@absolutejs/auth 0.65.4 → 0.65.6

package/dist/server.js

@@ -6120,8 +6120,12 @@ var DEFAULT_VERIFICATION_TOKEN_TTL_MS = MILLISECONDS_IN_A_DAY;
 // src/credentials/emailVerification.ts
 var credentialsEmailVerification = ({
   credentialStore,
+  getUserByEmail,
+  onCreateCredentialUser,
   onEmailVerified,
+  onRegistrationSuccess,
   onSendEmail,
+  requireEmailVerification = false,
   verificationTokenDurationMs = DEFAULT_VERIFICATION_TOKEN_TTL_MS,
   verifyEmailRoute = "/auth/verify-email"
 }) => new Elysia10().post(verifyEmailRoute, async ({ body: { token }, status }) => {
@@ -6132,7 +6136,36 @@ var credentialsEmailVerification = ({
   if (consumed.expiresAt < Date.now()) {
     return status("Bad Request", "Invalid or expired verification token");
   }
+  const credential = await credentialStore.getCredentialByEmail(consumed.email);
+  if (!credential) {
+    return status("Bad Request", "Invalid or expired verification token");
+  }
+  let user = await getUserByEmail(consumed.email);
+  if (requireEmailVerification && !user && credential.registrationData !== undefined) {
+    const created = await onCreateCredentialUser({
+      ...credential.registrationData,
+      email: consumed.email
+    });
+    if (created instanceof Response || isStatusResponse(created)) {
+      return created;
+    }
+    user = created;
+  }
   await credentialStore.setEmailVerified(consumed.email);
+  if (credential.registrationData !== undefined) {
+    await credentialStore.saveCredential({
+      ...credential,
+      emailVerified: true,
+      registrationData: undefined,
+      updatedAt: Date.now()
+    });
+  }
+  if (user && credential.registrationData !== undefined) {
+    await onRegistrationSuccess?.({
+      email: consumed.email,
+      user
+    });
+  }
   await onEmailVerified?.({ email: consumed.email });
   return status("OK", { status: "email_verified" });
 }, { body: t7.Object({ token: t7.String() }) }).post(`${verifyEmailRoute}/request`, async ({ body: { email }, status }) => {
@@ -6506,7 +6539,7 @@ var credentialsPasswordReset = ({
 }) => new Elysia12().post(`${resetPasswordRoute}/request`, async ({ body: { email }, status }) => {
   const normalizedEmail = email.trim().toLowerCase();
   const credential = await credentialStore.getCredentialByEmail(normalizedEmail);
-  if (credential && credential.status === "active") {
+  if (credential && credential.status === "active" && credential.registrationData === undefined) {
     const token = generateSecureToken();
     const expiresAt = Date.now() + resetTokenDurationMs;
     await credentialStore.saveResetToken({
@@ -6616,12 +6649,16 @@ var credentialsRegister = ({
       status: "verification_required"
     });
   }
-  const created = await onCreateCredentialUser({
-    ...extraFields,
-    email: normalizedEmail
-  });
-  if (created instanceof Response || isStatusResponse(created)) {
-    return created;
+  let created;
+  if (!requireEmailVerification) {
+    const result = await onCreateCredentialUser({
+      ...extraFields,
+      email: normalizedEmail
+    });
+    if (result instanceof Response || isStatusResponse(result)) {
+      return result;
+    }
+    created = result;
   }
   const now = Date.now();
   await credentialStore.saveCredential({
@@ -6629,6 +6666,7 @@ var credentialsRegister = ({
     email: normalizedEmail,
     emailVerified: false,
     passwordHash: await hashPassword(password),
+    registrationData: requireEmailVerification ? extraFields : undefined,
     status: "active",
     updatedAt: now
   });
@@ -6645,15 +6683,18 @@ var credentialsRegister = ({
     token,
     type: "verify_email"
   });
-  await onRegistrationSuccess?.({
-    email: normalizedEmail,
-    user: created
-  });
   if (requireEmailVerification) {
     return status("Created", {
       status: "verification_required"
     });
   }
+  if (created === undefined) {
+    throw new Error("Credential user was not created");
+  }
+  await onRegistrationSuccess?.({
+    email: normalizedEmail,
+    user: created
+  });
   const userSessionId = await promoteToSession({
     authSessionStore,
     cookie: user_session_id,
@@ -32527,7 +32568,7 @@ var createNeonLinkedProviderGrantStore = (db) => ({
         owner_ref: grant.ownerRef,
         provider_family: grant.providerFamily,
         provider_subject: grant.providerSubject,
-        refresh_token_ciphertext: grant.refreshTokenCiphertext ?? null,
+        refresh_token_ciphertext: sql`coalesce(excluded.refresh_token_ciphertext, ${linkedProviderGrantsTable.refresh_token_ciphertext})`,
         status: grant.status,
         token_type: grant.tokenType ?? null,
         updated_at: new Date(grant.updatedAt)
@@ -32586,7 +32627,11 @@ var createInMemoryLinkedProviderStores = (input = {}) => {
       [...bindings.entries()].filter(([, binding]) => binding.grantId === id).forEach(([bindingId2]) => bindings.delete(bindingId2));
     },
     saveGrant: async (grant) => {
-      grants.set(grant.id, cloneGrant(grant));
+      const existing = grants.get(grant.id);
+      grants.set(grant.id, cloneGrant({
+        ...grant,
+        refreshTokenCiphertext: grant.refreshTokenCiphertext ?? existing?.refreshTokenCiphertext
+      }));
     }
   };
   const bindingStore = {
@@ -33006,7 +33051,8 @@ var validateEmailDeliverability = async (email, options) => {
 };
 // src/credentials/inMemoryCredentialStore.ts
 var cloneCredential = (value) => ({
-  ...value
+  ...value,
+  registrationData: value.registrationData === undefined ? undefined : structuredClone(value.registrationData)
 });
 var cloneToken = (value) => ({ ...value });
 var consumeToken = (tokens, tokenHash) => {
@@ -33061,6 +33107,7 @@ var credentialsTable = pgTable("auth_credentials", {
   email_verified: boolean("email_verified").notNull().default(false),
   organization_id: varchar("organization_id", { length: ID_LENGTH2 }),
   password_hash: text("password_hash").notNull(),
+  registration_data: jsonb("registration_data").$type(),
   status: varchar("status", { length: STATUS_LENGTH }).notNull().default("active"),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull(),
   user_id: varchar("user_id", { length: ID_LENGTH2 })
@@ -33082,6 +33129,7 @@ var toCredentialRecord = (row) => ({
   emailVerified: row.email_verified,
   organizationId: row.organization_id ?? undefined,
   passwordHash: row.password_hash,
+  registrationData: row.registration_data ?? undefined,
   status: isCredentialStatus(row.status) ? row.status : "active",
   updatedAt: row.updated_at_ms,
   userId: row.user_id ?? undefined
@@ -33123,6 +33171,7 @@ var createPostgresCredentialStore = (db) => ({
       email_verified: credential.emailVerified,
       organization_id: credential.organizationId ?? null,
       password_hash: credential.passwordHash,
+      registration_data: credential.registrationData ?? null,
       status: credential.status,
       updated_at_ms: credential.updatedAt,
       user_id: credential.userId ?? null
@@ -37767,6 +37816,10 @@ var mfaSmsColumnsMigration = {
   ].join(`
 `)
 };
+var credentialDeferredUserMigration = {
+  id: "0002_deferred_user_creation",
+  sql: 'ALTER TABLE "auth_credentials" ADD COLUMN IF NOT EXISTS "registration_data" jsonb;'
+};
 var mfaTotpLockoutMigration = {
   id: "0003_totp_lockout",
   sql: 'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "totp_failed_attempts" smallint NOT NULL DEFAULT 0;'
@@ -37822,11 +37875,17 @@ var blockMigrations = {
     apiKeysTable
   ]),
   audit: initMigration("audit", [auditEventsTable]),
-  credentials: initMigration("credentials", [
-    credentialsTable,
-    credentialResetTokensTable,
-    credentialVerificationTokensTable
-  ]),
+  credentials: {
+    block: "credentials",
+    migrations: [
+      ...initMigration("credentials", [
+        credentialsTable,
+        credentialResetTokensTable,
+        credentialVerificationTokensTable
+      ]).migrations,
+      credentialDeferredUserMigration
+    ]
+  },
   fga: initMigration("fga", [warrantsTable]),
   linkedProviders: initMigration("linkedProviders", [
     linkedProviderBindingsTable,
@@ -38843,5 +38902,5 @@ export {
   VerificationProviderError
 };
 
-//# debugId=3114C96CDAA5FE1E64756E2164756E21
+//# debugId=9E267BACCB0FD73264756E2164756E21
 //# sourceMappingURL=server.js.map