@absolutejs/auth 0.36.0 → 0.37.0

package/dist/index.js

@@ -1,4 +1,19 @@
 // @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
 // node_modules/citra/dist/index.js
@@ -20771,6 +20786,132 @@ var switchActiveSession = ({
 };
 // src/tenancy.ts
 var hasOrganizationScope = (value) => typeof value.organizationId === "string" && value.organizationId.length > 0;
+// src/credentials/backgroundOps.ts
+var HIBP_BREACHED_ACCOUNT_URL = "https://haveibeenpwned.com/api/v3/breachedaccount/";
+var HIBP_USER_AGENT = "@absolutejs/auth breach scanner";
+var DEFAULT_PAUSE_MS = 1700;
+var HIBP_NOT_FOUND = 404;
+var HIBP_RATE_LIMITED = 429;
+var MS_PER_DAY = 86400000;
+var MS_PER_SECOND3 = 1000;
+var sleep = (delayMs) => new Promise((resolve) => {
+  setTimeout(resolve, delayMs);
+});
+var isBreachRecord = (entry) => {
+  if (typeof entry !== "object" || entry === null)
+    return false;
+  if (!("name" in entry))
+    return false;
+  const candidate = entry;
+  return typeof candidate.name === "string";
+};
+var isBreachRecordArray = (value) => Array.isArray(value) && value.every(isBreachRecord);
+var checkEmailBreaches = async (email, apiKey, truncate) => {
+  const url = `${HIBP_BREACHED_ACCOUNT_URL}${encodeURIComponent(email)}?truncateResponse=${truncate ? "true" : "false"}`;
+  const response = await fetch(url, {
+    headers: {
+      "hibp-api-key": apiKey,
+      "user-agent": HIBP_USER_AGENT
+    }
+  });
+  if (response.status === HIBP_NOT_FOUND)
+    return [];
+  if (response.status === HIBP_RATE_LIMITED) {
+    const retryAfter = Number(response.headers.get("retry-after") ?? "0");
+    if (retryAfter > 0)
+      await sleep(retryAfter * MS_PER_SECOND3);
+    return [];
+  }
+  if (!response.ok)
+    return [];
+  const body = await response.json();
+  if (!isBreachRecordArray(body))
+    return [];
+  return body;
+};
+var scanEmail = async (email, apiKey, truncate, onBreachFound) => {
+  const breaches = await checkEmailBreaches(email, apiKey, truncate);
+  if (breaches.length === 0)
+    return false;
+  await onBreachFound({ breaches, email });
+  return true;
+};
+var scanPage = async (options) => {
+  let scanned = 0;
+  let breached = 0;
+  for (const email of options.emails) {
+    scanned += 1;
+    const hit = await scanEmail(email, options.apiKey, options.truncate, options.onBreachFound);
+    if (hit)
+      breached += 1;
+    await sleep(options.pauseMs);
+  }
+  return { breached, scanned };
+};
+var runEmailBreachScan = async (input) => {
+  const pauseMs = input.pauseMs ?? DEFAULT_PAUSE_MS;
+  const truncate = input.truncateResponse ?? true;
+  let scanned = 0;
+  let breached = 0;
+  let cursor;
+  do {
+    const page = await input.iterateEmails(cursor);
+    const tally = await scanPage({
+      apiKey: input.hibpApiKey,
+      emails: page.emails,
+      onBreachFound: input.onBreachFound,
+      pauseMs,
+      truncate
+    });
+    scanned += tally.scanned;
+    breached += tally.breached;
+    cursor = page.nextCursor;
+  } while (cursor !== undefined);
+  const result = { breached, scanned };
+  return result;
+};
+var pruneCandidate = async (candidate, cutoff, dryRun, onDelete) => {
+  const reference = candidate.lastLoginAt ?? candidate.createdAt;
+  if (reference === undefined || reference === null)
+    return false;
+  if (reference >= cutoff)
+    return false;
+  if (!dryRun)
+    await onDelete(candidate.userId);
+  return true;
+};
+var prunePage = async (options) => {
+  const pruned = [];
+  for (const candidate of options.candidates) {
+    const removed = await pruneCandidate(candidate, options.cutoff, options.dryRun, options.onDelete);
+    if (removed)
+      pruned.push(candidate.userId);
+  }
+  return pruned;
+};
+var pruneInactiveUsers = async (input) => {
+  const now = input.now?.() ?? Date.now();
+  const thresholdMs = input.olderThanDays * MS_PER_DAY;
+  const cutoff = now - thresholdMs;
+  const dryRun = input.dryRun ?? false;
+  const prunedUserIds = [];
+  let scanned = 0;
+  let cursor;
+  do {
+    const page = await input.iterateUsers(cursor);
+    scanned += page.users.length;
+    const removed = await prunePage({
+      candidates: page.users,
+      cutoff,
+      dryRun,
+      onDelete: input.onDelete
+    });
+    prunedUserIds.push(...removed);
+    cursor = page.nextCursor;
+  } while (cursor !== undefined);
+  const result = { dryRun, prunedUserIds, scanned };
+  return result;
+};
 // src/credentials/emailValidation.ts
 import { resolveMx } from "dns/promises";
 var EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u;
@@ -24373,6 +24514,7 @@ export {
   samlServiceProvidersTable,
   samlIdpRoutes,
   runMigrations,
+  runEmailBreachScan,
   rotateVaultKey,
   rotateMfaEncryptionKey,
   rolesTable,
@@ -24400,6 +24542,7 @@ export {
   readUserInfoBearer,
   readSessionRing,
   pushAuthorizationRequest,
+  pruneInactiveUsers,
   providers,
   providerOptions,
   protectRoutePlugin,
@@ -24703,5 +24846,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=1069DAAF739CAF9F64756E2164756E21
+//# debugId=26C38ACE51F8A69A64756E2164756E21
 //# sourceMappingURL=index.js.map