@baseplate-dev/plugin-auth 0.6.17 → 0.6.18

package/dist/local-auth/core/generators/auth-module/auth-module.generator.d.ts

@@ -1,6 +1,7 @@
 export declare const authModuleGenerator: import("@baseplate-dev/sync").GeneratorBundleCreator<{
     userAdminRoles?: string[] | undefined;
     devWebPorts?: number[] | undefined;
+    emailOtp?: boolean | undefined;
 }, {
     paths: import("@baseplate-dev/sync").GeneratorTask<{
         localAuthCoreAuthModulePaths: import("@baseplate-dev/sync").ProviderExport<import("./generated/template-paths.js").LocalAuthCoreAuthModulePaths>;
@@ -12,10 +13,13 @@ export declare const authModuleGenerator: import("@baseplate-dev/sync").Generato
             cleanupAuthVerificationQueue: {};
             cleanupAuthVerificationWorker: {};
             cleanupExpiredAuthVerifications: {};
+            consumeCodeVerification: {};
             CookieUserSessionService: {};
             createAuthVerification: {};
+            createCodeVerification: {};
             userSessionPayload: {};
             validateAuthVerification: {};
+            validateCodeVerification: {};
         }>>;
     }, {
         paths: import("@baseplate-dev/sync").ProviderType<import("./generated/template-paths.js").LocalAuthCoreAuthModulePaths>;

package/dist/local-auth/core/generators/auth-module/auth-module.generator.js

@@ -8,12 +8,13 @@ import { LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED as GENERATED_TEMPLATES } from './
 const descriptorSchema = z.object({
     userAdminRoles: z.array(z.string()).default([]),
     devWebPorts: z.array(z.number()).default([]),
+    emailOtp: z.boolean().default(false),
 });
 export const authModuleGenerator = createGenerator({
     name: 'local-auth/core/auth-module',
     generatorFileUrl: import.meta.url,
     descriptorSchema,
-    buildTasks: ({ userAdminRoles, devWebPorts }) => ({
+    buildTasks: ({ userAdminRoles, devWebPorts, emailOtp }) => ({
         paths: GENERATED_TEMPLATES.paths.task,
         imports: GENERATED_TEMPLATES.imports.task,
         renderers: GENERATED_TEMPLATES.renderers.task,
@@ -70,6 +71,9 @@ export const authModuleGenerator = createGenerator({
                             },
                         }));
                         await builder.apply(renderers.servicesAuthVerification.render({}));
+                        if (emailOtp) {
+                            await builder.apply(renderers.servicesCodeVerification.render({}));
+                        }
                         await builder.apply(renderers.constantsGroup.render({}));
                         await builder.apply(renderers.utilsGroup.render({}));
                         await builder.apply(renderers.moduleGroup.render({

package/dist/local-auth/core/generators/auth-module/generated/index.d.ts

@@ -5,10 +5,13 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
                 cleanupAuthVerificationQueue: {};
                 cleanupAuthVerificationWorker: {};
                 cleanupExpiredAuthVerifications: {};
+                consumeCodeVerification: {};
                 CookieUserSessionService: {};
                 createAuthVerification: {};
+                createCodeVerification: {};
                 userSessionPayload: {};
                 validateAuthVerification: {};
+                validateCodeVerification: {};
             }>>;
         }, {
             paths: import("@baseplate-dev/sync").ProviderType<import("./template-paths.js").LocalAuthCoreAuthModulePaths>;
@@ -384,6 +387,23 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
                 prisma: {};
             }>>;
         }, Record<never, Record<never, never>>>;
+        servicesCodeVerification: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
+            configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                getConfig: {};
+                isDevelopment: {};
+            }>>;
+            prismaGeneratedImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                PrismaClient: {};
+                Prisma: {};
+                '*': {};
+                $Enums: {};
+            }>>;
+            prismaImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                prisma: {};
+            }>>;
+        }, {
+            servicesAuthVerification: {};
+        }>;
         userSessionService: import("@baseplate-dev/core-generators").TsTemplateFile<{
             TPL_PRISMA_USER_SESSION: {};
         }, {

package/dist/local-auth/core/generators/auth-module/generated/template-paths.d.ts

@@ -7,6 +7,7 @@ export interface LocalAuthCoreAuthModulePaths {
     schemaUserSessionPayloadObjectType: string;
     schemaUserSessionQueries: string;
     servicesAuthVerification: string;
+    servicesCodeVerification: string;
     sessionCookie: string;
     userRolesMutations: string;
     userRolesService: string;

package/dist/local-auth/core/generators/auth-module/generated/template-paths.js

@@ -19,6 +19,7 @@ const localAuthCoreAuthModulePathsTask = createGeneratorTask({
                     schemaUserSessionPayloadObjectType: `${moduleRoot}/schema/user-session-payload.object-type.ts`,
                     schemaUserSessionQueries: `${moduleRoot}/schema/user-session.queries.ts`,
                     servicesAuthVerification: `${moduleRoot}/services/auth-verification.service.ts`,
+                    servicesCodeVerification: `${moduleRoot}/services/code-verification.service.ts`,
                     sessionCookie: `${moduleRoot}/utils/session-cookie.ts`,
                     userRolesMutations: `${moduleRoot}/schema/user-roles.mutations.ts`,
                     userRolesService: `${moduleRoot}/services/user-roles.service.ts`,

package/dist/local-auth/core/generators/auth-module/generated/template-renderers.d.ts

@@ -17,6 +17,9 @@ export interface LocalAuthCoreAuthModuleRenderers {
     servicesAuthVerification: {
         render: (options: Omit<RenderTsTemplateFileActionInput<typeof LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES.servicesAuthVerification>, 'destination' | 'importMapProviders' | 'template' | 'generatorPaths'>) => BuilderAction;
     };
+    servicesCodeVerification: {
+        render: (options: Omit<RenderTsTemplateFileActionInput<typeof LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES.servicesCodeVerification>, 'destination' | 'importMapProviders' | 'template' | 'generatorPaths'>) => BuilderAction;
+    };
     userSessionService: {
         render: (options: Omit<RenderTsTemplateFileActionInput<typeof LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES.userSessionService>, 'destination' | 'importMapProviders' | 'template' | 'generatorPaths'>) => BuilderAction;
     };

package/dist/local-auth/core/generators/auth-module/generated/template-renderers.js

@@ -81,6 +81,19 @@ const localAuthCoreAuthModuleRenderersTask = createGeneratorTask({
                             ...options,
                         }),
                     },
+                    servicesCodeVerification: {
+                        render: (options) => typescriptFile.renderTemplateFile({
+                            template: LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES.servicesCodeVerification,
+                            destination: paths.servicesCodeVerification,
+                            importMapProviders: {
+                                configServiceImports,
+                                prismaGeneratedImports,
+                                prismaImports,
+                            },
+                            generatorPaths: paths,
+                            ...options,
+                        }),
+                    },
                     userSessionService: {
                         render: (options) => typescriptFile.renderTemplateFile({
                             template: LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES.userSessionService,

package/dist/local-auth/core/generators/auth-module/generated/ts-import-providers.d.ts

@@ -3,20 +3,26 @@ export declare const authModuleImportsSchema: {
     cleanupAuthVerificationQueue: {};
     cleanupAuthVerificationWorker: {};
     cleanupExpiredAuthVerifications: {};
+    consumeCodeVerification: {};
     CookieUserSessionService: {};
     createAuthVerification: {};
+    createCodeVerification: {};
     userSessionPayload: {};
     validateAuthVerification: {};
+    validateCodeVerification: {};
 };
 export type AuthModuleImportsProvider = TsImportMapProviderFromSchema<typeof authModuleImportsSchema>;
 export declare const authModuleImportsProvider: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
     cleanupAuthVerificationQueue: {};
     cleanupAuthVerificationWorker: {};
     cleanupExpiredAuthVerifications: {};
+    consumeCodeVerification: {};
     CookieUserSessionService: {};
     createAuthVerification: {};
+    createCodeVerification: {};
     userSessionPayload: {};
     validateAuthVerification: {};
+    validateCodeVerification: {};
 }>>;
 export declare const LOCAL_AUTH_CORE_AUTH_MODULE_IMPORTS: {
     task: import("@baseplate-dev/sync").GeneratorTask<{
@@ -24,10 +30,13 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_IMPORTS: {
             cleanupAuthVerificationQueue: {};
             cleanupAuthVerificationWorker: {};
             cleanupExpiredAuthVerifications: {};
+            consumeCodeVerification: {};
             CookieUserSessionService: {};
             createAuthVerification: {};
+            createCodeVerification: {};
             userSessionPayload: {};
             validateAuthVerification: {};
+            validateCodeVerification: {};
         }>>;
     }, {
         paths: import("@baseplate-dev/sync").ProviderType<import("./template-paths.js").LocalAuthCoreAuthModulePaths>;

package/dist/local-auth/core/generators/auth-module/generated/ts-import-providers.js

@@ -5,10 +5,13 @@ export const authModuleImportsSchema = createTsImportMapSchema({
     cleanupAuthVerificationQueue: {},
     cleanupAuthVerificationWorker: {},
     cleanupExpiredAuthVerifications: {},
+    consumeCodeVerification: {},
     CookieUserSessionService: {},
     createAuthVerification: {},
+    createCodeVerification: {},
     userSessionPayload: {},
     validateAuthVerification: {},
+    validateCodeVerification: {},
 });
 export const authModuleImportsProvider = createReadOnlyProviderType('auth-module-imports');
 const localAuthCoreAuthModuleImportsTask = createGeneratorTask({
@@ -25,10 +28,13 @@ const localAuthCoreAuthModuleImportsTask = createGeneratorTask({
                     cleanupAuthVerificationQueue: paths.queuesCleanupAuthVerification,
                     cleanupAuthVerificationWorker: paths.queuesCleanupAuthVerificationWorker,
                     cleanupExpiredAuthVerifications: paths.servicesAuthVerification,
+                    consumeCodeVerification: paths.servicesCodeVerification,
                     CookieUserSessionService: paths.userSessionService,
                     createAuthVerification: paths.servicesAuthVerification,
+                    createCodeVerification: paths.servicesCodeVerification,
                     userSessionPayload: paths.schemaUserSessionPayloadObjectType,
                     validateAuthVerification: paths.servicesAuthVerification,
+                    validateCodeVerification: paths.servicesCodeVerification,
                 }),
             },
         };

package/dist/local-auth/core/generators/auth-module/generated/typed-templates.d.ts

@@ -325,6 +325,23 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
             prisma: {};
         }>>;
     }, Record<never, Record<never, never>>>;
+    servicesCodeVerification: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
+        configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            getConfig: {};
+            isDevelopment: {};
+        }>>;
+        prismaGeneratedImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            PrismaClient: {};
+            Prisma: {};
+            '*': {};
+            $Enums: {};
+        }>>;
+        prismaImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            prisma: {};
+        }>>;
+    }, {
+        servicesAuthVerification: {};
+    }>;
     userSessionService: import("@baseplate-dev/core-generators").TsTemplateFile<{
         TPL_PRISMA_USER_SESSION: {};
     }, {

package/dist/local-auth/core/generators/auth-module/generated/typed-templates.js

@@ -140,6 +140,25 @@ const servicesAuthVerification = createTsTemplateFile({
     },
     variables: {},
 });
+const servicesCodeVerification = createTsTemplateFile({
+    fileOptions: { kind: 'singleton' },
+    importMapProviders: {
+        configServiceImports: configServiceImportsProvider,
+        prismaGeneratedImports: prismaGeneratedImportsProvider,
+        prismaImports: prismaImportsProvider,
+    },
+    name: 'services-code-verification',
+    projectExports: {
+        consumeCodeVerification: { isTypeOnly: false },
+        createCodeVerification: { isTypeOnly: false },
+        validateCodeVerification: { isTypeOnly: false },
+    },
+    referencedGeneratorTemplates: { servicesAuthVerification: {} },
+    source: {
+        path: path.join(import.meta.dirname, '../templates/module/services/code-verification.service.ts'),
+    },
+    variables: {},
+});
 const userSessionService = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     importMapProviders: {
@@ -201,6 +220,7 @@ export const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES = {
     queuesCleanupAuthVerification,
     queuesCleanupAuthVerificationWorker,
     servicesAuthVerification,
+    servicesCodeVerification,
     userSessionService,
     utilsGroup,
 };

package/dist/local-auth/core/generators/auth-module/templates/module/services/auth-verification.service.d.ts

@@ -1,4 +1,8 @@
 import type { AuthVerification, Prisma } from '%prismaGeneratedImports';
+/**
+ * Constant-time comparison of two hex strings to prevent timing attacks.
+ */
+export declare function safeCompare(a: string, b: string): boolean;
 /**
  * Creates a new auth verification using the split-token pattern.
  *

package/dist/local-auth/core/generators/auth-module/templates/module/services/auth-verification.service.js

@@ -20,7 +20,7 @@ function hashVerifier(verifier) {
 /**
  * Constant-time comparison of two hex strings to prevent timing attacks.
  */
-function safeCompare(a, b) {
+export function safeCompare(a, b) {
     if (a.length !== b.length)
         return false;
     return crypto.timingSafeEqual(Buffer.from(a, 'hex'), Buffer.from(b, 'hex'));

package/dist/local-auth/core/generators/auth-module/templates/module/services/auth-verification.service.ts

@@ -27,7 +27,7 @@ function hashVerifier(verifier: string): string {
 /**
  * Constant-time comparison of two hex strings to prevent timing attacks.
  */
-function safeCompare(a: string, b: string): boolean {
+export function safeCompare(a: string, b: string): boolean {
   if (a.length !== b.length) return false;
   return crypto.timingSafeEqual(Buffer.from(a, 'hex'), Buffer.from(b, 'hex'));
 }

package/dist/local-auth/core/generators/auth-module/templates/module/services/code-verification.service.d.ts

@@ -0,0 +1,66 @@
+import type { AuthVerification, Prisma } from '%prismaGeneratedImports';
+/**
+ * Creates or replaces a short code verification (e.g. an emailed OTP).
+ *
+ * The identifier is caller-supplied (typically an email) rather than a random
+ * selector, so the code cannot be folded into a single token the way a
+ * split-token flow does. Only one code may be outstanding per
+ * `type`/`identifier` pair, so requesting a new one replaces any existing code
+ * and resets the attempt counter.
+ *
+ * The identifier rather than a user reference is the subject here, since a
+ * code may be issued for an address that has no account yet.
+ *
+ * The returned id identifies this particular issuance, so a caller that binds
+ * it to the requester (e.g. in a cookie) can tell one request apart from the
+ * next. It is regenerated on every call for that reason: reusing it would let
+ * whoever requested an earlier code redeem a later one requested by someone
+ * else.
+ *
+ * @param code - The plaintext code sent to the user; only its hash is stored
+ */
+export declare function createCodeVerification({ type, identifier, code, expiresInSec, }: {
+    type: string;
+    identifier: string;
+    code: string;
+    expiresInSec: number;
+}): Promise<{
+    id: string;
+}>;
+/**
+ * Validates a short code verification without consuming it, so the caller can
+ * gather any further input it needs before committing.
+ *
+ * Security: a short numeric code has far less entropy than a random token, so
+ * each code carries its own attempt counter alongside the endpoint rate limits.
+ * The record is deleted when the code has expired or the attempt budget is
+ * exhausted. Pass the returned record to {@link consumeCodeVerification} to
+ * complete the flow.
+ *
+ * Both cleanup paths delete by filter rather than by primary key: simultaneous
+ * callers can each decide the record should go, and only one of them removes a
+ * row. A keyed delete would raise on the others instead of returning null.
+ */
+export declare function validateCodeVerification({ type, identifier, code, maxAttempts, }: {
+    type: string;
+    identifier: string;
+    code: string;
+    maxAttempts: number;
+}): Promise<AuthVerification | null>;
+/**
+ * Consumes a previously validated verification, returning whether this call is
+ * the one that claimed it.
+ *
+ * The conditional delete is the authorization step: concurrent requests
+ * carrying the same code race here, and only the request that removes the row
+ * may proceed. Reading the row and deleting it in separate statements would
+ * let both win.
+ *
+ * @param client - Transaction client, so consuming the code can be committed
+ * together with whatever the code authorized rather than ahead of it
+ */
+export declare function consumeCodeVerification({ id, client, }: {
+    id: string;
+    client?: Prisma.TransactionClient;
+}): Promise<boolean>;
+//# sourceMappingURL=code-verification.service.d.ts.map

package/dist/local-auth/core/generators/auth-module/templates/module/services/code-verification.service.js

@@ -0,0 +1,134 @@
+// @ts-nocheck
+import { safeCompare } from '$servicesAuthVerification';
+import { getConfig } from '%configServiceImports';
+import { prisma } from '%prismaImports';
+import * as crypto from 'node:crypto';
+/**
+ * Short code verifications, for flows that email a handful of digits rather
+ * than a link.
+ *
+ * These share the `AuthVerification` table with the split-token flows in
+ * {@link ./auth-verification.service.js} but not their security model: the
+ * secret is short enough to guess, so it is keyed rather than hashed, carries
+ * its own attempt budget, and is addressed by a caller-supplied identifier
+ * instead of a random selector.
+ */
+/**
+ * Derives the stored value for a short code.
+ *
+ * Short codes occupy a keyspace small enough to invert a plain digest by
+ * exhaustive search, so they are keyed with the server secret rather than
+ * hashed: an attacker holding only the database cannot recover them. The type
+ * and identifier are mixed in so a stored value is valid solely for the flow
+ * and address it was issued for.
+ */
+function hashCode({ type, identifier, code, }) {
+    return crypto
+        .createHmac('sha256', getConfig().AUTH_SECRET)
+        .update(`${type}:${identifier}:${code}`)
+        .digest('hex');
+}
+/**
+ * Creates or replaces a short code verification (e.g. an emailed OTP).
+ *
+ * The identifier is caller-supplied (typically an email) rather than a random
+ * selector, so the code cannot be folded into a single token the way a
+ * split-token flow does. Only one code may be outstanding per
+ * `type`/`identifier` pair, so requesting a new one replaces any existing code
+ * and resets the attempt counter.
+ *
+ * The identifier rather than a user reference is the subject here, since a
+ * code may be issued for an address that has no account yet.
+ *
+ * The returned id identifies this particular issuance, so a caller that binds
+ * it to the requester (e.g. in a cookie) can tell one request apart from the
+ * next. It is regenerated on every call for that reason: reusing it would let
+ * whoever requested an earlier code redeem a later one requested by someone
+ * else.
+ *
+ * @param code - The plaintext code sent to the user; only its hash is stored
+ */
+export async function createCodeVerification({ type, identifier, code, expiresInSec, }) {
+    const value = hashCode({ type, identifier, code });
+    const expiresAt = new Date(Date.now() + expiresInSec * 1000);
+    const id = crypto.randomUUID();
+    await prisma.authVerification.upsert({
+        where: { type_identifier: { type, identifier } },
+        create: {
+            id,
+            type,
+            identifier,
+            value,
+            expiresAt,
+        },
+        // Resetting `attempts` is what gives the replacement code a fresh budget;
+        // without it a reissued code would inherit the old code's failed guesses.
+        update: {
+            id,
+            value,
+            attempts: 0,
+            expiresAt,
+        },
+        select: { id: true },
+    });
+    return { id };
+}
+/**
+ * Validates a short code verification without consuming it, so the caller can
+ * gather any further input it needs before committing.
+ *
+ * Security: a short numeric code has far less entropy than a random token, so
+ * each code carries its own attempt counter alongside the endpoint rate limits.
+ * The record is deleted when the code has expired or the attempt budget is
+ * exhausted. Pass the returned record to {@link consumeCodeVerification} to
+ * complete the flow.
+ *
+ * Both cleanup paths delete by filter rather than by primary key: simultaneous
+ * callers can each decide the record should go, and only one of them removes a
+ * row. A keyed delete would raise on the others instead of returning null.
+ */
+export async function validateCodeVerification({ type, identifier, code, maxAttempts, }) {
+    const record = await prisma.authVerification.findUnique({
+        where: { type_identifier: { type, identifier } },
+    });
+    if (!record) {
+        return null;
+    }
+    if (record.expiresAt < new Date()) {
+        await prisma.authVerification.deleteMany({ where: { id: record.id } });
+        return null;
+    }
+    if (safeCompare(record.value, hashCode({ type, identifier, code }))) {
+        return record;
+    }
+    // Incremented in the database rather than read-modify-written here, so
+    // simultaneous guesses each cost a point instead of sharing one.
+    const { attempts } = await prisma.authVerification.update({
+        where: { id: record.id },
+        data: { attempts: { increment: 1 } },
+        select: { attempts: true },
+    });
+    if (attempts >= maxAttempts) {
+        await prisma.authVerification.deleteMany({ where: { id: record.id } });
+    }
+    return null;
+}
+/**
+ * Consumes a previously validated verification, returning whether this call is
+ * the one that claimed it.
+ *
+ * The conditional delete is the authorization step: concurrent requests
+ * carrying the same code race here, and only the request that removes the row
+ * may proceed. Reading the row and deleting it in separate statements would
+ * let both win.
+ *
+ * @param client - Transaction client, so consuming the code can be committed
+ * together with whatever the code authorized rather than ahead of it
+ */
+export async function consumeCodeVerification({ id, client = prisma, }) {
+    const { count } = await client.authVerification.deleteMany({
+        where: { id },
+    });
+    return count === 1;
+}
+//# sourceMappingURL=code-verification.service.js.map