first commit

api/commands/user_create.ts

@@ -0,0 +1,51 @@
+import { BaseCommand } from '@adonisjs/core/ace'
+import type { CommandOptions } from '@adonisjs/core/types/ace'
+
+/**
+ * Creates the account used to log in. There is no sign-up page: the only
+ * way to create an account is this command, run on the VPS:
+ *
+ *   docker exec -it big-brother node ace user:create
+ */
+export default class UserCreate extends BaseCommand {
+  static commandName = 'user:create'
+  static description = 'Créer un compte (mot de passe + double authentification)'
+
+  static options: CommandOptions = {
+    startApp: true,
+  }
+
+  async run() {
+    const { default: User } = await import('#models/user')
+    const { enrollTotp } = await import('#services/totp_enrollment')
+
+    const username = await this.prompt.ask('Identifiant', {
+      validate: (value) =>
+        /^[\w.-]{3,64}$/.test(value) || '3 à 64 caractères : lettres, chiffres, . _ -',
+    })
+    if (await User.findBy('username', username)) {
+      this.logger.error(`Le compte « ${username} » existe déjà.`)
+      this.exitCode = 1
+      return
+    }
+
+    const password = await this.prompt.secure('Mot de passe (12 caractères minimum)', {
+      validate: (value) => value.length >= 12 || 'Au moins 12 caractères',
+    })
+    const confirmation = await this.prompt.secure('Confirme le mot de passe')
+    if (password !== confirmation) {
+      this.logger.error('Les mots de passe ne correspondent pas.')
+      this.exitCode = 1
+      return
+    }
+
+    const totpSecret = await enrollTotp(this, username)
+    if (!totpSecret) {
+      this.exitCode = 1
+      return
+    }
+
+    await User.create({ username, password, totpSecret })
+    this.logger.success(`Compte « ${username} » créé. Tu peux te connecter.`)
+  }
+}

api/commands/user_password.ts

@@ -0,0 +1,39 @@
+import { BaseCommand, args } from '@adonisjs/core/ace'
+import type { CommandOptions } from '@adonisjs/core/types/ace'
+
+export default class UserPassword extends BaseCommand {
+  static commandName = 'user:password'
+  static description = 'Changer le mot de passe d’un compte'
+
+  static options: CommandOptions = {
+    startApp: true,
+  }
+
+  @args.string({ description: 'Identifiant du compte' })
+  declare username: string
+
+  async run() {
+    const { default: User } = await import('#models/user')
+
+    const user = await User.findBy('username', this.username)
+    if (!user) {
+      this.logger.error(`Compte « ${this.username} » introuvable.`)
+      this.exitCode = 1
+      return
+    }
+
+    const password = await this.prompt.secure('Nouveau mot de passe (12 caractères minimum)', {
+      validate: (value) => value.length >= 12 || 'Au moins 12 caractères',
+    })
+    const confirmation = await this.prompt.secure('Confirme le mot de passe')
+    if (password !== confirmation) {
+      this.logger.error('Les mots de passe ne correspondent pas.')
+      this.exitCode = 1
+      return
+    }
+
+    user.password = password
+    await user.save()
+    this.logger.success('Mot de passe changé.')
+  }
+}

api/commands/user_reset_2fa.ts

@@ -0,0 +1,40 @@
+import { BaseCommand, args } from '@adonisjs/core/ace'
+import type { CommandOptions } from '@adonisjs/core/types/ace'
+
+/**
+ * New double authentication secret (lost phone, new app…).
+ */
+export default class UserReset2fa extends BaseCommand {
+  static commandName = 'user:reset-2fa'
+  static description = 'Réinitialiser la double authentification d’un compte'
+
+  static options: CommandOptions = {
+    startApp: true,
+  }
+
+  @args.string({ description: 'Identifiant du compte' })
+  declare username: string
+
+  async run() {
+    const { default: User } = await import('#models/user')
+    const { enrollTotp } = await import('#services/totp_enrollment')
+
+    const user = await User.findBy('username', this.username)
+    if (!user) {
+      this.logger.error(`Compte « ${this.username} » introuvable.`)
+      this.exitCode = 1
+      return
+    }
+
+    const totpSecret = await enrollTotp(this, user.username)
+    if (!totpSecret) {
+      this.exitCode = 1
+      return
+    }
+
+    user.totpSecret = totpSecret
+    user.totpLastStep = null
+    await user.save()
+    this.logger.success('Double authentification réinitialisée.')
+  }
+}