@byline/core 5.0.0 → 5.1.0

package/dist/@types/site-config.d.ts

@@ -5,7 +5,7 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-import type { SessionProvider } from '@byline/auth';
+import type { PasswordSignInProtection, SessionProvider } from '@byline/auth';
 import type { RecurringTaskDefinition } from '../scheduler/types.js';
 import type { SlugifierFn } from '../utils/slugify.js';
 import type { FilenameSlugifierFn } from '../utils/slugify-filename.js';
@@ -351,6 +351,8 @@ export interface ServerConfig<TAdminStore = unknown> extends BaseConfig {
      * ```
      */
     sessionProvider?: SessionProvider;
+    /** Required by the host password sign-in endpoint; shared limiter and trusted IP resolver. */
+    passwordSignIn?: PasswordSignInProtection;
     /**
      * Adapter-built bundle of admin repositories (users / roles /
      * permissions / refresh tokens). Typically constructed via the

package/dist/core.js

@@ -83,7 +83,11 @@ export const initBylineCore = async (config, pinoLogger) => {
             },
         });
     }
-    validateSchedulerConfig({ tasks: configuredTasks, adapter: composed.db });
+    validateSchedulerConfig({
+        tasks: configuredTasks,
+        adapter: composed.db,
+        passwordSignIn: resolvedConfig.passwordSignIn,
+    });
     // Freeze a snapshot of the validated task set: a new array of new, frozen
     // objects, then freeze the array itself. Without this, `core.recurringTasks`
     // would hold the caller's own array and definition objects, so a caller

package/dist/scheduler/scheduler-boot.test.node.js

@@ -26,6 +26,20 @@ const task = defineRecurringTask({
     run: async () => { },
 });
 describe('initBylineCore scheduler wiring', () => {
+    it('rejects missing password-sign-in cleanup registration before database initialization', async () => {
+        const config = serverConfig(testAdapter({}));
+        config.passwordSignIn = {
+            resolveClientIp: () => '192.0.2.1',
+            limiter: {
+                requiredCleanupTask: 'auth.sign-in-counters.cleanup',
+                acquire: async () => () => { },
+                consume: async () => ({ allowed: true, retryAfterSeconds: 0 }),
+            },
+        };
+        await expect(initBylineCore(config, {})).rejects.toThrow(/Register the limiter's cleanupTask/);
+        config.recurringTasks = [{ ...task, name: 'auth.sign-in-counters.cleanup' }];
+        await expect(initBylineCore(config, {})).rejects.toThrow(/scheduler capability/);
+    });
     it('rejects recurring tasks registered against an adapter without the scheduler capability', async () => {
         const config = serverConfig(testAdapter({}));
         config.recurringTasks = [task];

package/dist/scheduler/validate-scheduler-config.d.ts

@@ -5,6 +5,7 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
+import type { PasswordSignInProtection } from '@byline/auth';
 import type { ISchedulerStore, RecurringTaskDefinition } from './types.js';
 /**
  * Boot-time gate. Recurring tasks registered against an adapter that does not
@@ -12,6 +13,7 @@ import type { ISchedulerStore, RecurringTaskDefinition } from './types.js';
  * fails loudly at `initBylineCore()` instead.
  */
 export declare function validateSchedulerConfig(params: {
+    passwordSignIn?: PasswordSignInProtection;
     tasks?: readonly RecurringTaskDefinition[];
     adapter: {
         scheduler?: ISchedulerStore;

package/dist/scheduler/validate-scheduler-config.js

@@ -13,6 +13,11 @@ import { validateRecurringTasks } from './validate-tasks.js';
  */
 export function validateSchedulerConfig(params) {
     const tasks = params.tasks ?? [];
+    const cleanup = params.passwordSignIn?.limiter.requiredCleanupTask;
+    if (cleanup && !tasks.some((task) => task.name === cleanup)) {
+        throw new Error(`Password sign-in requires recurring task "${cleanup}". Register the limiter's cleanupTask ` +
+            'in recurringTasks and start the host scheduler (or invoke runDueTasks externally).');
+    }
     if (tasks.length === 0)
         return;
     validateRecurringTasks(tasks);

package/dist/scheduler/validate-scheduler-config.test.node.js

@@ -16,6 +16,22 @@ const task = defineRecurringTask({
 });
 const store = {};
 describe('validateSchedulerConfig', () => {
+    it('accepts matching cleanup registration and permits self-expiring custom limiters', () => {
+        const passwordSignIn = {
+            resolveClientIp: () => '192.0.2.1',
+            limiter: {
+                requiredCleanupTask: task.name,
+                acquire: async () => () => { },
+                consume: async () => ({ allowed: true, retryAfterSeconds: 0 }),
+            },
+        };
+        expect(() => validateSchedulerConfig({ passwordSignIn, tasks: [task], adapter: { scheduler: store } })).not.toThrow();
+        const { requiredCleanupTask: _, ...ttlLimiter } = passwordSignIn.limiter;
+        expect(() => validateSchedulerConfig({
+            passwordSignIn: { ...passwordSignIn, limiter: ttlLimiter },
+            adapter: {},
+        })).not.toThrow();
+    });
     it('passes when tasks are registered against a scheduler-capable adapter', () => {
         expect(() => validateSchedulerConfig({ tasks: [task], adapter: { scheduler: store } })).not.toThrow();
     });

package/dist/validation/password-sign-in.test.node.d.ts

@@ -0,0 +1,8 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export {};

package/dist/validation/password-sign-in.test.node.js

@@ -0,0 +1,21 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { describe, expect, it } from 'vitest';
+import { passwordSchema, passwordSignInSchema } from './shared.js';
+describe('password sign-in validation', () => {
+    it('accepts legacy credentials without imposing enrollment policy', () => {
+        expect(passwordSchema.safeParse('legacy').success).toBe(false);
+        expect(passwordSignInSchema.parse({ email: ' Admin@Example.com ', password: 'legacy' })).toEqual({ email: 'admin@example.com', password: 'legacy' });
+    });
+    it('shares the enrollment maximum without trimming passwords', () => {
+        expect(passwordSignInSchema.parse({ email: 'a', password: ' '.repeat(128) }).password).toHaveLength(128);
+        for (const password of ['', 'a'.repeat(129)])
+            expect(passwordSignInSchema.safeParse({ email: 'a', password }).success).toBe(false);
+        expect(passwordSignInSchema.safeParse({ email: 'a'.repeat(255), password: 'valid' }).success).toBe(false);
+    });
+});

package/dist/validation/shared.d.ts

@@ -5,17 +5,6 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-/**
- * Generic Zod helpers shared across packages.
- *
- * Kept separate from `@byline/core/zod-schemas` (which hosts the
- * collection-builder Zod machinery) so the purpose of each subpath
- * stays clear. Ported from `@infonomic/shared` — the organisation's
- * standard schema set, re-declared here so Byline has no external
- * dependency on that package.
- *
- * Pure Zod — no runtime side effects, client-safe.
- */
 import { z } from 'zod';
 /**
  * Stable error codes emitted by `passwordSchema`. The schema yields
@@ -53,3 +42,8 @@ export declare const passwordSchema: z.ZodString;
  * directly.
  */
 export declare const uuidSchema: z.ZodUUID;
+/** Login accepts existing passwords regardless of current enrollment complexity policy. */
+export declare const passwordSignInSchema: z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+}, z.core.$strip>;

package/dist/validation/shared.js

@@ -16,6 +16,7 @@
  *
  * Pure Zod — no runtime side effects, client-safe.
  */
+import { MAX_PASSWORD_LENGTH, MAX_SIGN_IN_EMAIL_LENGTH } from '@byline/auth';
 import { z } from 'zod';
 /**
  * Stable error codes emitted by `passwordSchema`. The schema yields
@@ -49,7 +50,7 @@ export const PASSWORD_ERROR_CODES = {
 export const passwordSchema = z
     .string()
     .min(8, PASSWORD_ERROR_CODES.TOO_SHORT)
-    .max(128, PASSWORD_ERROR_CODES.TOO_LONG)
+    .max(MAX_PASSWORD_LENGTH, PASSWORD_ERROR_CODES.TOO_LONG)
     .regex(/^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[#?!@$%^&*-]).{8,}$/, PASSWORD_ERROR_CODES.COMPLEXITY);
 /**
  * UUID with a descriptive error message. Equivalent to `z.uuid()` but
@@ -59,3 +60,8 @@ export const passwordSchema = z
 export const uuidSchema = z.uuid({
     message: 'Invalid UUID format. Must be a 36-character hex string with hyphens (e.g., 123e4567-e89b-12d3-a456-426614174000)',
 });
+/** Login accepts existing passwords regardless of current enrollment complexity policy. */
+export const passwordSignInSchema = z.object({
+    email: z.string().max(MAX_SIGN_IN_EMAIL_LENGTH).trim().min(1).toLowerCase(),
+    password: z.string().min(1).max(MAX_PASSWORD_LENGTH),
+});

package/package.json

@@ -2,7 +2,7 @@
   "name": "@byline/core",
   "private": false,
   "license": "MPL-2.0",
-  "version": "5.0.0",
+  "version": "5.1.0",
   "engines": {
     "node": ">=20.9.0"
   },
@@ -86,19 +86,19 @@
     "pino": "^10.3.1",
     "sharp": "^0.35.4",
     "uuid": "^14.0.2",
-    "zod": "^4.4.3",
-    "@byline/auth": "5.0.0"
+    "zod": "^4.5.4",
+    "@byline/auth": "5.1.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.10",
-    "@types/node": "^26.4.0",
+    "@biomejs/biome": "2.5.12",
+    "@types/node": "^26.5.0",
     "chokidar": "^5.0.0",
     "chokidar-cli": "^3.0.0",
     "npm-run-all": "^4.1.5",
-    "tsc-alias": "^1.9.2",
-    "tsx": "^4.23.12",
+    "tsc-alias": "^1.9.4",
+    "tsx": "^4.23.13",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.0"
   },
   "publishConfig": {
     "access": "public",