@absolutejs/auth 0.57.9 → 0.59.0

package/README.md

@@ -89,6 +89,44 @@ The concrete SimpleWebAuthn adapter follows the same boundary:
 import { createSimpleWebAuthnAdapter } from '@absolutejs/auth/webauthn';
 ```
 
+### Provider-managed phone verification
+
+`verificationProvider` is the vendor-neutral phone-verification lifecycle.
+The contract supports SMS, WhatsApp, and voice-call OTP; MFA currently selects
+SMS while signup, recovery, phone change, and step-up flows can use the same
+provider contract. Auth owns enrollment, atomic resend/code-consumption policy,
+audit, and session promotion; the provider generates, delivers, checks, and
+cancels the code.
+
+```ts
+import { auth } from '@absolutejs/auth/server';
+import { createTwilioVerificationProvider } from '@absolutejs/auth-twilio';
+import { Twilio } from 'twilio';
+
+const authPlugin = await auth({
+	// credentials, mfa, stores, providersConfiguration, etc.
+	verificationProvider: createTwilioVerificationProvider({
+		client: new Twilio(
+			process.env.TWILIO_ACCOUNT_SID!,
+			process.env.TWILIO_AUTH_TOKEN!
+		),
+		verifyServiceSid: process.env.TWILIO_VERIFY_SERVICE_SID!,
+		serviceTokenTtlMs: 10 * 60 * 1000
+	})
+});
+```
+
+Without a provider, `mfa.onSendSmsCode` keeps codes local and accepts any
+application-owned delivery system such as `@absolutejs/dispatch`. Its payload
+includes `purpose` and `userId` for safe templates, audit correlation, and
+tenant routing. Provider and local-code sends share the default 30-second
+per-enrollment resend cooldown; configure `mfa.smsResendCooldownMs` when needed.
+MFA enrollment, replacement, and removal require a fresh authentication by
+default (five minutes); configure `mfa.managementAuthMaxAgeMs` deliberately.
+
+Production databases must run the `mfa` migration block after upgrading to add
+the atomic SMS challenge identifier.
+
 ### Delegated AI agents
 
 The `agentAuth` block provides a standards-first agent identity layer. It

package/dist/cli/migrate.js

@@ -2672,7 +2672,7 @@ var lockoutsTable = pgTable8("auth_lockouts", {
 });
 
 // src/mfa/postgresMfaStore.ts
-import { eq as eq9 } from "drizzle-orm";
+import { and as and4, eq as eq9, isNull as isNull2, lte, or as or2, sql } from "drizzle-orm";
 import {
   bigint as bigint7,
   boolean as boolean3,
@@ -2688,12 +2688,16 @@ var mfaEnrollmentsTable = pgTable9("auth_mfa_enrollments", {
   backup_code_hashes: jsonb3("backup_code_hashes").$type().notNull().default([]),
   created_at_ms: bigint7("created_at_ms", { mode: "number" }).notNull(),
   last_used_at_ms: bigint7("last_used_at_ms", { mode: "number" }),
+  sms_challenge_id: text4("sms_challenge_id"),
+  sms_code_sent_at_ms: bigint7("sms_code_sent_at_ms", { mode: "number" }),
   sms_failed_attempts: smallint("sms_failed_attempts").notNull().default(0),
   sms_pending_code_expires_at_ms: bigint7("sms_pending_code_expires_at_ms", {
     mode: "number"
   }),
   sms_pending_code_hash: text4("sms_pending_code_hash"),
+  sms_pending_purpose: text4("sms_pending_purpose").$type(),
   sms_phone: varchar9("sms_phone", { length: PHONE_LENGTH }),
+  sms_provider_reference: text4("sms_provider_reference"),
   sms_verified: boolean3("sms_verified").notNull().default(false),
   totp_failed_attempts: smallint("totp_failed_attempts").notNull().default(0),
   totp_secret_ciphertext: text4("totp_secret_ciphertext"),
@@ -2703,7 +2707,7 @@ var mfaEnrollmentsTable = pgTable9("auth_mfa_enrollments", {
 });
 
 // src/oidc/postgresStores.ts
-import { and as and4, desc as desc6, eq as eq10, gt as gt2, lt as lt3 } from "drizzle-orm";
+import { and as and5, desc as desc6, eq as eq10, gt as gt2, lt as lt3 } from "drizzle-orm";
 import {
   bigint as bigint8,
   boolean as boolean4,
@@ -2833,7 +2837,7 @@ var oauthRefreshTokensTable = pgTable10("auth_oauth_refresh_tokens", {
 });
 
 // src/organizations/postgresOrganizationStore.ts
-import { and as and5, desc as desc7, eq as eq11 } from "drizzle-orm";
+import { and as and6, desc as desc7, eq as eq11 } from "drizzle-orm";
 import {
   bigint as bigint9,
   jsonb as jsonb5,
@@ -2909,7 +2913,7 @@ var setupSessionsTable = pgTable13("auth_setup_sessions", {
 });
 
 // src/roles/postgresRoleStore.ts
-import { and as and6, eq as eq14 } from "drizzle-orm";
+import { and as and7, eq as eq14 } from "drizzle-orm";
 import {
   bigint as bigint12,
   jsonb as jsonb7,
@@ -2995,7 +2999,7 @@ var samlServiceProvidersTable = pgTable17("auth_saml_service_providers", {
 });
 
 // src/sso/postgresSsoConnectionStore.ts
-import { and as and7, desc as desc9, eq as eq18 } from "drizzle-orm";
+import { and as and8, desc as desc9, eq as eq18 } from "drizzle-orm";
 import { bigint as bigint16, boolean as boolean5, jsonb as jsonb9, pgTable as pgTable18, varchar as varchar18 } from "drizzle-orm/pg-core";
 var ID_LENGTH15 = 255;
 var TYPE_LENGTH2 = 16;
@@ -3045,7 +3049,7 @@ var vcPresentationRequestsTable = pgTable19("auth_vc_presentation_requests", {
 });
 
 // src/vault/postgresVaultStore.ts
-import { and as and8, eq as eq20 } from "drizzle-orm";
+import { and as and9, eq as eq20 } from "drizzle-orm";
 import {
   bigint as bigint18,
   pgTable as pgTable20,
@@ -3170,18 +3174,18 @@ var JOURNAL_DDL = `CREATE TABLE IF NOT EXISTS "auth_migrations" (
 var isJournalRow = (value) => typeof value === "object" && value !== null && typeof Reflect.get(value, "id") === "string";
 var isBlockName = (value) => Object.hasOwn(blockMigrations, value);
 var allBlockNames = () => Object.keys(blockMigrations).filter(isBlockName);
-var applyOne = async (client, id, sql, log) => {
-  await client.query(sql);
+var applyOne = async (client, id, sql2, log) => {
+  await client.query(sql2);
   await client.query(`INSERT INTO "auth_migrations" ("id", "applied_at_ms") VALUES ($1, $2)`, [id, Date.now()]);
   log(`apply  ${id}`);
 };
-var runOne = async (client, id, sql, applied, result, log) => {
+var runOne = async (client, id, sql2, applied, result, log) => {
   if (applied.has(id)) {
     result.skipped.push(id);
     log(`skip   ${id}`);
     return;
   }
-  await applyOne(client, id, sql, log);
+  await applyOne(client, id, sql2, log);
   result.applied.push(id);
 };
 var runMigrations = async ({
@@ -3240,6 +3244,19 @@ var mfaTotpLockoutMigration = {
   id: "0003_totp_lockout",
   sql: 'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "totp_failed_attempts" smallint NOT NULL DEFAULT 0;'
 };
+var mfaSmsDeliveryPolicyMigration = {
+  id: "0004_sms_delivery_policy",
+  sql: [
+    'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_code_sent_at_ms" bigint;',
+    'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_pending_purpose" text;',
+    'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_provider_reference" text;'
+  ].join(`
+`)
+};
+var mfaSmsAtomicChallengeMigration = {
+  id: "0005_sms_atomic_challenge",
+  sql: 'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_challenge_id" text;'
+};
 var oidcResourceAudienceMigration = {
   id: "0002_resource_audience",
   sql: [
@@ -3294,7 +3311,9 @@ var blockMigrations = {
     migrations: [
       ...initMigration("mfa", [mfaEnrollmentsTable]).migrations,
       mfaSmsColumnsMigration,
-      mfaTotpLockoutMigration
+      mfaTotpLockoutMigration,
+      mfaSmsDeliveryPolicyMigration,
+      mfaSmsAtomicChallengeMigration
     ]
   },
   oidc: {
@@ -3531,5 +3550,5 @@ var main = async () => {
 };
 await main();
 
-//# debugId=CF3F65D5B7AF923D64756E2164756E21
+//# debugId=F3F4FD6B1C5A081764756E2164756E21
 //# sourceMappingURL=migrate.js.map