@absolutejs/auth 0.65.4 → 0.65.6

package/dist/credentials/config.d.ts

@@ -69,9 +69,10 @@ export type CredentialsConfig<UserType> = {
     }) => void | Promise<void>;
     passwordPolicy?: PasswordPolicy;
     registerRoute?: RouteString;
-    /** When true, registration creates the account but NOT a session, and login is
-     *  rejected until the email is verified. Default false = auto-login on register and
-     *  verification acts as a soft, later gate. */
+    /** When true, registration stores only a pending credential and does NOT call
+     *  `onCreateCredentialUser` until a verification token is accepted. No user
+     *  account or session exists before email ownership is proven. Default false
+     *  creates the user immediately and auto-logs them in. */
     requireEmailVerification?: boolean;
     /** When true, `POST /register` returns 409 "Email is already registered" for a
      *  known email. Default false = enumeration-safe: return the same generic

package/dist/credentials/emailVerification.d.ts

@@ -1,6 +1,6 @@
 import { Elysia } from 'elysia';
 import { type CredentialsConfig } from './config';
-export declare const credentialsEmailVerification: <UserType>({ credentialStore, onEmailVerified, onSendEmail, verificationTokenDurationMs, verifyEmailRoute }: CredentialsConfig<UserType>) => Elysia<"", {
+export declare const credentialsEmailVerification: <UserType>({ credentialStore, getUserByEmail, onCreateCredentialUser, onEmailVerified, onRegistrationSuccess, onSendEmail, requireEmailVerification, verificationTokenDurationMs, verifyEmailRoute }: CredentialsConfig<UserType>) => Elysia<"", {
     decorator: {};
     store: {};
     derive: {};
@@ -25,19 +25,7 @@ export declare const credentialsEmailVerification: <UserType>({ credentialStore,
             query: unknown;
             headers: unknown;
             response: {
-                400: "Invalid or expired verification token";
-                200: {
-                    readonly status: "email_verified";
-                };
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
+                [x: number]: {};
             };
         };
     };

package/dist/credentials/postgresCredentialStore.d.ts

@@ -79,6 +79,21 @@ export declare const credentialsTable: import("drizzle-orm/pg-core").PgTableWith
             identity: undefined;
             generated: undefined;
         }>;
+        registration_data: import("drizzle-orm/pg-core").PgBuildColumn<"auth_credentials", import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgJsonbBuilder, Record<string, unknown>>, {
+            name: string;
+            tableName: "auth_credentials";
+            dataType: "object json";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         status: import("drizzle-orm/pg-core").PgBuildColumn<"auth_credentials", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>>, {
             name: string;
             tableName: "auth_credentials";

package/dist/credentials/routes.d.ts

@@ -43,19 +43,7 @@ export declare const credentialRoutes: <UserType>(config: CredentialRouteProps<U
             query: unknown;
             headers: unknown;
             response: {
-                400: "Invalid or expired verification token";
-                200: {
-                    readonly status: "email_verified";
-                };
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
+                [x: number]: {};
             };
         };
     };

package/dist/credentials/types.d.ts

@@ -6,6 +6,12 @@ export type CredentialRecord = {
     emailVerified: boolean;
     organizationId?: OrganizationId;
     passwordHash: string;
+    /**
+     * Signup fields held until email ownership is proven. This is deliberately
+     * stored with the credential rather than in the consumer's user table so
+     * `requireEmailVerification` does not create an impersonatable account.
+     */
+    registrationData?: Record<string, unknown>;
     status: CredentialStatus;
     updatedAt: number;
     userId?: string;

package/dist/index.d.ts

@@ -760,19 +760,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
                 query: unknown;
                 headers: unknown;
                 response: {
-                    400: "Invalid or expired verification token";
-                    200: {
-                        readonly status: "email_verified";
-                    };
-                    422: {
-                        type: "validation";
-                        on: string;
-                        summary?: string;
-                        message?: string;
-                        found?: unknown;
-                        property?: string;
-                        expected?: string;
-                    };
+                    [x: number]: {};
                 };
             };
         };

package/dist/index.js

@@ -5124,8 +5124,12 @@ var DEFAULT_VERIFICATION_TOKEN_TTL_MS = MILLISECONDS_IN_A_DAY;
 // src/credentials/emailVerification.ts
 var credentialsEmailVerification = ({
   credentialStore,
+  getUserByEmail,
+  onCreateCredentialUser,
   onEmailVerified,
+  onRegistrationSuccess,
   onSendEmail,
+  requireEmailVerification = false,
   verificationTokenDurationMs = DEFAULT_VERIFICATION_TOKEN_TTL_MS,
   verifyEmailRoute = "/auth/verify-email"
 }) => new Elysia10().post(verifyEmailRoute, async ({ body: { token }, status }) => {
@@ -5136,7 +5140,36 @@ var credentialsEmailVerification = ({
   if (consumed.expiresAt < Date.now()) {
     return status("Bad Request", "Invalid or expired verification token");
   }
+  const credential = await credentialStore.getCredentialByEmail(consumed.email);
+  if (!credential) {
+    return status("Bad Request", "Invalid or expired verification token");
+  }
+  let user = await getUserByEmail(consumed.email);
+  if (requireEmailVerification && !user && credential.registrationData !== undefined) {
+    const created = await onCreateCredentialUser({
+      ...credential.registrationData,
+      email: consumed.email
+    });
+    if (created instanceof Response || isStatusResponse(created)) {
+      return created;
+    }
+    user = created;
+  }
   await credentialStore.setEmailVerified(consumed.email);
+  if (credential.registrationData !== undefined) {
+    await credentialStore.saveCredential({
+      ...credential,
+      emailVerified: true,
+      registrationData: undefined,
+      updatedAt: Date.now()
+    });
+  }
+  if (user && credential.registrationData !== undefined) {
+    await onRegistrationSuccess?.({
+      email: consumed.email,
+      user
+    });
+  }
   await onEmailVerified?.({ email: consumed.email });
   return status("OK", { status: "email_verified" });
 }, { body: t7.Object({ token: t7.String() }) }).post(`${verifyEmailRoute}/request`, async ({ body: { email }, status }) => {
@@ -5510,7 +5543,7 @@ var credentialsPasswordReset = ({
 }) => new Elysia12().post(`${resetPasswordRoute}/request`, async ({ body: { email }, status }) => {
   const normalizedEmail = email.trim().toLowerCase();
   const credential = await credentialStore.getCredentialByEmail(normalizedEmail);
-  if (credential && credential.status === "active") {
+  if (credential && credential.status === "active" && credential.registrationData === undefined) {
     const token = generateSecureToken();
     const expiresAt = Date.now() + resetTokenDurationMs;
     await credentialStore.saveResetToken({
@@ -5620,12 +5653,16 @@ var credentialsRegister = ({
       status: "verification_required"
     });
   }
-  const created = await onCreateCredentialUser({
-    ...extraFields,
-    email: normalizedEmail
-  });
-  if (created instanceof Response || isStatusResponse(created)) {
-    return created;
+  let created;
+  if (!requireEmailVerification) {
+    const result = await onCreateCredentialUser({
+      ...extraFields,
+      email: normalizedEmail
+    });
+    if (result instanceof Response || isStatusResponse(result)) {
+      return result;
+    }
+    created = result;
   }
   const now = Date.now();
   await credentialStore.saveCredential({
@@ -5633,6 +5670,7 @@ var credentialsRegister = ({
     email: normalizedEmail,
     emailVerified: false,
     passwordHash: await hashPassword(password),
+    registrationData: requireEmailVerification ? extraFields : undefined,
     status: "active",
     updatedAt: now
   });
@@ -5649,15 +5687,18 @@ var credentialsRegister = ({
     token,
     type: "verify_email"
   });
-  await onRegistrationSuccess?.({
-    email: normalizedEmail,
-    user: created
-  });
   if (requireEmailVerification) {
     return status("Created", {
       status: "verification_required"
     });
   }
+  if (created === undefined) {
+    throw new Error("Credential user was not created");
+  }
+  await onRegistrationSuccess?.({
+    email: normalizedEmail,
+    user: created
+  });
   const userSessionId = await promoteToSession({
     authSessionStore,
     cookie: user_session_id,
@@ -31531,7 +31572,7 @@ var createNeonLinkedProviderGrantStore = (db) => ({
         owner_ref: grant.ownerRef,
         provider_family: grant.providerFamily,
         provider_subject: grant.providerSubject,
-        refresh_token_ciphertext: grant.refreshTokenCiphertext ?? null,
+        refresh_token_ciphertext: sql`coalesce(excluded.refresh_token_ciphertext, ${linkedProviderGrantsTable.refresh_token_ciphertext})`,
         status: grant.status,
         token_type: grant.tokenType ?? null,
         updated_at: new Date(grant.updatedAt)
@@ -31590,7 +31631,11 @@ var createInMemoryLinkedProviderStores = (input = {}) => {
       [...bindings.entries()].filter(([, binding]) => binding.grantId === id).forEach(([bindingId2]) => bindings.delete(bindingId2));
     },
     saveGrant: async (grant) => {
-      grants.set(grant.id, cloneGrant(grant));
+      const existing = grants.get(grant.id);
+      grants.set(grant.id, cloneGrant({
+        ...grant,
+        refreshTokenCiphertext: grant.refreshTokenCiphertext ?? existing?.refreshTokenCiphertext
+      }));
     }
   };
   const bindingStore = {
@@ -32010,7 +32055,8 @@ var validateEmailDeliverability = async (email, options) => {
 };
 // src/credentials/inMemoryCredentialStore.ts
 var cloneCredential = (value) => ({
-  ...value
+  ...value,
+  registrationData: value.registrationData === undefined ? undefined : structuredClone(value.registrationData)
 });
 var cloneToken = (value) => ({ ...value });
 var consumeToken = (tokens, tokenHash) => {
@@ -32065,6 +32111,7 @@ var credentialsTable = pgTable("auth_credentials", {
   email_verified: boolean("email_verified").notNull().default(false),
   organization_id: varchar("organization_id", { length: ID_LENGTH2 }),
   password_hash: text("password_hash").notNull(),
+  registration_data: jsonb("registration_data").$type(),
   status: varchar("status", { length: STATUS_LENGTH }).notNull().default("active"),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull(),
   user_id: varchar("user_id", { length: ID_LENGTH2 })
@@ -32086,6 +32133,7 @@ var toCredentialRecord = (row) => ({
   emailVerified: row.email_verified,
   organizationId: row.organization_id ?? undefined,
   passwordHash: row.password_hash,
+  registrationData: row.registration_data ?? undefined,
   status: isCredentialStatus(row.status) ? row.status : "active",
   updatedAt: row.updated_at_ms,
   userId: row.user_id ?? undefined
@@ -32127,6 +32175,7 @@ var createPostgresCredentialStore = (db) => ({
       email_verified: credential.emailVerified,
       organization_id: credential.organizationId ?? null,
       password_hash: credential.passwordHash,
+      registration_data: credential.registrationData ?? null,
       status: credential.status,
       updated_at_ms: credential.updatedAt,
       user_id: credential.userId ?? null
@@ -36771,6 +36820,10 @@ var mfaSmsColumnsMigration = {
   ].join(`
 `)
 };
+var credentialDeferredUserMigration = {
+  id: "0002_deferred_user_creation",
+  sql: 'ALTER TABLE "auth_credentials" ADD COLUMN IF NOT EXISTS "registration_data" jsonb;'
+};
 var mfaTotpLockoutMigration = {
   id: "0003_totp_lockout",
   sql: 'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "totp_failed_attempts" smallint NOT NULL DEFAULT 0;'
@@ -36826,11 +36879,17 @@ var blockMigrations = {
     apiKeysTable
   ]),
   audit: initMigration("audit", [auditEventsTable]),
-  credentials: initMigration("credentials", [
-    credentialsTable,
-    credentialResetTokensTable,
-    credentialVerificationTokensTable
-  ]),
+  credentials: {
+    block: "credentials",
+    migrations: [
+      ...initMigration("credentials", [
+        credentialsTable,
+        credentialResetTokensTable,
+        credentialVerificationTokensTable
+      ]).migrations,
+      credentialDeferredUserMigration
+    ]
+  },
   fga: initMigration("fga", [warrantsTable]),
   linkedProviders: initMigration("linkedProviders", [
     linkedProviderBindingsTable,
@@ -38181,5 +38240,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=C6EA4E2761E1FA9664756E2164756E21
+//# debugId=9CCB3DA09AA91A9764756E2164756E21
 //# sourceMappingURL=index.js.map