" + html.EscapeString(c.greeting) + "
") + for _, p := range c.paragraphs { + text.WriteString(p + "\n\n") + h.WriteString("" + html.EscapeString(p) + "
") + } + if c.actionURL != "" { + text.WriteString(c.actionLabel + ":\n" + c.actionURL + "\n\n") + h.WriteString(`` + html.EscapeString(c.actionLabel) + `
`) + } + text.WriteString(footer + "\n") + h.WriteString(`` + html.EscapeString(footer) + `
`) + return mailer.Message{To: to, ToName: toName, Subject: "[" + a.set.fromName + "] " + c.subject, + HTML: h.String(), Text: text.String(), Tag: tag} +} + +func (a *authService) activationMail(u *users.User, token string) mailer.Message { + return a.render(u.Email, u.DisplayName, "activate", mailContent{ + subject: "Activate your account", greeting: "Hello " + u.DisplayName + ",", + paragraphs: []string{"Confirm your address to activate your account. The link works once and expires in 48 hours.", + "When you open the link, enter the password you chose when you registered."}, + actionLabel: "Activate my account", actionURL: a.link("activate", token)}) +} + +func (a *authService) resetMail(u *users.User, token string) mailer.Message { + return a.render(u.Email, u.DisplayName, "reset", mailContent{ + subject: "Reset your password", greeting: "Hello " + u.DisplayName + ",", + paragraphs: []string{"Someone asked to reset the password of your account. The link works once and expires in 1 hour. Using it logs out all your devices."}, + actionLabel: "Choose a new password", actionURL: a.link("reset", token)}) +} + +func (a *authService) registerNoticeMail(u *users.User) mailer.Message { + return a.render(u.Email, u.DisplayName, "register-notice", mailContent{ + subject: "Registration attempt with your address", greeting: "Hello " + u.DisplayName + ",", + paragraphs: []string{"Someone tried to register a new account with your address, but you already have one.", + "If it was you, log in, or use \"forgot password\" if you lost it."}, + actionLabel: "Log in", actionURL: a.set.baseURL.String() + "/#/account/login"}) +} + +func (a *authService) emailChangeConfirmMail(u *users.User, newEmail, token string) mailer.Message { + return a.render(newEmail, u.DisplayName, "email-change", mailContent{ + subject: "Confirm your new address", greeting: "Hello " + u.DisplayName + ",", + paragraphs: []string{"Confirm that this address should replace the one on your account. The link expires in 24 hours."}, + actionLabel: "Confirm new address", actionURL: a.link("confirm-email", token)}) +} + +func (a *authService) emailChangeNoticeMail(u *users.User, newEmail string) mailer.Message { + return a.render(u.Email, u.DisplayName, "email-change-notice", mailContent{ + subject: "Address change requested", greeting: "Hello " + u.DisplayName + ",", + paragraphs: []string{"A change of your account address to " + newEmail + " was requested. It takes effect only when confirmed from the new address.", + "If this was not you, change your password now."}}) +} + +// addrRE matches anything around an @ up to whitespace or a character that +// cannot appear unquoted in an address, so RFC 5322 atext specials and +// UTF-8 local parts and domains are covered. +var addrRE = regexp.MustCompile(`[^\s"<>()\[\],;:]+@[^\s"<>()\[\],;:]+`) + +// redactAddrs renders a mailer/provider error for the server log with every +// email address replaced byh
", Text: "t", Tag: "activate"}) + if err != nil || id != "<201798300811.5787683@relay.domain.com>" { + t.Fatalf("Send = %q, %v", id, err) + } + if gotPath != "/smtp/email" || gotKey != "xkeysib-test" { + t.Fatalf("path=%q key=%q", gotPath, gotKey) + } + sender := body["sender"].(map[string]any) + to := body["to"].([]any)[0].(map[string]any) + if sender["email"] != "noreply@example.org" || sender["name"] != "CoreScope" || + to["email"] != "a@example.org" || to["name"] != "Alice" || + body["subject"] != "S" || body["htmlContent"] != "h
" || body["textContent"] != "t" || + body["tags"].([]any)[0] != "activate" { + t.Fatalf("request body = %+v", body) + } +} + +func TestBrevoSendErrorMapping(t *testing.T) { + srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.WriteHeader(http.StatusUnauthorized) + w.Write([]byte(`{"code":"unauthorized","message":"Key not found"}`)) + })) + defer srv.Close() + b := NewBrevo("bad", "noreply@example.org", "") + b.BaseURL = srv.URL + _, err := b.Send(context.Background(), Message{To: "a@example.org", Text: "t"}) + if err == nil || !strings.Contains(err.Error(), "401") || !strings.Contains(err.Error(), "Key not found") { + t.Fatalf("err = %v", err) + } + if strings.Contains(err.Error(), "bad") { + t.Fatal("API key leaked into the error text") + } +} + +func TestBrevoEvents(t *testing.T) { + var gotQuery string + srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + gotQuery = r.URL.RawQuery + w.Write([]byte(`{"events":[ + {"date":"2026-10-06T12:00:05.000+02:00","email":"a@example.org","event":"requests","messageId":"' + intro + '
' + (hint ? '' + hint + '
' : '') + + '' + links + '
Signed in as ' + escapeHtml(u.email) + (u.role === 'admin' ? ' (admin)' : '') + '
' + + 'Forgot password? · Create an account
'); + onSubmit('loginForm', function () { + return CSAuth.request('POST', '/api/auth/login', { email: val('loginEmail'), password: val('loginPassword') }).then(function (r) { + if (!r.ok) { say(errText(r), false); return; } + CSAuth.setUser(r.data); + location.hash = '#/account'; + }); + }); + }, + + register: function (app) { + app.innerHTML = shell('Create an account', + '' + + 'Already registered? Log in
'); + onSubmit('registerForm', function () { + var email = val('regEmail'); + return CSAuth.request('POST', '/api/auth/register', { + email: email, displayName: val('regName'), password: val('regPassword') + }).then(function (r) { + if (!r.ok) { say(errText(r), false); return; } + goCheckMail('register', email); + }); + }); + }, + + 'check-mail': function (app) { + app.innerHTML = checkMailHtml(mailSent); + var h = document.getElementById('mailSentHeading'); + if (h && h.focus) h.focus(); + }, + + activate: function (app) { + var token = takeToken('activate'); + if (!token) { + app.innerHTML = shell('Activate your account', msgBox() + ''); + say('This link is incomplete. Open the link from the mail again.', false); + return; + } + app.innerHTML = shell('Activate your account', + '' + + ''); + onSubmit('activateForm', function () { + return CSAuth.request('POST', '/api/auth/activate', { token: token, password: val('actPassword') }).then(function (r) { + if (r.status === 401) { say('Wrong password for this account', false); return; } + if (!r.ok) { + say(errText(r), false); + // An already active account needs a login, not a new registration. + if (!/already activated/i.test(errText(r))) showGone(r, '#/account/register', 'Register again to get a new link'); + return; + } + say('Your account is active. You are logged in.', true); + CSAuth.setUser(r.data); + location.hash = '#/account'; + }); + }); + }, + + forgot: function (app) { + app.innerHTML = shell('Forgot password', + ''); + onSubmit('forgotForm', function () { + var email = val('forgotEmail'); + return CSAuth.request('POST', '/api/auth/forgot', { email: email }).then(function (r) { + if (!r.ok) { say(errText(r), false); return; } + goCheckMail('forgot', email); + }); + }); + }, + + reset: function (app) { + var token = takeToken('reset'); + app.innerHTML = shell('Choose a new password', + '' + + ''); + onSubmit('resetForm', function () { + if (val('resetPassword') !== val('resetPassword2')) { say('The passwords do not match.', false); return; } + return CSAuth.request('POST', '/api/auth/reset', { token: token, password: val('resetPassword') }).then(function (r) { + say(r.ok ? r.data.message : errText(r), r.ok); + // The reset ended every session, this browser's included. + if (r.ok) CSAuth.setUser(null); + if (!r.ok) showGone(r, '#/account/forgot', 'Send a new link'); + }); + }); + }, + + 'confirm-email': function (app) { + var p = tokenView(app, 'Confirm your new address', 'confirm-email', '/api/account/confirm-email', null, + { href: '#/account', label: 'Send a new link from your account page' }); + if (p) p.then(function (r) { if (r && r.ok && CSAuth.user()) CSAuth.refreshMe(); }); + }, + + profile: function (app) { + var u = CSAuth.user(); + if (!u) { location.hash = '#/account/login'; return; } + shown.app = app; + shown.userId = u.id; + app.innerHTML = profileHtml(u); + document.getElementById('profName').value = u.displayName; + + document.getElementById('accountPageLogout').addEventListener('click', function () { + return CSAuth.logout('#/account/login').then(function (r) { + if (!r.ok) say(errText(r), false, 'logoutMsg'); + }, function () { say('Network error, try again.', false, 'logoutMsg'); }); + }); + + onSubmit('profileForm', function () { + return CSAuth.request('PATCH', '/api/account', { displayName: val('profName') }).then(function (r) { + if (r.ok) CSAuth.setUser(r.data); + say(r.ok ? 'Saved.' : errText(r), r.ok, 'profMsg'); + }); + }, 'profMsg'); + onSubmit('pwForm', function (form) { + return CSAuth.request('POST', '/api/account/password', { currentPassword: val('pwCurrent'), newPassword: val('pwNew') }).then(function (r) { + if (r.ok) form.reset(); + say(r.ok ? r.data.message : errText(r), r.ok, 'pwMsg'); + if (r.ok) loadSessions(); + }); + }, 'pwMsg'); + onSubmit('emailForm', function (form) { + return CSAuth.request('POST', '/api/account/email', { newEmail: val('emailNew'), currentPassword: val('emailPw') }).then(function (r) { + if (r.ok) form.reset(); + say(r.ok ? r.data.message : errText(r), r.ok, 'emailMsg'); + }); + }, 'emailMsg'); + onSubmit('delForm', function () { + if (!confirm('Delete your account permanently?')) return; + return CSAuth.request('DELETE', '/api/account', { currentPassword: val('delPw') }).then(function (r) { + if (!r.ok) { say(errText(r), false, 'delMsg'); return; } + CSAuth.setUser(null); + CSAuth.notify('Your account was deleted.'); + location.hash = '#/home'; + }); + }, 'delMsg'); + + function loadSessions() { + return CSAuth.request('GET', '/api/account/sessions').then(function (r) { + var list = document.getElementById('sessList'); + if (!list) return; + if (!r.ok) { say(errText(r), false, 'sessMsg'); return; } + list.innerHTML = sessionsHtml(r.data); + }).catch(function () { say('Network error, try again.', false, 'sessMsg'); }); + } + document.getElementById('sessList').addEventListener('click', function (e) { + var id = e.target && e.target.getAttribute && e.target.getAttribute('data-sess'); + if (!id) return; + CSAuth.request('DELETE', '/api/account/sessions/' + encodeURIComponent(id)).then(function (r) { + say(r.ok ? 'Device logged out.' : errText(r), r.ok, 'sessMsg'); + loadSessions(); + }).catch(function () { say('Network error, try again.', false, 'sessMsg'); }); + }); + loadSessions(); + } + }; + + function init(app, routeParam) { + if (!window.CSAuth) { app.innerHTML = shell('Accounts', 'Accounts are not available.
'); return; } + app.innerHTML = shell('Accounts', 'Loading…
'); + CSAuth.ready().then(function () { + if (!CSAuth.isEnabled()) { app.innerHTML = shell('Accounts', 'Accounts are not enabled on this instance.
'); return; } + views[viewName(routeParam)](app); + }); + } + + // Logout (here, in the header or by a 401) leaves the profile for the + // login view; another user logging in re-renders it. A display-name save + // is the same user and keeps the form and its message. + window.addEventListener('cs-auth-changed', function (e) { + if (currentView() !== 'profile' || !shown.app) return; + var u = e.detail; + if (!u) { location.hash = '#/account/login'; return; } + if (u.id !== shown.userId) views.profile(shown.app); + }); + + registerPage('account', { init: init, destroy: function () {} }); + window.CSAccount = { _test: { profileHtml: profileHtml, sessionsHtml: sessionsHtml, renewLinkHtml: renewLinkHtml, views: views, checkMailHtml: checkMailHtml } }; +})(); diff --git a/public/admin-users.js b/public/admin-users.js new file mode 100644 index 00000000..eb4a69ef --- /dev/null +++ b/public/admin-users.js @@ -0,0 +1,255 @@ +/* #/admin/users: admin user management (optional user management). + * Table with filters, per-row actions, and a detail panel with the mail + * delivery timeline and audit log. Every dynamic value goes through escapeHtml. + * Deep link: #/admin/users?status=&role=&q=&id= (read in init, written back + * with replaceState so filter changes add no history entries). */ +(function () { + 'use strict'; + var filters = { status: '', role: '', q: '' }; + var openId = null; + var loadSeq = 0; + // The page on screen and whether it was rendered for an admin, so an auth + // change can redirect or re-render (null app: page left). + var mounted = { app: null, admin: false }; + var STATUSES = ['pending', 'active', 'disabled']; + var ROLES = ['user', 'admin']; + + function errText(r) { return (r.data && r.data.error) || ('Request failed (HTTP ' + r.status + ')'); } + function fmt(iso) { if (!iso) return '—'; try { return new Date(iso).toLocaleString(); } catch (_) { return iso; } } + function say(text, ok) { + var el = document.getElementById('umMsg'); + if (!el) return; + el.textContent = text; + el.classList.toggle('ok', !!ok); + el.classList.toggle('err', !ok); + } + function netErr() { say('Network error, try again.', false); } + function chip(event, reason) { + var e = String(event || 'sent'); + return '' + escapeHtml(e.replace(/_/g, ' ')) + ''; + } + + // Only known filter values and a numeric id are taken from the address bar. + function readHash(hash) { + var p = new URLSearchParams(String(hash || '').split('?')[1] || ''); + var pick = function (v, allowed) { return allowed.indexOf(v) !== -1 ? v : ''; }; + var id = p.get('id') || ''; + return { status: pick(p.get('status'), STATUSES), role: pick(p.get('role'), ROLES), q: p.get('q') || '', id: /^\d+$/.test(id) ? id : '' }; + } + function hashFor(f, id) { + var p = new URLSearchParams(); + if (f.status) p.set('status', f.status); + if (f.role) p.set('role', f.role); + if (f.q) p.set('q', f.q); + if (id) p.set('id', id); + var s = p.toString(); + return '#/admin/users' + (s ? '?' + s : ''); + } + function syncHash() { + var h = hashFor(filters, openId); + if (h !== location.hash) history.replaceState(null, '', h); + } + + // Mirrors the server guards (admin_users_handlers.go): disable only active, + // enable only disabled, role change not for pending, no self/config-admin removal. + function actionsFor(u, me) { + me = me || {}; + var b = function (act, label) { + return ''; + }; + var self = u.id === me.id; + var out = [b('detail', 'Details')]; + if (u.status === 'pending') out.push(b('activate', 'Activate'), b('resend', 'Resend mail')); + if (u.status === 'active' && !self && !u.configAdmin) out.push(b('disable', 'Disable')); + if (u.status === 'disabled') out.push(b('enable', 'Enable')); + if (u.status !== 'pending' && !u.configAdmin) out.push(u.role === 'admin' ? b('demote', 'Make user') : b('promote', 'Make admin')); + if (!self && !u.configAdmin) out.push(b('delete', 'Delete')); + return '' + escapeHtml(String((d.sessions || []).length)) + ' active session(s). "Opened" depends on tracking pixels: some mail apps load them automatically, others block them.
' + + 'Loading…
Admins only. Log in
| Name | Role | Status | Last mail | ' + + 'Created | Last login | Actions | ' + + '
|---|
Network error, reload the page.