catch (error) { + roleIds = []; + } + return Object.assign({}, invitation, { + roleNames: roleIds.map(function (roleId) { + return roleNamesById.get(Number(roleId)); + }).filter(Boolean).join(', ') || 'No roles assigned', + createdAtLabel: formatDashboardDate(invitation.created_at), + expiresAtLabel: formatDashboardDate(invitation.expires_at), + createdByLabel: invitation.created_by_username || 'System' + }); + } + app.get('/settings/users', requirePermission('users.read'), async function (req, res, next) { try { const page = Math.max(1, Math.floor(Number(req.query.page) || 1)); @@ -102,6 +126,76 @@ } }); + app.get('/settings/invitations', requirePermission('invitations.read'), async function (req, res, next) { + try { + const page = Math.max(1, Math.floor(Number(req.query.page) || 1)); + const search = common.getSearchQuery(req); + const sort = common.getSortQuery(req); + const direction = common.getSortDirectionQuery(req); + const data = await rbacData.fetchInvitationsPage(pool, page, LIST_PAGE_SIZE, search, sort, direction); + const roles = await fetchRoleOptions(); + const roleNamesById = new Map((roles || []).map(function (role) { + return [Number(role.id), role.name]; + })); + const invitations = (data.invitations || []).map(function (invitation) { + return mapInvitationForView(invitation, roleNamesById); + }); + res.send(pages.renderInvitationsPage({ + invitations: invitations, + pagination: buildPagination(data.totalItems, data.currentPage, 'page', { search: search, sort: sort, direction: direction }, LIST_PAGE_SIZE, 'invitations', 'Invitation pages'), + message: req.query.message ? String(req.query.message) : '' + }, req.currentUser)); + } catch (error) { + next(error); + } + }); + + app.post('/settings/invitations/:id/delete', requirePermission('invitations.delete'), async function (req, res, next) { + try { + const invitationId = Number(req.params.id); + if (!Number.isInteger(invitationId) || invitationId <= 0) { + return res.status(400).send('Invalid invitation.'); + } + const [result] = await pool.query('DELETE FROM a_user_invitations WHERE id = ? AND used_at IS NULL', [invitationId]); + if (!result || !result.affectedRows) { + return res.status(404).send('Invitation not found.'); + } + if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'users', eventType: 'user.invitation_deleted', actorUserId: getAuditUserId(req), targetType: 'invitation', targetId: invitationId }); + res.redirect('/settings/invitations?message=' + encodeURIComponent('Invitation deleted.')); + } catch (error) { + next(error); + } + }); + + app.post('/settings/invitations/:id/resend', requirePermission('invitations.allow'), async function (req, res, next) { + try { + const invitationId = Number(req.params.id); + if (!Number.isInteger(invitationId) || invitationId <= 0) { + return res.status(400).send('Invalid invitation.'); + } + if (typeof sendAccountEmail !== 'function' || typeof createOneTimeToken !== 'function' || typeof hashSessionToken !== 'function') { + return res.status(503).send('Email delivery is not available.'); + } + const settings = await fetchAppSettings(pool); + if (!settings['email.smtp_enabled']) { + return res.status(503).send('Email delivery is not configured.'); + } + const [rows] = await pool.query('SELECT email, name, role_ids_json FROM a_user_invitations WHERE id = ? AND used_at IS NULL AND expires_at > NOW() LIMIT 1', [invitationId]); + if (!rows.length) { + return res.status(404).send('Invitation not found.'); + } + const invitation = rows[0]; + const token = createOneTimeToken(); + const invitationUrl = getRequestOrigin(req) + '/accept-invite?token=' + encodeURIComponent(token); + await sendAccountEmail(settings, Object.assign({ to: invitation.email }, renderAccountEmailTemplate(settings['email.invitation_subject'], settings['email.invitation_body'], { url: invitationUrl, username: '', display_name: invitation.name || 'there', email: invitation.email, action_alignment: settings['email.invitation_button_alignment'], action_label: settings['email.invitation_button_text'] }))); + await pool.query('UPDATE a_user_invitations SET token_hash = ?, expires_at = DATE_ADD(NOW(), INTERVAL 24 HOUR), created_at = NOW(), created_by = ? WHERE id = ? AND used_at IS NULL', [hashSessionToken(token), getAuditUserId(req), invitationId]); + if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'users', eventType: 'user.invitation_resent', actorUserId: getAuditUserId(req), targetType: 'invitation', targetId: invitationId, targetLabel: invitation.email }); + res.redirect('/settings/invitations?message=' + encodeURIComponent('Invitation resent.')); + } catch (error) { + next(error); + } + }); + app.get('/settings/users/new', requirePermission('users.create'), function (req, res) { fetchRoleOptions().then(function (roles) { res.send(pages.renderUsersAddPage(req.query.message ? String(req.query.message) : '', req.currentUser, mapRolesForForm(roles, []), {}, 'primary')); @@ -110,6 +204,53 @@ }); }); + app.get('/settings/users/invite', requirePermission('invitations.create'), async function (req, res, next) { + try { + const roles = await fetchRoleOptions(); + res.send(pages.renderUsersInvitePage('', req.currentUser, mapRolesForForm(roles, []), {}, 'success')); + } catch (error) { + next(error); + } + }); + + app.post('/settings/users/invite', requirePermission('invitations.create'), async function (req, res, next) { + try { + const email = common.validateMaxLength(req.body.email || '', USER_EMAIL_MAX_LENGTH, 'Email').toLowerCase(); + const name = common.validateMaxLength(req.body.name || '', USER_NAME_MAX_LENGTH, 'Name'); + const selectedRoleIds = readArrayField(req.body, ['role_ids[]', 'role_ids']); + const roleCheck = await validateRoleIds(selectedRoleIds); + const formValues = { email: email, name: name }; + async function renderInviteError(message) { + const roles = await fetchRoleOptions(); + return res.status(400).send(pages.renderUsersInvitePage(message, req.currentUser, mapRolesForForm(roles, selectedRoleIds), formValues, 'warning')); + } + if (!email || !EMAIL_PATTERN.test(email)) return renderInviteError('Email address is invalid.'); + if (!name) return renderInviteError('Display name is required.'); + if (!roleCheck.ok) return renderInviteError(roleCheck.message); + if (typeof sendAccountEmail !== 'function' || typeof createOneTimeToken !== 'function' || typeof hashSessionToken !== 'function') return renderInviteError('Email delivery is not available.'); + const settings = await fetchAppSettings(pool); + if (!settings['email.smtp_enabled']) return renderInviteError('Email delivery is not configured.'); + const [existingUsers] = await pool.query('SELECT id FROM a_users WHERE email = ? OR pending_email = ? LIMIT 1', [email, email]); + if (existingUsers.length) return renderInviteError('That email address is already associated with an account.'); + const [recentInvites] = await pool.query('SELECT COUNT(*) AS invite_count FROM a_user_invitations WHERE created_by = ? AND created_at > DATE_SUB(NOW(), INTERVAL 1 HOUR)', [getAuditUserId(req)]); + if (Number(recentInvites[0] && recentInvites[0].invite_count) >= 25) return renderInviteError('Invitation sending is temporarily limited. Try again later.'); + const token = createOneTimeToken(); + await pool.query('UPDATE a_user_invitations SET used_at = NOW() WHERE email = ? AND used_at IS NULL', [email]); + await pool.query('INSERT INTO a_user_invitations (email, name, role_ids_json, token_hash, expires_at, created_by) VALUES (?, ?, ?, ?, DATE_ADD(NOW(), INTERVAL 24 HOUR), ?)', [email, name || null, JSON.stringify(roleCheck.roleIds), hashSessionToken(token), getAuditUserId(req)]); + const invitationUrl = getRequestOrigin(req) + '/accept-invite?token=' + encodeURIComponent(token); + try { + await sendAccountEmail(settings, Object.assign({ to: email }, renderAccountEmailTemplate(settings['email.invitation_subject'], settings['email.invitation_body'], { url: invitationUrl, username: '', display_name: name || 'there', email: email, action_alignment: settings['email.invitation_button_alignment'], action_label: settings['email.invitation_button_text'] }))); + } catch (mailError) { + await pool.query('DELETE FROM a_user_invitations WHERE token_hash = ?', [hashSessionToken(token)]); + throw mailError; + } + if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'users', eventType: 'user.invitation_sent', actorUserId: getAuditUserId(req), targetType: 'email', targetLabel: email, details: { roleIds: roleCheck.roleIds } }); + res.redirect('/settings/users?message=' + encodeURIComponent('Invitation sent.')); + } catch (error) { + next(error); + } + }); + app.get('/settings/users/:id/duplicate', requirePermission('users.read'), requirePermission('users.create'), async function (req, res, next) { try { const userId = Number(req.params.id); @@ -222,6 +363,7 @@ try { const name = common.validateMaxLength(req.body.name || '', USER_NAME_MAX_LENGTH, 'Name'); const username = common.validateMaxLength(req.body.username || '', USER_USERNAME_MAX_LENGTH, 'Username'); + const email = common.validateMaxLength(req.body.email || '', USER_EMAIL_MAX_LENGTH, 'Email').toLowerCase(); const password = String(req.body.password || ''); const confirmPassword = String(req.body.confirm_password || ''); const saveAction = String(req.body.save_action || req.body.action || '').trim().toLowerCase(); @@ -229,7 +371,8 @@ const roleCheck = await validateRoleIds(selectedRoleIds); const formValues = { username: username, - name: name + name: name, + email: email }; async function renderValidationError(message) { @@ -243,6 +386,9 @@ if (!username) { return renderValidationError('Username is required.'); } + if (email && !EMAIL_PATTERN.test(email)) { + return renderValidationError('Email address is invalid.'); + } const passwordStrengthMessage = validatePasswordStrength(password, await getPasswordRequirements()); if (passwordStrengthMessage) { return renderValidationError(passwordStrengthMessage); @@ -267,8 +413,8 @@ const actorId = getAuditUserId(req); await connection.beginTransaction(); const [result] = await connection.query( - 'INSERT INTO a_users (name, username, password_hash, password_salt, password_iterations, must_change_password, created_by, modified_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?)', - [name, username, passwordRecord.hash, passwordRecord.salt, passwordRecord.iterations, mustChangePassword ? 1 : 0, actorId, actorId] + 'INSERT INTO a_users (name, username, email, password_hash, password_salt, password_iterations, must_change_password, created_by, modified_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)', + [name, username, email || null, passwordRecord.hash, passwordRecord.salt, passwordRecord.iterations, mustChangePassword ? 1 : 0, actorId, actorId] ); await rbacData.syncUserRoles(connection, result.insertId, roleCheck.roleIds); await connection.commit(); @@ -364,7 +510,9 @@ } const username = common.validateMaxLength(req.body.username || user.username || '', USER_USERNAME_MAX_LENGTH, 'Username'); + const email = common.validateMaxLength(req.body.email || '', USER_EMAIL_MAX_LENGTH, 'Email').toLowerCase(); const accountLocked = req.body.account_locked === '1' || (Array.isArray(req.body.account_locked) && req.body.account_locked.includes('1')); + const emailVerified = req.body.email_verified === '1' || (Array.isArray(req.body.email_verified) && req.body.email_verified.includes('1')); const [countRows] = await pool.query('SELECT COUNT(*) AS user_count FROM a_users'); const canDelete = !countRows.length || Number(countRows[0].user_count) > 1; @@ -386,6 +534,9 @@ if (!username) { return renderValidationError('Username is required.'); } + if (email && !EMAIL_PATTERN.test(email)) { + return renderValidationError('Email address is invalid.'); + } if (shouldUpdatePassword) { const passwordStrengthMessage = validatePasswordStrength(password, await getPasswordRequirements()); if (passwordStrengthMessage) { @@ -410,12 +561,14 @@ const changes = buildAuditChanges({ name: user.name, username: user.username, + email: user.email || '', roleIds: user.roleIds, accountLocked: Boolean(user.account_locked), passwordReset: false }, { name: name, username: username, + email: email, roleIds: roleCheck.roleIds, accountLocked: accountLocked, passwordReset: shouldUpdatePassword @@ -426,6 +579,10 @@ await connection.rollback(); return res.status(404).send('User not found.'); } + await connection.query('UPDATE a_users SET email = ?, email_verified_at = CASE WHEN email = ? THEN email_verified_at ELSE NULL END, modified_by = ? WHERE id = ?', [email || null, email || null, getAuditUserId(req), userId]); + if (emailVerified && email && (await fetchAppSettings(pool))['security.allow_admin_email_verification_bypass']) { + await connection.query('UPDATE a_users SET email_verified_at = NOW() WHERE id = ? AND email = ?', [userId, email]); + } await rbacData.syncUserRoles(connection, userId, roleCheck.roleIds); if (accountLocked) { await connection.query('DELETE FROM a_sessions WHERE user_id = ?', [userId]); @@ -471,6 +628,17 @@ details: { source: 'administrator' } }); } + if (emailVerified && !user.email_verified_at && email) { + await recordRequestAuditEvent(pool, req, { + category: 'security', + eventType: 'email.verification_bypassed', + actorUserId: req.currentUser.id, + targetType: 'user', + targetId: userId, + targetLabel: username, + details: { source: 'administrator' } + }); + } } if (saveAction === 'new') { return res.redirect('/settings/users/new?message=' + encodeURIComponent('User updated.')); diff --git a/src/web/routes/auth/accept-invite.js b/src/web/routes/auth/accept-invite.js new file mode 100644 index 0000000..2641a6a --- /dev/null +++ b/src/web/routes/auth/accept-invite.js @@ -0,0 +1,27 @@ +const { renderView } = require('../../view'); + +module.exports = function renderAcceptInvitePage(message, token, email, name, passwordRequirements, isValidInvitation) { + const requirements = passwordRequirements || { minimumLength: 10, minimumCategories: 3, requireLowercase: false, requireUppercase: false, requireNumber: false, requireSymbol: false }; + const requiredCategories = []; + if (requirements.requireLowercase) requiredCategories.push('lowercase'); + if (requirements.requireUppercase) requiredCategories.push('uppercase'); + if (requirements.requireNumber) requiredCategories.push('number'); + if (requirements.requireSymbol) requiredCategories.push('symbol'); + const passwordRequirementsText = requiredCategories.length + ? 'Use at least ' + requirements.minimumLength + ' characters and include ' + requiredCategories.join(', ') + '.' + : requirements.minimumCategories === 4 + ? 'Use at least ' + requirements.minimumLength + ' characters and include uppercase, lowercase, number, and symbol.' + : 'Use at least ' + requirements.minimumLength + ' characters and include ' + requirements.minimumCategories + ' of: uppercase, lowercase, number, and symbol.'; + return renderView('auth/accept-invite', { + title: 'Accept invitation', + authShell: true, + bodyClass: 'login-page-body', + message: message || '', + isValidInvitation: Boolean(isValidInvitation), + token: token || '', + email: email || '', + name: name || '', + passwordMinimumLength: requirements.minimumLength, + passwordRequirementsText: passwordRequirementsText + }); +}; diff --git a/src/web/routes/auth/email-verification-error.js b/src/web/routes/auth/email-verification-error.js new file mode 100644 index 0000000..b311968 --- /dev/null +++ b/src/web/routes/auth/email-verification-error.js @@ -0,0 +1,5 @@ +const { renderView } = require('../../view'); + +module.exports = function renderEmailVerificationErrorPage(message) { + return renderView('auth/email-verification-error', { title: 'Verification link unavailable', authShell: true, bodyClass: 'login-page-body', message: message || 'This email verification link is invalid or has expired.' }); +}; diff --git a/src/web/routes/auth/email-verified.js b/src/web/routes/auth/email-verified.js new file mode 100644 index 0000000..c43f19f --- /dev/null +++ b/src/web/routes/auth/email-verified.js @@ -0,0 +1,5 @@ +const { renderView } = require('../../view'); + +module.exports = function renderEmailVerifiedPage() { + return renderView('auth/email-verified', { title: 'Email verified', authShell: true, bodyClass: 'login-page-body' }); +}; diff --git a/src/web/routes/auth/forgot-password.js b/src/web/routes/auth/forgot-password.js new file mode 100644 index 0000000..55c11c0 --- /dev/null +++ b/src/web/routes/auth/forgot-password.js @@ -0,0 +1,5 @@ +const { renderView } = require('../../view'); + +module.exports = function renderForgotPasswordPage(message) { + return renderView('auth/forgot-password', { title: 'Reset password', authShell: true, bodyClass: 'login-page-body', message: message || '' }); +}; \ No newline at end of file diff --git a/src/web/routes/auth/index.js b/src/web/routes/auth/index.js index 45954a1..6f47f02 100644 --- a/src/web/routes/auth/index.js +++ b/src/web/routes/auth/index.js @@ -2,6 +2,7 @@ const { normalizeReturnToPath, getRequestOrigin } = require('../../lib/auth/session'); const { fetchAppSettings } = require('#src/data/app-settings'); +const { renderAccountEmailTemplate } = require('#src/data/account-email-templates'); module.exports = function registerAuthRoutes(app, deps) { const pool = deps.pool; @@ -17,6 +18,10 @@ module.exports = function registerAuthRoutes(app, deps) { const verifyPassword = deps.verifyPassword; const sessionCookieName = deps.sessionCookieName; const recordRequestAuditEvent = deps.recordRequestAuditEvent; + const sendAccountEmail = deps.sendAccountEmail; + const createOneTimeToken = deps.createOneTimeToken; + const getConnection = deps.getConnection; + const rbacData = deps.rbacData; function getReturnTo(req) { return normalizeReturnToPath(req && (req.query && req.query.returnTo || req.body && req.body.returnTo), getRequestOrigin(req)); @@ -77,6 +82,141 @@ module.exports = function registerAuthRoutes(app, deps) { await pool.query('DELETE FROM a_login_attempts WHERE rate_key = ?', [rateKey]); } + async function getPasswordRequirements() { + const settings = await fetchAppSettings(pool); + return { + minimumLength: settings['security.password_min_length'], + minimumCategories: settings['security.password_min_categories'], + requireLowercase: settings['security.password_require_lowercase'], + requireUppercase: settings['security.password_require_uppercase'], + requireNumber: settings['security.password_require_number'], + requireSymbol: settings['security.password_require_symbol'] + }; + } + + app.get('/accept-invite', async function (req, res, next) { + try { + const token = String(req.query.token || '').trim(); + const [rows] = await pool.query('SELECT email, name FROM a_user_invitations WHERE token_hash = ? AND used_at IS NULL AND expires_at > NOW() LIMIT 1', [hashSessionToken(token)]); + const invitation = rows[0] || null; + if (!invitation) return res.status(400).send(pages.renderAcceptInvitePage('This invitation is invalid or has expired.', token, '', '', await getPasswordRequirements(), false)); + res.send(pages.renderAcceptInvitePage('', token, invitation.email, invitation.name, await getPasswordRequirements(), true)); + } catch (error) { + next(error); + } + }); + + app.post('/accept-invite', async function (req, res, next) { + const connection = typeof getConnection === 'function' ? await getConnection() : pool; + try { + const token = String(req.body.token || '').trim(); + const username = String(req.body.username || '').trim(); + const name = String(req.body.name || '').trim(); + const password = String(req.body.password || ''); + const confirmPassword = String(req.body.confirm_password || ''); + const [rows] = await connection.query('SELECT id, email, name, role_ids_json FROM a_user_invitations WHERE token_hash = ? AND used_at IS NULL AND expires_at > NOW() LIMIT 1', [hashSessionToken(token)]); + const invitation = rows[0] || null; + const requirements = await getPasswordRequirements(); + const renderError = function (message) { return res.status(400).send(pages.renderAcceptInvitePage(message, token, invitation ? invitation.email : '', name || (invitation && invitation.name) || '', requirements, Boolean(invitation))); }; + if (!invitation) return renderError('This invitation is invalid or has expired.'); + if (!username) return renderError('Username is required.'); + if (!name) return renderError('Name is required.'); + const [existingUsers] = await connection.query('SELECT id FROM a_users WHERE username = ? LIMIT 1', [username]); + if (existingUsers.length) return renderError('That username already exists.'); + const strengthMessage = deps.validatePasswordStrength(password, requirements); + if (strengthMessage) return renderError(strengthMessage); + if (password !== confirmPassword) return renderError('Passwords do not match.'); + const passwordRecord = deps.hashPassword(password); + const roleIds = JSON.parse(invitation.role_ids_json || '[]'); + await connection.beginTransaction(); + const [result] = await connection.query('INSERT INTO a_users (name, username, email, email_verified_at, password_hash, password_salt, password_iterations, created_by, modified_by) VALUES (?, ?, ?, NOW(), ?, ?, ?, NULL, NULL)', [name, username, invitation.email, passwordRecord.hash, passwordRecord.salt, passwordRecord.iterations]); + if (rbacData && typeof rbacData.syncUserRoles === 'function') await rbacData.syncUserRoles(connection, result.insertId, roleIds); + await connection.query('UPDATE a_user_invitations SET used_at = NOW() WHERE id = ? AND used_at IS NULL', [invitation.id]); + await connection.commit(); + if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'users', eventType: 'user.invitation_accepted', targetType: 'user', targetId: result.insertId, targetLabel: username, details: { invitationId: invitation.id } }); + res.redirect('/login?message=' + encodeURIComponent('Account created. You can now sign in.')); + } catch (error) { + try { await connection.rollback(); } catch (_rollbackError) {} + next(error); + } finally { + if (connection !== pool && connection && typeof connection.release === 'function') connection.release(); + } + }); + + app.get('/forgot-password', function (req, res) { + res.send(pages.renderForgotPasswordPage('')); + }); + + app.post('/forgot-password', async function (req, res, next) { + try { + const identity = String(req.body.identity || '').trim(); + const genericMessage = 'If that account has a verified email address, a reset link has been sent.'; + const [rows] = await pool.query('SELECT id, name, username, email FROM a_users WHERE username = ? OR (email = ? AND email_verified_at IS NOT NULL) LIMIT 1', [identity, identity.toLowerCase()]); + const user = rows[0] || null; + const settings = await fetchAppSettings(pool); + if (user && user.email && user.email_verified_at && typeof sendAccountEmail === 'function' && typeof createOneTimeToken === 'function') { + const token = createOneTimeToken(); + await pool.query('DELETE FROM a_account_tokens WHERE user_id = ? AND token_type = ?', [user.id, 'password-reset']); + await pool.query('INSERT INTO a_account_tokens (user_id, token_type, token_hash, expires_at) VALUES (?, ?, ?, DATE_ADD(NOW(), INTERVAL 30 MINUTE))', [user.id, 'password-reset', hashSessionToken(token)]); + const resetUrl = getRequestOrigin(req) + '/reset-password?token=' + encodeURIComponent(token); + try { + await sendAccountEmail(settings, Object.assign({ to: user.email }, renderAccountEmailTemplate(settings['email.reset_subject'], settings['email.reset_body'], { url: resetUrl, username: user.username, display_name: user.name, email: user.email, action_alignment: settings['email.reset_button_alignment'], action_label: settings['email.reset_button_text'] }))); + if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'security', eventType: 'password.reset_requested', targetType: 'user', targetId: user.id, targetLabel: user.username }); + } catch (_mailError) { + await pool.query('DELETE FROM a_account_tokens WHERE token_hash = ?', [hashSessionToken(token)]); + } + } + res.send(pages.renderForgotPasswordPage(genericMessage)); + } catch (error) { + next(error); + } + }); + + app.get('/reset-password', async function (req, res, next) { + try { + const token = String(req.query.token || '').trim(); + if (!token) return res.redirect('/forgot-password'); + res.send(pages.renderResetPasswordPage('', token, await getPasswordRequirements())); + } catch (error) { + next(error); + } + }); + + app.post('/reset-password', async function (req, res, next) { + try { + const token = String(req.body.token || ''); + const password = String(req.body.password || ''); + const confirmPassword = String(req.body.confirm_password || ''); + const [rows] = await pool.query('SELECT t.id AS token_id, t.user_id, u.username, u.email FROM a_account_tokens t JOIN a_users u ON u.id = t.user_id WHERE t.token_hash = ? AND t.token_type = ? AND t.used_at IS NULL AND t.expires_at > NOW() LIMIT 1', [hashSessionToken(token), 'password-reset']); + const record = rows[0] || null; + if (!record) return res.status(400).send(pages.renderResetPasswordPage('This reset link is invalid or has expired.', token, await getPasswordRequirements())); + const strengthMessage = deps.validatePasswordStrength(password, await getPasswordRequirements()); + if (strengthMessage || password !== confirmPassword) return res.status(400).send(pages.renderResetPasswordPage(strengthMessage || 'Passwords do not match.', token, await getPasswordRequirements())); + const passwordRecord = deps.hashPassword(password); + await pool.query('UPDATE a_users SET password_hash = ?, password_salt = ?, password_iterations = ?, must_change_password = 0, modified_at = CURRENT_TIMESTAMP WHERE id = ?', [passwordRecord.hash, passwordRecord.salt, passwordRecord.iterations, record.user_id]); + await pool.query('UPDATE a_account_tokens SET used_at = NOW() WHERE id = ?', [record.token_id]); + await pool.query('DELETE FROM a_sessions WHERE user_id = ?', [record.user_id]); + if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'security', eventType: 'password.reset', targetType: 'user', targetId: record.user_id, targetLabel: record.username, details: { source: 'email' } }); + res.redirect('/login?message=' + encodeURIComponent('Password updated. You can now sign in.')); + } catch (error) { + next(error); + } + }); + + app.get('/verify-email', async function (req, res, next) { + try { + const tokenHash = hashSessionToken(String(req.query.token || '')); + const [rows] = await pool.query('SELECT id FROM a_users WHERE pending_email_token_hash = ? AND pending_email_expires_at > NOW() LIMIT 1', [tokenHash]); + const user = rows[0] || null; + if (!user) return res.status(400).send(pages.renderEmailVerificationErrorPage('This email verification link is invalid or has expired.')); + await pool.query('UPDATE a_users SET email = pending_email, email_verified_at = NOW(), pending_email = NULL, pending_email_token_hash = NULL, pending_email_expires_at = NULL WHERE id = ?', [user.id]); + if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'security', eventType: 'email.verification_completed', targetType: 'user', targetId: user.id }); + res.send(pages.renderEmailVerifiedPage()); + } catch (error) { + next(error); + } + }); + app.get('/', function (req, res) { res.redirect(req.currentUser ? '/dashboard' : '/login'); }); @@ -90,7 +230,11 @@ module.exports = function registerAuthRoutes(app, deps) { const message = typeof consumeAuthMessageCookie === 'function' ? consumeAuthMessageCookie(req, res) : (req.query.message ? String(req.query.message) : ''); - res.send(pages.renderLoginPage(message, returnTo, req.query.username ? String(req.query.username) : '')); + fetchAppSettings(pool).then(function (settings) { + res.send(pages.renderLoginPage(message, returnTo, req.query.username ? String(req.query.username) : '', Boolean(settings['email.smtp_enabled']))); + }).catch(function (error) { + res.status(500).send(error.message || 'Unable to load login settings.'); + }); }); app.post('/login', async function (req, res, next) { @@ -123,8 +267,12 @@ module.exports = function registerAuthRoutes(app, deps) { return res.status(401).send(pages.renderLoginPage(message, returnTo, username)); } - const [rows] = await pool.query('SELECT id, name, username, password_hash, password_salt, password_iterations, account_locked FROM a_users WHERE username = ? LIMIT 1', [username]); - const user = rows[0] || null; + const [usernameRows] = await pool.query('SELECT id, name, username, password_hash, password_salt, password_iterations, account_locked FROM a_users WHERE username = ? LIMIT 1', [username]); + let user = usernameRows[0] || null; + if (!user) { + const [emailRows] = await pool.query('SELECT id, name, username, password_hash, password_salt, password_iterations, account_locked FROM a_users WHERE email = ? AND email_verified_at IS NOT NULL LIMIT 1', [username.toLowerCase()]); + user = emailRows[0] || null; + } if (user && user.account_locked) { if (typeof recordRequestAuditEvent === 'function') { await recordRequestAuditEvent(pool, req, { diff --git a/src/web/routes/auth/login.js b/src/web/routes/auth/login.js index 7b0d8b9..7a0c9aa 100644 --- a/src/web/routes/auth/login.js +++ b/src/web/routes/auth/login.js @@ -2,7 +2,7 @@ const { renderView } = require('../../view'); -module.exports = function renderLoginPage(message, returnTo, username) { +module.exports = function renderLoginPage(message, returnTo, username, showForgotPassword) { return renderView('auth/login', { title: 'Sign in', authShell: true, @@ -10,6 +10,7 @@ module.exports = function renderLoginPage(message, returnTo, username) { message: message || '', returnTo: returnTo || '', username: username || '', + showForgotPassword: Boolean(showForgotPassword), messageVariant: 'warning' }); }; \ No newline at end of file diff --git a/src/web/routes/auth/reset-password.js b/src/web/routes/auth/reset-password.js new file mode 100644 index 0000000..53ef0c6 --- /dev/null +++ b/src/web/routes/auth/reset-password.js @@ -0,0 +1,16 @@ +const { renderView } = require('../../view'); + +module.exports = function renderResetPasswordPage(message, token, passwordRequirements) { + const requirements = passwordRequirements || { minimumLength: 10, minimumCategories: 3, requireLowercase: false, requireUppercase: false, requireNumber: false, requireSymbol: false }; + const requiredCategories = []; + if (requirements.requireLowercase) requiredCategories.push('lowercase'); + if (requirements.requireUppercase) requiredCategories.push('uppercase'); + if (requirements.requireNumber) requiredCategories.push('number'); + if (requirements.requireSymbol) requiredCategories.push('symbol'); + const passwordRequirementsText = requiredCategories.length + ? 'Use at least ' + requirements.minimumLength + ' characters and include ' + requiredCategories.join(', ') + '.' + : requirements.minimumCategories === 4 + ? 'Use at least ' + requirements.minimumLength + ' characters and include uppercase, lowercase, number, and symbol.' + : 'Use at least ' + requirements.minimumLength + ' characters and include ' + requirements.minimumCategories + ' of: uppercase, lowercase, number, and symbol.'; + return renderView('auth/reset-password', { title: 'Choose a new password', authShell: true, bodyClass: 'login-page-body', message: message || '', token: token || '', passwordMinimumLength: requirements.minimumLength, passwordRequirementsText: passwordRequirementsText }); +}; \ No newline at end of file diff --git a/src/web/routes/data-sources/api-sources/duplicate.js b/src/web/routes/data-sources/api-sources/duplicate.js index 43e397c..c365dcc 100644 --- a/src/web/routes/data-sources/api-sources/duplicate.js +++ b/src/web/routes/data-sources/api-sources/duplicate.js @@ -26,6 +26,9 @@ function buildDuplicateApiSource(apiSource, duplicateName) { tokenUrl: apiSource.token_url || '', tokenRequestBodyJson: apiSource.token_request_body_json || '', tokenResponsePath: apiSource.token_response_path || 'access_token', + tokenRefreshUrl: apiSource.token_refresh_url || '', + tokenRefreshRequestBodyJson: apiSource.token_refresh_request_body_json || '', + tokenRefreshResponsePath: apiSource.token_refresh_response_path || 'refresh_token', tokenHeaderName: apiSource.token_header_name || 'Authorization', tokenHeaderPrefix: apiSource.token_header_prefix || 'Bearer', itemsPath: apiSource.items_path || '' diff --git a/src/web/routes/data-sources/api-sources/edit.js b/src/web/routes/data-sources/api-sources/edit.js index 00bbda7..e9606e7 100644 --- a/src/web/routes/data-sources/api-sources/edit.js +++ b/src/web/routes/data-sources/api-sources/edit.js @@ -21,6 +21,9 @@ module.exports = function renderApiSourceEditPage(apiSource, data, message, curr tokenUrl: apiSource.token_url || '', tokenRequestBodyJson: apiSource.token_request_body_json || '', tokenResponsePath: apiSource.token_response_path || 'access_token', + tokenRefreshUrl: apiSource.token_refresh_url || '', + tokenRefreshRequestBodyJson: apiSource.token_refresh_request_body_json || '', + tokenRefreshResponsePath: apiSource.token_refresh_response_path || 'refresh_token', tokenHeaderName: apiSource.token_header_name || 'Authorization', tokenHeaderPrefix: apiSource.token_header_prefix || 'Bearer', itemsPath: apiSource.items_path || '', diff --git a/src/web/routes/data-sources/api-sources/form-view-model.js b/src/web/routes/data-sources/api-sources/form-view-model.js index d3696ea..2035ccc 100644 --- a/src/web/routes/data-sources/api-sources/form-view-model.js +++ b/src/web/routes/data-sources/api-sources/form-view-model.js @@ -17,6 +17,9 @@ function buildDefaultApiSource() { tokenUrl: '', tokenRequestBodyJson: '', tokenResponsePath: 'access_token', + tokenRefreshUrl: '', + tokenRefreshRequestBodyJson: '', + tokenRefreshResponsePath: 'refresh_token', tokenHeaderName: 'Authorization', tokenHeaderPrefix: 'Bearer', itemsPath: '', diff --git a/src/web/routes/data-sources/api-sources/routes.js b/src/web/routes/data-sources/api-sources/routes.js index b059e25..7925e1a 100644 --- a/src/web/routes/data-sources/api-sources/routes.js +++ b/src/web/routes/data-sources/api-sources/routes.js @@ -105,6 +105,9 @@ module.exports = function registerApiSourceRoutes(app, deps) { authHeaderValue: apiSource.auth_header_value || '', tokenUrl: apiSource.token_url || '', tokenResponsePath: apiSource.token_response_path || 'access_token', + tokenRefreshUrl: apiSource.token_refresh_url || '', + tokenRefreshRequestBodyJson: apiSource.token_refresh_request_body_json || '', + tokenRefreshResponsePath: apiSource.token_refresh_response_path || 'refresh_token', itemsPath: apiSource.items_path || '', intervalLabel: apiSource.update_interval_unit === 'seconds' ? (Math.max(1, Number(apiSource.update_interval_value) || 0) === 1 ? 'Every second' : `Every ${Math.max(1, Number(apiSource.update_interval_value) || 0)} seconds`) @@ -183,6 +186,9 @@ module.exports = function registerApiSourceRoutes(app, deps) { tokenUrl: apiSource.token_url || '', tokenRequestBodyJson: apiSource.token_request_body_json || '', tokenResponsePath: apiSource.token_response_path || 'access_token', + tokenRefreshUrl: apiSource.token_refresh_url || '', + tokenRefreshRequestBodyJson: apiSource.token_refresh_request_body_json || '', + tokenRefreshResponsePath: apiSource.token_refresh_response_path || 'refresh_token', tokenHeaderName: apiSource.token_header_name || 'Authorization', tokenHeaderPrefix: apiSource.token_header_prefix || 'Bearer', itemsPath: apiSource.items_path || '', @@ -242,8 +248,8 @@ module.exports = function registerApiSourceRoutes(app, deps) { const actorId = getAuditUserId(req); await connection.beginTransaction(); const [result] = await connection.query( - 'INSERT INTO i_api_sources (name, api_url, request_method, request_body_json, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, token_url, token_request_body_json, token_response_path, token_header_name, token_header_prefix, items_path, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_by, modified_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', - [payload.name, payload.apiUrl, payload.requestMethod, payload.requestBodyJson || null, payload.authMethod, payload.authUsername || null, payload.authPassword || null, payload.authBearerToken || null, payload.authHeaderName || null, payload.authHeaderValue || null, payload.tokenUrl || null, payload.tokenRequestBodyJson || null, payload.tokenResponsePath || null, payload.tokenHeaderName || null, payload.tokenHeaderPrefix || null, payload.itemsPath || null, payload.updateIntervalValue, payload.updateIntervalUnit, null, null, null, null, null, actorId, actorId] + 'INSERT INTO i_api_sources (name, api_url, request_method, request_body_json, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, token_url, token_request_body_json, token_response_path, token_refresh_url, token_refresh_request_body_json, token_refresh_response_path, token_header_name, token_header_prefix, items_path, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_by, modified_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', + [payload.name, payload.apiUrl, payload.requestMethod, payload.requestBodyJson || null, payload.authMethod, payload.authUsername || null, payload.authPassword || null, payload.authBearerToken || null, payload.authHeaderName || null, payload.authHeaderValue || null, payload.tokenUrl || null, payload.tokenRequestBodyJson || null, payload.tokenResponsePath || null, payload.tokenRefreshUrl || null, payload.tokenRefreshRequestBodyJson || null, payload.tokenRefreshResponsePath || null, payload.tokenHeaderName || null, payload.tokenHeaderPrefix || null, payload.itemsPath || null, payload.updateIntervalValue, payload.updateIntervalUnit, null, null, null, null, null, actorId, actorId] ); await connection.commit(); dataSourceTasks.registerRecurringRefresh('api-source', result.insertId, payload.name, payload.updateIntervalValue, payload.updateIntervalUnit, function () { @@ -308,8 +314,8 @@ module.exports = function registerApiSourceRoutes(app, deps) { const actorId = getAuditUserId(req); await connection.beginTransaction(); await connection.query( - 'UPDATE i_api_sources SET name = ?, api_url = ?, request_method = ?, request_body_json = ?, auth_method = ?, auth_username = ?, auth_password = ?, auth_bearer_token = ?, auth_header_name = ?, auth_header_value = ?, token_url = ?, token_request_body_json = ?, token_response_path = ?, token_header_name = ?, token_header_prefix = ?, items_path = ?, update_interval_value = ?, update_interval_unit = ?, modified_by = ? WHERE id = ?', - [payload.name, payload.apiUrl, payload.requestMethod, payload.requestBodyJson || null, payload.authMethod, payload.authUsername || null, payload.authPassword || null, payload.authBearerToken || null, payload.authHeaderName || null, payload.authHeaderValue || null, payload.tokenUrl || null, payload.tokenRequestBodyJson || null, payload.tokenResponsePath || null, payload.tokenHeaderName || null, payload.tokenHeaderPrefix || null, payload.itemsPath || null, payload.updateIntervalValue, payload.updateIntervalUnit, actorId, apiSource.id] + 'UPDATE i_api_sources SET name = ?, api_url = ?, request_method = ?, request_body_json = ?, auth_method = ?, auth_username = ?, auth_password = ?, auth_bearer_token = ?, auth_header_name = ?, auth_header_value = ?, token_url = ?, token_request_body_json = ?, token_response_path = ?, token_refresh_url = ?, token_refresh_request_body_json = ?, token_refresh_response_path = ?, token_header_name = ?, token_header_prefix = ?, items_path = ?, update_interval_value = ?, update_interval_unit = ?, modified_by = ? WHERE id = ?', + [payload.name, payload.apiUrl, payload.requestMethod, payload.requestBodyJson || null, payload.authMethod, payload.authUsername || null, payload.authPassword || null, payload.authBearerToken || null, payload.authHeaderName || null, payload.authHeaderValue || null, payload.tokenUrl || null, payload.tokenRequestBodyJson || null, payload.tokenResponsePath || null, payload.tokenRefreshUrl || null, payload.tokenRefreshRequestBodyJson || null, payload.tokenRefreshResponsePath || null, payload.tokenHeaderName || null, payload.tokenHeaderPrefix || null, payload.itemsPath || null, payload.updateIntervalValue, payload.updateIntervalUnit, actorId, apiSource.id] ); await connection.commit(); if (apiSource.enabled === 0 || apiSource.enabled === false) { diff --git a/src/web/routes/data-sources/weather.js b/src/web/routes/data-sources/weather.js index 154cadb..4c2a5ae 100644 --- a/src/web/routes/data-sources/weather.js +++ b/src/web/routes/data-sources/weather.js @@ -6,6 +6,7 @@ const renderWeatherLocationAddPage = require('./weather/add'); const renderWeatherLocationEditPage = require('./weather/edit'); const { buildDuplicateWeatherLocationName, buildDuplicateWeatherLocation } = require('./weather/duplicate'); const { fetchAppSettings } = require('../../../data/app-settings'); +const { buildAuditChanges } = require('../../../data/audit-log'); async function getWeatherLocationUsageIds(pool, common) { const [slides] = await pool.query('SELECT content_json FROM c_slides WHERE content_json IS NOT NULL'); @@ -42,6 +43,7 @@ module.exports = function registerWeatherRoutes(app, deps) { const dataSourceTasks = deps.dataSourceTasks; const backgroundTaskQueue = deps.backgroundTaskQueue; const requirePermission = deps.requirePermission; + const recordRequestAuditEvent = deps.recordRequestAuditEvent; const listPageSize = 25; async function getProviderAvailability() { const settings = await fetchAppSettings(pool); @@ -121,6 +123,7 @@ module.exports = function registerWeatherRoutes(app, deps) { return dataSourceTasks.refreshWeatherLocationInBackground(result.insertId, null); }); await backgroundTaskQueue.enqueueTask({ key: 'weather-location-refresh:' + result.insertId, title: 'Weather location refresh', category: 'data-source', taskType: 'data-source-refresh', payload: { sourceType: 'weather-location', sourceId: result.insertId, sourceName: payload.name, actorId: actorId }, metadata: { sourceType: 'weather-location', sourceId: result.insertId, sourceName: payload.name } }); + if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'weather', eventType: 'weather-location.created', actorUserId: actorId, targetType: 'weather-location', targetId: result.insertId, targetLabel: payload.name }); redirectAfterSave(req, res, '/data-sources/weather/' + result.insertId + '/edit', { closeUrl: '/data-sources/weather', newUrl: '/data-sources/weather/new', message: 'Weather location created.' }); } catch (error) { try { await connection.rollback(); } catch (_rollbackError) { } @@ -143,6 +146,7 @@ module.exports = function registerWeatherRoutes(app, deps) { } else { dataSourceTasks.removeRecurringRefresh('weather-location', location.id); } + if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'weather', eventType: enabled ? 'weather-location.enabled' : 'weather-location.disabled', actorUserId: getAuditUserId(req), targetType: 'weather-location', targetId: location.id, targetLabel: location.name }); return res.redirect('/data-sources/weather/' + location.id + '/edit?message=' + encodeURIComponent(enabled ? 'Weather location enabled.' : 'Weather location disabled.')); } const payload = common.buildWeatherLocationPayload(req, location); @@ -159,6 +163,7 @@ module.exports = function registerWeatherRoutes(app, deps) { return dataSourceTasks.refreshWeatherLocationInBackground(location.id, null); }); } + if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'weather', eventType: 'weather-location.updated', actorUserId: getAuditUserId(req), targetType: 'weather-location', targetId: location.id, targetLabel: payload.name, details: { changes: buildAuditChanges({ name: location.name, locationLabel: location.location_label, latitude: location.latitude, longitude: location.longitude, timezone: location.timezone, provider: location.provider, temperatureUnit: location.temperature_unit, windUnit: location.wind_unit, precipitationUnit: location.precipitation_unit, updateIntervalValue: location.update_interval_value, updateIntervalUnit: location.update_interval_unit }, payload) } }); redirectAfterSave(req, res, '/data-sources/weather/' + location.id + '/edit', { closeUrl: '/data-sources/weather', newUrl: '/data-sources/weather/new', message: 'Weather location updated.' }); } catch (error) { try { await connection.rollback(); } catch (_rollbackError) { } @@ -174,6 +179,7 @@ module.exports = function registerWeatherRoutes(app, deps) { return res.redirect('/data-sources/weather/' + location.id + '/edit?message=' + encodeURIComponent('Weather location is disabled.')); } await backgroundTaskQueue.enqueueTask({ key: 'weather-location-refresh:' + location.id, title: 'Weather location refresh', category: 'data-source', taskType: 'data-source-refresh', payload: { sourceType: 'weather-location', sourceId: location.id, sourceName: location.name, actorId: getAuditUserId(req) }, metadata: { sourceType: 'weather-location', sourceId: location.id, sourceName: location.name } }); + if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'weather', eventType: 'weather-location.refresh_requested', actorUserId: getAuditUserId(req), targetType: 'weather-location', targetId: location.id, targetLabel: location.name }); res.redirect('/data-sources/weather/' + location.id + '/edit?message=' + encodeURIComponent('Weather refresh queued.')); } catch (error) { next(error); } }); @@ -187,6 +193,7 @@ module.exports = function registerWeatherRoutes(app, deps) { } await pool.query('DELETE FROM i_weather_locations WHERE id = ?', [location.id]); dataSourceTasks.removeRecurringRefresh('weather-location', location.id); + if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'weather', eventType: 'weather-location.deleted', actorUserId: getAuditUserId(req), targetType: 'weather-location', targetId: location.id, targetLabel: location.name }); res.redirect('/data-sources/weather?message=' + encodeURIComponent('Weather location deleted.')); } catch (error) { next(error); } }); diff --git a/src/web/routes/register.js b/src/web/routes/register.js index b0a3c9c..4a68b42 100644 --- a/src/web/routes/register.js +++ b/src/web/routes/register.js @@ -40,6 +40,8 @@ function registerRoutes(app, deps) { mediaDir: deps.mediaDir, requirePermission: deps.requirePermission, recordRequestAuditEvent: deps.recordRequestAuditEvent + ,sendAccountEmail: deps.sendAccountEmail + ,createOneTimeToken: deps.createOneTimeToken }); registerAuditLogRoutes(app, { pool: deps.pool, @@ -81,8 +83,14 @@ function registerAuthAndAccountRoutes(app, deps) { parseCookies: deps.parseCookies, hashSessionToken: deps.hashSessionToken, verifyPassword: deps.verifyPassword, + hashPassword: deps.hashPassword, + validatePasswordStrength: deps.validatePasswordStrength, sessionCookieName: deps.sessionCookieName, recordRequestAuditEvent: deps.recordRequestAuditEvent + ,sendAccountEmail: deps.sendAccountEmail + ,createOneTimeToken: deps.createOneTimeToken + ,getConnection: deps.pool.getConnection ? deps.pool.getConnection.bind(deps.pool) : null + ,rbacData: deps.rbacData }); registerPagesRoutes(app, { @@ -112,6 +120,8 @@ function registerAuthAndAccountRoutes(app, deps) { hashSessionToken: deps.hashSessionToken, sessionCookieName: deps.sessionCookieName, recordRequestAuditEvent: deps.recordRequestAuditEvent + ,sendAccountEmail: deps.sendAccountEmail + ,createOneTimeToken: deps.createOneTimeToken }); registerUsersRoutes(app, { @@ -126,6 +136,10 @@ function registerAuthAndAccountRoutes(app, deps) { rbacData: deps.rbacData, requirePermission: deps.requirePermission, recordRequestAuditEvent: deps.recordRequestAuditEvent + ,sendAccountEmail: deps.sendAccountEmail + ,createOneTimeToken: deps.createOneTimeToken + ,hashSessionToken: deps.hashSessionToken + ,getRequestOrigin: deps.getRequestOrigin }); } @@ -186,6 +200,7 @@ function registerSignageRoutes(app, deps) { findAvailableClientName: deps.findAvailableClientName, withClientNameReservation: deps.withClientNameReservation, broadcastDashboardState: deps.broadcastDashboardState, + recordRequestAuditEvent: deps.recordRequestAuditEvent, requirePermission: deps.requirePermission }); } @@ -298,6 +313,7 @@ function registerSettingsAndContentRoutes(app, deps) { redirectAfterSave: deps.redirectAfterSave, dataSourceTasks: deps.dataSourceTasks, backgroundTaskQueue: deps.backgroundTaskQueue, + recordRequestAuditEvent: deps.recordRequestAuditEvent, requirePermission: deps.requirePermission }); diff --git a/src/web/routes/settings/invitations/list.js b/src/web/routes/settings/invitations/list.js new file mode 100644 index 0000000..431cdc5 --- /dev/null +++ b/src/web/routes/settings/invitations/list.js @@ -0,0 +1,15 @@ +// Pending invitations page renderer. + +const { renderView } = require('../../../view'); + +module.exports = function renderInvitationsPage(data, currentUser) { + return renderView('settings/invitations/list', { + title: 'Pending invitations', + active: 'users-invitations', + userManagementMenuOpen: true, + currentUser: currentUser || null, + message: data.message || '', + invitations: data.invitations || [], + pagination: data.pagination || null + }); +}; \ No newline at end of file diff --git a/src/web/routes/settings/rbac/form-view-model.js b/src/web/routes/settings/rbac/form-view-model.js index f6e2ccf..1d31a27 100644 --- a/src/web/routes/settings/rbac/form-view-model.js +++ b/src/web/routes/settings/rbac/form-view-model.js @@ -98,6 +98,7 @@ function buildRbacAddViewModel(message, currentUser, formValues, permissionGroup return { title: 'Create role', active: 'rbac', + userManagementMenuOpen: true, isEdit: false, usersPresent: true, formId: 'role-create-form', @@ -130,6 +131,7 @@ function buildRbacEditViewModel(role, message, currentUser, permissionGroups, us return { title: 'Edit role', active: 'rbac', + userManagementMenuOpen: true, isEdit: true, usersPresent: true, formId: 'role-edit-form', diff --git a/src/web/routes/settings/rbac/list.js b/src/web/routes/settings/rbac/list.js index c98ba26..fabcb30 100644 --- a/src/web/routes/settings/rbac/list.js +++ b/src/web/routes/settings/rbac/list.js @@ -6,6 +6,7 @@ module.exports = function renderRbacPage(data, message, currentUser) { return renderView('settings/rbac/list', { title: 'Roles and permissions', active: 'rbac', + userManagementMenuOpen: true, message: message, currentUser: currentUser || null, roles: data.roles || [], diff --git a/src/web/routes/settings/routes.js b/src/web/routes/settings/routes.js index f3be513..5b361a4 100644 --- a/src/web/routes/settings/routes.js +++ b/src/web/routes/settings/routes.js @@ -1,7 +1,7 @@ // Settings page route registration. const { ANNOUNCEMENT_ICON_CATALOG } = require('#src/data/announcement-icons'); -const { AUDIT_CATEGORY_KEYS, AUDIT_CATEGORY_LABELS } = require('#src/data/audit-log'); +const { AUDIT_CATEGORY_KEYS, AUDIT_CATEGORY_LABELS, SCREEN_CONTROL_COMMAND_KEYS, SCREEN_CONTROL_COMMAND_LABELS } = require('#src/data/audit-log'); const { fetchAppSettings, saveAppSettings } = require('#src/data/app-settings'); const { appVersion, detectSchemaVersion } = require('#src/db/migrations'); @@ -20,6 +20,7 @@ module.exports = function registerSettingsPageRoutes(app, deps) { const pages = deps.pages; const pool = deps.pool; const recordRequestAuditEvent = deps.recordRequestAuditEvent; + const sendAccountEmail = deps.sendAccountEmail; if (!pages || !pool || typeof deps.requirePermission !== 'function') { throw new Error('registerSettingsPageRoutes requires pool, pages, and requirePermission.'); @@ -54,9 +55,12 @@ module.exports = function registerSettingsPageRoutes(app, deps) { 'security.password_require_number', 'security.password_require_symbol', 'security.require_password_change_for_new_users', - 'security.require_password_change_after_admin_reset' + 'security.require_password_change_after_admin_reset', + 'security.allow_admin_email_verification_bypass' ], - audit: ['audit.enabled', 'audit.categories', 'audit.include_request_metadata', 'audit.retention_days'], + email: ['email.smtp_enabled', 'email.smtp_host', 'email.smtp_port', 'email.smtp_security', 'email.smtp_username', 'email.from_address', 'email.from_name'], + 'email-templates': ['email.verification_subject', 'email.verification_body', 'email.verification_button_alignment', 'email.verification_button_text', 'email.reset_subject', 'email.reset_body', 'email.reset_button_alignment', 'email.reset_button_text', 'email.invitation_subject', 'email.invitation_body', 'email.invitation_button_alignment', 'email.invitation_button_text'], + audit: ['audit.enabled', 'audit.categories', 'audit.screen_control_commands', 'audit.include_request_metadata', 'audit.retention_days'], media: ['uploads.image_max_bytes', 'uploads.video_max_bytes', 'uploads.wysiwyg_image_max_bytes', 'uploads.allowed_mime_types'], weather: ['weather.open_meteo_api_key', 'weather.pirate_weather_api_key'], icons: ['announcements.suggested_icons'] @@ -156,6 +160,27 @@ module.exports = function registerSettingsPageRoutes(app, deps) { passwordRequireSymbol: Boolean(settings['security.password_require_symbol']), requirePasswordChangeForNewUsers: Boolean(settings['security.require_password_change_for_new_users']), requirePasswordChangeAfterAdminReset: Boolean(settings['security.require_password_change_after_admin_reset']), + allowAdminEmailVerificationBypass: Boolean(settings['security.allow_admin_email_verification_bypass']), + smtpEnabled: Boolean(settings['email.smtp_enabled']), + smtpHost: String(settings['email.smtp_host'] || ''), + smtpPort: Number(settings['email.smtp_port']) || 587, + smtpSecurity: String(settings['email.smtp_security'] || 'starttls'), + smtpUsername: String(settings['email.smtp_username'] || ''), + smtpConfigured: Boolean(settings['email.smtp_password']), + emailFromAddress: String(settings['email.from_address'] || ''), + emailFromName: String(settings['email.from_name'] || ''), + verificationEmailSubject: String(settings['email.verification_subject'] || ''), + verificationEmailBody: String(settings['email.verification_body'] || ''), + verificationButtonAlignment: String(settings['email.verification_button_alignment'] || 'center'), + verificationButtonText: String(settings['email.verification_button_text'] || 'Verify email address'), + resetEmailSubject: String(settings['email.reset_subject'] || ''), + resetEmailBody: String(settings['email.reset_body'] || ''), + resetButtonAlignment: String(settings['email.reset_button_alignment'] || 'center'), + resetButtonText: String(settings['email.reset_button_text'] || 'Reset password'), + invitationEmailSubject: String(settings['email.invitation_subject'] || ''), + invitationEmailBody: String(settings['email.invitation_body'] || ''), + invitationButtonAlignment: String(settings['email.invitation_button_alignment'] || 'center'), + invitationButtonText: String(settings['email.invitation_button_text'] || 'Accept invitation'), defaultSlideDurationSeconds: Number(settings['player.default_slide_duration_seconds']) || 10, defaultFadeBetweenSlides: Boolean(settings['player.default_fade_between_slides']), defaultSkipUnavailableRtmp: Boolean(settings['player.skip_unavailable_rtmp']), @@ -176,7 +201,7 @@ module.exports = function registerSettingsPageRoutes(app, deps) { ,auditCategories: AUDIT_CATEGORY_KEYS.map(function (category) { return { key: category, label: AUDIT_CATEGORY_LABELS[category] || category, isSelected: settings['audit.categories'].includes(category) }; }) - ,auditEventCategories: AUDIT_CATEGORY_KEYS.filter(function (category) { return category !== 'users' && category !== 'roles' && category !== 'system-settings' && category !== 'slides' && category !== 'templates' && category !== 'playlists' && category !== 'screens' && category !== 'announcements' && category !== 'canvas-sizes' && category !== 'api-sources' && category !== 'rss-feeds' && category !== 'timetables'; }).map(function (category) { + ,auditEventCategories: AUDIT_CATEGORY_KEYS.filter(function (category) { return category !== 'users' && category !== 'roles' && category !== 'system-settings' && category !== 'slides' && category !== 'templates' && category !== 'playlists' && category !== 'screens' && category !== 'announcements' && category !== 'canvas-sizes' && category !== 'api-sources' && category !== 'rss-feeds' && category !== 'timetables' && category !== 'weather' && category !== 'screen-controls'; }).map(function (category) { return { key: category, label: AUDIT_CATEGORY_LABELS[category] || category, isSelected: settings['audit.categories'].includes(category) }; }) ,auditAdministrationCategories: AUDIT_CATEGORY_KEYS.filter(function (category) { return category === 'users' || category === 'roles' || category === 'system-settings'; }).map(function (category) { @@ -185,9 +210,13 @@ module.exports = function registerSettingsPageRoutes(app, deps) { ,auditContentCategories: AUDIT_CATEGORY_KEYS.filter(function (category) { return category === 'slides' || category === 'templates' || category === 'playlists' || category === 'screens' || category === 'announcements' || category === 'canvas-sizes'; }).map(function (category) { return { key: category, label: AUDIT_CATEGORY_LABELS[category] || category, isSelected: settings['audit.categories'].includes(category) }; }) - ,auditDataSourceCategories: AUDIT_CATEGORY_KEYS.filter(function (category) { return category === 'api-sources' || category === 'rss-feeds' || category === 'timetables'; }).map(function (category) { + ,auditDataSourceCategories: AUDIT_CATEGORY_KEYS.filter(function (category) { return category === 'api-sources' || category === 'rss-feeds' || category === 'timetables' || category === 'weather'; }).map(function (category) { return { key: category, label: AUDIT_CATEGORY_LABELS[category] || category, isSelected: settings['audit.categories'].includes(category) }; }) + ,auditScreenControlCommands: SCREEN_CONTROL_COMMAND_KEYS.map(function (command) { + const selectedCommands = Array.isArray(settings['audit.screen_control_commands']) ? settings['audit.screen_control_commands'] : []; + return { key: command, label: SCREEN_CONTROL_COMMAND_LABELS[command] || command, isSelected: selectedCommands.includes(command) }; + }) }, diagnostics)); } @@ -244,7 +273,7 @@ module.exports = function registerSettingsPageRoutes(app, deps) { app.post('/settings/system', deps.requirePermission('system-settings.update'), async function (req, res, next) { try { const section = String(req.body && req.body.settings_section || '').trim().toLowerCase(); - if (section !== 'icons' && section !== 'media' && section !== 'security' && section !== 'defaults' && section !== 'audit' && section !== 'weather') { + if (section !== 'icons' && section !== 'media' && section !== 'security' && section !== 'email' && section !== 'email-templates' && section !== 'defaults' && section !== 'audit' && section !== 'weather') { const error = new Error('Unknown settings section.'); error.statusCode = 400; error.expose = true; @@ -252,6 +281,62 @@ module.exports = function registerSettingsPageRoutes(app, deps) { } const previousSettings = await fetchAppSettings(pool); + if (section === 'email' && String(req.body && req.body.settings_action || '').trim().toLowerCase() === 'test_email') { + const recipient = String(req.currentUser && req.currentUser.email || '').trim(); + if (!previousSettings['email.smtp_enabled'] || typeof sendAccountEmail !== 'function') { + const error = new Error('Email delivery is not configured.'); + error.statusCode = 400; + error.expose = true; + throw error; + } + if (!recipient) { + const error = new Error('Your account does not have an email address.'); + error.statusCode = 400; + error.expose = true; + throw error; + } + await sendAccountEmail(previousSettings, { + to: recipient, + subject: 'Pulse Signage SMTP test email', + text: 'This is a test email from Pulse Signage. Your SMTP settings are working.' + }); + return res.redirect('/settings/system?message=' + encodeURIComponent('Test email sent to ' + recipient + '.') + '#email-delivery'); + } + + if (section === 'email-templates') { + const verificationSubject = String(req.body && req.body.verification_subject || '').trim(); + const verificationBody = String(req.body && req.body.verification_body || '').trim(); + const resetSubject = String(req.body && req.body.reset_subject || '').trim(); + const resetBody = String(req.body && req.body.reset_body || '').trim(); + const verificationButtonText = String(req.body && req.body.verification_button_text || '').trim(); + const resetButtonText = String(req.body && req.body.reset_button_text || '').trim(); + const invitationSubject = String(req.body && req.body.invitation_subject || '').trim(); + const invitationBody = String(req.body && req.body.invitation_body || '').trim(); + const invitationButtonText = String(req.body && req.body.invitation_button_text || '').trim(); + if (!verificationSubject || !verificationBody.includes('[[url]]') || !resetSubject || !resetBody.includes('[[url]]') || !invitationSubject || !invitationBody.includes('[[url]]') || !verificationButtonText || !resetButtonText || !invitationButtonText) { + const error = new Error('Email templates require a subject, message, and the correct link placeholder.'); + error.statusCode = 400; + error.expose = true; + throw error; + } + const savedSettings = await saveAppSettings(pool, { + 'email.verification_subject': verificationSubject, + 'email.verification_body': verificationBody, + 'email.verification_button_alignment': ['left', 'center', 'right'].includes(String(req.body && req.body.verification_button_alignment || '').trim()) ? String(req.body.verification_button_alignment).trim() : 'center', + 'email.verification_button_text': verificationButtonText, + 'email.reset_subject': resetSubject, + 'email.reset_body': resetBody, + 'email.reset_button_alignment': ['left', 'center', 'right'].includes(String(req.body && req.body.reset_button_alignment || '').trim()) ? String(req.body.reset_button_alignment).trim() : 'center', + 'email.reset_button_text': resetButtonText + ,'email.invitation_subject': invitationSubject + ,'email.invitation_body': invitationBody + ,'email.invitation_button_alignment': ['left', 'center', 'right'].includes(String(req.body && req.body.invitation_button_alignment || '').trim()) ? String(req.body.invitation_button_alignment).trim() : 'center' + ,'email.invitation_button_text': invitationButtonText + }, req.currentUser && req.currentUser.id); + await recordSettingsAuditEvent(req, previousSettings, savedSettings, section); + return res.redirect('/settings/system?message=' + encodeURIComponent('Account email templates saved.') + '#email-templates'); + } + if (section === 'defaults') { const defaultSlideDurationSeconds = Number(req.body && req.body.default_slide_duration_seconds); const defaultAnnouncementDurationValue = Number(req.body && req.body.default_announcement_duration_value); @@ -322,11 +407,41 @@ module.exports = function registerSettingsPageRoutes(app, deps) { 'security.password_require_symbol': passwordRequireSymbol, 'security.require_password_change_for_new_users': requirePasswordChangeForNewUsers, 'security.require_password_change_after_admin_reset': requirePasswordChangeAfterAdminReset + ,'security.allow_admin_email_verification_bypass': req.body && (req.body.allow_admin_email_verification_bypass === '1' || req.body.allow_admin_email_verification_bypass === 'true') }, req.currentUser && req.currentUser.id); await recordSettingsAuditEvent(req, previousSettings, savedSettings, section); return res.redirect('/settings/system?message=' + encodeURIComponent('Security settings saved.') + '#security-sessions'); } + if (section === 'email') { + const smtpEnabled = req.body && (req.body.smtp_enabled === '1' || req.body.smtp_enabled === 'true'); + const smtpHost = String(req.body && req.body.smtp_host || '').trim(); + const smtpPort = Number(req.body && req.body.smtp_port); + const smtpSecurity = String(req.body && req.body.smtp_security || 'starttls').trim().toLowerCase(); + const smtpUsername = String(req.body && req.body.smtp_username || '').trim(); + const smtpPassword = String(req.body && req.body.smtp_password || ''); + const fromAddress = String(req.body && req.body.from_address || '').trim(); + const fromName = String(req.body && req.body.from_name || '').trim(); + if (smtpEnabled && (!smtpHost || !Number.isInteger(smtpPort) || smtpPort < 1 || smtpPort > 65535 || !fromAddress)) { + const error = new Error('Enabled email delivery requires an SMTP host, valid port, and from address.'); + error.statusCode = 400; + error.expose = true; + throw error; + } + const savedSettings = await saveAppSettings(pool, { + 'email.smtp_enabled': smtpEnabled, + 'email.smtp_host': smtpHost, + 'email.smtp_port': smtpPort || 587, + 'email.smtp_security': smtpSecurity, + 'email.smtp_username': smtpUsername, + 'email.smtp_password': smtpPassword || previousSettings['email.smtp_password'], + 'email.from_address': fromAddress, + 'email.from_name': fromName + }, req.currentUser && req.currentUser.id); + await recordSettingsAuditEvent(req, previousSettings, savedSettings, section); + return res.redirect('/settings/system?message=' + encodeURIComponent('Email settings saved.') + '#email-delivery'); + } + if (section === 'audit') { const auditEnabled = req.body && (req.body.audit_enabled === '1' || req.body.audit_enabled === 'true'); const includeRequestMetadata = req.body && (req.body.include_request_metadata === '1' || req.body.include_request_metadata === 'true'); @@ -334,8 +449,17 @@ module.exports = function registerSettingsPageRoutes(app, deps) { const auditCategories = Array.from(new Set((Array.isArray(selectedCategories) ? selectedCategories : selectedCategories ? [selectedCategories] : []).map(function (category) { return String(category || '').trim().toLowerCase(); }).filter(function (category) { - return AUDIT_CATEGORY_KEYS.includes(category); + return AUDIT_CATEGORY_KEYS.includes(category) && category !== 'screen-controls'; }))); + const selectedScreenControlCommands = req.body && (req.body['audit_screen_control_commands[]'] !== undefined ? req.body['audit_screen_control_commands[]'] : req.body.audit_screen_control_commands); + const screenControlCommands = Array.from(new Set((Array.isArray(selectedScreenControlCommands) ? selectedScreenControlCommands : selectedScreenControlCommands ? [selectedScreenControlCommands] : []).map(function (command) { + return String(command || '').trim().toLowerCase(); + }).filter(function (command) { + return SCREEN_CONTROL_COMMAND_KEYS.includes(command); + }))); + if (screenControlCommands.length) { + auditCategories.push('screen-controls'); + } const retentionDays = Number(req.body && req.body.audit_retention_days); if (!auditCategories.length || !Number.isInteger(retentionDays) || retentionDays < 0 || retentionDays > 3650) { const error = new Error('Select at least one audit category and use a retention period between 0 and 3650 days.'); @@ -346,6 +470,7 @@ module.exports = function registerSettingsPageRoutes(app, deps) { const savedSettings = await saveAppSettings(pool, { 'audit.enabled': auditEnabled, 'audit.categories': auditCategories, + 'audit.screen_control_commands': screenControlCommands, 'audit.include_request_metadata': includeRequestMetadata, 'audit.retention_days': retentionDays }, req.currentUser && req.currentUser.id); @@ -371,7 +496,7 @@ module.exports = function registerSettingsPageRoutes(app, deps) { error.expose = true; throw error; } - await pool.query('DELETE FROM o_app_settings WHERE setting_key NOT IN (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', ['announcements.suggested_icons', 'announcements.default_icon', 'announcements.default_duration_value', 'announcements.default_duration_unit', 'player.default_slide_duration_seconds', 'player.default_fade_between_slides', 'player.skip_unavailable_rtmp', 'data-sources.rss_default_interval_value', 'data-sources.rss_default_interval_unit', 'data-sources.api_default_interval_value', 'data-sources.api_default_interval_unit', 'weather.open_meteo_api_key', 'weather.pirate_weather_api_key', 'uploads.image_max_bytes', 'uploads.video_max_bytes', 'uploads.wysiwyg_image_max_bytes', 'uploads.allowed_mime_types', 'security.session_lifetime_days', 'security.allow_user_session_revocation', 'security.max_active_sessions', 'security.login_max_attempts', 'security.login_lockout_minutes', 'security.login_rate_limit_scope', 'security.password_min_length', 'security.password_min_categories', 'security.password_require_lowercase', 'security.password_require_uppercase', 'security.password_require_number', 'security.password_require_symbol', 'security.require_password_change_for_new_users', 'security.require_password_change_after_admin_reset', 'audit.enabled', 'audit.categories', 'audit.include_request_metadata', 'audit.retention_days']); + await pool.query('DELETE FROM o_app_settings WHERE setting_key NOT IN (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', ['announcements.suggested_icons', 'announcements.default_icon', 'announcements.default_duration_value', 'announcements.default_duration_unit', 'player.default_slide_duration_seconds', 'player.default_fade_between_slides', 'player.skip_unavailable_rtmp', 'data-sources.rss_default_interval_value', 'data-sources.rss_default_interval_unit', 'data-sources.api_default_interval_value', 'data-sources.api_default_interval_unit', 'weather.open_meteo_api_key', 'weather.pirate_weather_api_key', 'uploads.image_max_bytes', 'uploads.video_max_bytes', 'uploads.wysiwyg_image_max_bytes', 'uploads.allowed_mime_types', 'security.session_lifetime_days', 'security.allow_user_session_revocation', 'security.max_active_sessions', 'security.login_max_attempts', 'security.login_lockout_minutes', 'security.login_rate_limit_scope', 'security.password_min_length', 'security.password_min_categories', 'security.password_require_lowercase', 'security.password_require_uppercase', 'security.password_require_number', 'security.password_require_symbol', 'security.require_password_change_for_new_users', 'security.require_password_change_after_admin_reset', 'security.allow_admin_email_verification_bypass', 'email.smtp_enabled', 'email.smtp_host', 'email.smtp_port', 'email.smtp_security', 'email.smtp_username', 'email.smtp_password', 'email.from_address', 'email.from_name', 'email.reply_to', 'audit.enabled', 'audit.categories', 'audit.screen_control_commands', 'audit.include_request_metadata', 'audit.retention_days']); const savedSettings = await saveAppSettings(pool, { 'uploads.image_max_bytes': imageMaxMb * 1024 * 1024, 'uploads.video_max_bytes': videoMaxMb * 1024 * 1024, @@ -408,7 +533,7 @@ module.exports = function registerSettingsPageRoutes(app, deps) { error.expose = true; throw error; } - await pool.query('DELETE FROM o_app_settings WHERE setting_key NOT IN (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', ['announcements.suggested_icons', 'announcements.default_icon', 'announcements.default_duration_value', 'announcements.default_duration_unit', 'player.default_slide_duration_seconds', 'player.default_fade_between_slides', 'player.skip_unavailable_rtmp', 'data-sources.rss_default_interval_value', 'data-sources.rss_default_interval_unit', 'data-sources.api_default_interval_value', 'data-sources.api_default_interval_unit', 'weather.open_meteo_api_key', 'weather.pirate_weather_api_key', 'uploads.image_max_bytes', 'uploads.video_max_bytes', 'uploads.wysiwyg_image_max_bytes', 'uploads.allowed_mime_types', 'security.session_lifetime_days', 'security.allow_user_session_revocation', 'security.max_active_sessions', 'security.login_max_attempts', 'security.login_lockout_minutes', 'security.login_rate_limit_scope', 'security.password_min_length', 'security.password_min_categories', 'security.password_require_lowercase', 'security.password_require_uppercase', 'security.password_require_number', 'security.password_require_symbol', 'security.require_password_change_for_new_users', 'security.require_password_change_after_admin_reset', 'audit.enabled', 'audit.categories', 'audit.include_request_metadata', 'audit.retention_days']); + await pool.query('DELETE FROM o_app_settings WHERE setting_key NOT IN (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', ['announcements.suggested_icons', 'announcements.default_icon', 'announcements.default_duration_value', 'announcements.default_duration_unit', 'player.default_slide_duration_seconds', 'player.default_fade_between_slides', 'player.skip_unavailable_rtmp', 'data-sources.rss_default_interval_value', 'data-sources.rss_default_interval_unit', 'data-sources.api_default_interval_value', 'data-sources.api_default_interval_unit', 'weather.open_meteo_api_key', 'weather.pirate_weather_api_key', 'uploads.image_max_bytes', 'uploads.video_max_bytes', 'uploads.wysiwyg_image_max_bytes', 'uploads.allowed_mime_types', 'security.session_lifetime_days', 'security.allow_user_session_revocation', 'security.max_active_sessions', 'security.login_max_attempts', 'security.login_lockout_minutes', 'security.login_rate_limit_scope', 'security.password_min_length', 'security.password_min_categories', 'security.password_require_lowercase', 'security.password_require_uppercase', 'security.password_require_number', 'security.password_require_symbol', 'security.require_password_change_for_new_users', 'security.require_password_change_after_admin_reset', 'audit.enabled', 'audit.categories', 'audit.screen_control_commands', 'audit.include_request_metadata', 'audit.retention_days']); const savedSettings = await saveAppSettings(pool, { 'announcements.suggested_icons': suggestedIcons }, req.currentUser && req.currentUser.id); diff --git a/src/web/routes/settings/users/form-view-model.js b/src/web/routes/settings/users/form-view-model.js index 2da2fc3..b1f7fdf 100644 --- a/src/web/routes/settings/users/form-view-model.js +++ b/src/web/routes/settings/users/form-view-model.js @@ -22,6 +22,7 @@ function buildUsersAddViewModel(message, currentUser, roles, formValues, message return { title: 'Add user', active: 'users', + userManagementMenuOpen: true, isEdit: false, formId: 'user-form', formAction: '/settings/users', @@ -44,6 +45,7 @@ function buildUsersEditViewModel(user, message, currentUser, roles, sessions) { return { title: 'Edit user', active: 'users', + userManagementMenuOpen: true, isEdit: true, formId: 'user-profile-form', formAction: '/settings/users/' + user.id + '/username', diff --git a/src/web/routes/settings/users/invite.js b/src/web/routes/settings/users/invite.js new file mode 100644 index 0000000..af68ddc --- /dev/null +++ b/src/web/routes/settings/users/invite.js @@ -0,0 +1,14 @@ +const { renderView } = require('../../../view'); + +module.exports = function renderUsersInvitePage(message, currentUser, roles, formValues, messageVariant) { + return renderView('settings/users/invite', { + title: 'Invite user', + active: 'users', + userManagementMenuOpen: true, + currentUser: currentUser || null, + message: message || '', + messageVariant: messageVariant || 'success', + roles: Array.isArray(roles) ? roles : [], + formValues: formValues || {} + }); +}; diff --git a/src/web/routes/settings/users/list.js b/src/web/routes/settings/users/list.js index aa13725..3002742 100644 --- a/src/web/routes/settings/users/list.js +++ b/src/web/routes/settings/users/list.js @@ -6,6 +6,7 @@ module.exports = function renderUsersPage(data, message, currentUser) { return renderView('settings/users/list', { title: 'Users', active: 'users', + userManagementMenuOpen: true, message: message, currentUser: currentUser || null, users: data.users || [], diff --git a/src/web/views/account/index.hbs b/src/web/views/account/index.hbs new file mode 100644 index 0000000..69b05e6 --- /dev/null +++ b/src/web/views/account/index.hbs @@ -0,0 +1,113 @@ +
+
+

My account

+

Update your username, email, display name, and password.

+
+
+ +
+
+
+
+

Account details

+
+
+
+
+
+ + +
+
+ + +
+
+ + +
{{#if emailPending}}Pending verification for {{pendingEmail}}. Enter a different address here to replace it, or resend the verification email below.{{else}}{{#if emailVerified}}Verified{{else}}Not verified{{/if}}. Email is optional; changing the address requires confirmation by email.{{/if}}
+
+
+ +
+
+ {{#if emailPending}}
{{/if}} +
+ + {{#if allowUserSessionRevocation}} +
+
+

Active sessions

+
+
+
+ {{#if sessions.length}} + {{#each sessions}} +
+
+
+
{{#if isCurrent}}Current session{{else}}Active session{{/if}}
+
+ {{#unless isCurrent}} +
+ +
+ {{/unless}} +
+
{{ipAddress}} · {{userAgent}}
+
Created {{createdAtLabel}} · Last used {{lastUsedAtLabel}} · Expires {{expiresAtLabel}}
+
+ {{/each}} + {{else}} +

No active sessions were found.

+ {{/if}} +
+
+
+
+ +
+
+
+ {{/if}} +
+ +
+
+
+

Password

+
+
+
+ +
+ + +
+
+ + +
+
{{passwordRequirementsText}}
+
+
+
+
+
+

Confirmation

+
+
+ + +
Required to save account details or change your password.
+
+
+
+ + + Cancel +
+
+
+
+
diff --git a/src/web/views/account/password.hbs b/src/web/views/account/password.hbs deleted file mode 100644 index ffbac29..0000000 --- a/src/web/views/account/password.hbs +++ /dev/null @@ -1,95 +0,0 @@ -
-
-

My account

-

Update your display name and password.

-
-
- -
-
-
-
-

Display name

-
-
-
- -
-
-
- - Cancel -
-
-
-
- - {{#if allowUserSessionRevocation}} -
-
-

Active sessions

-
-
-
- {{#if sessions.length}} - {{#each sessions}} -
-
-
-
{{#if isCurrent}}Current session{{else}}Active session{{/if}}
-
- {{#unless isCurrent}} -
- -
- {{/unless}} -
-
{{ipAddress}} · {{userAgent}}
-
Created {{createdAtLabel}} · Last used {{lastUsedAtLabel}} · Expires {{expiresAtLabel}}
-
- {{/each}} - {{else}} -

No active sessions were found.

- {{/if}} -
-
-
-
- -
-
-
- {{/if}} -
- -
-
-
-

Password

-
-
-
-
- - -
-
- - -
-
- - -
-
{{passwordRequirementsText}}
-
-
-
- - Cancel -
-
-
-
-
-
diff --git a/src/web/views/auth/accept-invite.hbs b/src/web/views/auth/accept-invite.hbs new file mode 100644 index 0000000..40935d7 --- /dev/null +++ b/src/web/views/auth/accept-invite.hbs @@ -0,0 +1,27 @@ + +{{#if isValidInvitation}} +
+ {{#if message}}
{{message}}
{{/if}} +
+ +
+
+
+
+
+
{{passwordRequirementsText}}
+ +
+
+{{else}} +
+
+ +

Invitation link unavailable

+
+
+

{{message}}

+ Return to sign in +
+
+{{/if}} diff --git a/src/web/views/auth/email-verification-error.hbs b/src/web/views/auth/email-verification-error.hbs new file mode 100644 index 0000000..9311ac0 --- /dev/null +++ b/src/web/views/auth/email-verification-error.hbs @@ -0,0 +1,11 @@ + +
+
+ +

Verification link unavailable

+
+
+

{{message}}

+ Return to sign in +
+
diff --git a/src/web/views/auth/email-verified.hbs b/src/web/views/auth/email-verified.hbs new file mode 100644 index 0000000..06a67db --- /dev/null +++ b/src/web/views/auth/email-verified.hbs @@ -0,0 +1,11 @@ + +
+
+ +

Email verified

+
+
+

Your email address has been verified successfully.

+ Continue to sign in +
+
diff --git a/src/web/views/auth/forgot-password.hbs b/src/web/views/auth/forgot-password.hbs new file mode 100644 index 0000000..c3d2a1f --- /dev/null +++ b/src/web/views/auth/forgot-password.hbs @@ -0,0 +1,11 @@ + +
+

Reset password

+ {{#if message}}
{{message}}
{{/if}} +
+ + + +
+ Back to sign in +
\ No newline at end of file diff --git a/src/web/views/auth/login.hbs b/src/web/views/auth/login.hbs index 7773f4f..5dbe684 100644 --- a/src/web/views/auth/login.hbs +++ b/src/web/views/auth/login.hbs @@ -1,29 +1,44 @@ -
-
-

Sign in

+
-
-
-
-

API source details

-
-
-
-
- - -
-
- - -
-
- - -
+{{#if isEdit}}{{/if}} + +
+
+
+
+
+

Connection

-
-

Request

-
-
-
POST requests use JSON with the existing authentication settings.
- +
+
+
+ +
-
-
-
-

Access and parsing

-
-
- - +
+
+ +
-
- - -
-
-
-
Optional. Use dot notation to change the default base for placeholders.
-
-
-
-
-

Authentication details

- -