@binary1702/auth 0.2.4 → 0.3.0

package/dist/next/index.js

@@ -5,92 +5,178 @@
 //               export { GET, POST } from "@binary1702/auth/next"
 //
 // Serves:
-//   GET  /auth/sign-in    the sign-in page
-//   POST /auth/sign-in    verify, set cookie, redirect to ?next or /
-//   GET  /auth/sign-up    the sign-up page (see core/signup.ts for when)
-//   POST /auth/sign-up    create user, set cookie, redirect
-//   GET  /auth/sign-out   clear cookie, redirect to sign-in
-//   POST /auth/sign-out   same (for fetch callers)
-//   GET  /auth/session    { user } or { user: null }
+//   GET  /auth/sign-in          the sign-in page
+//   POST /auth/sign-in          verify, set cookie, redirect to ?next or /
+//   GET  /auth/sign-up          the sign-up page (see core/signup.ts for when)
+//   POST /auth/sign-up          create user, email a verify link, set cookie, redirect
+//   GET  /auth/sign-out         clear cookie, redirect to sign-in
+//   POST /auth/sign-out         same (for fetch callers)
+//   GET  /auth/session          the session contract (core/org.ts), or 401
+//   POST /auth/session          switch the active organization { organization: id }
+//   GET  /auth/verify?token=    consume the link, mark the email verified
+//   POST /auth/verify/resend    email a fresh link (body: email)
+//   GET  /auth/forgot           "send me a reset link" form
+//   POST /auth/forgot           email a reset link if the address exists; same answer either way
+//   GET  /auth/reset?token=     "choose a new password" form
+//   POST /auth/reset            consume the token, set the password, sign in
 //
 // Use anywhere on the server:
-//   const user = await requireUser()   // { id, email } or throws AuthError(401)
-//   const user = await getUser()       // { id, email } or null
+//   const session = await getSession()         // { user, organization, authorization } or null
+//   const session = await requireSession()     // same, or throws AuthError(401)
+//   const session = await requirePermission("invoices.create")   // or throws AuthError(403)
+//   const user = await getUser() / requireUser()                 // just the user part
+// All of them run the same check: signature, user still exists with
+// the epoch the token was signed under, email verified when required.
 // ─────────────────────────────────────────────────────────────
 import { cookies } from "next/headers.js";
 import { NextResponse } from "next/server.js";
-import { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_UP_PATH, getSecret } from "../core/config.js";
-import { signSession, verifySession } from "../core/session.js";
-import { hashPassword, verifyPassword } from "../core/password.js";
-import { countUsers, createUser, findUser } from "../core/db.js";
-import { signInPage, signUpPage } from "../core/html.js";
-import { signupPolicy, validateCredentials } from "../core/signup.js";
+import { randomBytes } from "node:crypto";
+import { COOKIE_NAME, SIGN_IN_PATH, SIGN_UP_PATH, cookieName, getSecret } from "../core/config.js";
+import { options } from "../core/options.js";
+import { isCurrent, signSession, verifySession } from "../core/session.js";
+import { hashPassword, needsRehash, verifyPassword } from "../core/password.js";
+import { addMember, adminOrgs, adminUsers, countUsers, createOrg, createUser, db, DuplicateUserError, rehashPassword, findOrg, findUser, markVerified, removeMember, removeOrg, removeUser, revokeSessions, sessionRow, setActiveOrg, setPassword, setPasswordById, } from "../core/db.js";
+import { forgotPage, messagePage, resendForm, resetPage, securityHeaders, setSiteName, signInPage, signUpPage } from "../core/html.js";
+import { adminPage } from "../core/admin-html.js";
+import { ADMIN_PATH, backTo as adminBackTo, isAdmin, isOrgAction, isUserAction, refusedOnSelf, roleChoices } from "../core/admin.js";
+import { emailTransport } from "../core/email.js";
+import { clientIp, rateLimit, retryMessage } from "../core/rate.js";
+import { signupPolicy, validateCredentials, validatePassword } from "../core/signup.js";
+import { isSameOrigin, safeEqual, safeNext } from "../core/guard.js";
+import { consumeToken, issueToken } from "../core/tokens.js";
+import { sendEmail } from "../core/email.js";
+import { VERIFY_TTL_SECONDS, mayAccess, verifyEmail, verifyLink } from "../core/verify.js";
+import { FORGOT_PATH, FORGOT_SENT, RESET_LINK_INVALID, RESET_TTL_SECONDS, resetEmail, resetLink } from "../core/reset.js";
+import { buildSession, hasPermission } from "../core/org.js";
 export class AuthError extends Error {
-    status = 401;
-    constructor(message = "Unauthorized") {
+    status;
+    constructor(message = "Unauthorized", status = 401) {
         super(message);
         this.name = "AuthError";
+        this.status = status;
     }
 }
-/** Current user from the session cookie, or null. Never touches the database. */
-export async function getUser() {
-    const token = (await cookies()).get(COOKIE_NAME)?.value;
+/**
+ * The one session check, for anything that hands out data: a valid
+ * signature, AND the user still exists with the epoch the token was
+ * signed under, AND (when required) a verified email. One query, which
+ * also brings the active organization and role. (The proxy skips the
+ * lookup; see core/session.ts for why that is safe.)
+ */
+async function sessionFromToken(token) {
     if (!token)
         return null;
-    return verifySession(token, getSecret());
+    const claim = await verifySession(token, getSecret());
+    if (!claim)
+        return null;
+    const row = await sessionRow(claim.id);
+    const o = options();
+    if (!row || !isCurrent(claim, row.epoch) || !mayAccess(row.verified, o.requireVerified))
+        return null;
+    return buildSession(row, o);
+}
+async function cookieToken() {
+    return pickCookie(async (name) => (await cookies()).get(name)?.value);
+}
+/** The current cookie name first, then the pre-0.3.0 one, so upgrading signs nobody out. */
+async function pickCookie(get) {
+    return (await get(cookieName(options().production))) ?? (await get(COOKIE_NAME));
+}
+/** The session contract for the current request, or null if signed out, deleted or revoked. */
+export async function getSession() {
+    return sessionFromToken(await cookieToken());
+}
+/** The session, or throw AuthError (status 401). */
+export async function requireSession() {
+    const session = await getSession();
+    if (!session)
+        throw new AuthError();
+    return session;
+}
+/** The session, or throw AuthError: 401 when signed out, 403 when the role lacks the permission. */
+export async function requirePermission(permission) {
+    const session = await requireSession();
+    if (!hasPermission(session, permission))
+        throw new AuthError("Forbidden", 403);
+    return session;
+}
+/** Current user from the session cookie, or null if signed out, deleted or revoked. */
+export async function getUser() {
+    return (await getSession())?.user ?? null;
 }
 /** Current user, or throw AuthError (status 401). */
 export async function requireUser() {
-    const user = await getUser();
-    if (!user)
-        throw new AuthError();
-    return user;
+    return (await requireSession()).user;
 }
-/** A 401 JSON response for catch blocks: `catch (e) { return unauthorized(e) }` */
+/** A 401/403 JSON response for catch blocks: `catch (e) { return unauthorized(e) }` */
 export function unauthorized(err) {
     if (err && !(err instanceof AuthError))
         throw err;
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const status = err instanceof AuthError ? err.status : 401;
+    return NextResponse.json({ error: status === 403 ? "Forbidden" : "Unauthorized" }, { status });
 }
 const cookieOptions = () => ({
     httpOnly: true,
     sameSite: "lax",
-    secure: process.env.NODE_ENV === "production",
+    secure: options().production,
     path: "/",
-    maxAge: SESSION_DAYS * 24 * 60 * 60,
+    maxAge: options().sessionDays * 24 * 60 * 60,
 });
-/** Only allow same-origin relative paths as a post-login destination. */
-function safeNext(value) {
-    if (!value || !value.startsWith("/") || value.startsWith("//"))
-        return "/";
-    return value;
+/** An auth page: HTML plus the headers every one of them carries (see securityHeaders) */
+function html(body, status = 200, headers = securityHeaders()) {
+    return new NextResponse(body, { status, headers: { "content-type": "text/html; charset=utf-8", ...headers } });
 }
-function html(body, status = 200) {
-    return new NextResponse(body, { status, headers: { "content-type": "text/html; charset=utf-8" } });
+/** Per-user JSON: never cached by a browser or a CDN */
+function sessionJson(session) {
+    const res = session
+        ? NextResponse.json(session)
+        : NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    res.headers.set("cache-control", "no-store");
+    return res;
 }
 async function readBody(req) {
     const type = req.headers.get("content-type") ?? "";
     const get = (b, k) => String((b instanceof FormData ? b.get(k) : b[k]) ?? "");
     const b = type.includes("application/json")
         ? (await req.json().catch(() => ({})))
-        : await req.formData();
+        : await req.formData().catch(() => new FormData());
     return {
         email: get(b, "email").trim().toLowerCase(),
         password: get(b, "password"),
         invite: get(b, "invite").trim(),
-        next: safeNext(get(b, "next")),
+        token: get(b, "token").trim(),
+        organization: get(b, "organization").trim(),
+        next: safeNext(get(b, "next"), req.url),
         json: type.includes("application/json"),
     };
 }
+/** Every field of a form or JSON body as strings (the admin forms vary per action). */
+async function readFields(req) {
+    const type = req.headers.get("content-type") ?? "";
+    const out = new Proxy({}, { get: (t, k) => (typeof k === "string" ? (t[k] ?? "") : undefined) });
+    if (type.includes("application/json")) {
+        const b = (await req.json().catch(() => ({})));
+        for (const [k, v] of Object.entries(b))
+            out[k] = String(v ?? "");
+    }
+    else {
+        const fd = await req.formData().catch(() => new FormData());
+        fd.forEach((v, k) => (out[k] = String(v)));
+    }
+    return out;
+}
+async function currentSession(req) {
+    return sessionFromToken(await pickCookie((name) => req.cookies.get(name)?.value));
+}
 async function currentUser(req) {
-    const token = req.cookies.get(COOKIE_NAME)?.value;
-    return token ? verifySession(token, getSecret()) : null;
+    return (await currentSession(req))?.user ?? null;
 }
 /** Sign the user in on a response: cookie + redirect (form) or JSON (fetch). */
 async function signedIn(req, user, next, json) {
-    const token = await signSession(user, getSecret());
-    const res = json ? NextResponse.json({ user }) : NextResponse.redirect(new URL(next, req.url), 303);
-    res.cookies.set(COOKIE_NAME, token, cookieOptions());
+    const token = await signSession(user, getSecret(), options().sessionDays);
+    const body = { user: { id: user.id, email: user.email } };
+    const res = json ? NextResponse.json(body) : NextResponse.redirect(new URL(next, req.url), 303);
+    res.cookies.set(cookieName(options().production), token, cookieOptions());
     return res;
 }
 /** Back to a form with ?error=<msg>, keeping ?next. */
@@ -101,22 +187,176 @@ function backTo(req, path, error, next) {
         url.searchParams.set("next", next);
     return NextResponse.redirect(url, 303);
 }
+/** The sign-in page in its "check your email" state. */
+function checkYourEmail(req, next, json, user) {
+    if (json)
+        return NextResponse.json({ user: user ?? null, verify: true }, { status: user ? 200 : 403 });
+    const url = new URL(SIGN_IN_PATH, req.url);
+    url.searchParams.set("verify", "1");
+    if (next !== "/")
+        url.searchParams.set("next", next);
+    return NextResponse.redirect(url, 303);
+}
+/** 429 with Retry-After: JSON for fetch callers, the form again (with the message) for browsers. */
+function tooMany(d, json, page) {
+    const message = retryMessage(d.retryAfter);
+    const res = json ? NextResponse.json({ error: message, retryAfter: d.retryAfter }, { status: 429 }) : html(page(message), 429);
+    res.headers.set("retry-after", String(d.retryAfter));
+    return res;
+}
 function signOutResponse(req, json) {
     const res = json
         ? NextResponse.json({ ok: true })
         : NextResponse.redirect(new URL(SIGN_IN_PATH, req.url), 303);
+    // Clear both names: the current one and the pre-0.3.0 one a browser may still hold
+    res.cookies.set(cookieName(options().production), "", { ...cookieOptions(), maxAge: 0 });
     res.cookies.set(COOKIE_NAME, "", { ...cookieOptions(), maxAge: 0 });
     return res;
 }
 async function policy() {
-    return signupPolicy(process.env, await countUsers());
+    return signupPolicy(options().signup, await countUsers());
+}
+/** Issue a verify token and email the link. Throws if the email cannot be sent. */
+async function sendVerification(req, user, next) {
+    const raw = await issueToken(user.id, "verify", VERIFY_TTL_SECONDS, { next });
+    await sendEmail(verifyEmail(user.email, verifyLink(req.url, raw, next), siteName(req)));
+}
+/** For subjects and titles: `name` from b17_auth.yaml, else the host serving the request */
+function siteName(req) {
+    const name = options().name;
+    setSiteName(name);
+    return name || new URL(req.url).host;
+}
+// ── admin ─────────────────────────────────────────────────────
+async function renderAdmin(self, nonce, view, notice, error) {
+    const o = options();
+    const [users, orgs, [tokens]] = await Promise.all([
+        adminUsers(),
+        adminOrgs(),
+        db().query(`SELECT COUNT(*)::int AS total, COUNT(*) FILTER (WHERE used_at IS NULL AND expires_at > now())::int AS live FROM tokens`),
+    ]);
+    const inUse = orgs.flatMap((org) => org.members.map((m) => m.role));
+    return adminPage({
+        self,
+        view,
+        users,
+        orgs,
+        roles: roleChoices(Object.keys(o.permissions), inUse),
+        options: o,
+        transport: emailTransport({ ...o.email, production: o.production }),
+        tokens: tokens ?? { total: 0, live: 0 },
+        notice,
+        error,
+        nonce,
+    });
+}
+/** Back to the admin page with a one-line result */
+function adminResult(req, kind, message, back) {
+    const url = new URL(`${ADMIN_PATH}${back ? `?${back}` : ""}`, req.url);
+    url.searchParams.set(kind, message);
+    return NextResponse.redirect(url, 303);
+}
+/** The admin POSTs: what the CLI does, from a form. Returns a notice or an error message. */
+async function adminAction(route, self, f, sendVerify) {
+    const ok = (message) => ({ ok: true, message });
+    const fail = (message) => ({ ok: false, message });
+    const email = f.email.trim().toLowerCase();
+    if (route === "admin/users") {
+        const action = f.action;
+        if (!isUserAction(action))
+            return fail("Unknown action.");
+        const refused = refusedOnSelf(action, email, self);
+        if (refused)
+            return fail(refused);
+        if (action === "add") {
+            const invalid = validateCredentials(email, f.password, options());
+            if (invalid)
+                return fail(invalid);
+            if (await findUser(email))
+                return fail("That email is already registered.");
+            try {
+                await createUser(email, await hashPassword(f.password), { verified: true });
+            }
+            catch (err) {
+                if (err instanceof DuplicateUserError)
+                    return fail("That email is already registered.");
+                throw err;
+            }
+            return ok(`Added ${email}.`);
+        }
+        const user = await findUser(email);
+        if (!user)
+            return fail(`No user ${email}.`);
+        if (action === "set-password") {
+            const invalid = validatePassword(f.password);
+            if (invalid)
+                return fail(invalid);
+            await setPassword(email, await hashPassword(f.password));
+            return ok(`Password set for ${email}; their other sessions are ended.`);
+        }
+        if (action === "sign-out") {
+            await revokeSessions(email);
+            return ok(`Every session of ${email} is ended.`);
+        }
+        if (action === "verify") {
+            await markVerified(user.id);
+            return ok(`${email} marked verified.`);
+        }
+        if (action === "send-verify") {
+            if (user.verified_at)
+                return fail(`${email} is already verified.`);
+            try {
+                await sendVerify({ id: user.id, email: user.email });
+            }
+            catch (err) {
+                return fail(`Could not send: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            return ok(`Verification email sent to ${email}.`);
+        }
+        await removeUser(email);
+        return ok(`Removed ${email}.`);
+    }
+    if (route === "admin/orgs") {
+        const action = f.action;
+        if (!isOrgAction(action))
+            return fail("Unknown action.");
+        if (action === "create") {
+            const name = f.name.trim();
+            if (!name)
+                return fail("An organization needs a name.");
+            if (await findOrg(name))
+                return fail(`There is already an organization called ${name}.`);
+            const org = await createOrg(name);
+            return ok(`Created ${org.name}.`);
+        }
+        const org = await findOrg(f.org);
+        if (!org)
+            return fail("No such organization.");
+        if (action === "remove-org") {
+            await removeOrg(org.id);
+            return ok(`Removed ${org.name} and its memberships.`);
+        }
+        const user = await findUser(email);
+        if (!user)
+            return fail(`No user ${email}. Add them first.`);
+        if (action === "remove-member") {
+            return (await removeMember(org.id, user.id)) ? ok(`${email} removed from ${org.name}.`) : fail(`${email} is not a member of ${org.name}.`);
+        }
+        const role = f.role.trim();
+        if (!/^[a-z0-9_-]{1,32}$/i.test(role))
+            return fail("A role is one word: letters, digits, - or _.");
+        await addMember(org.id, user.id, role); // add-member and set-role are the same upsert
+        return ok(`${email} is ${role} in ${org.name}.`);
+    }
+    return fail("Unknown action.");
 }
 // ── handlers ──────────────────────────────────────────────────
 export async function GET(req, ctx) {
     const { path } = await ctx.params;
     const route = path.join("/");
     const q = req.nextUrl.searchParams;
-    const next = safeNext(q.get("next"));
+    const next = safeNext(q.get("next"), req.url);
+    siteName(req); // so <title> carries the app name on every page below
     if (route === "sign-in") {
         if (await currentUser(req))
             return NextResponse.redirect(new URL(next, req.url));
@@ -125,7 +365,13 @@ export async function GET(req, ctx) {
         if (p.reason === "first")
             return NextResponse.redirect(new URL(SIGN_UP_PATH, req.url));
         const error = q.get("error") === "1" ? "Wrong email or password." : (q.get("error") ?? undefined);
-        return html(signInPage({ next, error, canSignUp: p.allowed }));
+        const verify = q.get("verify") === "1";
+        const notice = verify
+            ? "Check your email for a verification link, then sign in."
+            : q.get("verified") === "1"
+                ? "Email verified. Sign in to continue."
+                : undefined;
+        return html(signInPage({ next, error, notice, resend: verify, canSignUp: p.allowed }));
     }
     if (route === "sign-up") {
         if (await currentUser(req))
@@ -138,16 +384,97 @@ export async function GET(req, ctx) {
     if (route === "sign-out")
         return signOutResponse(req, false);
     if (route === "session")
-        return NextResponse.json({ user: await currentUser(req) });
+        return sessionJson(await currentSession(req));
+    if (route === "admin") {
+        const session = await currentSession(req);
+        if (!session)
+            return NextResponse.redirect(new URL(`${SIGN_IN_PATH}?next=${encodeURIComponent(ADMIN_PATH)}`, req.url));
+        if (!isAdmin(session, options().admins)) {
+            return html(messagePage({ title: "Not an admin", message: `Add ${session.user.email} under admins: in b17_auth.yaml to open this page.`, link: { href: "/", text: "Back" } }), 403);
+        }
+        const nonce = randomBytes(16).toString("base64");
+        const orgId = q.get("org");
+        const tab = q.get("tab");
+        const view = orgId ? { tab: "org", orgId } : tab === "users" || tab === "settings" ? { tab } : { tab: "orgs" };
+        return html(await renderAdmin(session.user.email, nonce, view, q.get("notice") ?? undefined, q.get("error") ?? undefined), 200, securityHeaders(nonce));
+    }
+    if (route === "forgot") {
+        return html(forgotPage({ sent: q.get("sent") === "1", message: FORGOT_SENT, error: q.get("error") ?? undefined }));
+    }
+    if (route === "reset") {
+        // Show the form without consuming the token: a mail scanner that
+        // prefetches the link must not burn it.
+        const token = q.get("token") ?? "";
+        if (!token)
+            return html(messagePage({ title: "Link expired", message: RESET_LINK_INVALID, link: { href: FORGOT_PATH, text: "Request a new link" } }), 400);
+        return html(resetPage({ token, error: q.get("error") ?? undefined }));
+    }
+    if (route === "verify") {
+        const token = await consumeToken(q.get("token") ?? "", "verify");
+        const user = token ? await markVerified(token.userId) : null;
+        if (!user) {
+            return html(messagePage({
+                title: "Link expired",
+                message: "This verification link is invalid, already used, or older than 24 hours.",
+                after: resendForm(),
+            }), 400);
+        }
+        const dest = safeNext(typeof token.meta.next === "string" ? token.meta.next : q.get("next"), req.url);
+        // Signed in already (sign-up set the cookie)? Carry on. Otherwise sign in.
+        if (await currentUser(req))
+            return NextResponse.redirect(new URL(dest, req.url), 303);
+        const url = new URL(SIGN_IN_PATH, req.url);
+        url.searchParams.set("verified", "1");
+        if (dest !== "/")
+            url.searchParams.set("next", dest);
+        return NextResponse.redirect(url, 303);
+    }
     return NextResponse.json({ error: "Not found" }, { status: 404 });
 }
 export async function POST(req, ctx) {
     const { path } = await ctx.params;
     const route = path.join("/");
+    siteName(req); // pages rendered from a POST (a failed reset) carry the app name too
+    // Every POST here sets or clears the session cookie, which SameSite
+    // does not protect: another site could sign the visitor in as itself.
+    if (!isSameOrigin(req.headers)) {
+        return NextResponse.json({ error: "Cross-site request refused" }, { status: 403 });
+    }
     if (route === "sign-out")
         return signOutResponse(req, true);
+    if (route === "admin/users" || route === "admin/orgs") {
+        const session = await currentSession(req);
+        if (!session || !isAdmin(session, options().admins)) {
+            return NextResponse.json({ error: session ? "Forbidden" : "Unauthorized" }, { status: session ? 403 : 401 });
+        }
+        const f = await readFields(req);
+        const result = await adminAction(route, session.user.email, f, (user) => sendVerification(req, user, "/"));
+        // After removing an organization there is nothing to return to; otherwise, the view the form was on
+        const back = f.action === "remove-org" ? "" : adminBackTo(f);
+        return adminResult(req, result.ok ? "notice" : "error", result.message, back);
+    }
+    if (route === "session") {
+        // Switch the active organization. The id is the client's wish; the
+        // membership check in setActiveOrg() is what makes it true.
+        const session = await currentSession(req);
+        if (!session)
+            return sessionJson(null);
+        const { organization, json, next } = await readBody(req);
+        if (!(await setActiveOrg(session.user.id, organization))) {
+            return NextResponse.json({ error: "Not a member of that organization" }, { status: 403 });
+        }
+        return json ? sessionJson(await currentSession(req)) : NextResponse.redirect(new URL(next, req.url), 303);
+    }
     if (route === "sign-in") {
         const { email, password, next, json } = await readBody(req);
+        // Count the attempt before checking anything: wrong guesses are the ones that matter
+        const byIp = await rateLimit("signin:ip", clientIp(req.headers));
+        const byEmail = email ? await rateLimit("signin:email", email) : null;
+        const limited = !byIp.allowed ? byIp : byEmail && !byEmail.allowed ? byEmail : null;
+        if (limited) {
+            const canSignUp = (await policy()).allowed;
+            return tooMany(limited, json, (error) => signInPage({ next, error, email, canSignUp }));
+        }
         const row = email && password ? await findUser(email) : null;
         const ok = row ? await verifyPassword(password, row.password_hash) : false;
         if (!row || !ok) {
@@ -155,7 +482,12 @@ export async function POST(req, ctx) {
                 return NextResponse.json({ error: "Wrong email or password" }, { status: 401 });
             return backTo(req, SIGN_IN_PATH, "1", next);
         }
-        return signedIn(req, { id: row.id, email: row.email }, next, json);
+        if (!mayAccess(row.verified_at !== null, options().requireVerified))
+            return checkYourEmail(req, next, json);
+        // A row hashed under older, weaker parameters gets upgraded now that we hold the password
+        if (needsRehash(row.password_hash))
+            await rehashPassword(row.id, await hashPassword(password));
+        return signedIn(req, { id: row.id, email: row.email, epoch: row.epoch }, next, json);
     }
     if (route === "sign-up") {
         const { email, password, invite, next, json } = await readBody(req);
@@ -163,15 +495,87 @@ export async function POST(req, ctx) {
         const fail = (msg, status = 400) => json ? NextResponse.json({ error: msg }, { status }) : backTo(req, SIGN_UP_PATH, msg, next);
         if (!p.allowed)
             return NextResponse.json({ error: "Sign-up is closed" }, { status: 404 });
-        if (p.inviteRequired && invite !== process.env.AUTH_INVITE_CODE)
+        const byIp = await rateLimit("signup:ip", clientIp(req.headers));
+        if (!byIp.allowed)
+            return tooMany(byIp, json, (error) => signUpPage({ next, error, inviteRequired: p.inviteRequired, first: p.reason === "first" }));
+        const o = options();
+        if (p.inviteRequired && !safeEqual(invite, o.inviteCode ?? ""))
             return fail("Wrong invite code.", 403);
-        const invalid = validateCredentials(email, password, process.env);
+        const invalid = validateCredentials(email, password, o);
         if (invalid)
             return fail(invalid);
         if (await findUser(email))
             return fail("That email is already registered.", 409);
-        const user = await createUser(email, await hashPassword(password));
+        let user;
+        try {
+            user = await createUser(email, await hashPassword(password));
+        }
+        catch (err) {
+            // Two sign-ups for one email at the same instant: the check above passed for both, the database let one in
+            if (err instanceof DuplicateUserError)
+                return fail("That email is already registered.", 409);
+            throw err;
+        }
+        const required = o.requireVerified;
+        try {
+            await sendVerification(req, user, next);
+        }
+        catch (err) {
+            // The account exists either way. Only when verification gates
+            // access is a lost email a failure the user must hear about.
+            console.error("[auth] could not send the verification email:", err instanceof Error ? err.message : err);
+            if (required)
+                return fail("Could not send the verification email. Try again later.", 500);
+        }
+        if (required)
+            return checkYourEmail(req, next, json, user);
+        return signedIn(req, user, next, json);
+    }
+    if (route === "forgot") {
+        const { email, json } = await readBody(req);
+        if (email) {
+            const d = await rateLimit("forgot:email", email);
+            if (!d.allowed)
+                return tooMany(d, json, (error) => forgotPage({ error }));
+        }
+        const row = email ? await findUser(email) : null;
+        if (row) {
+            const raw = await issueToken(row.id, "reset", RESET_TTL_SECONDS);
+            await sendEmail(resetEmail(row.email, resetLink(req.url, raw), siteName(req))).catch((err) => console.error("[auth] could not send the reset email:", err instanceof Error ? err.message : err));
+        }
+        // Same answer whether or not the address exists
+        if (json)
+            return NextResponse.json({ ok: true, message: FORGOT_SENT });
+        const url = new URL(FORGOT_PATH, req.url);
+        url.searchParams.set("sent", "1");
+        return NextResponse.redirect(url, 303);
+    }
+    if (route === "reset") {
+        const { token, password, next, json } = await readBody(req);
+        const fail = (msg, status = 400) => json ? NextResponse.json({ error: msg }, { status }) : html(resetPage({ token, error: msg }), status);
+        // Validate before consuming, so a weak password does not burn the link
+        const invalid = validatePassword(password);
+        if (invalid)
+            return fail(invalid);
+        const consumed = await consumeToken(token, "reset");
+        const user = consumed ? await setPasswordById(consumed.userId, await hashPassword(password)) : null;
+        if (!user)
+            return fail(RESET_LINK_INVALID);
         return signedIn(req, user, next, json);
     }
+    if (route === "verify/resend") {
+        const { email, next, json } = await readBody(req);
+        if (email) {
+            const d = await rateLimit("verify:email", email);
+            if (!d.allowed)
+                return tooMany(d, json, (error) => signInPage({ next, error, email, resend: true }));
+        }
+        const row = email ? await findUser(email) : null;
+        if (row && row.verified_at === null) {
+            await sendVerification(req, { id: row.id, email: row.email }, next).catch((err) => console.error("[auth] could not resend the verification email:", err instanceof Error ? err.message : err));
+        }
+        // Same answer whether or not the address exists
+        return json ? NextResponse.json({ ok: true }) : checkYourEmail(req, next, false);
+    }
     return NextResponse.json({ error: "Not found" }, { status: 404 });
 }

package/dist/next/proxy.d.ts

@@ -1,5 +1,6 @@
 import { NextResponse, type NextRequest } from "next/server.js";
+import { MATCHER } from "../core/guard.ts";
 /** Paste this into proxy.ts as `export const config = { matcher: MATCHER }` */
-export declare const MATCHER: string[];
+export { MATCHER };
 export declare function proxy(request: NextRequest): Promise<NextResponse>;
 export default proxy;