Release v2.11.1

2026-09-04 15:43:55 +01:00
parent 2c150b5b2e
commit 98f969ca0f
104 changed files with 3559 additions and 447 deletions
@@ -2,6 +2,7 @@

 const { normalizeReturnToPath, getRequestOrigin } = require('../../lib/auth/session');
 const { fetchAppSettings } = require('#src/data/app-settings');
+const { renderAccountEmailTemplate } = require('#src/data/account-email-templates');

 module.exports = function registerAuthRoutes(app, deps) {
  const pool = deps.pool;
@@ -17,6 +18,10 @@ module.exports = function registerAuthRoutes(app, deps) {
  const verifyPassword = deps.verifyPassword;
  const sessionCookieName = deps.sessionCookieName;
  const recordRequestAuditEvent = deps.recordRequestAuditEvent;
+  const sendAccountEmail = deps.sendAccountEmail;
+  const createOneTimeToken = deps.createOneTimeToken;
+  const getConnection = deps.getConnection;
+  const rbacData = deps.rbacData;

  function getReturnTo(req) {
    return normalizeReturnToPath(req && (req.query && req.query.returnTo || req.body && req.body.returnTo), getRequestOrigin(req));
@@ -77,6 +82,141 @@ module.exports = function registerAuthRoutes(app, deps) {
    await pool.query('DELETE FROM a_login_attempts WHERE rate_key = ?', [rateKey]);
  }

+  async function getPasswordRequirements() {
+    const settings = await fetchAppSettings(pool);
+    return {
+      minimumLength: settings['security.password_min_length'],
+      minimumCategories: settings['security.password_min_categories'],
+      requireLowercase: settings['security.password_require_lowercase'],
+      requireUppercase: settings['security.password_require_uppercase'],
+      requireNumber: settings['security.password_require_number'],
+      requireSymbol: settings['security.password_require_symbol']
+    };
+  }
+
+  app.get('/accept-invite', async function (req, res, next) {
+    try {
+      const token = String(req.query.token || '').trim();
+      const [rows] = await pool.query('SELECT email, name FROM a_user_invitations WHERE token_hash = ? AND used_at IS NULL AND expires_at > NOW() LIMIT 1', [hashSessionToken(token)]);
+      const invitation = rows[0] || null;
+      if (!invitation) return res.status(400).send(pages.renderAcceptInvitePage('This invitation is invalid or has expired.', token, '', '', await getPasswordRequirements(), false));
+      res.send(pages.renderAcceptInvitePage('', token, invitation.email, invitation.name, await getPasswordRequirements(), true));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  app.post('/accept-invite', async function (req, res, next) {
+    const connection = typeof getConnection === 'function' ? await getConnection() : pool;
+    try {
+      const token = String(req.body.token || '').trim();
+      const username = String(req.body.username || '').trim();
+      const name = String(req.body.name || '').trim();
+      const password = String(req.body.password || '');
+      const confirmPassword = String(req.body.confirm_password || '');
+      const [rows] = await connection.query('SELECT id, email, name, role_ids_json FROM a_user_invitations WHERE token_hash = ? AND used_at IS NULL AND expires_at > NOW() LIMIT 1', [hashSessionToken(token)]);
+      const invitation = rows[0] || null;
+      const requirements = await getPasswordRequirements();
+      const renderError = function (message) { return res.status(400).send(pages.renderAcceptInvitePage(message, token, invitation ? invitation.email : '', name || (invitation && invitation.name) || '', requirements, Boolean(invitation))); };
+      if (!invitation) return renderError('This invitation is invalid or has expired.');
+      if (!username) return renderError('Username is required.');
+      if (!name) return renderError('Name is required.');
+        const [existingUsers] = await connection.query('SELECT id FROM a_users WHERE username = ? LIMIT 1', [username]);
+        if (existingUsers.length) return renderError('That username already exists.');
+      const strengthMessage = deps.validatePasswordStrength(password, requirements);
+      if (strengthMessage) return renderError(strengthMessage);
+      if (password !== confirmPassword) return renderError('Passwords do not match.');
+      const passwordRecord = deps.hashPassword(password);
+      const roleIds = JSON.parse(invitation.role_ids_json || '[]');
+      await connection.beginTransaction();
+      const [result] = await connection.query('INSERT INTO a_users (name, username, email, email_verified_at, password_hash, password_salt, password_iterations, created_by, modified_by) VALUES (?, ?, ?, NOW(), ?, ?, ?, NULL, NULL)', [name, username, invitation.email, passwordRecord.hash, passwordRecord.salt, passwordRecord.iterations]);
+      if (rbacData && typeof rbacData.syncUserRoles === 'function') await rbacData.syncUserRoles(connection, result.insertId, roleIds);
+      await connection.query('UPDATE a_user_invitations SET used_at = NOW() WHERE id = ? AND used_at IS NULL', [invitation.id]);
+      await connection.commit();
+      if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'users', eventType: 'user.invitation_accepted', targetType: 'user', targetId: result.insertId, targetLabel: username, details: { invitationId: invitation.id } });
+      res.redirect('/login?message=' + encodeURIComponent('Account created. You can now sign in.'));
+    } catch (error) {
+      try { await connection.rollback(); } catch (_rollbackError) {}
+      next(error);
+    } finally {
+      if (connection !== pool && connection && typeof connection.release === 'function') connection.release();
+    }
+  });
+
+  app.get('/forgot-password', function (req, res) {
+    res.send(pages.renderForgotPasswordPage(''));
+  });
+
+  app.post('/forgot-password', async function (req, res, next) {
+    try {
+      const identity = String(req.body.identity || '').trim();
+      const genericMessage = 'If that account has a verified email address, a reset link has been sent.';
+      const [rows] = await pool.query('SELECT id, name, username, email FROM a_users WHERE username = ? OR (email = ? AND email_verified_at IS NOT NULL) LIMIT 1', [identity, identity.toLowerCase()]);
+      const user = rows[0] || null;
+      const settings = await fetchAppSettings(pool);
+      if (user && user.email && user.email_verified_at && typeof sendAccountEmail === 'function' && typeof createOneTimeToken === 'function') {
+        const token = createOneTimeToken();
+        await pool.query('DELETE FROM a_account_tokens WHERE user_id = ? AND token_type = ?', [user.id, 'password-reset']);
+        await pool.query('INSERT INTO a_account_tokens (user_id, token_type, token_hash, expires_at) VALUES (?, ?, ?, DATE_ADD(NOW(), INTERVAL 30 MINUTE))', [user.id, 'password-reset', hashSessionToken(token)]);
+        const resetUrl = getRequestOrigin(req) + '/reset-password?token=' + encodeURIComponent(token);
+        try {
+          await sendAccountEmail(settings, Object.assign({ to: user.email }, renderAccountEmailTemplate(settings['email.reset_subject'], settings['email.reset_body'], { url: resetUrl, username: user.username, display_name: user.name, email: user.email, action_alignment: settings['email.reset_button_alignment'], action_label: settings['email.reset_button_text'] })));
+          if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'security', eventType: 'password.reset_requested', targetType: 'user', targetId: user.id, targetLabel: user.username });
+        } catch (_mailError) {
+          await pool.query('DELETE FROM a_account_tokens WHERE token_hash = ?', [hashSessionToken(token)]);
+        }
+      }
+      res.send(pages.renderForgotPasswordPage(genericMessage));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  app.get('/reset-password', async function (req, res, next) {
+    try {
+      const token = String(req.query.token || '').trim();
+      if (!token) return res.redirect('/forgot-password');
+      res.send(pages.renderResetPasswordPage('', token, await getPasswordRequirements()));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  app.post('/reset-password', async function (req, res, next) {
+    try {
+      const token = String(req.body.token || '');
+      const password = String(req.body.password || '');
+      const confirmPassword = String(req.body.confirm_password || '');
+      const [rows] = await pool.query('SELECT t.id AS token_id, t.user_id, u.username, u.email FROM a_account_tokens t JOIN a_users u ON u.id = t.user_id WHERE t.token_hash = ? AND t.token_type = ? AND t.used_at IS NULL AND t.expires_at > NOW() LIMIT 1', [hashSessionToken(token), 'password-reset']);
+      const record = rows[0] || null;
+      if (!record) return res.status(400).send(pages.renderResetPasswordPage('This reset link is invalid or has expired.', token, await getPasswordRequirements()));
+      const strengthMessage = deps.validatePasswordStrength(password, await getPasswordRequirements());
+      if (strengthMessage || password !== confirmPassword) return res.status(400).send(pages.renderResetPasswordPage(strengthMessage || 'Passwords do not match.', token, await getPasswordRequirements()));
+      const passwordRecord = deps.hashPassword(password);
+      await pool.query('UPDATE a_users SET password_hash = ?, password_salt = ?, password_iterations = ?, must_change_password = 0, modified_at = CURRENT_TIMESTAMP WHERE id = ?', [passwordRecord.hash, passwordRecord.salt, passwordRecord.iterations, record.user_id]);
+      await pool.query('UPDATE a_account_tokens SET used_at = NOW() WHERE id = ?', [record.token_id]);
+      await pool.query('DELETE FROM a_sessions WHERE user_id = ?', [record.user_id]);
+      if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'security', eventType: 'password.reset', targetType: 'user', targetId: record.user_id, targetLabel: record.username, details: { source: 'email' } });
+      res.redirect('/login?message=' + encodeURIComponent('Password updated. You can now sign in.'));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  app.get('/verify-email', async function (req, res, next) {
+    try {
+      const tokenHash = hashSessionToken(String(req.query.token || ''));
+      const [rows] = await pool.query('SELECT id FROM a_users WHERE pending_email_token_hash = ? AND pending_email_expires_at > NOW() LIMIT 1', [tokenHash]);
+      const user = rows[0] || null;
+      if (!user) return res.status(400).send(pages.renderEmailVerificationErrorPage('This email verification link is invalid or has expired.'));
+      await pool.query('UPDATE a_users SET email = pending_email, email_verified_at = NOW(), pending_email = NULL, pending_email_token_hash = NULL, pending_email_expires_at = NULL WHERE id = ?', [user.id]);
+      if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'security', eventType: 'email.verification_completed', targetType: 'user', targetId: user.id });
+      res.send(pages.renderEmailVerifiedPage());
+    } catch (error) {
+      next(error);
+    }
+  });
+
  app.get('/', function (req, res) {
    res.redirect(req.currentUser ? '/dashboard' : '/login');
  });
@@ -90,7 +230,11 @@ module.exports = function registerAuthRoutes(app, deps) {
    const message = typeof consumeAuthMessageCookie === 'function'
      ? consumeAuthMessageCookie(req, res)
      : (req.query.message ? String(req.query.message) : '');
-    res.send(pages.renderLoginPage(message, returnTo, req.query.username ? String(req.query.username) : ''));
+    fetchAppSettings(pool).then(function (settings) {
+      res.send(pages.renderLoginPage(message, returnTo, req.query.username ? String(req.query.username) : '', Boolean(settings['email.smtp_enabled'])));
+    }).catch(function (error) {
+      res.status(500).send(error.message || 'Unable to load login settings.');
+    });
  });

  app.post('/login', async function (req, res, next) {
@@ -123,8 +267,12 @@ module.exports = function registerAuthRoutes(app, deps) {
        return res.status(401).send(pages.renderLoginPage(message, returnTo, username));
      }

-      const [rows] = await pool.query('SELECT id, name, username, password_hash, password_salt, password_iterations, account_locked FROM a_users WHERE username = ? LIMIT 1', [username]);
-      const user = rows[0] || null;
+      const [usernameRows] = await pool.query('SELECT id, name, username, password_hash, password_salt, password_iterations, account_locked FROM a_users WHERE username = ? LIMIT 1', [username]);
+      let user = usernameRows[0] || null;
+      if (!user) {
+        const [emailRows] = await pool.query('SELECT id, name, username, password_hash, password_salt, password_iterations, account_locked FROM a_users WHERE email = ? AND email_verified_at IS NOT NULL LIMIT 1', [username.toLowerCase()]);
+        user = emailRows[0] || null;
+      }
      if (user && user.account_locked) {
        if (typeof recordRequestAuditEvent === 'function') {
          await recordRequestAuditEvent(pool, req, {