5bdf3d8 · 4458289 · c718d35 · 862f5e3
@@ -343,7 +343,7 @@
to `/recover`: give the email on your account and, if it is verified, a link
that lasts 30 minutes and works once registers a new passkey and signs you in.
The relying party is the address the browser used (or
`FORGE_URL`), so a passkey does not follow a forge to another hostname.
Sign-up is a username, an email address and a passkey (`/signup`, `src/web/pages/signup-passkey.ts`); the running server refuses a password-only sign-up on the form, `POST /api/v1/users` and the terminal (`passkeyOnlySignup`, set in `main.ts`). Accounts that already have a password still sign in. The owner claim of a spawned forge (`/claim`, `web/pages/claim.ts`) and an admin's everyday account (`web/pages/everyday.ts`) make their account with a passkey too (`web/passkey-ceremony.ts`, challenges from `POST /claim/options` and `POST /settings/everyday/options`); neither reads a password, and without JavaScript the page says a passkey needs it. A claim post with no passkey is refused and does not spend the link.
Sign-up is a username and a password of at least 12 characters (`/signup`, `POST /api/v1/users` with `{username, password, email?}`, the terminal), hashed with argon2id; the email is optional and, when given, gets the verify link (an account with none has nothing to prove). A passkey (`src/web/pages/signup-passkey.ts`, which does take an email) is offered beside the password. Nothing in the path touches an edge, parent or Forgejo account. An operator can still refuse password sign-ups with `passkeyOnlySignup`. The owner claim of a spawned forge (`/claim`, `web/pages/claim.ts`) and an admin's everyday account (`web/pages/everyday.ts`) make their account with a passkey too (`web/passkey-ceremony.ts`, challenges from `POST /claim/options` and `POST /settings/everyday/options`); neither reads a password, and without JavaScript the page says a passkey needs it. A claim post with no passkey is refused and does not spend the link.
A forge with a parent (`FORGE_PARENT_URL`, or the `upstream` in a spawned
forge's `parent.json`) offers "Continue with <parent>" on `/signin`. The forge
@@ -34,6 +34,7 @@
import {
  type ProfilePatch,
  type UpdateProfileError,
  type User,
  isStandInEmail,
} from "../core/users.ts";
import { err, ok, type Result } from "../kernel/result.ts";
import { requireUser } from "./access.ts";
@@ -41,7 +42,8 @@
import type { SignupSlot } from "./signup-window.ts";
export interface SignUpInput {
  username: string;
  email: string;
  /** Optional: absent or blank, the account has none and nothing is mailed. */
  email?: string;
  password: string;
  /** The Turnstile token the browser's widget gave; read only when a secret is set. */
  humanToken?: string;
@@ -50,6 +52,7 @@
export interface SignUpInput {
export type SignUpError =
  | CreateUserError
  | "human_check"
  | "invalid_email"
  | "passkey_required"
  | "signup_closed";
@@ -79,6 +82,19 @@
export function plausibleEmail(email: string): boolean {
  return email.length <= 254 && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
}
/** The shortest password a sign-up takes. */
export const MIN_SIGNUP_PASSWORD = 12;
/**
 * Stands in for the address of an account that gave none: the column is
 * unique and never empty, and `.invalid` is a name no mail can reach
 * (the same device the crew's addresses use).
 */
      
        sentinelcrew
        25d ago
        outdated
      
      Medium: updateProfile (core/users.ts) still accepts [email protected]. Another account can take this stand-in, and so can an old one after a rename, and the settings page shows it as the person's email. Refuse .invalid in updateProfile and render a stand-in as empty.
    
const noEmail = (username: string): string => `${username.toLowerCase()}@no-email.invalid`;
/** Whether an address is one a person could have given: plausible and not a stand-in. */
const givenEmail = (email: string): boolean => plausibleEmail(email) && !isStandInEmail(email);
/** What a person is told when the check fails. */
export const HUMAN_CHECK_MESSAGE =
  "We could not tell you are a person. Reload the page and try again.";
@@ -101,12 +117,15 @@
export async function signUp(
    address?: string | undefined;
  },
): Promise<Result<User, SignUpError>> {
  // Password sign-in stays for the accounts that have a password. It can go
  // when every such account has a passkey (Settings → Passkeys shows who is
  // left) and recovery without a password exists (#1618): then delete this
  // action's password path, `verifyPasswordThrottled`'s doors and the password column.
  // A username and a password is a way in that stays, beside the passkey
  // (#2923; it once was to go, #1618). Email is optional: given, the verify
  // link goes to it. Either way the account starts unproven: adding and
  // proving an address in settings is what lets it create and cost.
  if (signupClosed(app, from.invite)) return err("signup_closed");
  if (app.config.passkeyOnlySignup === true) return err("passkey_required");
  const email = (input.email ?? "").trim();
  if (email !== "" && !givenEmail(email)) return err("invalid_email");
  if (input.password.length < MIN_SIGNUP_PASSWORD) return err("weak_password");
  const secret = app.config.turnstileSecret;
  // The terminal cannot render a widget, so with a secret set it brings no
  // token and is refused, the forge's first account too: sign up on the web page.
@@ -116,8 +135,14 @@
export async function signUp(
    if (!(await verify(input.humanToken ?? "", from.address)))
      return err("human_check");
  }
  const { humanToken: _token, ...account } = input;
  const created = await createUser(app.db, { ...account, origin: "signup", slot: from.slot, invite: from.invite });
  const created = await createUser(app.db, {
    username: input.username,
    password: input.password,
    email: email === "" ? noEmail(input.username) : email,
      
        sentinelcrew
        25d ago
        outdated
      
      High: no email means no verification needed, so leaving out one field skips the verify gate (requireVerified, crew dispatch). Leave these accounts unproven. Adding and proving an email should be what unlocks creating and spending.
    
    origin: "signup",
    slot: from.slot,
    invite: from.invite,
  });
  if (!created.ok) return created;
  app.bus.append({
    kind: "user.created",
@@ -130,7 +155,7 @@
export async function signUp(
  auditInvite(app, created.value.id);
  // The address is proven by the link it is sent; until then nothing it
  // does may create or cost.
  await welcome(app, created.value);
  if (email !== "") await welcome(app, created.value);
  return created;
}
@@ -137,9 +137,8 @@
export interface ForgeConfig {
  /**
   * Refuse every sign-up that would make an account with only a password:
   * the web form, `POST /api/v1/users` and the terminal answer in words,
   * and `signUpWithPasskey` is the one way in. `main.ts` sets it; the
   * library default is off so a test can still seed accounts with a
   * password.
   * and `signUpWithPasskey` is the one way in. An operator's choice, off
   * by default: a username and a password sign up (#2923).
   */
  passkeyOnlySignup?: boolean;
  /**
@@ -388,6 +388,9 @@
export type UpdateProfileError =
  | "invalid_commit_email"
  | "no_such_user";
/** Whether an address is a stand-in (`.invalid`): no mail reaches it, no person gave it. */
export const isStandInEmail = (email: string): boolean => /\.invalid$/i.test(email.trim());
/** Change the mutable profile fields. Absent keys are left untouched. */
export function updateProfile(
  db: Database,
@@ -396,10 +399,14 @@
export function updateProfile(
): Result<User, UpdateProfileError> {
  const current = getUserById(db, userId);
  if (!current || current.kind === "org") return err("no_such_user");
  const email = patch.email?.trim() ?? current.email;
  let email = patch.email?.trim() ?? current.email;
  // The form shows a stand-in as empty; leaving it so keeps it.
  if (email === "" && isStandInEmail(current.email)) email = current.email;
  if (email === "" || email.length > MAX_EMAIL || !email.includes("@"))
    return err("invalid_email");
  if (email.toLowerCase() !== current.email.toLowerCase()) {
    // Stand-ins belong to the accounts that gave no address; nobody may take one.
    if (isStandInEmail(email)) return err("invalid_email");
    const taken = db
      .query("SELECT 1 FROM user WHERE email = ?1 COLLATE NOCASE AND id != ?2")
      .get(email, userId);
@@ -1215,6 +1215,8 @@
export function apiRoutes(router: Router<Handler>): void {
  // ── accounts ─────────────────────────────────────────────────────────
  router.add("POST", "/api/v1/users", async (ctx) => {
    // A page on another site cannot sign a visitor up from here.
    if (crossOrigin(ctx.request, ctx.url, ctx.app.log)) return forbidden();
    const slot = signupSlot(ctx);
    if (typeof slot === "number")
      return json(
@@ -219,8 +219,6 @@
const app = createApp({
  Number(process.env.FORGE_MAIL_DAILY) > 0
    ? { mailDailyCap: Number(process.env.FORGE_MAIL_DAILY) }
    : {}),
  // No door makes a password-only account (#1996).
  passkeyOnlySignup: true,
  // Signup asks Cloudflare Turnstile when its secret is set.
  ...(turnstileSecret === ""
    ? {}
@@ -840,7 +840,7 @@
const MESSAGES: Record<string, string> = {
  email_taken: "that email address is taken",
  key_exists: "that key is already registered",
  taken: "that name is taken",
  weak_password: "the password must be at least 10 characters",
  weak_password: "the password is too short (10 characters at least)",
      
        sentinelcrew
        25d ago
        outdated
      
      Low: password change in the terminal shows this message too, but its minimum is still 10. Give the sign-up refusal its own message.
    
  bad_credentials: "wrong username or password",
  throttled: "too many attempts: try again in a minute",
  already_forked: "you already have a fork of this repo",
@@ -35,10 +35,13 @@
const SIGN_IN: Field[] = [
const CREATE: Field[] = [
  { label: "Username" },
  { label: "Email" },
  { label: "Password", secret: true, hint: "At least 10 characters." },
  { label: "Email", hint: "Optional." },
  { label: "Password", secret: true, hint: "At least 12 characters." },
];
/** What sign-up says to a short password; the password change form keeps its own wording. */
export const SIGNUP_WEAK_MESSAGE = "the password is too short (sign-up needs 12 characters)";
/** While signup is `invite` the create form also asks for the link's token. */
const INVITE_BLANK_MESSAGE = "Paste the token from your invite link.";
const INVITE: Field = { label: "Invite", secret: true, hint: "The token from your invite link." };
@@ -109,7 +112,9 @@
export function signInScreen(f: Session, ctx: Ctx, onDone: () => void): Screen {
          );
      
        sentinelcrew
        25d ago
        outdated
      
      This nested ternary with a string literal inline is hard to read. Lift it into a named constant beside INVITE_SPENT_MESSAGE, for example const SIGNUP_WEAK_MESSAGE = "the password is too short (sign-up needs 12 characters)", and branch on it in an if. Then the new terminal test can assert on the constant.
    
          if (!created.ok) {
            // With signup = invite a refusal means the token did not open the door.
            error = needsInvite && created.error === "signup_closed" ? INVITE_SPENT_MESSAGE : errorText(created.error);
            if (needsInvite && created.error === "signup_closed") error = INVITE_SPENT_MESSAGE;
            else if (created.error === "weak_password") error = SIGNUP_WEAK_MESSAGE;
            else error = errorText(created.error);
            return;
          }
          const adopted = f.adopt(created.value);
@@ -36,6 +36,7 @@
import { endAccountSession } from "../../actions/signins.ts";
import { listSessions, type SessionInfo } from "../../core/sessions.ts";
import { ADMIN_TOKEN_WORDS, listTokens, type TokenScope } from "../../core/tokens.ts";
import type { CommitEmail, User } from "../../core/users.ts";
import { isStandInEmail } from "../../core/users.ts";
import { cookieValue, type Ctx } from "../../http/context.ts";
import { sshCommand } from "../../ssh/command.ts";
import {
@@ -100,7 +101,7 @@
interface ProfileForm {
/** The profile form as the account stands now. */
const currentProfile = (user: User): ProfileForm => ({
  displayName: user.displayName,
  email: user.email,
  email: isStandInEmail(user.email) ? "" : user.email,
  commitEmail: user.commitEmail,
});
@@ -224,12 +225,16 @@
function unverifiedNotice(ctx: Ctx): Html {
  return card(
    html`<p>
        Your email is not verified yet. Until it is, you can read and talk,
        but not make repositories, apps or runs. Follow the link we sent to
        <strong>${user.email}</strong>, or ask for another.
        but not make repositories, apps or runs.
        ${isStandInEmail(user.email)
          ? html`Add your email below and follow the link we send to it.`
          : html`Follow the link we sent to <strong>${user.email}</strong>, or ask for another.`}
      </p>
      <form method="post" action="/settings/email/verify">
      ${isStandInEmail(user.email)
        ? html``
        : html`<form method="post" action="/settings/email/verify">
        ${btn("Send another link", { type: "submit" })}
      </form>`,
      </form>`}`,
    { tone: "attn" },
  );
}
@@ -278,8 +278,8 @@
function authForm(
      </div>`,
  );
  // No door makes a password-only account: sign-up is a name, an address and
  // a passkey, made in the browser (`signup-passkey.ts`).
  // Only an operator who set `passkeyOnlySignup` gets a form with no
  // password: a name, an address and a passkey (`signup-passkey.ts`).
  const byPasskey = kind === "signup" && ctx.app.config.passkeyOnlySignup === true;
  // Sign-in leads with the passkey: one press, nothing typed; the password
@@ -326,7 +326,7 @@
function authForm(
          type: "email",
          value: values.email ?? "",
          autocomplete: "email",
          required: true,
          hint: "Optional. Given, we send a link to prove it.",
          // A pinned name is not editable, so the keyboard goes to the email.
          ...(vouched !== undefined ? { autofocus: true } : {}),
          ...(errors.email ? { error: errors.email } : {}),
@@ -340,7 +340,7 @@
function authForm(
          autocomplete: kind === "signin" ? "current-password" : "new-password",
          required: true,
          ...(kind === "signup"
            ? { minlength: 10, hint: "At least 10 characters." }
            ? { minlength: 12, hint: "At least 12 characters." }
            : {}),
          ...(errors.password ? { error: errors.password } : {}),
        }),
@@ -359,6 +359,17 @@
function authForm(
        <p class="error-note mb" id="passkey-signup-note" role="alert">${errors.password ?? ""}</p>
        <noscript><p class="muted small">Signing up needs JavaScript for the passkey.</p></noscript>`,
      )}
      ${when(
        kind === "signup" && !byPasskey,
        () => html`<div class="passkey-on">
          <p class="muted small mb">
            Or skip the password: a passkey signs you in with a fingerprint,
            face or device PIN. It needs an email address above.
          </p>
          <p class="error-note mb" id="passkey-signup-note" role="alert"></p>
          <button type="button" id="passkey-signup" class="btn" data-variant="outline">Create account with a passkey</button>
      
        sentinelcrew
        25d ago
        
      
      Low: this button is hand-rolled markup rather than the named btn() component. The other passkey buttons on this page do the same because they need an id, so this matches the file and does not block on its own. If btn() can take an id, use it here.
    
      
        sentinelcrew
        25d ago
        
      
      Non-blocking: this is a hand-rolled button. It matches the existing passkey button, but both should move onto btn() once it can take an id.
    
        </div>`,
      )}
      ${when(
        errors.human,
        (message) => html`<p class="error mb" role="alert">${message}</p>`,
@@ -469,7 +480,7 @@
export function signupPage(ctx: Ctx): Response {
    title: "Sign up",
    body: authForm(ctx, "signup"),
    turnstile: siteKey(ctx) !== undefined,
    ...(ctx.app.config.passkeyOnlySignup === true ? { scriptJs: passkeyJs } : {}),
    scriptJs: passkeyJs,
  });
}
@@ -627,7 +638,7 @@
export async function signupSubmit(ctx: Ctx): Promise<Response> {
          },
        }),
        turnstile: siteKey(ctx) !== undefined,
        ...(ctx.app.config.passkeyOnlySignup === true ? { scriptJs: passkeyJs } : {}),
        scriptJs: passkeyJs,
      },
      429,
    );
@@ -653,7 +664,8 @@
export async function signupSubmit(ctx: Ctx): Promise<Response> {
      username_taken: { username: "That username is taken." },
      username_reserved: { username: "That name is reserved." },
      email_taken: { email: "That email already has an account." },
      weak_password: { password: "Passwords need at least 10 characters." },
      weak_password: { password: "Passwords need at least 12 characters." },
      invalid_email: { email: "That does not look like an email address." },
      human_check: { human: HUMAN_CHECK_MESSAGE },
      passkey_required: { human: PASSKEY_REQUIRED_MESSAGE },
    }[created.error] ?? { username: "Something went wrong." };
@@ -663,7 +675,7 @@
export async function signupSubmit(ctx: Ctx): Promise<Response> {
        title: "Sign up",
        body: authForm(ctx, "signup", { values: { username, email }, errors }),
        turnstile: siteKey(ctx) !== undefined,
        ...(ctx.app.config.passkeyOnlySignup === true ? { scriptJs: passkeyJs } : {}),
        scriptJs: passkeyJs,
      },
      422,
    );
@@ -0,0 +1,141 @@
/**
 * Sign-up with a username and a password, email optional (#2923): the
 * account is made with neither passkey nor email and signs in; a short
 * password, a closed forge and a cross-origin post are refused; none of it
 * needs an edge or origin configured.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { requireVerified } from "../src/actions/verify.ts";
import { updateProfile } from "../src/core/users.ts";
import { emailVerified } from "../src/core/verify.ts";
import { getUserByName, verifyPasswordThrottled } from "../src/core/users.ts";
import { setLimit } from "../src/settings/limits.ts";
import { setSignup } from "../src/settings/signup.ts";
import { serve, type Servers } from "../src/http/server.ts";
describe("password sign-up", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  const mails: { to: string }[] = [];
  const post = (body: unknown, headers: Record<string, string> = {}) =>
    fetch(`${base}/api/v1/users`, {
      method: "POST",
      headers: { "content-type": "application/json", ...headers },
      body: JSON.stringify(body),
    });
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-signup-password-"));
    delete process.env.FORGE_EDGE_TOKEN;
    app = createApp({
      dataDir,
      port: 0,
      mailer: async (m) => {
        mails.push({ to: m.to });
        return true;
      },
    });
    servers = await serve(app);
    base = servers.url;
    setLimit(app.db, "signup.per_source", 100, "system");
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("an account with neither passkey nor email signs up and signs in", async () => {
    const res = await post({ username: "quinn", password: "a-long-passphrase" });
    expect(res.status).toBe(201);
    const user = getUserByName(app.db, "quinn")!;
    expect(user.email.endsWith(".invalid")).toBe(true);
    expect(emailVerified(app.db, user.id)).toBe(false);
    expect(requireVerified(app, user)).toEqual({ ok: false, error: "unverified" });
    expect(mails.length).toBe(0);
    const hash = app.db.query<{ password_hash: string }, [string]>("SELECT password_hash FROM user WHERE id = ?1").get(user.id)!;
    expect(hash.password_hash.startsWith("$argon2id$")).toBe(true);
    const verified = await verifyPasswordThrottled(app.db, { username: "quinn", password: "a-long-passphrase", source: "test" });
    expect(verified.ok).toBe(true);
    const basic = await fetch(`${base}/api/v1/user`, {
      headers: { authorization: `Basic ${btoa("quinn:a-long-passphrase")}` },
    });
    expect(basic.status).toBe(200);
  });
  test("a second account with no email does not collide with the first", async () => {
    expect((await post({ username: "rae", password: "another-passphrase" })).status).toBe(201);
  });
  test("a given email gets the verify mail and starts unproven", async () => {
    const res = await post({ username: "sol", password: "a-long-passphrase", email: "[email protected]" });
    expect(res.status).toBe(201);
    expect(mails.map((m) => m.to)).toEqual(["[email protected]"]);
    expect(emailVerified(app.db, getUserByName(app.db, "sol")!.id)).toBe(false);
  });
  test("a stand-in address cannot be taken in settings, and shows empty", () => {
    const rae = getUserByName(app.db, "quinn")!;
    const other = getUserByName(app.db, "sol") ?? rae;
    expect(updateProfile(app.db, other.id, { email: rae.email }).ok).toBe(false);
    expect(updateProfile(app.db, other.id, { email: "[email protected]" }).ok).toBe(false);
    const kept = updateProfile(app.db, rae.id, { email: "", displayName: "Quinn" });
    expect(kept.ok && kept.value.email).toBe(rae.email);
  });
  test("a stand-in address cannot be given, and a malformed one is refused", async () => {
    expect((await post({ username: "tam", password: "a-long-passphrase", email: "[email protected]" })).status).toBe(422);
    expect((await post({ username: "tam", password: "a-long-passphrase", email: "nope" })).status).toBe(422);
  });
  test("a password under 12 characters is refused", async () => {
    const res = await post({ username: "uma", password: "elevenchars" });
    expect(res.status).toBe(422);
    expect(((await res.json()) as { error: string }).error).toBe("weak_password");
    expect(getUserByName(app.db, "uma")).toBeUndefined();
  });
  test("the form signs up with no email and sets an HttpOnly session", async () => {
    const page = await fetch(`${base}/signup`);
    const text = await page.text();
    expect(text).toContain('id="passkey-signup"');
    const res = await fetch(`${base}/signup`, {
      method: "POST",
      redirect: "manual",
      headers: { "content-type": "application/x-www-form-urlencoded", origin: base },
      body: new URLSearchParams({ username: "vic", email: "", password: "a-long-passphrase" }),
    });
    expect(res.status).toBe(303);
    expect(res.headers.get("set-cookie")).toContain("HttpOnly");
    expect(getUserByName(app.db, "vic")).toBeDefined();
  });
  test("a cross-origin post is refused", async () => {
    const api = await post({ username: "wes", password: "a-long-passphrase" }, { origin: "https://evil.example" });
    expect(api.status).toBe(403);
    const form = await fetch(`${base}/signup`, {
      method: "POST",
      redirect: "manual",
      headers: { "content-type": "application/x-www-form-urlencoded", origin: "https://evil.example" },
      body: new URLSearchParams({ username: "wes", password: "a-long-passphrase" }),
    });
    expect(form.status).toBe(403);
    expect(getUserByName(app.db, "wes")).toBeUndefined();
  });
  test("a closed forge refuses", async () => {
    setSignup(app.db, "closed", "system");
    const res = await post({ username: "xan", password: "a-long-passphrase" });
    expect(res.status).toBe(403);
    expect(((await res.json()) as { error: string }).error).toBe("signup_closed");
    expect(getUserByName(app.db, "xan")).toBeUndefined();
    setSignup(app.db, "open", "system");
  });
});
@@ -8,6 +8,8 @@
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App as Forge } from "../src/app.ts";
import { getUserByName } from "../src/core/users.ts";
import { emailVerified } from "../src/core/verify.ts";
import { SIGNUP_WEAK_MESSAGE } from "../src/tui/screens/signin.ts";
import { createForgeApp } from "../src/tui/forge.ts";
import type { TuiIdentity } from "../src/tui/session.ts";
import { headlessTerminal } from "../src/tui/term/terminal.ts";
@@ -57,3 +59,38 @@
test("with an edge token the terminal sign-up makes no row", async () => {
    app.stop();
  }
});
test("without an edge the terminal signs up with a blank email, unverified, and refuses 11 characters", async () => {
  const plain = createApp({ dataDir: await mkdtemp(join(tmpdir(), "forge-tui-signup-")), port: 0, url: "https://forge.example", disk: () => ({ freeBytes: 95, totalBytes: 100 }) });
  const identity: TuiIdentity = { sshUsername: "git", remoteAddress: "198.51.100.8", fingerprint: "SHA256:y", publicKey: KEY };
  const { app } = createForgeApp(plain, identity, { terminal: headlessTerminal(120, 32), exitHooks: false });
  app.start();
  const key = (k: string, ctrl = false): void =>
    app.dispatch({ type: "key", key: k, ctrl, alt: false, shift: false });
  const type = (t: string): void => [...t].forEach((c) => key(c));
  try {
    await settleApp(app);
    key("s");
    await settleApp(app);
    // The forge has no accounts, so the form opens in create mode.
    expect(app.screen.toText()).toContain("Email");
    type("nora");
    key("tab");
    key("tab"); // email left blank
    type("elevenchars");
    key("enter");
    await settleApp(app);
    expect(app.screen.toText()).toContain(SIGNUP_WEAK_MESSAGE);
    expect(getUserByName(plain.db, "nora")).toBeFalsy();
    type("1"); // twelve now
    key("enter");
    await settleApp(app);
    const user = getUserByName(plain.db, "nora");
    expect(user).toBeTruthy();
    expect(emailVerified(plain.db, user!.id)).toBe(false);
    expect(app.screen.toText()).toContain("signed in as nora");
  } finally {
    app.stop();
    plain.close();
  }
});
@@ -192,7 +192,8 @@
describe("turnstile doors", () => {
  test("off, the page has no widget and the policy is unchanged", async () => {
    const { base } = await boot();
    const response = await fetch(`${base}/signup`);
    expect(await response.text()).not.toContain("cf-turnstile");
    // The passkey script always names the token field; the widget is the div.
    expect(await response.text()).not.toContain("class=\"cf-turnstile");
    expect(response.headers.get("content-security-policy")).not.toContain("cloudflare");
  });
		@@ -343,7 +343,7 @@ to `/recover`: give the email on your account and, if it is verified, a link
343	343	that lasts 30 minutes and works once registers a new passkey and signs you in.
344	344	The relying party is the address the browser used (or
345	345	`FORGE_URL`), so a passkey does not follow a forge to another hostname.
346		Sign-up is a username, an email address and a passkey (`/signup`, `src/web/pages/signup-passkey.ts`); the running server refuses a password-only sign-up on the form, `POST /api/v1/users` and the terminal (`passkeyOnlySignup`, set in `main.ts`). Accounts that already have a password still sign in. The owner claim of a spawned forge (`/claim`, `web/pages/claim.ts`) and an admin's everyday account (`web/pages/everyday.ts`) make their account with a passkey too (`web/passkey-ceremony.ts`, challenges from `POST /claim/options` and `POST /settings/everyday/options`); neither reads a password, and without JavaScript the page says a passkey needs it. A claim post with no passkey is refused and does not spend the link.
	346	Sign-up is a username and a password of at least 12 characters (`/signup`, `POST /api/v1/users` with `{username, password, email?}`, the terminal), hashed with argon2id; the email is optional and, when given, gets the verify link (an account with none has nothing to prove). A passkey (`src/web/pages/signup-passkey.ts`, which does take an email) is offered beside the password. Nothing in the path touches an edge, parent or Forgejo account. An operator can still refuse password sign-ups with `passkeyOnlySignup`. The owner claim of a spawned forge (`/claim`, `web/pages/claim.ts`) and an admin's everyday account (`web/pages/everyday.ts`) make their account with a passkey too (`web/passkey-ceremony.ts`, challenges from `POST /claim/options` and `POST /settings/everyday/options`); neither reads a password, and without JavaScript the page says a passkey needs it. A claim post with no passkey is refused and does not spend the link.
347	347
348	348	A forge with a parent (`FORGE_PARENT_URL`, or the `upstream` in a spawned
349	349	forge's `parent.json`) offers "Continue with <parent>" on `/signin`. The forge
		@@ -34,6 +34,7 @@ import {
34	34	type ProfilePatch,
35	35	type UpdateProfileError,
36	36	type User,
	37	isStandInEmail,
37	38	} from "../core/users.ts";
38	39	import { err, ok, type Result } from "../kernel/result.ts";
39	40	import { requireUser } from "./access.ts";
		@@ -41,7 +42,8 @@ import type { SignupSlot } from "./signup-window.ts";
41	42
42	43	export interface SignUpInput {
43	44	username: string;
44		email: string;
	45	/** Optional: absent or blank, the account has none and nothing is mailed. */
	46	email?: string;
45	47	password: string;
46	48	/** The Turnstile token the browser's widget gave; read only when a secret is set. */
47	49	humanToken?: string;
		@@ -50,6 +52,7 @@ export interface SignUpInput {
50	52	export type SignUpError =
51	53	\| CreateUserError
52	54	\| "human_check"
	55	\| "invalid_email"
53	56	\| "passkey_required"
54	57	\| "signup_closed";
55	58
		@@ -79,6 +82,19 @@ export function plausibleEmail(email: string): boolean {
79	82	return email.length <= 254 && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
80	83	}
81	84
	85	/** The shortest password a sign-up takes. */
	86	export const MIN_SIGNUP_PASSWORD = 12;
	87
	88	/**
	89	* Stands in for the address of an account that gave none: the column is
	90	* unique and never empty, and `.invalid` is a name no mail can reach
	91	* (the same device the crew's addresses use).
	92	*/
		sentinelcrew 25d ago outdated Medium: `updateProfile` (core/users.ts) still accepts `[email protected]`. Another account can take this stand-in, and so can an old one after a rename, and the settings page shows it as the person's email. Refuse `.invalid` in `updateProfile` and render a stand-in as empty.
	93	const noEmail = (username: string): string => `${username.toLowerCase()}@no-email.invalid`;
	94
	95	/** Whether an address is one a person could have given: plausible and not a stand-in. */
	96	const givenEmail = (email: string): boolean => plausibleEmail(email) && !isStandInEmail(email);
	97
82	98	/** What a person is told when the check fails. */
83	99	export const HUMAN_CHECK_MESSAGE =
84	100	"We could not tell you are a person. Reload the page and try again.";
		@@ -101,12 +117,15 @@ export async function signUp(
101	117	address?: string \| undefined;
102	118	},
103	119	): Promise<Result<User, SignUpError>> {
104		// Password sign-in stays for the accounts that have a password. It can go
105		// when every such account has a passkey (Settings → Passkeys shows who is
106		// left) and recovery without a password exists (#1618): then delete this
107		// action's password path, `verifyPasswordThrottled`'s doors and the password column.
	120	// A username and a password is a way in that stays, beside the passkey
	121	// (#2923; it once was to go, #1618). Email is optional: given, the verify
	122	// link goes to it. Either way the account starts unproven: adding and
	123	// proving an address in settings is what lets it create and cost.
108	124	if (signupClosed(app, from.invite)) return err("signup_closed");
109	125	if (app.config.passkeyOnlySignup === true) return err("passkey_required");
	126	const email = (input.email ?? "").trim();
	127	if (email !== "" && !givenEmail(email)) return err("invalid_email");
	128	if (input.password.length < MIN_SIGNUP_PASSWORD) return err("weak_password");
110	129	const secret = app.config.turnstileSecret;
111	130	// The terminal cannot render a widget, so with a secret set it brings no
112	131	// token and is refused, the forge's first account too: sign up on the web page.
		@@ -116,8 +135,14 @@ export async function signUp(
116	135	if (!(await verify(input.humanToken ?? "", from.address)))
117	136	return err("human_check");
118	137	}
119		const { humanToken: _token, ...account } = input;
120		const created = await createUser(app.db, { ...account, origin: "signup", slot: from.slot, invite: from.invite });
	138	const created = await createUser(app.db, {
	139	username: input.username,
	140	password: input.password,
	141	email: email === "" ? noEmail(input.username) : email,
		sentinelcrew 25d ago outdated High: no email means no verification needed, so leaving out one field skips the verify gate (`requireVerified`, crew dispatch). Leave these accounts unproven. Adding and proving an email should be what unlocks creating and spending.
	142	origin: "signup",
	143	slot: from.slot,
	144	invite: from.invite,
	145	});
121	146	if (!created.ok) return created;
122	147	app.bus.append({
123	148	kind: "user.created",
		@@ -130,7 +155,7 @@ export async function signUp(
130	155	auditInvite(app, created.value.id);
131	156	// The address is proven by the link it is sent; until then nothing it
132	157	// does may create or cost.
133		await welcome(app, created.value);
	158	if (email !== "") await welcome(app, created.value);
134	159	return created;
135	160	}
136	161
		@@ -137,9 +137,8 @@ export interface ForgeConfig {
137	137	/**
138	138	* Refuse every sign-up that would make an account with only a password:
139	139	* the web form, `POST /api/v1/users` and the terminal answer in words,
140		* and `signUpWithPasskey` is the one way in. `main.ts` sets it; the
141		* library default is off so a test can still seed accounts with a
142		* password.
	140	* and `signUpWithPasskey` is the one way in. An operator's choice, off
	141	* by default: a username and a password sign up (#2923).
143	142	*/
144	143	passkeyOnlySignup?: boolean;
145	144	/**
		@@ -388,6 +388,9 @@ export type UpdateProfileError =
388	388	\| "invalid_commit_email"
389	389	\| "no_such_user";
390	390
	391	/** Whether an address is a stand-in (`.invalid`): no mail reaches it, no person gave it. */
	392	export const isStandInEmail = (email: string): boolean => /\.invalid$/i.test(email.trim());
	393
391	394	/** Change the mutable profile fields. Absent keys are left untouched. */
392	395	export function updateProfile(
393	396	db: Database,
		@@ -396,10 +399,14 @@ export function updateProfile(
396	399	): Result<User, UpdateProfileError> {
397	400	const current = getUserById(db, userId);
398	401	if (!current \|\| current.kind === "org") return err("no_such_user");
399		const email = patch.email?.trim() ?? current.email;
	402	let email = patch.email?.trim() ?? current.email;
	403	// The form shows a stand-in as empty; leaving it so keeps it.
	404	if (email === "" && isStandInEmail(current.email)) email = current.email;
400	405	if (email === "" \|\| email.length > MAX_EMAIL \|\| !email.includes("@"))
401	406	return err("invalid_email");
402	407	if (email.toLowerCase() !== current.email.toLowerCase()) {
	408	// Stand-ins belong to the accounts that gave no address; nobody may take one.
	409	if (isStandInEmail(email)) return err("invalid_email");
403	410	const taken = db
404	411	.query("SELECT 1 FROM user WHERE email = ?1 COLLATE NOCASE AND id != ?2")
405	412	.get(email, userId);
		@@ -1215,6 +1215,8 @@ export function apiRoutes(router: Router<Handler>): void {
1215	1215	// ── accounts ─────────────────────────────────────────────────────────
1216	1216
1217	1217	router.add("POST", "/api/v1/users", async (ctx) => {
	1218	// A page on another site cannot sign a visitor up from here.
	1219	if (crossOrigin(ctx.request, ctx.url, ctx.app.log)) return forbidden();
1218	1220	const slot = signupSlot(ctx);
1219	1221	if (typeof slot === "number")
1220	1222	return json(
		@@ -219,8 +219,6 @@ const app = createApp({
219	219	Number(process.env.FORGE_MAIL_DAILY) > 0
220	220	? { mailDailyCap: Number(process.env.FORGE_MAIL_DAILY) }
221	221	: {}),
222		// No door makes a password-only account (#1996).
223		passkeyOnlySignup: true,
224	222	// Signup asks Cloudflare Turnstile when its secret is set.
225	223	...(turnstileSecret === ""
226	224	? {}
		@@ -840,7 +840,7 @@ const MESSAGES: Record<string, string> = {
840	840	email_taken: "that email address is taken",
841	841	key_exists: "that key is already registered",
842	842	taken: "that name is taken",
843		weak_password: "the password must be at least 10 characters",
	843	weak_password: "the password is too short (10 characters at least)",
		sentinelcrew 25d ago outdated Low: password change in the terminal shows this message too, but its minimum is still 10. Give the sign-up refusal its own message.
844	844	bad_credentials: "wrong username or password",
845	845	throttled: "too many attempts: try again in a minute",
846	846	already_forked: "you already have a fork of this repo",
		@@ -35,10 +35,13 @@ const SIGN_IN: Field[] = [
35	35
36	36	const CREATE: Field[] = [
37	37	{ label: "Username" },
38		{ label: "Email" },
39		{ label: "Password", secret: true, hint: "At least 10 characters." },
	38	{ label: "Email", hint: "Optional." },
	39	{ label: "Password", secret: true, hint: "At least 12 characters." },
40	40	];
41	41
	42	/** What sign-up says to a short password; the password change form keeps its own wording. */
	43	export const SIGNUP_WEAK_MESSAGE = "the password is too short (sign-up needs 12 characters)";
	44
42	45	/** While signup is `invite` the create form also asks for the link's token. */
43	46	const INVITE_BLANK_MESSAGE = "Paste the token from your invite link.";
44	47	const INVITE: Field = { label: "Invite", secret: true, hint: "The token from your invite link." };
		@@ -109,7 +112,9 @@ export function signInScreen(f: Session, ctx: Ctx, onDone: () => void): Screen {
109	112	);
		sentinelcrew 25d ago outdated This nested ternary with a string literal inline is hard to read. Lift it into a named constant beside `INVITE_SPENT_MESSAGE`, for example `const SIGNUP_WEAK_MESSAGE = "the password is too short (sign-up needs 12 characters)"`, and branch on it in an `if`. Then the new terminal test can assert on the constant.
110	113	if (!created.ok) {
111	114	// With signup = invite a refusal means the token did not open the door.
112		error = needsInvite && created.error === "signup_closed" ? INVITE_SPENT_MESSAGE : errorText(created.error);
	115	if (needsInvite && created.error === "signup_closed") error = INVITE_SPENT_MESSAGE;
	116	else if (created.error === "weak_password") error = SIGNUP_WEAK_MESSAGE;
	117	else error = errorText(created.error);
113	118	return;
114	119	}
115	120	const adopted = f.adopt(created.value);
		@@ -36,6 +36,7 @@ import { endAccountSession } from "../../actions/signins.ts";
36	36	import { listSessions, type SessionInfo } from "../../core/sessions.ts";
37	37	import { ADMIN_TOKEN_WORDS, listTokens, type TokenScope } from "../../core/tokens.ts";
38	38	import type { CommitEmail, User } from "../../core/users.ts";
	39	import { isStandInEmail } from "../../core/users.ts";
39	40	import { cookieValue, type Ctx } from "../../http/context.ts";
40	41	import { sshCommand } from "../../ssh/command.ts";
41	42	import {
		@@ -100,7 +101,7 @@ interface ProfileForm {
100	101	/** The profile form as the account stands now. */
101	102	const currentProfile = (user: User): ProfileForm => ({
102	103	displayName: user.displayName,
103		email: user.email,
	104	email: isStandInEmail(user.email) ? "" : user.email,
104	105	commitEmail: user.commitEmail,
105	106	});
106	107
		@@ -224,12 +225,16 @@ function unverifiedNotice(ctx: Ctx): Html {
224	225	return card(
225	226	html`<p>
226	227	Your email is not verified yet. Until it is, you can read and talk,
227		but not make repositories, apps or runs. Follow the link we sent to
228		<strong>${user.email}</strong>, or ask for another.
	228	but not make repositories, apps or runs.
	229	${isStandInEmail(user.email)
	230	? html`Add your email below and follow the link we send to it.`
	231	: html`Follow the link we sent to <strong>${user.email}</strong>, or ask for another.`}
229	232	</p>
230		<form method="post" action="/settings/email/verify">
	233	${isStandInEmail(user.email)
	234	? html``
	235	: html`<form method="post" action="/settings/email/verify">
231	236	${btn("Send another link", { type: "submit" })}
232		</form>`,
	237	</form>`}`,
233	238	{ tone: "attn" },
234	239	);
235	240	}
		@@ -278,8 +278,8 @@ function authForm(
278	278	</div>`,
279	279	);
280	280
281		// No door makes a password-only account: sign-up is a name, an address and
282		// a passkey, made in the browser (`signup-passkey.ts`).
	281	// Only an operator who set `passkeyOnlySignup` gets a form with no
	282	// password: a name, an address and a passkey (`signup-passkey.ts`).
283	283	const byPasskey = kind === "signup" && ctx.app.config.passkeyOnlySignup === true;
284	284
285	285	// Sign-in leads with the passkey: one press, nothing typed; the password
		@@ -326,7 +326,7 @@ function authForm(
326	326	type: "email",
327	327	value: values.email ?? "",
328	328	autocomplete: "email",
329		required: true,
	329	hint: "Optional. Given, we send a link to prove it.",
330	330	// A pinned name is not editable, so the keyboard goes to the email.
331	331	...(vouched !== undefined ? { autofocus: true } : {}),
332	332	...(errors.email ? { error: errors.email } : {}),
		@@ -340,7 +340,7 @@ function authForm(
340	340	autocomplete: kind === "signin" ? "current-password" : "new-password",
341	341	required: true,
342	342	...(kind === "signup"
343		? { minlength: 10, hint: "At least 10 characters." }
	343	? { minlength: 12, hint: "At least 12 characters." }
344	344	: {}),
345	345	...(errors.password ? { error: errors.password } : {}),
346	346	}),
		@@ -359,6 +359,17 @@ function authForm(
359	359	<p class="error-note mb" id="passkey-signup-note" role="alert">${errors.password ?? ""}</p>
360	360	<noscript><p class="muted small">Signing up needs JavaScript for the passkey.</p></noscript>`,
361	361	)}
	362	${when(
	363	kind === "signup" && !byPasskey,
	364	() => html`<div class="passkey-on">
	365	<p class="muted small mb">
	366	Or skip the password: a passkey signs you in with a fingerprint,
	367	face or device PIN. It needs an email address above.
	368	</p>
	369	<p class="error-note mb" id="passkey-signup-note" role="alert"></p>
	370	<button type="button" id="passkey-signup" class="btn" data-variant="outline">Create account with a passkey</button>
		sentinelcrew 25d ago Low: this button is hand-rolled markup rather than the named `btn()` component. The other passkey buttons on this page do the same because they need an `id`, so this matches the file and does not block on its own. If `btn()` can take an `id`, use it here. sentinelcrew 25d ago Non-blocking: this is a hand-rolled button. It matches the existing passkey button, but both should move onto `btn()` once it can take an `id`.
	371	</div>`,
	372	)}
362	373	${when(
363	374	errors.human,
364	375	(message) => html`<p class="error mb" role="alert">${message}</p>`,
		@@ -469,7 +480,7 @@ export function signupPage(ctx: Ctx): Response {
469	480	title: "Sign up",
470	481	body: authForm(ctx, "signup"),
471	482	turnstile: siteKey(ctx) !== undefined,
472		...(ctx.app.config.passkeyOnlySignup === true ? { scriptJs: passkeyJs } : {}),
	483	scriptJs: passkeyJs,
473	484	});
474	485	}
475	486
		@@ -627,7 +638,7 @@ export async function signupSubmit(ctx: Ctx): Promise<Response> {
627	638	},
628	639	}),
629	640	turnstile: siteKey(ctx) !== undefined,
630		...(ctx.app.config.passkeyOnlySignup === true ? { scriptJs: passkeyJs } : {}),
	641	scriptJs: passkeyJs,
631	642	},
632	643	429,
633	644	);
		@@ -653,7 +664,8 @@ export async function signupSubmit(ctx: Ctx): Promise<Response> {
653	664	username_taken: { username: "That username is taken." },
654	665	username_reserved: { username: "That name is reserved." },
655	666	email_taken: { email: "That email already has an account." },
656		weak_password: { password: "Passwords need at least 10 characters." },
	667	weak_password: { password: "Passwords need at least 12 characters." },
	668	invalid_email: { email: "That does not look like an email address." },
657	669	human_check: { human: HUMAN_CHECK_MESSAGE },
658	670	passkey_required: { human: PASSKEY_REQUIRED_MESSAGE },
659	671	}[created.error] ?? { username: "Something went wrong." };
		@@ -663,7 +675,7 @@ export async function signupSubmit(ctx: Ctx): Promise<Response> {
663	675	title: "Sign up",
664	676	body: authForm(ctx, "signup", { values: { username, email }, errors }),
665	677	turnstile: siteKey(ctx) !== undefined,
666		...(ctx.app.config.passkeyOnlySignup === true ? { scriptJs: passkeyJs } : {}),
	678	scriptJs: passkeyJs,
667	679	},
668	680	422,
669	681	);