Ajoute le flux d'invitation avec activation de compte

server/routes.ts

@@ -1,6 +1,7 @@
 import { createHash, randomBytes } from "node:crypto";
 import type { Express, RequestHandler } from "express";
 import { z } from "zod";
+import { DEFAULT_ACCOUNT_INVITE_IDENTIFIER_PREFIX, getAccountInviteContext } from "./invites.js";
 
 type RegisterAuthApiRoutesOptions = {
   app: Express;
@@ -31,6 +32,10 @@ type RegisterAuthApiRoutesOptions = {
       expiresAt: Date;
     }) => Promise<void>;
   };
+  accountInvite?: {
+    enabled: boolean;
+    identifierPrefix?: string;
+  };
   onUserRegistered?: (user: { id: string; email: string | null; name: string | null }) => Promise<void> | void;
   onPasswordResetConfirmed?: (user: { id: string; email: string | null; name: string | null }) => Promise<void> | void;
 };
@@ -44,6 +49,8 @@ type AuthRouteMessages = {
   passwordResetUnavailable: string;
   invalidResetLink: string;
   expiredResetLink: string;
+  invalidInviteLink: string;
+  inviteAlreadyAccepted: string;
 };
 
 const defaultNormalizeEmail = (email: string) => email.trim();
@@ -56,7 +63,9 @@ const defaultMessages: AuthRouteMessages = {
   invalidPassword: "Invalid password",
   passwordResetUnavailable: "Email service is not configured.",
   invalidResetLink: "Invalid reset link",
-  expiredResetLink: "Invalid or expired reset link"
+  expiredResetLink: "Invalid or expired reset link",
+  invalidInviteLink: "Invalid or expired invite link",
+  inviteAlreadyAccepted: "This invite has already been accepted"
 };
 
 function hashPasswordResetToken(token: string): string {
@@ -75,8 +84,25 @@ export function registerAuthApiRoutes(options: RegisterAuthApiRoutesOptions): vo
   const passwordHasher = options.passwordHasher ?? ((password: string) => Promise.resolve(password));
   const passwordComparator = options.passwordComparator ?? ((password: string, hash: string) => Promise.resolve(password === hash));
   const passwordResetIdentifierPrefix = options.passwordReset?.identifierPrefix ?? defaultPasswordResetIdentifierPrefix;
+  const accountInviteIdentifierPrefix = options.accountInvite?.identifierPrefix ?? DEFAULT_ACCOUNT_INVITE_IDENTIFIER_PREFIX;
   const messages = { ...defaultMessages, ...(options.messages ?? {}) };
 
+  const buildSession = (userId: string) => ({
+    sessionToken: randomBytes(32).toString("hex"),
+    userId,
+    expires: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000)
+  });
+
+  const applySessionCookie = (res: any, session: { sessionToken: string; expires: Date }) => {
+    res.cookie(options.sessionCookieName, session.sessionToken, {
+      httpOnly: true,
+      sameSite: "lax",
+      secure: options.sessionCookieSecure,
+      path: "/",
+      expires: session.expires
+    });
+  };
+
   const findUserByEmail = async (email: string) => {
     const normalized = normalizeEmail(email);
     const lowered = normalized.toLowerCase();
@@ -207,24 +233,11 @@ export function registerAuthApiRoutes(options: RegisterAuthApiRoutesOptions): vo
       return res.status(401).json({ error: messages.invalidPassword });
     }
 
-    const sessionToken = randomBytes(32).toString("hex");
-    const expires = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
-
+    const session = buildSession(user.id);
     await options.prisma.session.create({
-      data: {
-        sessionToken,
-        userId: user.id,
-        expires
-      }
-    });
-
-    res.cookie(options.sessionCookieName, sessionToken, {
-      httpOnly: true,
-      sameSite: "lax",
-      secure: options.sessionCookieSecure,
-      path: "/",
-      expires
+      data: session
     });
+    applySessionCookie(res, session);
 
     return res.status(200).json({ ok: true });
   });
@@ -352,6 +365,95 @@ export function registerAuthApiRoutes(options: RegisterAuthApiRoutesOptions): vo
     return res.status(200).json({ ok: true });
   });
 
+  options.app.get(`${authApiBasePath}/invite/validate`, async (req, res) => {
+    if (!options.accountInvite?.enabled) {
+      return res.status(404).json({ error: messages.invalidInviteLink });
+    }
+
+    const parsed = z.object({ token: z.string().min(1) }).safeParse({
+      token: Array.isArray(req.query.token) ? req.query.token[0] : req.query.token
+    });
+
+    if (!parsed.success) {
+      return res.status(400).json({ error: messages.invalidInviteLink });
+    }
+
+    const context = await getAccountInviteContext({
+      prisma: options.prisma,
+      token: parsed.data.token,
+      identifierPrefix: accountInviteIdentifierPrefix
+    });
+
+    if (!context) {
+      return res.status(400).json({ error: messages.invalidInviteLink });
+    }
+
+    if (context.user.passwordHash || context.user.accounts.length > 0) {
+      return res.status(409).json({ error: messages.inviteAlreadyAccepted });
+    }
+
+    return res.status(200).json({
+      ok: true,
+      email: context.user.email,
+      name: context.user.name
+    });
+  });
+
+  options.app.post(`${authApiBasePath}/invite/accept`, async (req, res) => {
+    if (!options.accountInvite?.enabled) {
+      return res.status(404).json({ error: messages.invalidInviteLink });
+    }
+
+    const parsed = z
+      .object({
+        token: z.string().min(1),
+        name: z.string().min(2).max(60),
+        password: z.string().min(8)
+      })
+      .safeParse(req.body);
+
+    if (!parsed.success) {
+      return res.status(400).json({ error: messages.invalidPayload });
+    }
+
+    const context = await getAccountInviteContext({
+      prisma: options.prisma,
+      token: parsed.data.token,
+      identifierPrefix: accountInviteIdentifierPrefix
+    });
+
+    if (!context) {
+      return res.status(400).json({ error: messages.invalidInviteLink });
+    }
+
+    if (context.user.passwordHash || context.user.accounts.length > 0) {
+      return res.status(409).json({ error: messages.inviteAlreadyAccepted });
+    }
+
+    const passwordHash = await passwordHasher(parsed.data.password);
+    const session = buildSession(context.user.id);
+
+    await options.prisma.$transaction([
+      options.prisma.verificationToken.deleteMany({
+        where: { identifier: context.verificationToken.identifier }
+      }),
+      options.prisma.session.create({
+        data: session
+      }),
+      options.prisma.user.update({
+        where: { id: context.user.id },
+        data: {
+          name: parsed.data.name,
+          passwordHash,
+          emailVerified: context.user.emailVerified ?? new Date()
+        }
+      })
+    ]);
+
+    applySessionCookie(res, session);
+    return res.status(200).json({ ok: true });
+  });
+
   options.app.post(`${authApiBasePath}/logout`, async (req, res) => {
     const token = options.extractSessionToken(req.headers.cookie);