@baseplate-dev/plugin-auth 0.6.18 → 0.6.20

package/dist/local-auth/core/generators/auth-module/templates/module/services/code-verification.service.ts

@@ -3,7 +3,7 @@
 import type { AuthVerification, Prisma } from '%prismaGeneratedImports';
 
 import { safeCompare } from '$servicesAuthVerification';
-import { getConfig } from '%configServiceImports';
+import { deriveKey } from '%appSecretImports';
 import { prisma } from '%prismaImports';
 import * as crypto from 'node:crypto';
 
@@ -37,7 +37,7 @@ function hashCode({
   code: string;
 }): string {
   return crypto
-    .createHmac('sha256', getConfig().AUTH_SECRET)
+    .createHmac('sha256', deriveKey('auth:code-verification:v1'))
     .update(`${type}:${identifier}:${code}`)
     .digest('hex');
 }
@@ -101,18 +101,19 @@ export async function createCodeVerification({
 }
 
 /**
- * Validates a short code verification without consuming it, so the caller can
- * gather any further input it needs before committing.
+ * Validates a short code verification, leaving the record in place so the
+ * caller can gather any further input it needs before committing.
  *
  * Security: a short numeric code has far less entropy than a random token, so
  * each code carries its own attempt counter alongside the endpoint rate limits.
- * The record is deleted when the code has expired or the attempt budget is
- * exhausted. Pass the returned record to {@link consumeCodeVerification} to
+ * Every call spends an attempt, including one that matches, and the record is
+ * deleted once the code has expired or a wrong guess has spent the last
+ * attempt. Pass the returned record to {@link consumeCodeVerification} to
  * complete the flow.
  *
- * Both cleanup paths delete by filter rather than by primary key: simultaneous
+ * The cleanup paths delete by filter rather than by primary key: simultaneous
  * callers can each decide the record should go, and only one of them removes a
- * row. A keyed delete would raise on the others instead of returning null.
+ * row.
  */
 export async function validateCodeVerification({
   type,
@@ -138,19 +139,25 @@ export async function validateCodeVerification({
     return null;
   }
 
-  if (safeCompare(record.value, hashCode({ type, identifier, code }))) {
-    return record;
-  }
-
-  // Incremented in the database rather than read-modify-written here, so
-  // simultaneous guesses each cost a point instead of sharing one.
-  const { attempts } = await prisma.authVerification.update({
-    where: { id: record.id },
+  // Simultaneous guesses serialize on this statement, so at most `maxAttempts`
+  // of them reach the comparison below.
+  const [claimed] = await prisma.authVerification.updateManyAndReturn({
+    where: { id: record.id, attempts: { lt: maxAttempts } },
     data: { attempts: { increment: 1 } },
-    select: { attempts: true },
   });
 
-  if (attempts >= maxAttempts) {
+  // A spent budget is not this caller's to clean up: the guess that spent it
+  // discards the record below, and a correct guess that spent it may still be
+  // holding the record for {@link consumeCodeVerification}.
+  if (!claimed) {
+    return null;
+  }
+
+  if (safeCompare(claimed.value, hashCode({ type, identifier, code }))) {
+    return claimed;
+  }
+
+  if (claimed.attempts >= maxAttempts) {
     await prisma.authVerification.deleteMany({ where: { id: record.id } });
   }
 

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-session.service.js

@@ -1,14 +1,16 @@
 // @ts-nocheck
-import { signObject, unsignObject } from '$cookieSigner';
 import { getUserSessionCookieName } from '$sessionCookie';
 import { USER_SESSION_DURATION_SEC, USER_SESSION_MAX_LIFETIME_SEC, USER_SESSION_RENEWAL_THRESHOLD_SEC, } from '$userSessionConstants';
 import { verifyRequestOrigin } from '$verifyRequestOrigin';
+import { createSigner } from '%appSecretImports';
+import { getWebOrigins } from '%appUrlsImports';
 import { InvalidSessionError } from '%authContextImports';
 import { DEFAULT_USER_ROLES } from '%authRolesImports';
-import { getConfig, isDevelopment } from '%configServiceImports';
+import { isDevelopment } from '%configServiceImports';
 import { ForbiddenError } from '%errorHandlerServiceImports';
 import { prisma } from '%prismaImports';
 import { randomBytes } from 'node:crypto';
+const sessionCookieSigner = createSigner('auth:session:v1');
 function getCookieOptions() {
     return {
         httpOnly: true,
@@ -85,7 +87,7 @@ export class CookieUserSessionService {
             ...user.roles.map((role) => role.role),
         ];
         const cookieName = getUserSessionCookieName(context.reqInfo.headers);
-        const cookieValue = signObject({ token }, getConfig().AUTH_SECRET);
+        const cookieValue = sessionCookieSigner.sign({ token });
         context.cookieStore.set(cookieName, cookieValue, getCookieOptions());
         return { userId, expiresAt, roles };
     }
@@ -122,17 +124,14 @@ export class CookieUserSessionService {
         if ((req.method !== 'GET' ||
             req.headers.upgrade?.toLowerCase() === 'websocket') &&
             req.method !== 'HEAD' &&
-            !verifyRequestOrigin(req, [req.host, ...getConfig().ALLOWED_ORIGINS])) {
+            !verifyRequestOrigin(req, [req.host, ...getWebOrigins()])) {
             throw new ForbiddenError('Invalid Origin header');
         }
         try {
-            // Unsign the session cookie
-            const sessionCookieResult = unsignObject(sessionCookieValue, getConfig().AUTH_SECRET);
+            const sessionCookieResult = sessionCookieSigner.verify(sessionCookieValue);
             if (!sessionCookieResult)
                 throw new InvalidSessionError();
             const { token } = sessionCookieResult;
-            if (typeof token !== 'string')
-                throw new InvalidSessionError();
             // Fetch and validate user session
             const userSession = await TPL_PRISMA_USER_SESSION.findUnique({
                 where: { token },
@@ -152,7 +151,7 @@ export class CookieUserSessionService {
                         expiresAt: sessionExpiryResult.newExpiry,
                     },
                 });
-                const newSignedCookie = signObject({ token }, getConfig().AUTH_SECRET);
+                const newSignedCookie = sessionCookieSigner.sign({ token });
                 reply.setCookie(cookieName, newSignedCookie, getCookieOptions());
             }
             const { user } = userSession;

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-session.service.ts

@@ -10,7 +10,6 @@ import type {
 import type { CookieSerializeOptions } from '@fastify/cookie';
 import type { FastifyReply, FastifyRequest } from 'fastify';
 
-import { signObject, unsignObject } from '$cookieSigner';
 import { getUserSessionCookieName } from '$sessionCookie';
 import {
   USER_SESSION_DURATION_SEC,
@@ -18,9 +17,11 @@ import {
   USER_SESSION_RENEWAL_THRESHOLD_SEC,
 } from '$userSessionConstants';
 import { verifyRequestOrigin } from '$verifyRequestOrigin';
+import { createSigner } from '%appSecretImports';
+import { getWebOrigins } from '%appUrlsImports';
 import { InvalidSessionError } from '%authContextImports';
 import { DEFAULT_USER_ROLES } from '%authRolesImports';
-import { getConfig, isDevelopment } from '%configServiceImports';
+import { isDevelopment } from '%configServiceImports';
 import { ForbiddenError } from '%errorHandlerServiceImports';
 import { prisma } from '%prismaImports';
 import { randomBytes } from 'node:crypto';
@@ -30,6 +31,8 @@ interface SessionCookieValue {
   token: string;
 }
 
+const sessionCookieSigner = createSigner<SessionCookieValue>('auth:session:v1');
+
 function getCookieOptions(): CookieSerializeOptions {
   return {
     httpOnly: true,
@@ -131,7 +134,7 @@ export class CookieUserSessionService implements UserSessionService {
     ];
 
     const cookieName = getUserSessionCookieName(context.reqInfo.headers);
-    const cookieValue = signObject({ token }, getConfig().AUTH_SECRET);
+    const cookieValue = sessionCookieSigner.sign({ token });
 
     context.cookieStore.set(cookieName, cookieValue, getCookieOptions());
 
@@ -182,20 +185,16 @@ export class CookieUserSessionService implements UserSessionService {
       (req.method !== 'GET' ||
         req.headers.upgrade?.toLowerCase() === 'websocket') &&
       req.method !== 'HEAD' &&
-      !verifyRequestOrigin(req, [req.host, ...getConfig().ALLOWED_ORIGINS])
+      !verifyRequestOrigin(req, [req.host, ...getWebOrigins()])
     ) {
       throw new ForbiddenError('Invalid Origin header');
     }
     try {
-      // Unsign the session cookie
-      const sessionCookieResult = unsignObject(
-        sessionCookieValue,
-        getConfig().AUTH_SECRET,
-      ) as SessionCookieValue | undefined;
+      const sessionCookieResult =
+        sessionCookieSigner.verify(sessionCookieValue);
       if (!sessionCookieResult) throw new InvalidSessionError();
 
       const { token } = sessionCookieResult;
-      if (typeof token !== 'string') throw new InvalidSessionError();
 
       // Fetch and validate user session
       const userSession = await TPL_PRISMA_USER_SESSION.findUnique({
@@ -220,7 +219,7 @@ export class CookieUserSessionService implements UserSessionService {
             expiresAt: sessionExpiryResult.newExpiry,
           },
         });
-        const newSignedCookie = signObject({ token }, getConfig().AUTH_SECRET);
+        const newSignedCookie = sessionCookieSigner.sign({ token });
         reply.setCookie(cookieName, newSignedCookie, getCookieOptions());
       }
 

package/dist/local-auth/core/generators/auth-routes/auth-routes.generator.d.ts

@@ -33,6 +33,7 @@ export declare const authRoutesGenerator: import("@baseplate-dev/sync").Generato
                 isTypeOnly: true;
             };
             Alert: {};
+            AlertAction: {};
             AlertDescription: {};
             AlertTitle: {};
             Autocomplete: {};
@@ -62,6 +63,7 @@ export declare const authRoutesGenerator: import("@baseplate-dev/sync").Generato
             buttonVariants: {};
             Calendar: {};
             Card: {};
+            CardAction: {};
             CardContent: {};
             CardDescription: {};
             CardFooter: {};
@@ -188,6 +190,10 @@ export declare const authRoutesGenerator: import("@baseplate-dev/sync").Generato
             NotFoundCard: {};
             NumberField: {};
             NumberFieldController: {};
+            PageHeader: {};
+            PageHeaderActions: {};
+            PageHeaderDescription: {};
+            PageHeaderTitle: {};
             Popover: {};
             PopoverContent: {};
             PopoverTrigger: {};
@@ -197,6 +203,11 @@ export declare const authRoutesGenerator: import("@baseplate-dev/sync").Generato
                 isTypeOnly: true;
             };
             ScrollArea: {};
+            Section: {};
+            SectionActions: {};
+            SectionDescription: {};
+            SectionHeader: {};
+            SectionTitle: {};
             Select: {};
             SelectField: {};
             SelectFieldController: {};
@@ -252,7 +263,27 @@ export declare const authRoutesGenerator: import("@baseplate-dev/sync").Generato
             Textarea: {};
             TextareaField: {};
             TextareaFieldController: {};
+            Toast: {};
+            toast: {};
+            ToastAction: {};
+            ToastClose: {};
+            ToastContent: {};
+            ToastDescription: {};
             Toaster: {};
+            toastManager: {};
+            ToastOptions: {
+                isTypeOnly: true;
+            };
+            ToastPortal: {};
+            ToastProvider: {};
+            ToastTitle: {};
+            ToastType: {
+                isTypeOnly: true;
+            };
+            ToastUpdateOptions: {
+                isTypeOnly: true;
+            };
+            ToastViewport: {};
             Tooltip: {};
             TooltipContent: {};
             TooltipProvider: {};
@@ -265,6 +296,7 @@ export declare const authRoutesGenerator: import("@baseplate-dev/sync").Generato
             useConfirmDialogState: {};
             useControlledState: {};
             useControllerMerged: {};
+            useFieldIds: {};
             useIsMobile: {};
             useSidebar: {};
         }>>;