bug #107

Author: alainabbas

apps/api/defaults/cron/identities-init-invitation-expire.yml

@@ -0,0 +1,7 @@
+tasks:
+  - name: "identities-init-invitation-expire"
+    description: "Expiration des invitations d'initialisation de compte"
+    enabled: true
+    schedule: "1 * * * *"  # Tous les jours à 08:00
+    handler: "identities-init-invitation-expire"
+    options:

apps/api/src/management/identities/_enums/init-state.enum.ts

@@ -2,4 +2,5 @@ export enum InitStatesEnum {
   NOSENT = 0,
   SENT = 1,
   INITIALIZED = 2,
+  OUTOFDATE = -1,
 }

apps/api/src/management/identities/identities.command.ts

@@ -16,6 +16,12 @@ import { MailerService } from '@nestjs-modules/mailer';
 import { MailadmService } from '~/settings/mailadm.service';
 import { get } from 'radash';
 import { IdentitiesPasswordExpirationReminderService } from '~/management/identities/identities-password-expiration-reminder.service';
+import { InitStatesEnum } from '~/management/identities/_enums/init-state.enum';
+import {
+  buildExpiredInitInvitationFilter,
+  DEFAULT_INIT_TOKEN_TTL_SECONDS,
+  getInitInvitationExpirationCutoff,
+} from '~/management/passwd/init-invitation-expiration.helper';
 
 @SubCommand({ name: 'fingerprint' })
 export class IdentitiesFingerprintCommand extends CommandRunner {
@@ -320,6 +326,90 @@ export class IdentitiesPasswordExpirationReminderCommand extends CommandRunner {
   }
 }
 
+type IdentitiesInitExpireOptions = {
+  dryRun?: boolean;
+};
+
+@CronConsoleHandler({
+  handler: 'identities-init-invitation-expire',
+  command: 'identities init expire',
+  label: "Expiration des invitations d'initialisation de compte",
+  arguments: [
+    {
+      name: 'dryRun',
+      label: 'Simulation',
+      description: 'Compte les invitations expirées sans modifier les identités.',
+      type: 'boolean',
+      default: false,
+    },
+  ],
+})
+@SubCommand({ name: 'init' })
+export class IdentitiesInitExpireCommand extends CommandRunner {
+  private readonly logger = new Logger(IdentitiesInitExpireCommand.name);
+
+  public constructor(protected moduleRef: ModuleRef) {
+    super();
+  }
+
+  async run(inputs: string[], options: IdentitiesInitExpireOptions): Promise<void> {
+    const subTask = inputs?.[0];
+    if (subTask !== 'expire') {
+      console.error('Usage: yarn run console identities init expire [--dryRun]');
+      return;
+    }
+
+    // Services singleton : `ModuleRef.resolve()` ne fonctionne que pour les providers transient / request-scoped.
+    const identities = this.moduleRef.get(IdentitiesCrudService, { strict: false });
+    const passwdadm = this.moduleRef.get(PasswdadmService, { strict: false });
+
+    const policies = await passwdadm.getPolicies();
+    const ttlSeconds = Number(policies?.initTokenTTL) || DEFAULT_INIT_TOKEN_TTL_SECONDS;
+
+    const now = new Date();
+    const cutoff = getInitInvitationExpirationCutoff(ttlSeconds, now);
+    const filter = buildExpiredInitInvitationFilter(ttlSeconds, now);
+
+    this.logger.log(
+      `Checking outdated init invitations: initTokenTTL=${ttlSeconds}s cutoff=${cutoff.toISOString()} dryRun=${!!options?.dryRun}`,
+    );
+
+    const total = await identities.model.countDocuments(filter);
+    if (total === 0) {
+      this.logger.log('No outdated init invitation found.');
+      return;
+    }
+
+    if (options?.dryRun) {
+      const candidates = await identities.model.find(filter).select({ _id: 1, initInfo: 1 }).lean();
+      for (const candidate of candidates) {
+        this.logger.warn(
+          `[dryRun] Identity <${candidate._id}> init invitation expired (initDate=${candidate?.initInfo?.initDate?.toISOString?.() ?? 'n/a'})`,
+        );
+      }
+      this.logger.log(`[dryRun] ${total} identity(ies) would be flagged as OUTOFDATE.`);
+      return;
+    }
+
+    // Seules les identités encore en SENT sont passées en OUTOFDATE (garanti par le filtre).
+    const result = await identities.model.updateMany(filter, {
+      $set: { initState: InitStatesEnum.OUTOFDATE },
+    });
+
+    this.logger.log(`Outdated init invitations: ${result.modifiedCount}/${total} identity(ies) set to OUTOFDATE.`);
+  }
+
+  @Option({
+    flags: '--dryRun [dryRun]',
+    description: 'Compte les invitations expirées sans modifier les identités.',
+    defaultValue: false,
+  })
+  parseDryRun(val: string): boolean {
+    if (val === undefined || val === null || val === '') return true;
+    return /^(1|true|on|yes)$/i.test(String(val).trim());
+  }
+}
+
 @Command({
   name: 'identities',
   arguments: '<task>',
@@ -328,6 +418,7 @@ export class IdentitiesPasswordExpirationReminderCommand extends CommandRunner {
     IdentitiesCancelFusionCommand,
     IdentitiesPwnedCommand,
     IdentitiesPasswordExpirationReminderCommand,
+    IdentitiesInitExpireCommand,
   ],
 })
 export class IdentitiesCommand extends CommandRunner {

apps/web/src/constants/defaultMenuEntries.ts

@@ -191,14 +191,26 @@ export function getDefaultMenuEntries(): MenuItem[] {
       icon: 'mdi-email-fast',
       label: 'Invitations envoyées',
       name: 'invitations_envoyées',
-      path: '/identities/table?limit=10&skip=0&filters[%23initState]=1&initInvitationExpired=false&sort[metadata.lastUpdatedAt]=desc',
+      path: '/identities/table?limit=10&skip=0&filters[%23initState]=1&sort[metadata.lastUpdatedAt]=desc',
       color: 'warning',
       textColor: 'black',
       part: normalizeNameFromLabel(MenuPart.ACTIVATION),
       badge: { color: 'warning', textColor: 'black' },
       hideInMenuBar: false,
       acl: ['/management/identities'],
     },
+    {
+      icon: 'mdi-email-off',
+      label: 'Invitations périmées',
+      name: 'invitations_périmées',
+      path: '/identities/table?limit=10&skip=0&filters[%23initState]=-1&sort[metadata.lastUpdatedAt]=desc',
+      color: "negative",
+      textColor: 'white',
+      part: normalizeNameFromLabel(MenuPart.ACTIVATION),
+      badge: { color: "negative", textColor: 'white' },
+      hideInMenuBar: false,
+      acl: ['/management/identities'],
+    },
     {
       icon: 'mdi-email-open',
       label: 'Comptes activés',
@@ -211,16 +223,6 @@ export function getDefaultMenuEntries(): MenuItem[] {
       hideInMenuBar: false,
       acl: ['/management/identities'],
     },
-    {
-      icon: 'mdi-email-remove',
-      label: 'Invitations périmées',
-      name: 'invitations_périmées',
-      path: '/identities/outdated',
-      color: 'accent',
-      part: normalizeNameFromLabel(MenuPart.ACTIVATION),
-      hideInMenuBar: false,
-      acl: ['/management/identities'],
-    },
   ]
 }