@factiii/auth 0.4.1 → 0.5.1

package/dist/index.js

@@ -905,13 +905,13 @@ var BaseProcedureFactory = class {
           }
         }
         if (!validCode) {
-          const checkOTP = await this.config.prisma.oTP.findUnique({
-            where: { userId: user.id }
+          const checkOTP = await this.config.prisma.oTP.findFirst({
+            where: { userId: user.id, code: Number(code), expiresAt: { gte: /* @__PURE__ */ new Date() } }
           });
-          if (checkOTP && checkOTP.code === Number(code) && checkOTP.expiredAt >= /* @__PURE__ */ new Date()) {
+          if (checkOTP) {
             validCode = true;
             await this.config.prisma.oTP.delete({
-              where: { userId: user.id }
+              where: { id: checkOTP.id }
             });
           }
         }
@@ -1169,10 +1169,22 @@ var BaseProcedureFactory = class {
         data: { password: hashedPassword }
       });
       await this.config.prisma.passwordReset.delete({ where: { id: token } });
-      await this.config.prisma.session.updateMany({
+      const sessionsToDelete = await this.config.prisma.session.findMany({
         where: { userId: passwordReset.userId },
-        data: { revokedAt: /* @__PURE__ */ new Date() }
+        select: { id: true, socketId: true, userId: true }
+      });
+      await this.config.prisma.session.deleteMany({
+        where: { userId: passwordReset.userId }
       });
+      for (const session of sessionsToDelete) {
+        if (this.config.hooks?.onSessionRevoked) {
+          await this.config.hooks.onSessionRevoked(
+            session.id,
+            session.socketId,
+            "Password reset"
+          );
+        }
+      }
       return { message: "Password updated. Please log in with your new password." };
     });
   }
@@ -1670,11 +1682,9 @@ var TwoFaProcedureFactory = class {
         throw new import_server6.TRPCError({ code: "FORBIDDEN", message: "Invalid credentials." });
       }
       const otp = generateOtp();
-      const expiredAt = new Date(Date.now() + this.config.tokenSettings.otpValidityMs);
-      await this.config.prisma.oTP.upsert({
-        where: { userId: user.id },
-        update: { code: otp, expiredAt },
-        create: { userId: user.id, code: otp, expiredAt }
+      const expiresAt = new Date(Date.now() + this.config.tokenSettings.otpValidityMs);
+      await this.config.prisma.oTP.create({
+        data: { userId: user.id, code: otp, expiresAt }
       });
       if (this.config.emailService) {
         await this.config.emailService.sendOTPEmail(user.email, otp);
@@ -1693,14 +1703,14 @@ var TwoFaProcedureFactory = class {
       if (!user) {
         throw new import_server6.TRPCError({ code: "NOT_FOUND", message: "User not found" });
       }
-      const otp = await this.config.prisma.oTP.findUnique({
-        where: { userId: user.id }
+      const otp = await this.config.prisma.oTP.findFirst({
+        where: { userId: user.id, code, expiresAt: { gte: /* @__PURE__ */ new Date() } }
       });
-      if (!otp || otp.code !== code || otp.expiredAt < /* @__PURE__ */ new Date()) {
+      if (!otp) {
         throw new import_server6.TRPCError({ code: "FORBIDDEN", message: "Invalid or expired OTP" });
       }
       await this.config.prisma.oTP.delete({
-        where: { userId: user.id }
+        where: { id: otp.id }
       });
       await this.config.prisma.user.update({
         where: { id: user.id },

package/dist/index.mjs

@@ -771,13 +771,13 @@ var BaseProcedureFactory = class {
           }
         }
         if (!validCode) {
-          const checkOTP = await this.config.prisma.oTP.findUnique({
-            where: { userId: user.id }
+          const checkOTP = await this.config.prisma.oTP.findFirst({
+            where: { userId: user.id, code: Number(code), expiresAt: { gte: /* @__PURE__ */ new Date() } }
           });
-          if (checkOTP && checkOTP.code === Number(code) && checkOTP.expiredAt >= /* @__PURE__ */ new Date()) {
+          if (checkOTP) {
             validCode = true;
             await this.config.prisma.oTP.delete({
-              where: { userId: user.id }
+              where: { id: checkOTP.id }
             });
           }
         }
@@ -1035,10 +1035,22 @@ var BaseProcedureFactory = class {
         data: { password: hashedPassword }
       });
       await this.config.prisma.passwordReset.delete({ where: { id: token } });
-      await this.config.prisma.session.updateMany({
+      const sessionsToDelete = await this.config.prisma.session.findMany({
         where: { userId: passwordReset.userId },
-        data: { revokedAt: /* @__PURE__ */ new Date() }
+        select: { id: true, socketId: true, userId: true }
+      });
+      await this.config.prisma.session.deleteMany({
+        where: { userId: passwordReset.userId }
       });
+      for (const session of sessionsToDelete) {
+        if (this.config.hooks?.onSessionRevoked) {
+          await this.config.hooks.onSessionRevoked(
+            session.id,
+            session.socketId,
+            "Password reset"
+          );
+        }
+      }
       return { message: "Password updated. Please log in with your new password." };
     });
   }
@@ -1536,11 +1548,9 @@ var TwoFaProcedureFactory = class {
         throw new TRPCError6({ code: "FORBIDDEN", message: "Invalid credentials." });
       }
       const otp = generateOtp();
-      const expiredAt = new Date(Date.now() + this.config.tokenSettings.otpValidityMs);
-      await this.config.prisma.oTP.upsert({
-        where: { userId: user.id },
-        update: { code: otp, expiredAt },
-        create: { userId: user.id, code: otp, expiredAt }
+      const expiresAt = new Date(Date.now() + this.config.tokenSettings.otpValidityMs);
+      await this.config.prisma.oTP.create({
+        data: { userId: user.id, code: otp, expiresAt }
       });
       if (this.config.emailService) {
         await this.config.emailService.sendOTPEmail(user.email, otp);
@@ -1559,14 +1569,14 @@ var TwoFaProcedureFactory = class {
       if (!user) {
         throw new TRPCError6({ code: "NOT_FOUND", message: "User not found" });
       }
-      const otp = await this.config.prisma.oTP.findUnique({
-        where: { userId: user.id }
+      const otp = await this.config.prisma.oTP.findFirst({
+        where: { userId: user.id, code, expiresAt: { gte: /* @__PURE__ */ new Date() } }
       });
-      if (!otp || otp.code !== code || otp.expiredAt < /* @__PURE__ */ new Date()) {
+      if (!otp) {
         throw new TRPCError6({ code: "FORBIDDEN", message: "Invalid or expired OTP" });
       }
       await this.config.prisma.oTP.delete({
-        where: { userId: user.id }
+        where: { id: otp.id }
       });
       await this.config.prisma.user.update({
         where: { id: user.id },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@factiii/auth",
-  "version": "0.4.1",
+  "version": "0.5.1",
   "publishConfig": {
     "access": "public"
   },

package/prisma/schema.prisma

@@ -116,11 +116,13 @@ model PasswordReset {
 // ==============================================================================
 
 model OTP {
+  id        Int      @id @default(autoincrement())
   code      Int
-  expiredAt DateTime
-  userId    Int      @unique
+  expiresAt DateTime
+  userId    Int
   user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
 
+  @@index([userId])
 }
 
 // ==============================================================================