@devmoods/express-extras 0.73.0 → 0.74.0

package/dist/auth/emailAndPassword.js

@@ -6,7 +6,7 @@ import {} from './types.js';
 import { Unauthorized } from '../errors.js';
 import { getLogger } from '../logger.js';
 import { jsonSchema } from '../validate.js';
-const passwordSchema = { type: 'string', minLength: 4 };
+const passwordSchema = { type: 'string', minLength: 8 };
 const emailSchema = { type: 'string', minLength: 4 };
 const logger = getLogger('auth');
 export function EmailAndPasswordAuthProvider(options) {
@@ -35,7 +35,7 @@ export function EmailAndPasswordAuthProvider(options) {
                 catch (error) {
                     logger.error(error);
                     await context.jitter(timer.getDuration());
-                    throw Unauthorized(error.message, { cause: error });
+                    throw Unauthorized('Invalid email or password', { cause: error });
                 }
             });
             router.post('/change-password', {
@@ -73,11 +73,18 @@ export function EmailAndPasswordAuthProvider(options) {
             }, async (req) => {
                 const { email } = req.body;
                 const timer = startTimer();
-                const user = await options.login(email, skipPasswordCheck);
-                const temporaryToken = await context.createTemporaryToken(user);
-                await options.onEmailVerificationRequest?.(user, temporaryToken);
-                await context.jitter(timer.getDuration());
-                return 202;
+                try {
+                    const user = await options.login(email, skipPasswordCheck);
+                    const temporaryToken = await context.createTemporaryToken(user);
+                    await options.onEmailVerificationRequest?.(user, temporaryToken);
+                    await context.jitter(timer.getDuration());
+                    return 202;
+                }
+                catch (error) {
+                    logger.error(error);
+                    await context.jitter(timer.getDuration());
+                    return 202;
+                }
             });
             router.post('/verify-email', {
                 request: jsonSchema({
@@ -93,7 +100,6 @@ export function EmailAndPasswordAuthProvider(options) {
                 }
                 catch (error) {
                     logger.warn('failed to verify token', {
-                        token,
                         user: context.filterUser(user),
                         error: error.message,
                     });

package/dist/auth/google.d.ts

@@ -7,7 +7,8 @@ interface GoogleAuthProviderOptions<UserModel = AnyUser> {
     clientId?: string;
     clientSecret?: string;
     redirectUri?: string;
+    hostedDomain?: string;
     getOrCreateUserFromUserIdentifier(userIdentifier: string, profile: GoogleProfile): Promise<UserModel>;
 }
-export declare function GoogleAuthProvider<UserModel extends AnyUser>({ clientId, clientSecret, redirectUri, getOrCreateUserFromUserIdentifier }: GoogleAuthProviderOptions<UserModel>): AuthProvider<UserModel>;
+export declare function GoogleAuthProvider<UserModel extends AnyUser>({ clientId, clientSecret, redirectUri, hostedDomain, getOrCreateUserFromUserIdentifier }: GoogleAuthProviderOptions<UserModel>): AuthProvider<UserModel>;
 export {};

package/dist/auth/google.js

@@ -1,12 +1,12 @@
 import { config } from '@devmoods/config';
 import { type } from 'arktype';
 import { OAuth2Client } from 'google-auth-library';
-import { BadRequest, Unauthorized } from '../errors.js';
-import { getLogger } from '../logger.js';
 import { createTokenResponse } from './token.js';
 import {} from './types.js';
+import { BadRequest, Unauthorized } from '../errors.js';
+import { getLogger } from '../logger.js';
 const logger = getLogger('auth');
-export function GoogleAuthProvider({ clientId = config.GOOGLE_AUTH_CLIENT_ID, clientSecret = config.GOOGLE_AUTH_CLIENT_SECRET, redirectUri = `${config.PUBLIC_URL}/api/v1/auth/google/callback`, getOrCreateUserFromUserIdentifier, }) {
+export function GoogleAuthProvider({ clientId = config.GOOGLE_AUTH_CLIENT_ID, clientSecret = config.GOOGLE_AUTH_CLIENT_SECRET, redirectUri = `${config.PUBLIC_URL}/api/v1/auth/google/callback`, hostedDomain, getOrCreateUserFromUserIdentifier, }) {
     const client = new OAuth2Client({
         clientId,
         clientSecret,
@@ -79,10 +79,18 @@ export function GoogleAuthProvider({ clientId = config.GOOGLE_AUTH_CLIENT_ID, cl
                     throw Unauthorized('Invalid id token');
                 }
                 const payload = await verifyIdToken(idToken);
-                logger.info('google payload', { payload });
-                const user = await getOrCreateUserFromUserIdentifier(payload?.sub, {
+                if (!payload.sub) {
+                    throw Unauthorized('Token from Google is missing subject');
+                }
+                if (!payload.email || payload.email_verified !== true) {
+                    throw Unauthorized('Token from Google contains unverified email');
+                }
+                if (hostedDomain && payload.hd !== hostedDomain) {
+                    throw Unauthorized('Token from Google contains invalid hosted domain');
+                }
+                const user = await getOrCreateUserFromUserIdentifier(payload.sub, {
                     email: payload.email,
-                    fullName: payload.name,
+                    fullName: payload.name ?? '',
                 });
                 const accessToken = await context.login(req, res, user);
                 logger.info('google-login', { email: user.email });

package/dist/auth/passwordless.d.ts

@@ -1,6 +1,6 @@
 import { type AnyUser, type AuthProvider } from './types.js';
 export interface PasswordlessAuthProviderOptions<UserModel = AnyUser> {
     getUserByEmail(email: string): Promise<UserModel | null>;
-    onLoginRequest(user: UserModel, temporaryToken: string, otp: string): Promise<void>;
+    onLoginRequest(user: UserModel, challengeId: string, temporaryToken: string, otp: string): Promise<void>;
 }
 export declare function PasswordlessAuthProvider<UserModel extends AnyUser>(options: PasswordlessAuthProviderOptions<UserModel>): AuthProvider<UserModel>;

package/dist/auth/passwordless.js

@@ -1,6 +1,8 @@
+import * as crypto from 'node:crypto';
 import { DoesNotExistError } from '@devmoods/postgres';
 import { createTokenResponse } from './token.js';
 import {} from './types.js';
+import { BadRequest } from '../errors.js';
 import { getLogger } from '../logger.js';
 import { jsonSchema } from '../validate.js';
 const logger = getLogger('auth');
@@ -25,20 +27,30 @@ export function PasswordlessAuthProvider(options) {
                     type: 'object',
                     properties: {
                         type: { type: 'string', enum: ['otp', 'token'] },
+                        challengeId: { type: 'string' },
                         otp: { type: 'string' },
                         token: { type: 'string' },
                     },
                     required: ['type'],
                 }),
             }, async (req, res) => {
-                const { token: temporaryToken, otp, type: tokenType } = req.body;
-                const verify = tokenType === 'otp'
-                    ? context.verifyOtp
-                    : context.verifyTemporaryToken;
-                const tokenValue = String(tokenType === 'otp' ? otp : temporaryToken);
-                const uid = await verify(tokenValue, null, false);
+                const { challengeId, token: temporaryToken, otp, type: tokenType, } = req.body;
+                if (tokenType === 'otp' && (!challengeId || !otp)) {
+                    throw BadRequest('OTP logins require challengeId and otp');
+                }
+                if (tokenType === 'token' && !temporaryToken) {
+                    throw BadRequest('Token logins require token');
+                }
+                const uid = tokenType === 'otp'
+                    ? await context.verifyOtp(String(challengeId), String(otp), null, false)
+                    : await context.verifyTemporaryToken(String(temporaryToken), null, false);
                 const user = await context.getUserById(uid);
-                await verify(tokenValue, user);
+                if (tokenType === 'otp') {
+                    await context.verifyOtp(String(challengeId), String(otp), user);
+                }
+                else {
+                    await context.verifyTemporaryToken(String(temporaryToken), user);
+                }
                 const accessToken = await context.login(req, res, user);
                 logger.info('passwordless login', { tokenType, uid: user.id });
                 if (req.accepts('html')) {
@@ -62,13 +74,13 @@ export function PasswordlessAuthProvider(options) {
                 const user = await getUserOrNull(email);
                 if (!user) {
                     logger.warn('passwordless: user not found', { email });
-                    return 202;
+                    return [202, { challengeId: crypto.randomUUID() }];
                 }
                 const token = await context.createTemporaryToken(user);
-                const otp = await context.createOtp(user);
-                await options.onLoginRequest(user, token, otp);
+                const { challengeId, otp } = await context.createOtp(user);
+                await options.onLoginRequest(user, challengeId, token, otp);
                 logger.info('passwordless login requested', { email });
-                return 202;
+                return [202, { challengeId }];
             });
         },
     };

package/dist/auth/token.js

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto';
 import { config } from '@devmoods/config';
 import {} from 'express';
 import { SignJWT, jwtVerify } from 'jose';
@@ -27,7 +28,7 @@ export function createTokenResponse(accessToken) {
 export async function createAccessToken(payload, version = '1', secret = config.AUTH_JWT_SECRET) {
     const expiresIn = config.AUTH_TOKEN_EXPIRES;
     const secretKey = new TextEncoder().encode(secret);
-    const token = await new SignJWT({ v: version, ...payload })
+    const token = await new SignJWT({ jti: randomUUID(), v: version, ...payload })
         .setProtectedHeader({ alg: 'HS256' })
         .setExpirationTime(`${expiresIn}s`)
         .setIssuedAt(new Date())

package/dist/auth/tokenStorage.d.ts

@@ -1,5 +1,5 @@
-import { type RedisClient } from '../redis.js';
 import { TokenStorage } from './types.js';
+import { type RedisClient } from '../redis.js';
 export declare class RedisTokenStorage extends TokenStorage {
     redis: RedisClient;
     keyPrefix: string;

package/dist/auth/tokenStorage.js

@@ -1,6 +1,6 @@
 import { config } from '@devmoods/config';
-import {} from '../redis.js';
 import { TokenStorage } from './types.js';
+import {} from '../redis.js';
 export class RedisTokenStorage extends TokenStorage {
     redis;
     keyPrefix;

package/dist/auth/types.d.ts

@@ -31,6 +31,10 @@ export interface DecodedTemporaryToken {
     };
     signature: string;
 }
+export interface OtpChallenge {
+    challengeId: string;
+    otp: string;
+}
 export interface AuthProviderContext<UserModel extends AnyUser> {
     filterUser: AuthOptions<UserModel>['filterUser'];
     tokenStorage: AuthOptions<UserModel>['tokenStorage'];
@@ -38,8 +42,8 @@ export interface AuthProviderContext<UserModel extends AnyUser> {
     createTemporaryToken(user: UserModel | null): Promise<string>;
     verifyTemporaryToken(token: string, user: UserModel | null, consume?: boolean): Promise<string>;
     decodeTemporaryToken(token: string): DecodedTemporaryToken;
-    createOtp(user: UserModel): Promise<string>;
-    verifyOtp(otp: string, user: UserModel | null, consume?: boolean): Promise<string>;
+    createOtp(user: UserModel): Promise<OtpChallenge>;
+    verifyOtp(challengeId: string, otp: string, user: UserModel | null, consume?: boolean): Promise<string>;
     middleware: (options?: AuthMiddlewareOptions<UserModel>) => RequestHandler;
     login: (req: Request, res: Response, user: UserModel, isRefresh?: boolean) => Promise<AccessToken>;
     getUserById(id: string): Promise<UserModel>;

package/dist/auth.d.ts

@@ -1,5 +1,5 @@
 import { type RequestHandler, type Response, type Request, type Router } from 'express';
-import { type AnyUser, type AuthIsAllowedFn, type AuthMiddlewareOptions, type AuthOptions, type DecodedTemporaryToken } from './auth/types.js';
+import { type AnyUser, type AuthIsAllowedFn, type AuthMiddlewareOptions, type AuthOptions, type DecodedTemporaryToken, type OtpChallenge } from './auth/types.js';
 export * from './auth/types.js';
 export * from './auth/emailAndPassword.js';
 export * from './auth/passwordless.js';
@@ -15,8 +15,8 @@ export interface CreateAuth<UserModel extends AnyUser> {
     createTemporaryToken(user: UserModel | null): Promise<string>;
     verifyTemporaryToken(token: string, user: UserModel | null, consume?: boolean): Promise<string>;
     decodeTemporaryToken(token: string): DecodedTemporaryToken;
-    createOtp(user: UserModel): Promise<string>;
-    verifyOtp(otp: string, user: UserModel | null, consume?: boolean): Promise<string>;
+    createOtp(user: UserModel): Promise<OtpChallenge>;
+    verifyOtp(challengeId: string, otp: string, user: UserModel | null, consume?: boolean): Promise<string>;
     logout: (req: Request, res: Response) => Promise<void>;
     setSessionTokenVersion: (version: string) => void;
 }

package/dist/auth.js

@@ -17,14 +17,27 @@ export * from './auth/token.js';
 export * from './auth/google.js';
 export * from './auth/tokenStorage.js';
 const sha256 = (value) => crypto.createHash('sha256').update(value).digest('hex');
+const hashEquals = (left, right) => {
+    const leftBuffer = Buffer.from(left, 'hex');
+    const rightBuffer = Buffer.from(right, 'hex');
+    if (leftBuffer.length !== rightBuffer.length) {
+        return false;
+    }
+    return crypto.timingSafeEqual(leftBuffer, rightBuffer);
+};
 export function createAuth({ getUserById, filterUser, tokenStorage, providers, loginUrl = '/', onUserLoggedIn, sessionTokenVersion: initialSessionTokenVersion = '1', }) {
     let sessionTokenVersion = initialSessionTokenVersion;
     const useCurrentUser = () => useRequestContext('currentUser');
     const setCurrentUser = (user) => setRequestContext('currentUser', user);
     const login = async (req, res, user, isRefresh = false) => {
+        const previousToken = isRefresh ? extractAccessTokenFromRequest(req) : null;
+        const previousSessionId = previousToken ? sha256(previousToken) : null;
         const accessToken = await createAccessToken({ uid: user.id }, sessionTokenVersion);
         const sessionId = sha256(accessToken.token);
         await tokenStorage.set(sessionId, String(user.id), accessToken.expiresIn);
+        if (previousSessionId && previousSessionId !== sessionId) {
+            await tokenStorage.invalidate(previousSessionId);
+        }
         setAccessTokenCookie(res, accessToken.token);
         setCurrentUser(user);
         if (!isRefresh) {
@@ -161,7 +174,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
                     if (req.accepts('html')) {
                         return res.redirect(loginUrl);
                     }
-                    return next(Unauthorized(`Invalid token: ${error.message}`, { cause: error }));
+                    return next(Unauthorized('Invalid token', { cause: error }));
                 }
                 /* v8 ignore next -- @preserve */
                 next(error);
@@ -171,6 +184,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
     function protect(isAuthorized) {
         return async function authorizationMiddleware(req, res, next) {
             try {
+                // oxlint-disable-next-line eslint-plugin-react-hooks/rules-of-hooks
                 const user = useCurrentUser();
                 if (!user) {
                     throw new InvalidToken('User not logged in');
@@ -202,22 +216,48 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
     }
     async function createOtp(user) {
         const otp = crypto.randomInt(100000, 999999).toString();
-        await tokenStorage.set(otp, String(user.id), config.AUTH_OTP_EXPIRES);
-        return otp;
+        const challengeId = crypto.randomUUID();
+        const otpHash = sha256(otp);
+        await tokenStorage.set(`otp:${challengeId}`, JSON.stringify({
+            uid: String(user.id),
+            otpHash,
+            attempts: 0,
+            maxAttempts: config.AUTH_OTP_MAX_ATTEMPTS,
+        }), config.AUTH_OTP_EXPIRES);
+        return { challengeId, otp };
     }
-    async function verifyOtp(otp, user, consume = true) {
-        const storedUid = await tokenStorage.get(otp);
-        if (!storedUid) {
+    async function verifyOtp(challengeId, otp, user, consume = true) {
+        const storedChallenge = await tokenStorage.get(`otp:${challengeId}`);
+        if (!storedChallenge) {
             throw new InvalidToken('Invalid OTP');
         }
-        /* c8 ignore next 3 */
-        if (user && storedUid !== user.id) {
+        let parsedChallenge;
+        try {
+            parsedChallenge = JSON.parse(storedChallenge);
+        }
+        catch (error) {
+            await tokenStorage.invalidate(`otp:${challengeId}`);
+            throw new InvalidToken('Invalid OTP', { cause: error });
+        }
+        if (user && parsedChallenge.uid !== String(user.id)) {
+            throw new InvalidToken('Invalid OTP');
+        }
+        const attemptedOtpHash = sha256(otp);
+        const matches = hashEquals(parsedChallenge.otpHash, attemptedOtpHash);
+        if (!matches) {
+            const attempts = parsedChallenge.attempts + 1;
+            if (attempts >= parsedChallenge.maxAttempts) {
+                await tokenStorage.invalidate(`otp:${challengeId}`);
+            }
+            else {
+                await tokenStorage.set(`otp:${challengeId}`, JSON.stringify({ ...parsedChallenge, attempts }), config.AUTH_OTP_EXPIRES);
+            }
             throw new InvalidToken('Invalid OTP');
         }
         if (consume) {
-            await tokenStorage.invalidate(otp);
+            await tokenStorage.invalidate(`otp:${challengeId}`);
         }
-        return storedUid;
+        return parsedChallenge.uid;
     }
     /**
      * Create a short-lived token tied to a user that can be

package/dist/cache.d.ts

@@ -3,16 +3,37 @@ export interface CacheOptions {
     key?: string;
     expiresMs?: number | null;
 }
-export interface CacheAdapter {
-    get(key: string): Promise<any>;
-    set(key: string, value: any, expires?: number | null | undefined): Promise<void>;
-    clear(key?: string): Promise<void>;
+export declare abstract class CacheAdapter {
+    abstract get(key: string): Promise<any>;
+    abstract set(key: string, value: any, expires?: number | null | undefined): Promise<void>;
+    abstract clear(key?: string): Promise<void>;
 }
 export interface RedisCacheAdapterOptions {
     keyPrefix?: string;
 }
+export interface MemoryCacheAdapterOptions {
+    maxSize?: number;
+}
+export declare class RedisCacheAdapter extends CacheAdapter {
+    redis: RedisClient;
+    keyPrefix: string;
+    constructor(redis: RedisClient, { keyPrefix }?: RedisCacheAdapterOptions);
+    get(key: string): Promise<any>;
+    set(key: string, value: unknown, expires?: number | null): Promise<void>;
+    clear(key?: string): Promise<void>;
+    private withKeyPrefix;
+}
 export declare function createRedisCacheAdapter(redis: RedisClient, options?: RedisCacheAdapterOptions): CacheAdapter;
-export declare function createMemoryCacheAdapter(): CacheAdapter;
+export declare class MemoryCacheAdapter extends CacheAdapter {
+    #private;
+    maxSize?: number;
+    constructor({ maxSize }?: MemoryCacheAdapterOptions);
+    get(key: string): Promise<unknown>;
+    set(key: string, value: unknown, expires?: number): Promise<void>;
+    clear(key?: string): Promise<void>;
+    private evictLeastRecentlyUsedEntries;
+}
+export declare function createMemoryCacheAdapter(options?: MemoryCacheAdapterOptions): CacheAdapter;
 export type Cache = ReturnType<typeof createCache>;
 export declare function createCache(adapter: CacheAdapter): {
     set: (key: string, value: any, expires?: number | null | undefined) => Promise<void>;

package/dist/cache.js

@@ -1,62 +1,116 @@
 import { config } from '@devmoods/config';
 import {} from './redis.js';
-export function createRedisCacheAdapter(redis, options = {}) {
-    const { keyPrefix = `${config.REDIS_KEY_PREFIX}cache:` } = options;
-    const withKeyPrefix = (key) => `${keyPrefix}${key}`;
-    return {
-        async get(key) {
-            const value = await redis.get(withKeyPrefix(key));
-            if (value == null) {
-                return null;
-            }
-            return JSON.parse(value);
-        },
-        async set(key, value, expires) {
-            await redis.set(withKeyPrefix(key), JSON.stringify(value), {
-                PX: expires,
+const MAX_CACHE_KEY_SIZE_BYTES = 256;
+export class CacheAdapter {
+}
+export class RedisCacheAdapter extends CacheAdapter {
+    redis;
+    keyPrefix;
+    constructor(redis, { keyPrefix = `${config.REDIS_KEY_PREFIX}cache:`, } = {}) {
+        super();
+        this.redis = redis;
+        this.keyPrefix = keyPrefix;
+    }
+    async get(key) {
+        const value = await this.redis.get(this.withKeyPrefix(key));
+        if (value == null) {
+            return null;
+        }
+        return JSON.parse(value);
+    }
+    async set(key, value, expires) {
+        const serializedValue = JSON.stringify(value);
+        if (expires == null) {
+            await this.redis.set(this.withKeyPrefix(key), serializedValue);
+            return;
+        }
+        await this.redis.set(this.withKeyPrefix(key), serializedValue, {
+            PX: expires,
+        });
+    }
+    async clear(key) {
+        if (key) {
+            await this.redis.del(this.withKeyPrefix(key));
+            return;
+        }
+        let cursor = '0';
+        const pattern = `${this.keyPrefix}*`;
+        do {
+            const result = await this.redis.scan(cursor, {
+                MATCH: pattern,
+                COUNT: 100,
             });
-        },
-        async clear(key) {
-            if (key) {
-                await redis.del(withKeyPrefix(key));
-            }
-            const keys = await redis.keys(`${keyPrefix}*`);
-            for (const existingKey of keys) {
-                await redis.del(existingKey);
+            cursor = result.cursor;
+            /* v8 ignore next -- @preserve */
+            if (result.keys.length > 0) {
+                await this.redis.unlink(result.keys);
             }
-        },
-    };
+        } while (cursor !== '0');
+    }
+    withKeyPrefix(key) {
+        return `${this.keyPrefix}${key}`;
+    }
 }
-export function createMemoryCacheAdapter() {
-    const cache = new Map();
-    return {
-        async get(key) {
-            const entry = cache.get(key);
-            if (entry == null) {
-                return null;
-            }
-            const [value, expires] = entry;
-            if (expires != null && Date.now() >= expires) {
-                cache.delete(key);
-                return null;
-            }
-            return value;
-        },
-        async set(key, value, expires) {
-            cache.set(key, [value, expires == null ? null : Date.now() + expires]);
-        },
-        async clear(key) {
-            if (key) {
-                cache.delete(key);
-            }
-            else {
-                cache.clear();
+export function createRedisCacheAdapter(redis, options = {}) {
+    return new RedisCacheAdapter(redis, options);
+}
+export class MemoryCacheAdapter extends CacheAdapter {
+    maxSize;
+    #cache = new Map();
+    constructor({ maxSize } = {}) {
+        super();
+        this.maxSize = maxSize;
+    }
+    async get(key) {
+        const entry = this.#cache.get(key);
+        if (entry == null) {
+            return null;
+        }
+        const [value, expires] = entry;
+        if (expires != null && Date.now() >= expires) {
+            this.#cache.delete(key);
+            return null;
+        }
+        // Mark as recently used by deleting the entry and adding it back to the cache
+        this.#cache.delete(key);
+        this.#cache.set(key, entry);
+        return value;
+    }
+    async set(key, value, expires) {
+        this.#cache.delete(key);
+        this.#cache.set(key, [
+            value,
+            expires == null ? null : Date.now() + expires,
+        ]);
+        this.evictLeastRecentlyUsedEntries();
+    }
+    async clear(key) {
+        if (key) {
+            this.#cache.delete(key);
+        }
+        else {
+            this.#cache.clear();
+        }
+    }
+    evictLeastRecentlyUsedEntries() {
+        if (this.maxSize == null) {
+            return;
+        }
+        while (this.#cache.size > this.maxSize) {
+            const oldestKey = this.#cache.keys().next().value;
+            if (oldestKey == null) {
+                return;
             }
-        },
-    };
+            this.#cache.delete(oldestKey);
+        }
+    }
+}
+export function createMemoryCacheAdapter(options = {}) {
+    return new MemoryCacheAdapter(options);
 }
 export function createCache(adapter) {
     async function cached(key, options, fn) {
+        assertCacheKeySize(key);
         const cachedValue = await adapter.get(key);
         if (cachedValue != null) {
             return cachedValue;
@@ -73,7 +127,9 @@ export function createCache(adapter) {
             const baseKey = typeof options === 'object' && options != null
                 ? options.key
                 : undefined;
-            return `${baseKey ?? Buffer.from(fn.toString()).toString('hex')}-${hashKey(args)}`;
+            const cacheKey = `${baseKey ?? Buffer.from(fn.toString()).toString('hex')}-${hashKey(args)}`;
+            assertCacheKeySize(cacheKey);
+            return cacheKey;
         };
         const wrapped = async (...args) => {
             const cacheKey = getCacheKey(...args);
@@ -101,21 +157,28 @@ export function createCache(adapter) {
     };
 }
 function hashKey(obj) {
-    return JSON.stringify(obj, (key, value) => {
-        if (value === null || value === undefined) {
-            return String(value);
-        }
-        if (typeof value === 'object') {
-            if (Array.isArray(value)) {
-                return value;
-            }
-            return Object.keys(value)
-                .sort()
-                .reduce((result, item) => {
-                result[item] = value[item];
-                return result;
-            }, {});
+    return JSON.stringify(obj, (_, value) => {
+        if (!isPlainObject(value)) {
+            return value;
         }
-        return value;
+        return Object.keys(value)
+            .sort()
+            .reduce((result, key) => {
+            result[key] = value[key];
+            return result;
+        }, {});
     });
 }
+function assertCacheKeySize(key) {
+    if (Buffer.byteLength(key, 'utf8') <= MAX_CACHE_KEY_SIZE_BYTES) {
+        return;
+    }
+    throw new Error(`Cache key exceeds ${MAX_CACHE_KEY_SIZE_BYTES} bytes. Provide a shorter explicit key or reduce the size of the cache arguments.`);
+}
+function isPlainObject(value) {
+    if (Object.prototype.toString.call(value) !== '[object Object]') {
+        return false;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === null || prototype === Object.prototype;
+}

package/dist/composeMiddleware.js

@@ -20,14 +20,14 @@ function generate(handlers) {
     const stack = handlers.flat();
     return function middleware(err, req, res, done) {
         let index = -1;
-        // eslint-disable-next-line @typescript-eslint/no-shadow
+        // oxlint-disable-next-line @typescript-eslint/no-shadow
         function dispatch(pos, err) {
             const handler = stack[pos];
             index = pos;
             if (index === stack.length) {
                 return done(err);
             }
-            // eslint-disable-next-line @typescript-eslint/no-shadow
+            // oxlint-disable-next-line @typescript-eslint/no-shadow
             function next(err) {
                 /* v8 ignore next -- @preserve */
                 if (pos < index) {

package/dist/config.d.ts

@@ -9,6 +9,7 @@ declare const app: Defs<{
     AUTH_TOKEN_EXPIRES: number;
     AUTH_TEMP_TOKEN_EXPIRES: number;
     AUTH_OTP_EXPIRES: number;
+    AUTH_OTP_MAX_ATTEMPTS: number;
     AUTH_JWT_SECRET: string;
     AUTH_COOKIE_SAME_SITE: string;
     REDIS_URL: string;
@@ -41,6 +42,7 @@ export declare const config: import("@devmoods/config").Defs<{
     AUTH_TOKEN_EXPIRES: number;
     AUTH_TEMP_TOKEN_EXPIRES: number;
     AUTH_OTP_EXPIRES: number;
+    AUTH_OTP_MAX_ATTEMPTS: number;
     AUTH_JWT_SECRET: string;
     AUTH_COOKIE_SAME_SITE: string;
     REDIS_URL: string;

package/dist/config.js

@@ -7,6 +7,7 @@ const app = define({
     AUTH_TOKEN_EXPIRES: t.number(3600 * 24 * 30),
     AUTH_TEMP_TOKEN_EXPIRES: t.number(3600),
     AUTH_OTP_EXPIRES: t.number(5 * 60),
+    AUTH_OTP_MAX_ATTEMPTS: t.number(5),
     AUTH_JWT_SECRET: t.string(),
     AUTH_COOKIE_SAME_SITE: t.enum(['strict', 'lax', 'none'], 'strict'),
     REDIS_URL: t.string(),

package/dist/csrf.js

@@ -43,6 +43,7 @@ export function useCsrfOptions() {
 }
 const generateTokenAndHash = (req, { overwrite = false } = {}) => {
     const secret = getCsrfSecret();
+    // oxlint-disable-next-line eslint-plugin-react-hooks/rules-of-hooks
     const { sessionIdentifier, cookieName } = useCsrfOptions();
     const csrfCookie = req.cookies[cookieName];
     if (typeof csrfCookie === 'string' && !overwrite) {
@@ -66,6 +67,7 @@ const generateTokenAndHash = (req, { overwrite = false } = {}) => {
 export const generateCsrfToken = (req, res, options = {}) => {
     const { csrfToken, csrfTokenHash } = generateTokenAndHash(req, options);
     const cookieContent = `${csrfToken}|${csrfTokenHash}`;
+    // oxlint-disable-next-line eslint-plugin-react-hooks/rules-of-hooks
     const { cookieName } = useCsrfOptions();
     res.cookie(cookieName, cookieContent, {
         sameSite: 'lax',
@@ -85,6 +87,7 @@ const validateTokenHash = ({ csrfToken, csrfTokenHash, secret, sessionIdentifier
     return csrfTokenHash === expectedHash;
 };
 const validateRequest = (req) => {
+    // oxlint-disable-next-line eslint-plugin-react-hooks/rules-of-hooks
     const { cookieName, sessionIdentifier } = useCsrfOptions();
     const csrfCookie = req.cookies[cookieName];
     if (typeof csrfCookie !== 'string') {
@@ -112,6 +115,7 @@ const validateRequest = (req) => {
     }
 };
 export function doubleCsrfProtection(req) {
+    // oxlint-disable-next-line eslint-plugin-react-hooks/rules-of-hooks
     return async () => {
         const { exempt } = useCsrfOptions();
         if (exempt) {

package/dist/listen.js

@@ -8,7 +8,6 @@ import express, {} from 'express';
 import { BadRequest } from './errors.js';
 import { getLogger } from './logger.js';
 import { before, route } from './middleware.js';
-import { envPort } from './utils.js';
 const logger = getLogger('http');
 const appTimer = startTimer();
 export function stoppable(server, gracePeriodMs = Infinity) {
@@ -175,7 +174,7 @@ export function createExpressServer(app, options = {}) {
         configurable: true,
     });
     enhanced.start = async function start() {
-        const port = app.get('port') ?? envPort(0);
+        const port = config.PORT;
         await options.onStart?.();
         await ctl.start(port);
         logger.info('app listening', {

package/dist/logger.js

@@ -7,7 +7,7 @@ export class JsonStreamAdapter {
     constructor(stream) {
         this.#stream = stream;
     }
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    // oxlint-disable-next-line @typescript-eslint/no-unused-vars
     captureError(error, attributes) { }
     write(log) {
         const chunk = `${JSON.stringify(log)}\n`;
@@ -72,7 +72,7 @@ export function createLogger({ name, getContext, level = config.LOG_LEVEL, outpu
     function getFinalContext(context) {
         return Object.assign(baseContext(), getContext?.(), context);
     }
-    // eslint-disable-next-line @typescript-eslint/no-shadow
+    // oxlint-disable-next-line @typescript-eslint/no-shadow
     function log(level, message, context) {
         if (level < logLevel) {
             return;

package/dist/manage.js

@@ -33,13 +33,13 @@ export function registerDefaultCommands(app, program = defaultProgram) {
             }
             if (options.openapi) {
                 const routes = toOpenAPISpec(app);
-                // eslint-disable-next-line no-console
+                // oxlint-disable-next-line no-console
                 console.log(JSON.stringify(routes, null, 2));
                 return;
             }
             const routes = parseRoutes(app);
             if (options.json) {
-                // eslint-disable-next-line no-console
+                // oxlint-disable-next-line no-console
                 console.log(JSON.stringify(routes, null, 2));
                 return;
             }
@@ -60,7 +60,7 @@ export function registerDefaultCommands(app, program = defaultProgram) {
             .option('--json', 'Output JSON')
             .action(cli.wrap(async (options) => {
             if (options.json) {
-                // eslint-disable-next-line no-console
+                // oxlint-disable-next-line no-console
                 console.log(JSON.stringify(config, null, 2));
                 return;
             }

package/dist/middleware.js

@@ -225,14 +225,41 @@ export function withTransaction(wrapper) {
         try {
             await wrapper.transaction(async () => {
                 await new Promise((resolve, reject) => {
-                    res.on('finish', resolve);
-                    res.on('error', reject);
+                    const cleanup = () => {
+                        res.off('finish', onFinish);
+                        res.off('close', onClose);
+                        res.off('error', onError);
+                    };
+                    const onFinish = () => {
+                        cleanup();
+                        if (res.statusCode >= 400) {
+                            reject(new Error(`Request finished with status ${res.statusCode}; rolling back transaction.`));
+                            return;
+                        }
+                        resolve();
+                    };
+                    const onClose = () => {
+                        cleanup();
+                        if (!res.writableFinished) {
+                            reject(new Error('Request closed before the response finished.'));
+                        }
+                    };
+                    const onError = (error) => {
+                        cleanup();
+                        reject(error);
+                    };
+                    res.once('finish', onFinish);
+                    res.once('close', onClose);
+                    res.once('error', onError);
                     next();
                 });
             });
         }
         catch (error) {
             /* v8 ignore next -- @preserve */
+            if (res.headersSent || res.writableEnded) {
+                return;
+            }
             next(error);
         }
     };

package/dist/utils.d.ts

@@ -10,4 +10,3 @@ export declare namespace readEnv {
 }
 declare function readEnvNumber(key: string, defaultValue: number): number;
 declare function readEnvBoolean(key: string, defaultValue: boolean): boolean;
-export declare const envPort: (defaultPort?: number) => number;

package/dist/utils.js

@@ -13,4 +13,3 @@ function readEnvNumber(key, defaultValue) {
 function readEnvBoolean(key, defaultValue) {
     return ['true', '1', 't'].includes(readEnv(key, `${defaultValue}`).toLowerCase());
 }
-export const envPort = (defaultPort = 3000) => readEnv.number('PORT', defaultPort);

package/dist/vite/ssr.js

@@ -11,8 +11,8 @@ import * as path from 'node:path';
 import { config } from '@devmoods/config';
 import express, {} from 'express';
 import {} from 'vite';
-import {} from '../composeMiddleware.js';
 import {} from './types.js';
+import {} from '../composeMiddleware.js';
 import { generateCsrfToken } from '../csrf.js';
 import { composeMiddleware, route, useCspNonce } from '../middleware.js';
 import { createFetchRequest } from '../webapi.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devmoods/express-extras",
-  "version": "0.73.0",
+  "version": "0.74.0",
   "description": "Kubernetes-ready utilities for rapid Node.js application development",
   "type": "module",
   "main": "./dist/index.js",
@@ -45,7 +45,8 @@
   },
   "scripts": {
     "clean": "rm -rf dist",
-    "lint": "eslint",
+    "lint": "oxlint .",
+    "format": "oxfmt .",
     "test": "NODE_ENV=test DOTENV_CONFIG_PATH=.env.test vitest",
     "test:coverage": "pnpm run test --coverage",
     "build": "pnpm run clean && tsgo",
@@ -68,10 +69,10 @@
     "vite": "^8.0.8"
   },
   "dependencies": {
-    "@devmoods/config": "0.2.3",
+    "@devmoods/config": "0.2.4",
     "@devmoods/fetch": "^4.3.0",
-    "@devmoods/observability": "0.2.0",
-    "@devmoods/postgres": "0.5.0",
+    "@devmoods/observability": "0.3.0",
+    "@devmoods/postgres": "0.6.0",
     "@hey-api/openapi-ts": "^0.96.0",
     "@rolldown/plugin-babel": "^0.2.3",
     "@standard-schema/spec": "^1.1.0",
@@ -94,7 +95,7 @@
     "helmet": "^8.1.0",
     "jose": "^6.2.2",
     "nodemailer": "^8.0.5",
-    "redis": "^5.11.0",
+    "redis": "^5.12.1",
     "sonda": "^0.11.1",
     "tough-cookie": "^6.0.1",
     "uuid": "^13.0.0",
@@ -110,5 +111,5 @@
   "engines": {
     "node": ">=20 <26"
   },
-  "gitHead": "ea4f51756aca98bd050cf98128bf4d4b3da1bf38"
+  "gitHead": "2c4100d80823bcf16bd962b4b8a26bd078522dfc"
 }