@absolutejs/auth 0.60.0 → 0.62.0

package/dist/credentials/config.d.ts

@@ -41,6 +41,13 @@ export type CredentialsConfig<UserType> = {
     onEmailVerified?: (context: {
         email: string;
     }) => void | Promise<void>;
+    /** Called (in the enumeration-safe default) when someone tries to register an
+     *  email that already exists — send the real owner a "you already have an
+     *  account, sign in" email out-of-band. Not called when
+     *  `revealRegistrationConflicts` is true. */
+    onExistingAccount?: (context: {
+        email: string;
+    }) => void | Promise<void>;
     onPasswordReset?: (context: {
         email: string;
     }) => void | Promise<void>;
@@ -55,9 +62,17 @@ export type CredentialsConfig<UserType> = {
      *  rejected until the email is verified. Default false = auto-login on register and
      *  verification acts as a soft, later gate. */
     requireEmailVerification?: boolean;
+    /** When true, `POST /register` returns 409 "Email is already registered" for a
+     *  known email. Default false = enumeration-safe: return the same generic
+     *  response a new pending registration does and call `onExistingAccount`
+     *  instead of confirming the account exists. */
+    revealRegistrationConflicts?: boolean;
     resetPasswordRoute?: RouteString;
     resetTokenDurationMs?: number;
     sessionDurationMs?: number;
+    /** When set, login/register reject requests whose `Origin` header is not in
+     *  this list (defense against login/registration CSRF). Omit to disable. */
+    trustedOrigins?: readonly string[];
     verificationTokenDurationMs?: number;
     verifyEmailRoute?: RouteString;
 };

package/dist/credentials/login.d.ts

@@ -1,6 +1,6 @@
 import { Elysia } from 'elysia';
 import { type CredentialRouteProps } from './config';
-export declare const credentialsLogin: <UserType>({ authSessionStore, checkBreachesOnLogin, cookieSecure, credentialStore, getUserByEmail, isMfaRequired, lockoutGuard, loginRoute, onCredentialsLoginError, onCredentialsLoginSuccess, passwordVerifier, rehashOnLogin, requireEmailVerification, sessionDurationMs }: CredentialRouteProps<UserType>) => Elysia<"", {
+export declare const credentialsLogin: <UserType>({ authSessionStore, checkBreachesOnLogin, cookieSecure, credentialStore, getUserByEmail, isMfaRequired, lockoutGuard, loginRoute, onCredentialsLoginError, onCredentialsLoginSuccess, passwordVerifier, rehashOnLogin, requireEmailVerification, sessionDurationMs, trustedOrigins }: CredentialRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;
@@ -30,7 +30,7 @@ export declare const credentialsLogin: <UserType>({ authSessionStore, checkBreac
             headers: unknown;
             response: {
                 401: "Invalid email or password";
-                403: {
+                403: "Request origin is not allowed" | {
                     readonly status: "email_not_verified";
                 };
                 200: {

package/dist/credentials/register.d.ts

@@ -1,6 +1,6 @@
 import { Elysia } from 'elysia';
 import { type CredentialRouteProps } from './config';
-export declare const credentialsRegister: <UserType>({ authSessionStore, cookieSecure, credentialStore, onCreateCredentialUser, onCredentialsLoginSuccess, onRegistrationSuccess, onSendEmail, passwordPolicy, registerRoute, requireEmailVerification, sessionDurationMs, verificationTokenDurationMs }: CredentialRouteProps<UserType>) => Elysia<"", {
+export declare const credentialsRegister: <UserType>({ authSessionStore, cookieSecure, credentialStore, onCreateCredentialUser, onCredentialsLoginSuccess, onExistingAccount, onRegistrationSuccess, onSendEmail, passwordPolicy, registerRoute, requireEmailVerification, revealRegistrationConflicts, sessionDurationMs, trustedOrigins, verificationTokenDurationMs }: CredentialRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;

package/dist/credentials/routes.d.ts

@@ -98,7 +98,7 @@ export declare const credentialRoutes: <UserType>(config: CredentialRouteProps<U
             headers: unknown;
             response: {
                 401: "Invalid email or password";
-                403: {
+                403: "Request origin is not allowed" | {
                     readonly status: "email_not_verified";
                 };
                 200: {

package/dist/csrf.d.ts

@@ -0,0 +1 @@
+export declare const isTrustedOrigin: (request: Request, trustedOrigins?: readonly string[]) => boolean;

package/dist/index.d.ts

@@ -815,7 +815,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
                 headers: unknown;
                 response: {
                     401: "Invalid email or password";
-                    403: {
+                    403: "Request origin is not allowed" | {
                         readonly status: "email_not_verified";
                     };
                     200: {
@@ -3468,6 +3468,7 @@ export { resolveAuthHtmxRenderers } from './htmx/renderers';
 export type { AuthHtmxConfig, AuthHtmxConnectorTarget, AuthHtmxProviderData, AuthHtmxProviderInfo, AuthHtmxRenderOverrides, AuthHtmxRenderersConfig, AuthHtmxUser, AuthIdentityPayload, LinkedProviderPayload } from './htmx/types';
 export * from './utils';
 export * from './redirect';
+export * from './csrf';
 export { buildClientProviders, resolveClientProviderEntry, resolveProviderClientConfiguration } from './providers/clients';
 export type { OAuth2TokenResponse, OAuth2Client, OAuth2ClientForConfig, CustomProviderCredentials, ProviderConfig, ProviderOption, PKCEProvider, OIDCProvider, RefreshableProvider, RevocableProvider, ScopeRequiredProvider, ProvidersMap, ProviderConfiguration, CredentialsFor } from 'citra';
 export { providers, providerOptions, createCustomOAuth2Client, defineProvider, refreshableProviderOptions, revocableProviderOptions, oidcProviderOptions, pkceProviderOptions, scopeRequiredProviderOptions, decodeJWT, extractPropFromIdentity, isValidProviderOption, isRefreshableOAuth2Client, isRefreshableProviderOption, isOIDCProviderOption, isPKCEProviderOption, isRevocableProviderOption, isRevocableOAuth2Client } from 'citra';

package/dist/index.js

@@ -5145,6 +5145,15 @@ init_constants();
 init_crypto();
 import { Elysia as Elysia11, t as t8 } from "elysia";
 
+// src/csrf.ts
+var isTrustedOrigin = (request, trustedOrigins) => {
+  if (trustedOrigins === undefined || trustedOrigins.length === 0) {
+    return true;
+  }
+  const origin = request.headers.get("origin");
+  return origin !== null && trustedOrigins.includes(origin);
+};
+
 // src/credentials/import.ts
 init_crypto();
 var normalizeEmail = (email) => email.trim().toLowerCase();
@@ -5333,6 +5342,8 @@ var evaluatePassword = async (password, policy = {}) => {
 var isPasswordCompromised = (password) => isPasswordBreached(password);
 
 // src/credentials/login.ts
+var dummyPasswordHashPromise;
+var dummyPasswordHash = () => dummyPasswordHashPromise ??= hashPassword("absolutejs-auth-timing-equalizer");
 var credentialsLogin = ({
   authSessionStore,
   checkBreachesOnLogin,
@@ -5347,7 +5358,8 @@ var credentialsLogin = ({
   passwordVerifier,
   rehashOnLogin = false,
   requireEmailVerification = false,
-  sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS
+  sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS,
+  trustedOrigins
 }) => new Elysia11().use(sessionStore()).post(loginRoute, async ({
   body: { email, password },
   cookie: { user_session_id },
@@ -5355,6 +5367,9 @@ var credentialsLogin = ({
   status,
   store: { session, unregisteredSession }
 }) => withSpan("auth.credentials.login", undefined, async (span) => {
+  if (!isTrustedOrigin(request, trustedOrigins)) {
+    return status("Forbidden", "Request origin is not allowed");
+  }
   const headerBag = {};
   request.headers.forEach((value, key) => {
     headerBag[key] = value;
@@ -5374,7 +5389,13 @@ var credentialsLogin = ({
   const credential = await credentialStore.getCredentialByEmail(normalizedEmail);
   const user = await getUserByEmail(normalizedEmail);
   const verifyHash = passwordVerifier ?? verifyPassword;
-  const passwordValid = credential === undefined ? false : await verifyHash(password, credential.passwordHash);
+  let passwordValid;
+  if (credential === undefined) {
+    await verifyPassword(password, await dummyPasswordHash());
+    passwordValid = false;
+  } else {
+    passwordValid = await verifyHash(password, credential.passwordHash);
+  }
   if (!credential || !user || credential.status !== "active" || !passwordValid) {
     await lockoutGuard?.recordFailure(normalizedEmail);
     await onCredentialsLoginError?.({
@@ -5506,19 +5527,26 @@ var credentialsRegister = ({
   credentialStore,
   onCreateCredentialUser,
   onCredentialsLoginSuccess,
+  onExistingAccount,
   onRegistrationSuccess,
   onSendEmail,
   passwordPolicy,
   registerRoute = "/auth/register",
   requireEmailVerification = false,
+  revealRegistrationConflicts = false,
   sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS,
+  trustedOrigins,
   verificationTokenDurationMs = DEFAULT_VERIFICATION_TOKEN_TTL_MS
 }) => new Elysia13().use(sessionStore()).post(registerRoute, async ({
   body: { email, password, ...extraFields },
   cookie: { user_session_id },
+  request,
   status,
   store: { session }
 }) => withSpan("auth.credentials.register", undefined, async () => {
+  if (!isTrustedOrigin(request, trustedOrigins)) {
+    return status("Forbidden", "Request origin is not allowed");
+  }
   const normalizedEmail = email.trim().toLowerCase();
   if (!normalizedEmail.includes("@")) {
     return status("Bad Request", "A valid email is required");
@@ -5532,7 +5560,13 @@ var credentialsRegister = ({
   }
   const existing = await credentialStore.getCredentialByEmail(normalizedEmail);
   if (existing) {
-    return status("Conflict", "Email is already registered");
+    if (revealRegistrationConflicts) {
+      return status("Conflict", "Email is already registered");
+    }
+    await onExistingAccount?.({ email: normalizedEmail });
+    return status("Created", {
+      status: "verification_required"
+    });
   }
   const created = await onCreateCredentialUser({
     ...extraFields,
@@ -37323,6 +37357,9 @@ var buildAuthApplications = async (configuration) => {
       await webhookDispatch?.(event);
     }
   }) : undefined;
+  if (auditEmit === undefined) {
+    console.warn("[@absolutejs/auth] No audit sink configured (pass `audit` or `webhooks`). " + "Privileged flows (impersonation, role/permission changes, sign-out) will " + "run WITHOUT an audit trail.");
+  }
   const lockoutGuard = lockout ? createLockoutGuard(lockout) : undefined;
   const resolvedAgentAuth = agentAuth === undefined ? undefined : {
     ...agentAuth,
@@ -37705,6 +37742,7 @@ export {
   isValidUser,
   isValidProviderOption,
   isUserSessionId,
+  isTrustedOrigin,
   isSafeLocalPath,
   isRevocableProviderOption,
   isRevocableOAuth2Client,
@@ -38046,5 +38084,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=6BF9ABB7B635052264756E2164756E21
+//# debugId=A62F57FCBD818EE864756E2164756E21
 //# sourceMappingURL=index.js.map