@bedrock/account-http - npm Package Compare versions

Comparing version 7.0.1 to 7.1.0

CHANGELOG.md

 # bedrock-account-http ChangeLog
 
+## 7.1.0 - 2023-10-18
+
+### Added
+- Add optional `authorization` value when registering an account and
+  define first instance of it that uses a captcha via the Cloudflare
+  Turnstile service.
+
 ## 7.0.1 - 2023-01-24
@@ -4,0 +11,0 @@

lib/config.js

@@ -10,3 +10,9 @@ /*!
 
-const cfg = config['account-http'] = {};
+const cfg = config['account-http'] = {
+  // account registration options
+  registration: {
+    // default to false, set name of service as string
+    authorizationRequired: false
+  }
+};
 
@@ -13,0 +19,0 @@ cfg.routes = {

lib/index.js

@@ -9,4 +9,6 @@ /*!
 import {asyncHandler} from '@bedrock/express';
+import {authorizeRegistration} from './authorizations.js';
 import boolParser from 'express-query-boolean';
 import {createValidateMiddleware} from '@bedrock/validation';
+
 import intParser from 'express-query-int';
@@ -46,2 +48,6 @@ import {v4 as uuid} from 'uuid';
 
+      if(cfg.registration.authorizationRequired.length > 0) {
+        await authorizeRegistration({req});
+      }
+
       // anyone may create a new account; must be rate limited via another
@@ -221,1 +227,2 @@ // means if necessary
 }
+

package.json

 {
   "name": "@bedrock/account-http",
-  "version": "7.0.1",
+  "version": "7.1.0",
   "type": "module",
@@ -28,4 +28,8 @@ "description": "HTTP API for Bedrock User Accounts",
   "dependencies": {
+    "@bedrock/https-agent": "^4.0.0",
+    "@bedrock/turnstile": "^1.0.0",
+    "@digitalbazaar/http-client": "^4.0.0",
     "express-query-boolean": "^2.0.0",
     "express-query-int": "^3.0.0",
+    "forwarded": "^0.2.0",
     "uuid": "^9.0.0"
@@ -32,0 +36,0 @@ },

schemas/bedrock-account-http.js

@@ -13,3 +13,17 @@ /*!
     properties: {
-      email: schemas.email()
+      email: schemas.email(),
+      authorization: {
+        type: 'object',
+        additionalProperties: false,
+        required: ['type', 'token'],
+        properties: {
+          type: {
+            type: 'string',
+            enum: ['turnstile']
+          },
+          token: {
+            type: 'string'
+          }
+        }
+      }
     }
@@ -16,0 +30,0 @@ };

test/mocha/10-api.js

@@ -88,2 +88,18 @@ /*!
   describe('post /', function() {
+    it('should create account with authorization', async function() {
+      config['account-http'].registration.authorizationRequired = 'turnstile';
+      const authorization = {
+        token: 'XXXX.DUMMY.TOKEN.XXXX',
+        type: 'turnstile'
+      };
+      const email = {email: '[e-mail]', authorization};
+      const result = await api.post('/', email);
+      result.status.should.equal(201);
+      config['account-http'].registration.authorizationRequired = false;
+    });
+    it('should create account without authorization', async function() {
+      const email = {email: '[e-mail]'};
+      const result = await api.post('/', email);
+      result.status.should.equal(201);
+    });
     it('should return 400 if there is no email', async function() {
@@ -95,3 +111,5 @@ const result = await api.post('/');
     it('should return 201 if there is an email', async function() {
-      const result = await api.post('/', {email: '[e-mail]'});
+      const result = await api.post('/', {
+        email: '[e-mail]'
+      });
       result.status.should.equal(201);
@@ -98,0 +116,0 @@ });

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

41830

increased by7.33%

Number of package files

17

increased by6.25%

Lines of code

795

increased by9.96%

Worsened metrics

Dependency count

12

increased by50%

Number of medium supply chain risk alerts

2

increased by100%

Dependency changes

• + Added@bedrock/https-agent@^4.0.0

• + Added@bedrock/turnstile@^1.0.0

• + Added@digitalbazaar/http-client@^4.0.0

• + Addedforwarded@^0.2.0

• + Added@bedrock/https-agent@4.1.0(transitive)

• + Added@bedrock/turnstile@1.0.2(transitive)

• + Added@digitalbazaar/http-client@4.1.1(transitive)

• + Addedky@1.7.2(transitive)

• + Addedundici@6.21.0(transitive)