@everystack/auth 0.2.1 → 0.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/auth",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "JWT authentication handlers, password hashing, and React auth context",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/index.ts

@@ -87,6 +87,10 @@ export interface AuthHandlers {
   oauth?: (request: Request) => Promise<Response>;
   verifyToken: (token: string) => Promise<TokenPayload | null>;
   revokeRefreshTokens: (userId: string) => Promise<void>;
+  confirmEmail?: (request: Request) => Promise<Response>;
+  forgotPassword?: (request: Request) => Promise<Response>;
+  resetPassword?: (request: Request) => Promise<Response>;
+  changePassword?: (request: Request) => Promise<Response>;
 }
 
 /**
@@ -110,6 +114,11 @@ export interface OAuthCallbacks {
   }>;
 }
 
+export interface TokenOperations {
+  create: (userId: string, type: string, relatesTo: string) => Promise<string>;
+  verify: (token: string, type: string) => Promise<{ userId: string; relatesTo: string }>;
+}
+
 export interface AuthOptions {
   mode?: 'node' | 'postgres';
   /** postgres.js sql client — required when mode is 'postgres' */
@@ -135,6 +144,15 @@ export interface AuthOptions {
   /** Callback to add extra claims (client_id, aud) during token signing.
    *  Receives base claims and the original request; returns extra claims to merge. */
   enrichClaims?: EnrichClaimsFn;
+  /** One-time token operations for email confirmation and password recovery.
+   *  Required for confirmEmail, forgotPassword, and resetPassword handlers. */
+  tokens?: TokenOperations;
+  /** Called after successful signup when tokens are configured. App sends confirmation email. */
+  onConfirmationRequired?: (user: { id: string; email: string }, token: string) => Promise<void>;
+  /** Called on forgot-password — app sends recovery email. */
+  onRecoveryRequired?: (user: { id: string; email: string }, token: string) => Promise<void>;
+  /** Called after email confirmed via one-time token — app updates user record. */
+  onEmailConfirmed?: (userId: string) => Promise<void>;
 }
 
 export {
@@ -162,6 +180,186 @@ function csrfCheck(request: Request, cookies?: CookieConfig): Response | null {
   return validateCsrfOrigin(request, cookies.allowedOrigins);
 }
 
+/**
+ * Add mode-independent email confirmation and password management handlers.
+ * Called after base handlers are created (works with both node and postgres modes).
+ */
+function addEmailPasswordFlows(
+  handlers: AuthHandlers,
+  db: any,
+  users: any,
+  options?: AuthOptions,
+): void {
+  if (options?.tokens) {
+    handlers.confirmEmail = async (request: Request): Promise<Response> => {
+      const csrfError = csrfCheck(request, options?.cookies);
+      if (csrfError) return csrfError;
+
+      let body: any;
+      try {
+        body = await request.json();
+      } catch {
+        return Response.json({ message: 'Invalid request body' }, { status: 400 });
+      }
+
+      const { token } = body;
+      if (!token) {
+        return Response.json({ message: 'token is required' }, { status: 400 });
+      }
+
+      try {
+        const result = await options.tokens!.verify(token, 'confirmation');
+        if (options.onEmailConfirmed) {
+          await options.onEmailConfirmed(result.userId);
+        }
+        return Response.json({ confirmed: true });
+      } catch {
+        return Response.json({ message: 'Invalid or expired token' }, { status: 401 });
+      }
+    };
+
+    handlers.forgotPassword = async (request: Request): Promise<Response> => {
+      const csrfError = csrfCheck(request, options?.cookies);
+      if (csrfError) return csrfError;
+
+      let body: any;
+      try {
+        body = await request.json();
+      } catch {
+        return Response.json({ message: 'Invalid request body' }, { status: 400 });
+      }
+
+      const { email } = body;
+      if (!email) {
+        return Response.json({ message: 'email is required' }, { status: 400 });
+      }
+
+      const [user] = await db.select().from(users).where(eq(users.email, email)).limit(1);
+
+      if (user) {
+        try {
+          const token = await options.tokens!.create(user.id, 'recovery', email);
+          if (options.onRecoveryRequired) {
+            await options.onRecoveryRequired({ id: user.id, email: user.email }, token);
+          }
+        } catch {
+          // Swallow — never reveal whether user exists
+        }
+      } else {
+        // Timing safety: consume roughly the same time as the success path
+        await verifyPassword('dummy', DUMMY_BCRYPT_HASH);
+      }
+
+      return Response.json({ sent: true });
+    };
+
+    handlers.resetPassword = async (request: Request): Promise<Response> => {
+      const csrfError = csrfCheck(request, options?.cookies);
+      if (csrfError) return csrfError;
+
+      let body: any;
+      try {
+        body = await request.json();
+      } catch {
+        return Response.json({ message: 'Invalid request body' }, { status: 400 });
+      }
+
+      const { token, password } = body;
+      if (!token || !password) {
+        return Response.json(
+          { message: 'token and password are required' },
+          { status: 400 },
+        );
+      }
+
+      let result: { userId: string; relatesTo: string };
+      try {
+        result = await options.tokens!.verify(token, 'recovery');
+      } catch {
+        return Response.json({ message: 'Invalid or expired token' }, { status: 401 });
+      }
+
+      const hash = await hashPassword(password);
+      await db.update(users).set(withPassword(users, {}, hash)).where(eq(users.id, result.userId));
+      await handlers.revokeRefreshTokens(result.userId);
+
+      return Response.json({ reset: true });
+    };
+  }
+
+  handlers.changePassword = async (request: Request): Promise<Response> => {
+    const csrfError = csrfCheck(request, options?.cookies);
+    if (csrfError) return csrfError;
+
+    const authHeader = request.headers.get('authorization');
+    if (!authHeader?.startsWith('Bearer ')) {
+      return Response.json({ message: 'Authentication required' }, { status: 401 });
+    }
+
+    const claims = await handlers.verifyToken(authHeader.slice(7));
+    if (!claims) {
+      return Response.json({ message: 'Invalid token' }, { status: 401 });
+    }
+
+    let body: any;
+    try {
+      body = await request.json();
+    } catch {
+      return Response.json({ message: 'Invalid request body' }, { status: 400 });
+    }
+
+    const { currentPassword, newPassword } = body;
+    if (!currentPassword || !newPassword) {
+      return Response.json(
+        { message: 'currentPassword and newPassword are required' },
+        { status: 400 },
+      );
+    }
+
+    const [user] = await db.select().from(users).where(eq(users.id, claims.sub)).limit(1);
+    if (!user) {
+      return Response.json({ message: 'User not found' }, { status: 404 });
+    }
+
+    const existingHash = getPasswordHash(user);
+    if (!existingHash) {
+      return Response.json(
+        { message: 'Password change not available for this account' },
+        { status: 400 },
+      );
+    }
+
+    const valid = await verifyPassword(currentPassword, existingHash);
+    if (!valid) {
+      return Response.json({ message: 'Current password is incorrect' }, { status: 401 });
+    }
+
+    const hash = await hashPassword(newPassword);
+    await db.update(users).set(withPassword(users, {}, hash)).where(eq(users.id, claims.sub));
+    await handlers.revokeRefreshTokens(claims.sub);
+
+    return Response.json({ changed: true });
+  };
+
+  // Wrap signup to trigger confirmation callback
+  if (options?.onConfirmationRequired && options?.tokens) {
+    const originalSignup = handlers.signup;
+    handlers.signup = async (request: Request): Promise<Response> => {
+      const response = await originalSignup(request);
+      if (response.status === 201) {
+        try {
+          const body = await response.clone().json();
+          const token = await options.tokens!.create(body.user.id, 'confirmation', body.user.email);
+          await options.onConfirmationRequired!({ id: body.user.id, email: body.user.email }, token);
+        } catch {
+          // Don't fail signup if confirmation email fails
+        }
+      }
+      return response;
+    };
+  }
+}
+
 /**
  * Create JWT auth handlers for signup, signin, refresh, and token verification.
  *
@@ -192,7 +390,9 @@ export function createAuthHandlers(
   options?: AuthOptions
 ): AuthHandlers {
   if (options?.mode === 'postgres') {
-    return createPostgresAuthHandlers(db, schema, jwtSecret, options);
+    const handlers = createPostgresAuthHandlers(db, schema, jwtSecret, options);
+    addEmailPasswordFlows(handlers, db, schema.users, options);
+    return handlers;
   }
 
   const { users, profiles } = schema;
@@ -224,7 +424,7 @@ export function createAuthHandlers(
     return refreshJwt.sign(payload as unknown as Record<string, unknown>);
   }
 
-  return {
+  const handlers: AuthHandlers = {
     verifyToken: async (token: string): Promise<TokenPayload | null> => {
       const claims = await accessJwt.verify(token);
       return (claims as TokenPayload | null) ?? null;
@@ -753,4 +953,7 @@ export function createAuthHandlers(
       }
     },
   };
+
+  addEmailPasswordFlows(handlers, db, users, options);
+  return handlers;
 }

package/src/plugin.ts

@@ -117,6 +117,10 @@ interface AuthContext extends PluginContext {
     signin: (req: Request) => Promise<Response>;
     refresh: (req: Request) => Promise<Response>;
     signout: (req: Request) => Promise<Response>;
+    confirmEmail?: (req: Request) => Promise<Response>;
+    forgotPassword?: (req: Request) => Promise<Response>;
+    resetPassword?: (req: Request) => Promise<Response>;
+    changePassword?: (req: Request) => Promise<Response>;
   };
   enrichClaimsRef?: { current: EnrichClaimsFn | null };
 }
@@ -203,14 +207,27 @@ export function authPlugin(options: AuthPluginOptions = {}): Plugin {
     }
 
     // --- Build contribution ---
-    const contribution: PluginContribution = {
-      routes: [
-        { path: `${basePath}/signup`, method: 'POST', exact: true, handler: auth.signup },
-        { path: `${basePath}/signin`, method: 'POST', exact: true, handler: auth.signin },
-        { path: `${basePath}/refresh`, method: 'POST', exact: true, handler: auth.refresh },
-        { path: `${basePath}/signout`, method: 'POST', exact: true, handler: auth.signout },
-      ],
-    };
+    const routes: Route[] = [
+      { path: `${basePath}/signup`, method: 'POST', exact: true, handler: auth.signup },
+      { path: `${basePath}/signin`, method: 'POST', exact: true, handler: auth.signin },
+      { path: `${basePath}/refresh`, method: 'POST', exact: true, handler: auth.refresh },
+      { path: `${basePath}/signout`, method: 'POST', exact: true, handler: auth.signout },
+    ];
+
+    if (auth.confirmEmail) {
+      routes.push({ path: `${basePath}/confirm-email`, method: 'POST', exact: true, handler: auth.confirmEmail });
+    }
+    if (auth.forgotPassword) {
+      routes.push({ path: `${basePath}/forgot-password`, method: 'POST', exact: true, handler: auth.forgotPassword });
+    }
+    if (auth.resetPassword) {
+      routes.push({ path: `${basePath}/reset-password`, method: 'POST', exact: true, handler: auth.resetPassword });
+    }
+    if (auth.changePassword) {
+      routes.push({ path: `${basePath}/change-password`, method: 'POST', exact: true, handler: auth.changePassword });
+    }
+
+    const contribution: PluginContribution = { routes };
 
     // --- Client management actions ---
     if (clientCallbacks) {