@ambushsoftworks/nestjs-auth-graphql 0.17.0-rc.2 → 0.17.0

package/CHANGELOG.md

@@ -27,6 +27,67 @@ for buried obligations. **The marker was introduced in 0.9.0 and has not been
 retro-applied**, so it is reliable from 0.9.0 onward only. Convention adopted
 from `@ambushsoftworks/nestjs-payments-graphql`.
 
+## [0.17.0] - 2026-10-02
+
+Passwordless sign-up with a passkey, a step-up token on sign-in, and fixes for
+**account enumeration in password reset and email verification** (present in
+every earlier version). Identical to `0.17.0-rc.2`, which LiftIQ piloted on
+staging and an Android device. This entry is the summary for anyone coming from
+0.16.x; the two release-candidate entries below have the detail.
+
+### ⚠ Security
+
+- **Password reset and email verification revealed which addresses have
+  accounts**: through a lock or social-only error, a cooldown only real accounts
+  had, account checks before the code, a password-strength error, response
+  timing, and "already verified". Every signed-out, email-keyed flow now answers
+  alike for every address. **If you are on 0.16.x or earlier, upgrade.**
+
+### ⚠ External configuration required
+
+Only for passwordless sign-up:
+- `PasskeyChallenge.userId` must not be a foreign key to users
+  (`assertPasskeyRepositoryContract` checks it).
+- `IUserRepository.create` must store the `emailVerified` it is given, and
+  `IUserRepository.delete` must work.
+- The email service needs `sendSignupCodeEmail` (`ConfigurableEmailService` has
+  it with the default renderer).
+
+### Added
+
+- **Passwordless sign-up**: `performStartPasskeySignup` →
+  `performVerifyPasskeySignupCode` (returns a verified `signupId`) →
+  `performCompletePasskeySignup`, plus `performPasskeySignupOptions` to retry
+  the passkey step without the code. The account exists only once its passkey
+  does.
+- **`stepUp.issueOnLogin`**: fresh sign-ins return a step-up token, so an app can
+  offer "Create a passkey?" without a second proof. Never from a refresh or the
+  biometric login.
+- **`retryAfterSeconds` on every `RATE_LIMIT_EXCEEDED`.**
+- New codes: `PASSWORD_RESET_CODE_INVALID`, `EMAIL_VERIFICATION_CODE_INVALID`,
+  the `PASSKEY_SIGNUP_*` family; `VERIFICATION_CODE_*` now used for signed-in
+  code checks.
+
+### Changed — breaking
+
+- **Code failures are no longer `UNAUTHENTICATED`.** Password reset and
+  verify-email each report one code for every failure (no remaining-attempts
+  count); verify-phone and step-up by email report `VERIFICATION_CODE_INVALID` /
+  `_EXPIRED` / `_EXHAUSTED`. Update any client logic that matched
+  `UNAUTHENTICATED` or the old messages.
+- `requestPasswordReset` no longer throws for a locked account, and its cooldown
+  applies to every address. `verifyEmail` refuses an already verified address.
+  `resendVerificationEmail` answers alike for every address.
+- A misconfigured per-realm `verification.baseUrl` is logged through
+  `IAuthLogger.error` instead of failing the request.
+- `PasskeyChallengePurpose` includes `'signup'`; `StepUpMethod` includes
+  `'oauth'`; `AuthRateLimitException` requires `retryAfterSeconds`.
+
+### Upgrading from an RC
+
+From rc.1: read the rc.2 entry (codes changed, and step 3 of sign-up needs the
+verified `signupId`). From rc.2: nothing changes.
+
 ## [0.17.0-rc.2] - 2026-10-02
 
 Fixes from LiftIQ's pilot of rc.1, chiefly **account enumeration in password

package/README.md

@@ -1401,6 +1401,14 @@ renderer); otherwise `PASSKEY_SIGNUP_UNAVAILABLE`.
 | `PASSKEY_SIGNUP_VERIFICATION_FAILED` | 400 | The created passkey did not verify |
 | `PASSKEY_SIGNUP_UNAVAILABLE` | 503 | No passkeys, or no `sendSignupCodeEmail` |
 
+**An expired challenge can leave an orphaned passkey.** If the options expire
+(`passkey.registrationTimeoutSeconds`, 300 s by default) while the device's
+passkey sheet is still open, the platform may already have saved the passkey
+when the app gets `PASSKEY_SIGNUP_CHALLENGE_EXPIRED`. The retry then creates a
+second one, and the first stays in the user's password manager with no account
+behind it. Neither side can prevent this; it is rare at the default timeout.
+Reported by LiftIQ on Android.
+
 **What your repositories must do for it:**
 - `IUserRepository.create` must store the `emailVerified` it is given (the
   OAuth sign-up already relies on this).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ambushsoftworks/nestjs-auth-graphql",
-  "version": "0.17.0-rc.2",
+  "version": "0.17.0",
   "description": "Production-grade authentication package for NestJS with GraphQL, supporting JWT, OAuth, email/SMS verification, and biometric auth",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",