@absolutejs/auth 0.58.0 → 0.59.1

package/README.md

@@ -91,9 +91,12 @@ import { createSimpleWebAuthnAdapter } from '@absolutejs/auth/webauthn';
 
 ### Provider-managed phone verification
 
-`verificationProvider` is the vendor-neutral challenge lifecycle used by SMS
-MFA. Auth owns enrollment, resend cooldowns, failed-attempt policy, audit, and
-session promotion; the provider generates, delivers, and checks the code.
+`verificationProvider` is the vendor-neutral phone-verification lifecycle.
+The contract supports SMS, WhatsApp, and voice-call OTP; MFA currently selects
+SMS while signup, recovery, phone change, and step-up flows can use the same
+provider contract. Auth owns enrollment, atomic resend/code-consumption policy,
+audit, and session promotion; the provider generates, delivers, checks, and
+cancels the code.
 
 ```ts
 import { auth } from '@absolutejs/auth/server';
@@ -118,9 +121,11 @@ application-owned delivery system such as `@absolutejs/dispatch`. Its payload
 includes `purpose` and `userId` for safe templates, audit correlation, and
 tenant routing. Provider and local-code sends share the default 30-second
 per-enrollment resend cooldown; configure `mfa.smsResendCooldownMs` when needed.
+MFA enrollment, replacement, and removal require a fresh authentication by
+default (five minutes); configure `mfa.managementAuthMaxAgeMs` deliberately.
 
 Production databases must run the `mfa` migration block after upgrading to add
-the durable cooldown timestamp.
+the atomic SMS challenge identifier.
 
 ### Delegated AI agents
 

package/dist/cli/migrate.js

@@ -2672,7 +2672,7 @@ var lockoutsTable = pgTable8("auth_lockouts", {
 });
 
 // src/mfa/postgresMfaStore.ts
-import { eq as eq9 } from "drizzle-orm";
+import { and as and4, eq as eq9, isNull as isNull2, lte, or as or2, sql } from "drizzle-orm";
 import {
   bigint as bigint7,
   boolean as boolean3,
@@ -2688,6 +2688,7 @@ var mfaEnrollmentsTable = pgTable9("auth_mfa_enrollments", {
   backup_code_hashes: jsonb3("backup_code_hashes").$type().notNull().default([]),
   created_at_ms: bigint7("created_at_ms", { mode: "number" }).notNull(),
   last_used_at_ms: bigint7("last_used_at_ms", { mode: "number" }),
+  sms_challenge_id: text4("sms_challenge_id"),
   sms_code_sent_at_ms: bigint7("sms_code_sent_at_ms", { mode: "number" }),
   sms_failed_attempts: smallint("sms_failed_attempts").notNull().default(0),
   sms_pending_code_expires_at_ms: bigint7("sms_pending_code_expires_at_ms", {
@@ -2706,7 +2707,7 @@ var mfaEnrollmentsTable = pgTable9("auth_mfa_enrollments", {
 });
 
 // src/oidc/postgresStores.ts
-import { and as and4, desc as desc6, eq as eq10, gt as gt2, lt as lt3 } from "drizzle-orm";
+import { and as and5, desc as desc6, eq as eq10, gt as gt2, lt as lt3 } from "drizzle-orm";
 import {
   bigint as bigint8,
   boolean as boolean4,
@@ -2836,7 +2837,7 @@ var oauthRefreshTokensTable = pgTable10("auth_oauth_refresh_tokens", {
 });
 
 // src/organizations/postgresOrganizationStore.ts
-import { and as and5, desc as desc7, eq as eq11 } from "drizzle-orm";
+import { and as and6, desc as desc7, eq as eq11 } from "drizzle-orm";
 import {
   bigint as bigint9,
   jsonb as jsonb5,
@@ -2912,7 +2913,7 @@ var setupSessionsTable = pgTable13("auth_setup_sessions", {
 });
 
 // src/roles/postgresRoleStore.ts
-import { and as and6, eq as eq14 } from "drizzle-orm";
+import { and as and7, eq as eq14 } from "drizzle-orm";
 import {
   bigint as bigint12,
   jsonb as jsonb7,
@@ -2998,7 +2999,7 @@ var samlServiceProvidersTable = pgTable17("auth_saml_service_providers", {
 });
 
 // src/sso/postgresSsoConnectionStore.ts
-import { and as and7, desc as desc9, eq as eq18 } from "drizzle-orm";
+import { and as and8, desc as desc9, eq as eq18 } from "drizzle-orm";
 import { bigint as bigint16, boolean as boolean5, jsonb as jsonb9, pgTable as pgTable18, varchar as varchar18 } from "drizzle-orm/pg-core";
 var ID_LENGTH15 = 255;
 var TYPE_LENGTH2 = 16;
@@ -3048,7 +3049,7 @@ var vcPresentationRequestsTable = pgTable19("auth_vc_presentation_requests", {
 });
 
 // src/vault/postgresVaultStore.ts
-import { and as and8, eq as eq20 } from "drizzle-orm";
+import { and as and9, eq as eq20 } from "drizzle-orm";
 import {
   bigint as bigint18,
   pgTable as pgTable20,
@@ -3173,18 +3174,18 @@ var JOURNAL_DDL = `CREATE TABLE IF NOT EXISTS "auth_migrations" (
 var isJournalRow = (value) => typeof value === "object" && value !== null && typeof Reflect.get(value, "id") === "string";
 var isBlockName = (value) => Object.hasOwn(blockMigrations, value);
 var allBlockNames = () => Object.keys(blockMigrations).filter(isBlockName);
-var applyOne = async (client, id, sql, log) => {
-  await client.query(sql);
+var applyOne = async (client, id, sql2, log) => {
+  await client.query(sql2);
   await client.query(`INSERT INTO "auth_migrations" ("id", "applied_at_ms") VALUES ($1, $2)`, [id, Date.now()]);
   log(`apply  ${id}`);
 };
-var runOne = async (client, id, sql, applied, result, log) => {
+var runOne = async (client, id, sql2, applied, result, log) => {
   if (applied.has(id)) {
     result.skipped.push(id);
     log(`skip   ${id}`);
     return;
   }
-  await applyOne(client, id, sql, log);
+  await applyOne(client, id, sql2, log);
   result.applied.push(id);
 };
 var runMigrations = async ({
@@ -3252,6 +3253,10 @@ var mfaSmsDeliveryPolicyMigration = {
   ].join(`
 `)
 };
+var mfaSmsAtomicChallengeMigration = {
+  id: "0005_sms_atomic_challenge",
+  sql: 'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_challenge_id" text;'
+};
 var oidcResourceAudienceMigration = {
   id: "0002_resource_audience",
   sql: [
@@ -3307,7 +3312,8 @@ var blockMigrations = {
       ...initMigration("mfa", [mfaEnrollmentsTable]).migrations,
       mfaSmsColumnsMigration,
       mfaTotpLockoutMigration,
-      mfaSmsDeliveryPolicyMigration
+      mfaSmsDeliveryPolicyMigration,
+      mfaSmsAtomicChallengeMigration
     ]
   },
   oidc: {
@@ -3544,5 +3550,5 @@ var main = async () => {
 };
 await main();
 
-//# debugId=19A5010083F8B61F64756E2164756E21
+//# debugId=F3F4FD6B1C5A081764756E2164756E21
 //# sourceMappingURL=migrate.js.map