@aooth/user 0.1.85 → 0.2.1

package/dist/atscript-db.d.cts

@@ -1,4 +1,4 @@
-import { D as UserCredentials, i as NewFederatedIdentity, k as UserStoreUpdate, n as FederatedIdentityStore, o as UserStore, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity } from "./federated-identity-store-COXONHvx.cjs";
+import { D as UserCredentials, i as NewFederatedIdentity, k as UserStoreUpdate, n as FederatedIdentityStore, o as UserStore, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity } from "./federated-identity-store-B_jEkl-a.cjs";
 //#region src/atscript-db/federated-identity-store.d.ts
 /**
  * Structural surface of `AtscriptDbTable` covering exactly the methods this

package/dist/atscript-db.d.mts

@@ -1,4 +1,4 @@
-import { D as UserCredentials, i as NewFederatedIdentity, k as UserStoreUpdate, n as FederatedIdentityStore, o as UserStore, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity } from "./federated-identity-store-COXONHvx.mjs";
+import { D as UserCredentials, i as NewFederatedIdentity, k as UserStoreUpdate, n as FederatedIdentityStore, o as UserStore, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity } from "./federated-identity-store-B_jEkl-a.mjs";
 //#region src/atscript-db/federated-identity-store.d.ts
 /**
  * Structural surface of `AtscriptDbTable` covering exactly the methods this

package/dist/{federated-identity-store-COXONHvx.d.cts → federated-identity-store-B_jEkl-a.d.cts}

@@ -65,6 +65,14 @@ interface AccountData {
    * the invite has been accepted.
    */
   pendingInvitation?: boolean;
+  /** Id of the user who issued the pending invite (written by the invite flow). */
+  invitedBy?: string;
+  /**
+   * Random marker of the current invite link. A re-invite rotates it, so a
+   * link issued before the re-invite answers 410 ("replaced") instead of
+   * activating the account. Absent on rows created before 0.2.
+   */
+  inviteNonce?: string;
   /**
    * Correspondence address whose inbox the user PROVED ownership of — written
    * at every inbox-proof moment (invite magic-link click, signup / recovery

package/dist/{federated-identity-store-COXONHvx.d.mts → federated-identity-store-B_jEkl-a.d.mts}

@@ -65,6 +65,14 @@ interface AccountData {
    * the invite has been accepted.
    */
   pendingInvitation?: boolean;
+  /** Id of the user who issued the pending invite (written by the invite flow). */
+  invitedBy?: string;
+  /**
+   * Random marker of the current invite link. A re-invite rotates it, so a
+   * link issued before the re-invite answers 410 ("replaced") instead of
+   * activating the account. Absent on rows created before 0.2.
+   */
+  inviteNonce?: string;
   /**
    * Correspondence address whose inbox the user PROVED ownership of — written
    * at every inbox-proof moment (invite magic-link click, signup / recovery

package/dist/index.cjs

@@ -487,9 +487,14 @@ var UserService = class {
 	}
 	async login(handle, password, lockoutOverride) {
 		const user = await this.store.findByHandle(handle);
-		if (!user) throw new require_federated_identity_store.UserAuthError("NOT_FOUND");
-		if (!user.account.active) throw new require_federated_identity_store.UserAuthError("INACTIVE");
-		await this.ensureNotLockedOrThrow(user.id, user.account);
+		try {
+			if (!user) throw new require_federated_identity_store.UserAuthError("NOT_FOUND");
+			if (!user.account.active) throw new require_federated_identity_store.UserAuthError("INACTIVE");
+			await this.ensureNotLockedOrThrow(user.id, user.account);
+		} catch (err) {
+			await this.burnPasswordHash(password);
+			throw err;
+		}
 		if (await this.hasher.verify(password, user.password.hash)) {
 			const now = await this.recordLogin(user.id);
 			user.account.lastLogin = now;
@@ -556,6 +561,26 @@ var UserService = class {
 		return this.getUser(id);
 	}
 	/**
+	* Accept a pending invitation in ONE compare-and-set write: clears
+	* `account.pendingInvitation` only while the row is still pending and its
+	* `account.inviteNonce` equals `nonce` (a row without a nonce — written
+	* before 0.2 — accepts any). Returns `false` (nothing written) when the
+	* invite was already accepted or replaced by a newer one, so two links of
+	* the same account can never both complete.
+	*/
+	async acceptInvitation(id, nonce) {
+		let accepted = false;
+		await this.store.withCas(id, (user) => {
+			accepted = false;
+			const account = user.account;
+			if (!account.pendingInvitation) return null;
+			if (account.inviteNonce !== void 0 && account.inviteNonce !== nonce) return null;
+			accepted = true;
+			return { set: { account: { pendingInvitation: false } } };
+		});
+		return accepted;
+	}
+	/**
 	* Flip the account active. `opts.verifiedEmail` lets callers that just
 	* proved an inbox (invite magic link, signup OTP) record the correspondence
 	* address in the same store write — see {@link setVerifiedEmail}.
@@ -978,6 +1003,21 @@ var UserService = class {
 	hasConfirmedMfaMethods(mfa) {
 		return mfa.methods.some((m) => m.confirmed);
 	}
+	/** Lazily minted hash of a random password, with the configured hasher params. */
+	dummyHash;
+	/**
+	* Verify `password` against a throwaway hash — same cost as a real check.
+	* The early exits still skip the failed-attempt counter write a wrong
+	* password costs (one store round trip); `AuthWorkflow`'s `'uniform'`
+	* lockout disclosure spends a comparable shadow-counter write on them.
+	*/
+	async burnPasswordHash(password) {
+		this.dummyHash ??= this.hasher.hash(this.hasher.generatePassword()).catch((err) => {
+			this.dummyHash = void 0;
+			throw err;
+		});
+		await this.hasher.verify(password, await this.dummyHash);
+	}
 	/**
 	* If `account.locked`: auto-unlock when the lock has expired (mutating
 	* `account` in place), or throw `LOCKED` otherwise.

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { C as TotpConfig, D as UserCredentials, E as UserAuthErrorType, O as UserServiceConfig, S as PolicyCheckResult, T as TrustedDeviceRecord, _ as PasswordData, a as pickDefinedProfile, b as PasswordPolicyEvalFn, c as AccountData, d as LockoutConfig, f as LoginResult, g as PasswordConfig, h as MfaMethodInfo, i as NewFederatedIdentity, k as UserStoreUpdate, l as DeepPartial, m as MfaMethod, n as FederatedIdentityStore, o as UserStore, p as MfaData, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity, u as LockStatus, v as PasswordPolicyContext, w as TransferablePolicy, x as PasswordPolicyInstance, y as PasswordPolicyDef } from "./federated-identity-store-COXONHvx.cjs";
+import { C as TotpConfig, D as UserCredentials, E as UserAuthErrorType, O as UserServiceConfig, S as PolicyCheckResult, T as TrustedDeviceRecord, _ as PasswordData, a as pickDefinedProfile, b as PasswordPolicyEvalFn, c as AccountData, d as LockoutConfig, f as LoginResult, g as PasswordConfig, h as MfaMethodInfo, i as NewFederatedIdentity, k as UserStoreUpdate, l as DeepPartial, m as MfaMethod, n as FederatedIdentityStore, o as UserStore, p as MfaData, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity, u as LockStatus, v as PasswordPolicyContext, w as TransferablePolicy, x as PasswordPolicyInstance, y as PasswordPolicyDef } from "./federated-identity-store-B_jEkl-a.cjs";
 //#region src/errors.d.ts
 declare class UserAuthError extends Error {
   readonly type: UserAuthErrorType;
@@ -178,6 +178,15 @@ declare class UserService<T extends object = object> {
    * Used by the invite workflow's `applyProfile` default fallback.
    */
   update(id: string, patch: Partial<UserCredentials & T>): Promise<UserCredentials & T>;
+  /**
+   * Accept a pending invitation in ONE compare-and-set write: clears
+   * `account.pendingInvitation` only while the row is still pending and its
+   * `account.inviteNonce` equals `nonce` (a row without a nonce — written
+   * before 0.2 — accepts any). Returns `false` (nothing written) when the
+   * invite was already accepted or replaced by a newer one, so two links of
+   * the same account can never both complete.
+   */
+  acceptInvitation(id: string, nonce: string | undefined): Promise<boolean>;
   /**
    * Flip the account active. `opts.verifiedEmail` lets callers that just
    * proved an inbox (invite magic link, signup OTP) record the correspondence
@@ -350,6 +359,15 @@ declare class UserService<T extends object = object> {
   getCorrespondenceEmail(user: UserCredentials & T): string | undefined | Promise<string | undefined>;
   private applyPasswordChange;
   private hasConfirmedMfaMethods;
+  /** Lazily minted hash of a random password, with the configured hasher params. */
+  private dummyHash?;
+  /**
+   * Verify `password` against a throwaway hash — same cost as a real check.
+   * The early exits still skip the failed-attempt counter write a wrong
+   * password costs (one store round trip); `AuthWorkflow`'s `'uniform'`
+   * lockout disclosure spends a comparable shadow-counter write on them.
+   */
+  private burnPasswordHash;
   /**
    * If `account.locked`: auto-unlock when the lock has expired (mutating
    * `account` in place), or throw `LOCKED` otherwise.

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { C as TotpConfig, D as UserCredentials, E as UserAuthErrorType, O as UserServiceConfig, S as PolicyCheckResult, T as TrustedDeviceRecord, _ as PasswordData, a as pickDefinedProfile, b as PasswordPolicyEvalFn, c as AccountData, d as LockoutConfig, f as LoginResult, g as PasswordConfig, h as MfaMethodInfo, i as NewFederatedIdentity, k as UserStoreUpdate, l as DeepPartial, m as MfaMethod, n as FederatedIdentityStore, o as UserStore, p as MfaData, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity, u as LockStatus, v as PasswordPolicyContext, w as TransferablePolicy, x as PasswordPolicyInstance, y as PasswordPolicyDef } from "./federated-identity-store-COXONHvx.mjs";
+import { C as TotpConfig, D as UserCredentials, E as UserAuthErrorType, O as UserServiceConfig, S as PolicyCheckResult, T as TrustedDeviceRecord, _ as PasswordData, a as pickDefinedProfile, b as PasswordPolicyEvalFn, c as AccountData, d as LockoutConfig, f as LoginResult, g as PasswordConfig, h as MfaMethodInfo, i as NewFederatedIdentity, k as UserStoreUpdate, l as DeepPartial, m as MfaMethod, n as FederatedIdentityStore, o as UserStore, p as MfaData, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity, u as LockStatus, v as PasswordPolicyContext, w as TransferablePolicy, x as PasswordPolicyInstance, y as PasswordPolicyDef } from "./federated-identity-store-B_jEkl-a.mjs";
 //#region src/errors.d.ts
 declare class UserAuthError extends Error {
   readonly type: UserAuthErrorType;
@@ -178,6 +178,15 @@ declare class UserService<T extends object = object> {
    * Used by the invite workflow's `applyProfile` default fallback.
    */
   update(id: string, patch: Partial<UserCredentials & T>): Promise<UserCredentials & T>;
+  /**
+   * Accept a pending invitation in ONE compare-and-set write: clears
+   * `account.pendingInvitation` only while the row is still pending and its
+   * `account.inviteNonce` equals `nonce` (a row without a nonce — written
+   * before 0.2 — accepts any). Returns `false` (nothing written) when the
+   * invite was already accepted or replaced by a newer one, so two links of
+   * the same account can never both complete.
+   */
+  acceptInvitation(id: string, nonce: string | undefined): Promise<boolean>;
   /**
    * Flip the account active. `opts.verifiedEmail` lets callers that just
    * proved an inbox (invite magic link, signup OTP) record the correspondence
@@ -350,6 +359,15 @@ declare class UserService<T extends object = object> {
   getCorrespondenceEmail(user: UserCredentials & T): string | undefined | Promise<string | undefined>;
   private applyPasswordChange;
   private hasConfirmedMfaMethods;
+  /** Lazily minted hash of a random password, with the configured hasher params. */
+  private dummyHash?;
+  /**
+   * Verify `password` against a throwaway hash — same cost as a real check.
+   * The early exits still skip the failed-attempt counter write a wrong
+   * password costs (one store round trip); `AuthWorkflow`'s `'uniform'`
+   * lockout disclosure spends a comparable shadow-counter write on them.
+   */
+  private burnPasswordHash;
   /**
    * If `account.locked`: auto-unlock when the lock has expired (mutating
    * `account` in place), or throw `LOCKED` otherwise.

package/dist/index.mjs

@@ -486,9 +486,14 @@ var UserService = class {
 	}
 	async login(handle, password, lockoutOverride) {
 		const user = await this.store.findByHandle(handle);
-		if (!user) throw new UserAuthError("NOT_FOUND");
-		if (!user.account.active) throw new UserAuthError("INACTIVE");
-		await this.ensureNotLockedOrThrow(user.id, user.account);
+		try {
+			if (!user) throw new UserAuthError("NOT_FOUND");
+			if (!user.account.active) throw new UserAuthError("INACTIVE");
+			await this.ensureNotLockedOrThrow(user.id, user.account);
+		} catch (err) {
+			await this.burnPasswordHash(password);
+			throw err;
+		}
 		if (await this.hasher.verify(password, user.password.hash)) {
 			const now = await this.recordLogin(user.id);
 			user.account.lastLogin = now;
@@ -555,6 +560,26 @@ var UserService = class {
 		return this.getUser(id);
 	}
 	/**
+	* Accept a pending invitation in ONE compare-and-set write: clears
+	* `account.pendingInvitation` only while the row is still pending and its
+	* `account.inviteNonce` equals `nonce` (a row without a nonce — written
+	* before 0.2 — accepts any). Returns `false` (nothing written) when the
+	* invite was already accepted or replaced by a newer one, so two links of
+	* the same account can never both complete.
+	*/
+	async acceptInvitation(id, nonce) {
+		let accepted = false;
+		await this.store.withCas(id, (user) => {
+			accepted = false;
+			const account = user.account;
+			if (!account.pendingInvitation) return null;
+			if (account.inviteNonce !== void 0 && account.inviteNonce !== nonce) return null;
+			accepted = true;
+			return { set: { account: { pendingInvitation: false } } };
+		});
+		return accepted;
+	}
+	/**
 	* Flip the account active. `opts.verifiedEmail` lets callers that just
 	* proved an inbox (invite magic link, signup OTP) record the correspondence
 	* address in the same store write — see {@link setVerifiedEmail}.
@@ -977,6 +1002,21 @@ var UserService = class {
 	hasConfirmedMfaMethods(mfa) {
 		return mfa.methods.some((m) => m.confirmed);
 	}
+	/** Lazily minted hash of a random password, with the configured hasher params. */
+	dummyHash;
+	/**
+	* Verify `password` against a throwaway hash — same cost as a real check.
+	* The early exits still skip the failed-attempt counter write a wrong
+	* password costs (one store round trip); `AuthWorkflow`'s `'uniform'`
+	* lockout disclosure spends a comparable shadow-counter write on them.
+	*/
+	async burnPasswordHash(password) {
+		this.dummyHash ??= this.hasher.hash(this.hasher.generatePassword()).catch((err) => {
+			this.dummyHash = void 0;
+			throw err;
+		});
+		await this.hasher.verify(password, await this.dummyHash);
+	}
 	/**
 	* If `account.locked`: auto-unlock when the lock has expired (mutating
 	* `account` in place), or throw `LOCKED` otherwise.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/user",
-  "version": "0.1.85",
+  "version": "0.2.1",
   "description": "User credential primitives for aoothjs",
   "keywords": [
     "aoothjs",
@@ -60,18 +60,18 @@
     "access": "public"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.109",
-    "@atscript/db": "^0.1.164",
-    "@atscript/db-sql-tools": "^0.1.164",
-    "@atscript/db-sqlite": "^0.1.164",
-    "@atscript/typescript": "^0.1.109",
+    "@atscript/core": "^0.2.1",
+    "@atscript/db": "^0.1.166",
+    "@atscript/db-sql-tools": "^0.1.166",
+    "@atscript/db-sqlite": "^0.1.166",
+    "@atscript/typescript": "^0.2.1",
     "@types/better-sqlite3": "^7.6.13",
     "@uniqu/core": "^0.1.15",
     "better-sqlite3": "^12.6.2",
-    "unplugin-atscript": "^0.1.109"
+    "unplugin-atscript": "^0.2.1"
   },
   "peerDependencies": {
-    "@atscript/db": "^0.1.164"
+    "@atscript/db": "^0.1.166"
   },
   "peerDependenciesMeta": {
     "@atscript/db": {

package/src/atscript-db/federated-identity.as.d.ts

@@ -7,7 +7,7 @@
  * Do not edit this file!
  */
 
-import type { TAtscriptTypeObject, TAtscriptTypeComplex, TAtscriptTypeFinal, TAtscriptTypeArray, TAtscriptAnnotatedType, TMetadataMap, Validator, TValidatorOptions } from "@atscript/typescript/utils"
+import type { TAtscriptTypeObject, TAtscriptTypeComplex, TAtscriptTypeFinal, TAtscriptTypeArray, TAtscriptAnnotatedType, TAtscriptField, TMetadataMap, Validator, TValidatorOptions } from "@atscript/typescript/utils"
 
 /**
  * Atscript interface **AoothFederatedIdentity**

package/src/atscript-db/user-credentials.as

@@ -28,6 +28,10 @@ export interface AoothUserCredentials {
         failedLoginAttempts: number
         lastLogin: number.timestamp
         pendingInvitation?: boolean
+        // Id of the user who issued the pending invite (set by the invite flow)
+        invitedBy?: string
+        // Random marker of the CURRENT invite link; a re-invite rotates it, so older links answer 410
+        inviteNonce?: string
         // Correspondence address whose inbox the user proved (invite click, OTP, email confirm); auth-owned, not a login handle
         verifiedEmail?: string
     }

package/src/atscript-db/user-credentials.as.d.ts

@@ -7,7 +7,7 @@
  * Do not edit this file!
  */
 
-import type { TAtscriptTypeObject, TAtscriptTypeComplex, TAtscriptTypeFinal, TAtscriptTypeArray, TAtscriptAnnotatedType, TMetadataMap, Validator, TValidatorOptions } from "@atscript/typescript/utils"
+import type { TAtscriptTypeObject, TAtscriptTypeComplex, TAtscriptTypeFinal, TAtscriptTypeArray, TAtscriptAnnotatedType, TAtscriptField, TMetadataMap, Validator, TValidatorOptions } from "@atscript/typescript/utils"
 
 /**
  * Atscript interface **AoothUserCredentials**
@@ -31,6 +31,8 @@ export declare class AoothUserCredentials {
     failedLoginAttempts: number
     lastLogin: number /* timestamp */
     pendingInvitation?: boolean
+    invitedBy?: string
+    inviteNonce?: string
     verifiedEmail?: string
   }
   mfa: {