From fc11432b870e983e4b6952dfab71b8cd595219e5 Mon Sep 17 00:00:00 2001 From: Nico <47644445+nicotsx@users.noreply.github.com> Date: Tue, 3 Mar 2026 21:46:47 +0100 Subject: [PATCH] feat: change email by cli (#611) ## Summary by CodeRabbit * **New Features** * New CLI command to change user email addresses with impact preview and validation. * **Accessibility** * Improved settings form with proper label-input associations and email field type validation. --- .../modules/settings/routes/settings.tsx | 8 +- app/server/cli/commands/change-email.test.ts | 151 +++++++++++++++ app/server/cli/commands/change-email.ts | 179 ++++++++++++++++++ app/server/cli/commands/reset-password.ts | 23 ++- app/server/cli/index.ts | 2 + 5 files changed, 356 insertions(+), 7 deletions(-) create mode 100644 app/server/cli/commands/change-email.test.ts create mode 100644 app/server/cli/commands/change-email.ts diff --git a/app/client/modules/settings/routes/settings.tsx b/app/client/modules/settings/routes/settings.tsx index f348e826..d3621073 100644 --- a/app/client/modules/settings/routes/settings.tsx +++ b/app/client/modules/settings/routes/settings.tsx @@ -164,12 +164,12 @@ export function SettingsPage({ appContext, initialMembers, initialSsoSettings, i
- - + +
- - + +
diff --git a/app/server/cli/commands/change-email.test.ts b/app/server/cli/commands/change-email.test.ts new file mode 100644 index 00000000..93fd172c --- /dev/null +++ b/app/server/cli/commands/change-email.test.ts @@ -0,0 +1,151 @@ +import { beforeEach, describe, expect, test } from "bun:test"; +import { eq } from "drizzle-orm"; +import { db } from "~/server/db/db"; +import { account, sessionsTable, usersTable } from "~/server/db/schema"; +import { changeEmailForUser, getEmailChangeImpact } from "./change-email"; + +const randomId = () => Bun.randomUUIDv7(); +const randomSlug = (prefix: string) => `${prefix}-${Math.random().toString(36).slice(2, 8)}`; + +const insertUser = async (username: string, email: string) => { + const id = randomId(); + + await db.insert(usersTable).values({ + id, + username, + name: username, + email, + }); + + return { id, username, email }; +}; + +const insertCredentialAccount = async (userId: string) => { + await db.insert(account).values({ + id: randomId(), + accountId: userId, + providerId: "credential", + userId, + password: randomSlug("hash"), + }); +}; + +const insertSsoAccount = async (userId: string, providerId: string, accountId = randomSlug("oidc-account")) => { + await db.insert(account).values({ + id: randomId(), + accountId, + providerId, + userId, + }); + + return accountId; +}; + +const insertSession = async (userId: string) => { + await db.insert(sessionsTable).values({ + id: randomId(), + userId, + token: randomSlug("token"), + expiresAt: new Date(Date.now() + 60_000), + }); +}; + +describe("changeEmailForUser", () => { + beforeEach(async () => { + await db.delete(sessionsTable); + await db.delete(account); + await db.delete(usersTable); + }); + + test("changes email, deletes linked SSO accounts, and invalidates sessions", async () => { + const user = await insertUser("alice", "alice@example.com"); + await insertCredentialAccount(user.id); + await insertSsoAccount(user.id, "oidc-google"); + await insertSession(user.id); + + const result = await changeEmailForUser("alice", "new-alice@example.com"); + + expect(result).toEqual({ + previousEmail: "alice@example.com", + updatedEmail: "new-alice@example.com", + deletedSsoAccounts: 1, + }); + + const [updatedUser] = await db + .select({ email: usersTable.email }) + .from(usersTable) + .where(eq(usersTable.id, user.id)); + expect(updatedUser?.email).toBe("new-alice@example.com"); + + const remainingAccounts = await db + .select({ providerId: account.providerId }) + .from(account) + .where(eq(account.userId, user.id)); + + expect(remainingAccounts).toEqual([{ providerId: "credential" }]); + + const sessions = await db + .select({ id: sessionsTable.id }) + .from(sessionsTable) + .where(eq(sessionsTable.userId, user.id)); + expect(sessions).toHaveLength(0); + }); + + test("fails when the user has no credential account", async () => { + const user = await insertUser("bob", "bob@example.com"); + await insertSsoAccount(user.id, "oidc-github"); + + await expect(changeEmailForUser("bob", "new-bob@example.com")).rejects.toThrow("no credential account"); + }); + + test("fails when the target email is already in use", async () => { + const firstUser = await insertUser("carol", "carol@example.com"); + await insertCredentialAccount(firstUser.id); + + const secondUser = await insertUser("dave", "dave@example.com"); + await insertCredentialAccount(secondUser.id); + + await expect(changeEmailForUser("carol", "dave@example.com")).rejects.toThrow("already in use"); + }); + + test("returns linked SSO accounts when previewing impact", async () => { + const user = await insertUser("eve", "eve@example.com"); + await insertCredentialAccount(user.id); + await insertSsoAccount(user.id, "oidc-google", "google-eve"); + await insertSsoAccount(user.id, "oidc-github", "github-eve"); + + const impact = await getEmailChangeImpact("eve", "eve-new@example.com"); + + expect(impact.ssoAccounts).toEqual([ + { providerId: "oidc-github", accountId: "github-eve" }, + { providerId: "oidc-google", accountId: "google-eve" }, + ]); + }); + + test("returns no SSO warning candidates when user has no SSO accounts", async () => { + const user = await insertUser("frank", "frank@example.com"); + await insertCredentialAccount(user.id); + + const impact = await getEmailChangeImpact("frank", "frank-new@example.com"); + + expect(impact.ssoAccounts).toEqual([]); + }); + + test("rejects changing to the same email and leaves SSO accounts and sessions unchanged", async () => { + const user = await insertUser("grace", "grace@example.com"); + await insertCredentialAccount(user.id); + await insertSsoAccount(user.id, "oidc-google", "google-grace"); + await insertSession(user.id); + + await expect(changeEmailForUser("grace", "grace@example.com")).rejects.toThrow("already has email"); + + const impact = await getEmailChangeImpact("grace", "grace-different@example.com"); + expect(impact.ssoAccounts).toEqual([{ providerId: "oidc-google", accountId: "google-grace" }]); + + const sessions = await db + .select({ id: sessionsTable.id }) + .from(sessionsTable) + .where(eq(sessionsTable.userId, user.id)); + expect(sessions).toHaveLength(1); + }); +}); diff --git a/app/server/cli/commands/change-email.ts b/app/server/cli/commands/change-email.ts new file mode 100644 index 00000000..a1b2e8ac --- /dev/null +++ b/app/server/cli/commands/change-email.ts @@ -0,0 +1,179 @@ +import { confirm, input, select } from "@inquirer/prompts"; +import { Command } from "commander"; +import { and, eq, ne } from "drizzle-orm"; +import { toMessage } from "~/server/utils/errors"; +import { db } from "../../db/db"; +import { account, sessionsTable, usersTable } from "../../db/schema"; + +const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/; + +type EmailChangeImpact = { + userId: string; + previousEmail: string; + updatedEmail: string; + ssoAccounts: Array<{ + providerId: string; + accountId: string; + }>; +}; + +const listUsers = () => { + return db.select({ id: usersTable.id, username: usersTable.username, email: usersTable.email }).from(usersTable); +}; + +export const changeEmailForUser = async (username: string, newEmail: string, precomputedImpact?: EmailChangeImpact) => { + const impact = precomputedImpact ?? (await getEmailChangeImpact(username, newEmail)); + + db.transaction((tx) => { + tx.update(usersTable).set({ email: impact.updatedEmail }).where(eq(usersTable.id, impact.userId)).run(); + tx.delete(account) + .where(and(eq(account.userId, impact.userId), ne(account.providerId, "credential"))) + .run(); + tx.delete(sessionsTable).where(eq(sessionsTable.userId, impact.userId)).run(); + }); + + return { + previousEmail: impact.previousEmail, + updatedEmail: impact.updatedEmail, + deletedSsoAccounts: impact.ssoAccounts.length, + }; +}; + +export const getEmailChangeImpact = async (username: string, newEmail: string): Promise => { + const normalizedEmail = newEmail.trim().toLowerCase(); + + if (!emailRegex.test(normalizedEmail)) { + throw new Error(`Invalid email address "${newEmail}"`); + } + + const [user] = await db.select().from(usersTable).where(eq(usersTable.username, username)); + + if (!user) { + throw new Error(`User "${username}" not found`); + } + + if (user.email.trim().toLowerCase() === normalizedEmail) { + throw new Error(`User "${username}" already has email "${normalizedEmail}"`); + } + + const [existingUser] = await db + .select({ id: usersTable.id }) + .from(usersTable) + .where(and(eq(usersTable.email, normalizedEmail), ne(usersTable.id, user.id))); + + if (existingUser) { + throw new Error(`Email "${normalizedEmail}" is already in use`); + } + + const [credentialAccount] = await db + .select({ id: account.id }) + .from(account) + .where(and(eq(account.userId, user.id), eq(account.providerId, "credential"))); + + if (!credentialAccount) { + throw new Error(`User "${username}" has no credential account. Reset their password before changing email.`); + } + + const ssoAccounts = ( + await db + .select({ + providerId: account.providerId, + accountId: account.accountId, + }) + .from(account) + .where(and(eq(account.userId, user.id), ne(account.providerId, "credential"))) + ).sort((left, right) => { + const providerCompare = left.providerId.localeCompare(right.providerId); + if (providerCompare !== 0) { + return providerCompare; + } + + return left.accountId.localeCompare(right.accountId); + }); + + return { + userId: user.id, + previousEmail: user.email, + updatedEmail: normalizedEmail, + ssoAccounts, + }; +}; + +export const changeEmailCommand = new Command("change-email") + .description("Change email for a user and remove linked SSO accounts") + .option("-u, --username ", "Username of the account") + .option("-e, --email ", "New email for the account") + .action(async (options) => { + console.info("\n📧 Zerobyte Change Email\n"); + + let username = options.username; + let newEmail = options.email; + + try { + if (!username) { + const users = await listUsers(); + + if (users.length === 0) { + console.error("❌ No users found in the database."); + console.info(" Please create a user first by starting the application."); + process.exit(1); + } + + username = await select({ + message: "Select user to change email for:", + choices: users.map((user) => ({ + name: `${user.username} (${user.email})`, + value: user.username, + })), + }); + } + + if (!newEmail) { + newEmail = await input({ + message: "Enter the new email:", + validate: (value) => { + if (!emailRegex.test(value.trim())) { + return "Please enter a valid email address"; + } + + return true; + }, + }); + } + + const impact = await getEmailChangeImpact(username, newEmail); + + if (impact.ssoAccounts.length > 0) { + console.warn("\n⚠️ Disclaimer: changing this email will delete the following linked SSO account(s):"); + for (const ssoAccount of impact.ssoAccounts) { + console.warn(` - ${ssoAccount.providerId} (${ssoAccount.accountId})`); + } + console.warn( + " The user will need to be invited again using the new email to regain access with those SSO providers.", + ); + + const shouldContinue = await confirm({ + message: `Continue and delete ${impact.ssoAccounts.length} SSO account(s) for "${username}"?`, + default: false, + }); + + if (!shouldContinue) { + console.info("\nℹ️ Email change cancelled. No data was modified."); + process.exit(0); + } + } + + const result = await changeEmailForUser(username, newEmail, impact); + + console.info(`\n✅ Email for "${username}" changed from "${result.previousEmail}" to "${result.updatedEmail}".`); + if (result.deletedSsoAccounts > 0) { + console.info(` Deleted ${result.deletedSsoAccounts} linked SSO account(s).`); + } + console.info(" All existing sessions have been invalidated."); + } catch (error) { + console.error(`\n❌ Failed to change email: ${toMessage(error)}`); + process.exit(1); + } + + process.exit(0); + }); diff --git a/app/server/cli/commands/reset-password.ts b/app/server/cli/commands/reset-password.ts index fb9225fa..34b6b94c 100644 --- a/app/server/cli/commands/reset-password.ts +++ b/app/server/cli/commands/reset-password.ts @@ -21,10 +21,27 @@ const resetPassword = async (username: string, newPassword: string) => { const legacyHash = user.passwordHash ? await Bun.password.hash(newPassword) : null; db.transaction((tx) => { - tx.update(account) - .set({ password: newPasswordHash }) + const existingAccount = tx + .select() + .from(account) .where(and(eq(account.userId, user.id), eq(account.providerId, "credential"))) - .run(); + .get(); + + if (existingAccount) { + tx.update(account).set({ password: newPasswordHash }).where(eq(account.id, existingAccount.id)).run(); + } else { + tx.insert(account) + .values({ + id: crypto.randomUUID(), + providerId: "credential", + accountId: user.username, + userId: user.id, + password: newPasswordHash, + createdAt: new Date(), + updatedAt: new Date(), + }) + .run(); + } if (legacyHash) { tx.update(usersTable).set({ passwordHash: legacyHash }).where(eq(usersTable.id, user.id)).run(); diff --git a/app/server/cli/index.ts b/app/server/cli/index.ts index 04638c4c..b7c3f82e 100644 --- a/app/server/cli/index.ts +++ b/app/server/cli/index.ts @@ -1,5 +1,6 @@ import { Command } from "commander"; import { assignOrganizationCommand } from "./commands/assign-organization"; +import { changeEmailCommand } from "./commands/change-email"; import { changeUsernameCommand } from "./commands/change-username"; import { disable2FACommand } from "./commands/disable-2fa"; import { rekey2FACommand } from "./commands/rekey-2fa"; @@ -12,6 +13,7 @@ program.name("zerobyte").description("Zerobyte CLI - Backup automation tool buil program.addCommand(resetPasswordCommand); program.addCommand(disable2FACommand); program.addCommand(changeUsernameCommand); +program.addCommand(changeEmailCommand); program.addCommand(rekey2FACommand); program.addCommand(assignOrganizationCommand);