@focura/auth-core 1.0.0 → 1.1.1

package/dist/index.js

@@ -1,5 +1,5 @@
+import crypto4 from 'crypto';
 import jwt from 'jsonwebtoken';
-import crypto3 from 'crypto';
 import { generateSecret, generateURI, verify } from 'otplib';
 import { z } from 'zod';
 
@@ -157,6 +157,9 @@ var init_sessionTimeout = __esm({
   }
 });
 
+// src/auth/authService.ts
+init_config();
+
 // src/tokens/backendToken.ts
 init_config();
 var TokenManager = class _TokenManager {
@@ -186,7 +189,7 @@ var TokenManager = class _TokenManager {
         role: p.role,
         type: "access",
         version: this.currentVersion,
-        jti: crypto3.randomUUID(),
+        jti: crypto4.randomUUID(),
         sessionId: p.sessionId
       },
       this.privateKey,
@@ -206,7 +209,7 @@ var TokenManager = class _TokenManager {
         role: p.role,
         type: "refresh",
         version: this.currentVersion,
-        jti: crypto3.randomUUID(),
+        jti: crypto4.randomUUID(),
         sessionId: p.sessionId
       },
       this.privateKey,
@@ -219,7 +222,7 @@ var TokenManager = class _TokenManager {
     );
   }
   createTokenPair(p) {
-    const sessionId = p.sessionId || crypto3.randomUUID();
+    const sessionId = p.sessionId || crypto4.randomUUID();
     const payload = { ...p, sessionId };
     return {
       accessToken: this.createAccessToken(payload),
@@ -234,7 +237,7 @@ var TokenManager = class _TokenManager {
         sub: userId,
         type: "sse",
         version: this.currentVersion,
-        jti: crypto3.randomUUID()
+        jti: crypto4.randomUUID()
       },
       this.privateKey,
       {
@@ -466,48 +469,6 @@ var TokenRevocation = class {
   }
 };
 
-// src/refresh/refreshLock.ts
-init_config();
-var RefreshLock = class {
-  constructor(redis, prefix = DEFAULTS.keyPrefix) {
-    this.redis = redis;
-    this.prefix = prefix;
-  }
-  redis;
-  prefix;
-  lockKey(sessionId) {
-    return `${this.prefix}refresh:lock:${sessionId}`;
-  }
-  async acquire(sessionId) {
-    try {
-      const result = await this.redis.setnx(
-        this.lockKey(sessionId),
-        "1"
-      );
-      return result === 1;
-    } catch (err) {
-      console.error("[RefreshLock] Failed to acquire lock:", err);
-      return false;
-    }
-  }
-  async release(sessionId) {
-    try {
-      await this.redis.del(this.lockKey(sessionId));
-    } catch (err) {
-      console.error("[RefreshLock] Failed to release lock:", err);
-    }
-  }
-  async isLocked(sessionId) {
-    try {
-      const val = await this.redis.get(this.lockKey(sessionId));
-      return !!val;
-    } catch (err) {
-      console.error("[RefreshLock] Failed to check lock status:", err);
-      return false;
-    }
-  }
-};
-
 // src/session/sessionManager.ts
 init_config();
 var SessionManager = class {
@@ -604,77 +565,6 @@ var SessionManager = class {
     }
   }
 };
-var SERVER_TO_SERVER_UA = /^(node|undici|axios|curl|go-http-client|python-requests|java\/|okhttp|superagent)/i;
-function looksLikeServerToServerUA(userAgent) {
-  return !userAgent || SERVER_TO_SERVER_UA.test(userAgent);
-}
-function looksLikeServerToServerRequest(req) {
-  const ua = req.headers["user-agent"] ?? "";
-  if (looksLikeServerToServerUA(ua)) return true;
-  return !req.headers["accept-language"] && !req.headers["accept-encoding"];
-}
-function normalizeUserAgent(userAgent) {
-  const ua = userAgent || "";
-  const mobile = /Mobile|Android|iPhone|iPad|iPod/i.test(ua);
-  const browser = /Edg\//i.test(ua) ? "Edge" : /OPR\/|Opera/i.test(ua) ? "Opera" : /Firefox\/|FxiOS/i.test(ua) ? "Firefox" : /CriOS\/|Chrome\//i.test(ua) ? "Chrome" : /Safari\//i.test(ua) ? "Safari" : "Other";
-  const os = /Android/i.test(ua) ? "Android" : /iPhone|iPad|iPod/i.test(ua) ? "iOS" : /Windows/i.test(ua) ? "Windows" : /Macintosh|Mac OS X/i.test(ua) ? "macOS" : /Linux/i.test(ua) ? "Linux" : "Other";
-  return `${browser}|${os}|${mobile ? "mobile" : "desktop"}`;
-}
-function primaryLanguage(acceptLanguage) {
-  const first = (acceptLanguage || "").split(",")[0]?.trim() ?? "";
-  return first ? first.split("-")[0].toLowerCase() : "";
-}
-function generateDeviceFingerprint(req) {
-  const components = [
-    normalizeUserAgent(req.headers["user-agent"] || ""),
-    primaryLanguage(req.headers["accept-language"] || "")
-  ].join("|");
-  return crypto3.createHash("sha256").update(components).digest("hex").substring(0, 32);
-}
-function getClientIp(req) {
-  if (typeof req.ip === "string" && req.ip.length > 0) {
-    return req.ip.startsWith("::ffff:") ? req.ip.slice(7) : req.ip;
-  }
-  const forwarded = req.headers["x-forwarded-for"];
-  if (typeof forwarded === "string") return forwarded.split(",")[0].trim();
-  const ip = req.socket?.remoteAddress || "unknown";
-  return ip.startsWith("::ffff:") ? ip.slice(7) : ip;
-}
-function createSessionMetadata(req) {
-  return {
-    deviceId: null,
-    ipAddress: getClientIp(req),
-    userAgent: req.headers["user-agent"] || "unknown",
-    lastActivity: Date.now()
-  };
-}
-function isPrivateIp(ip) {
-  if (!ip || ip === "unknown") return true;
-  const normalized = ip.startsWith("::ffff:") ? ip.slice(7) : ip;
-  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(normalized)) {
-    const [a, b] = normalized.split(".").map(Number);
-    return a === 0 || a === 10 || a === 127 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254;
-  }
-  return normalized === "::1" || /^fe80:/i.test(normalized) || /^fc/i.test(normalized) || /^fd/i.test(normalized);
-}
-function validateSessionBinding(req, storedMetadata) {
-  const currentDeviceId = generateDeviceFingerprint(req);
-  const currentIp = getClientIp(req);
-  if (currentDeviceId !== storedMetadata.deviceId) {
-    return { valid: false, reason: "DEVICE_MISMATCH" };
-  }
-  if (currentIp !== storedMetadata.ipAddress) {
-    if (isPrivateIp(currentIp) || isPrivateIp(storedMetadata.ipAddress)) {
-      return { valid: true };
-    }
-    const timeSinceLastActivity = Date.now() - storedMetadata.lastActivity;
-    const maxIpChangeInterval = 5 * 60 * 1e3;
-    if (timeSinceLastActivity < maxIpChangeInterval) {
-      return { valid: false, reason: "SUSPICIOUS_IP_CHANGE" };
-    }
-  }
-  return { valid: true };
-}
 
 // src/lockout/accountLockout.ts
 init_config();
@@ -784,12 +674,6 @@ var TotpManager = class {
   }
 };
 
-// src/index.ts
-init_sessionTimeout();
-
-// src/middleware/middlewareFactory.ts
-init_config();
-
 // src/errors/index.ts
 var UnauthorizedError = class extends Error {
   code;
@@ -891,8 +775,403 @@ var defaultErrors = {
   BadRequestError: (msg, code) => new BadRequestError(msg, code),
   ValidationError: (msg, details, code) => new ValidationError(msg, details, code)
 };
+var SERVER_TO_SERVER_UA = /^(node|undici|axios|curl|go-http-client|python-requests|java\/|okhttp|superagent)/i;
+function looksLikeServerToServerUA(userAgent) {
+  return !userAgent || SERVER_TO_SERVER_UA.test(userAgent);
+}
+function looksLikeServerToServerRequest(req) {
+  const ua = req.headers["user-agent"] ?? "";
+  if (looksLikeServerToServerUA(ua)) return true;
+  return !req.headers["accept-language"] && !req.headers["accept-encoding"];
+}
+function normalizeUserAgent(userAgent) {
+  const ua = userAgent || "";
+  const mobile = /Mobile|Android|iPhone|iPad|iPod/i.test(ua);
+  const browser = /Edg\//i.test(ua) ? "Edge" : /OPR\/|Opera/i.test(ua) ? "Opera" : /Firefox\/|FxiOS/i.test(ua) ? "Firefox" : /CriOS\/|Chrome\//i.test(ua) ? "Chrome" : /Safari\//i.test(ua) ? "Safari" : "Other";
+  const os = /Android/i.test(ua) ? "Android" : /iPhone|iPad|iPod/i.test(ua) ? "iOS" : /Windows/i.test(ua) ? "Windows" : /Macintosh|Mac OS X/i.test(ua) ? "macOS" : /Linux/i.test(ua) ? "Linux" : "Other";
+  return `${browser}|${os}|${mobile ? "mobile" : "desktop"}`;
+}
+function primaryLanguage(acceptLanguage) {
+  const first = (acceptLanguage || "").split(",")[0]?.trim() ?? "";
+  return first ? first.split("-")[0].toLowerCase() : "";
+}
+function generateDeviceFingerprint(req) {
+  const components = [
+    normalizeUserAgent(req.headers["user-agent"] || ""),
+    primaryLanguage(req.headers["accept-language"] || "")
+  ].join("|");
+  return crypto4.createHash("sha256").update(components).digest("hex").substring(0, 32);
+}
+function getClientIp(req) {
+  if (typeof req.ip === "string" && req.ip.length > 0) {
+    return req.ip.startsWith("::ffff:") ? req.ip.slice(7) : req.ip;
+  }
+  const forwarded = req.headers["x-forwarded-for"];
+  if (typeof forwarded === "string") return forwarded.split(",")[0].trim();
+  const ip = req.socket?.remoteAddress || "unknown";
+  return ip.startsWith("::ffff:") ? ip.slice(7) : ip;
+}
+function createSessionMetadata(req) {
+  return {
+    deviceId: null,
+    ipAddress: getClientIp(req),
+    userAgent: req.headers["user-agent"] || "unknown",
+    lastActivity: Date.now()
+  };
+}
+function isPrivateIp(ip) {
+  if (!ip || ip === "unknown") return true;
+  const normalized = ip.startsWith("::ffff:") ? ip.slice(7) : ip;
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(normalized)) {
+    const [a, b] = normalized.split(".").map(Number);
+    return a === 0 || a === 10 || a === 127 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254;
+  }
+  return normalized === "::1" || /^fe80:/i.test(normalized) || /^fc/i.test(normalized) || /^fd/i.test(normalized);
+}
+function validateSessionBinding(req, storedMetadata) {
+  const currentDeviceId = generateDeviceFingerprint(req);
+  const currentIp = getClientIp(req);
+  if (currentDeviceId !== storedMetadata.deviceId) {
+    return { valid: false, reason: "DEVICE_MISMATCH" };
+  }
+  if (currentIp !== storedMetadata.ipAddress) {
+    if (isPrivateIp(currentIp) || isPrivateIp(storedMetadata.ipAddress)) {
+      return { valid: true };
+    }
+    const timeSinceLastActivity = Date.now() - storedMetadata.lastActivity;
+    const maxIpChangeInterval = 5 * 60 * 1e3;
+    if (timeSinceLastActivity < maxIpChangeInterval) {
+      return { valid: false, reason: "SUSPICIOUS_IP_CHANGE" };
+    }
+  }
+  return { valid: true };
+}
+
+// src/auth/authService.ts
+var AuthService = class {
+  tokenManager;
+  tokenRevocation;
+  sessionManager;
+  accountLockout;
+  totpManager;
+  audit;
+  errors;
+  config;
+  userStore;
+  constructor(rawConfig) {
+    this.config = resolveConfig(rawConfig);
+    this.userStore = rawConfig.userStore;
+    this.errors = rawConfig.errors ?? defaultErrors;
+    this.tokenManager = new TokenManager(rawConfig.jwt);
+    this.tokenRevocation = new TokenRevocation(rawConfig.redis, this.config.keyPrefix);
+    this.sessionManager = new SessionManager(
+      rawConfig.redis,
+      this.tokenRevocation,
+      rawConfig.auditLogger,
+      this.config.keyPrefix,
+      this.config.maxConcurrentSessions
+    );
+    this.accountLockout = new AccountLockout(rawConfig.redis, {
+      maxFailures: this.config.lockoutMaxFailures,
+      lockoutSeconds: this.config.lockoutSeconds,
+      windowSeconds: this.config.lockoutWindowSeconds,
+      prefix: `${this.config.keyPrefix}lockout`
+    });
+    this.totpManager = new TotpManager(rawConfig.jwt.issuer ?? "Auth");
+    this.audit = new AuditLog(rawConfig.auditLogger);
+  }
+  getConfig() {
+    return this.config;
+  }
+  getRedis() {
+    return this.config.redis;
+  }
+  async exchange(input) {
+    const age = Date.now() - input.timestamp;
+    if (age > 6e4 || age < 0) {
+      this.audit.log("EXCHANGE_FAILED", { userId: input.userId, reason: "Proof expired" });
+      throw this.errors.UnauthorizedError("Exchange proof expired", "PROOF_EXPIRED");
+    }
+    const proofPayload = `${input.userId}${input.email}${input.role}${input.sessionId}${input.timestamp}`;
+    const expected = crypto4.createHmac("sha256", this.config.hmacSecret).update(proofPayload).digest("hex");
+    let valid = false;
+    try {
+      if (input.signature) {
+        valid = crypto4.timingSafeEqual(Buffer.from(input.signature, "hex"), Buffer.from(expected, "hex"));
+      }
+    } catch {
+      valid = false;
+    }
+    if (!valid) {
+      this.audit.log("EXCHANGE_FAILED", { userId: input.userId, reason: "Invalid signature" });
+      throw this.errors.UnauthorizedError("Invalid exchange proof", "INVALID_SIGNATURE");
+    }
+    const idempotencyKey = `exchange:idempotent:${input.userId}:${input.sessionId}:${input.timestamp}`;
+    const existing = await this.config.redis.get(idempotencyKey);
+    if (existing) {
+      return JSON.parse(existing);
+    }
+    const user = await this.userStore.findById(input.userId);
+    if (!user) {
+      this.audit.log("EXCHANGE_FAILED", { userId: input.userId, reason: "User not found" });
+      throw this.errors.UnauthorizedError("User not found", "USER_NOT_FOUND");
+    }
+    if (user.email.toLowerCase() !== input.email.toLowerCase()) {
+      this.audit.log("EXCHANGE_FAILED", { userId: input.userId, reason: "Email mismatch" });
+      throw this.errors.UnauthorizedError("Email mismatch", "EMAIL_MISMATCH");
+    }
+    if (!user.emailVerified) {
+      this.audit.log("EXCHANGE_FAILED", { userId: input.userId, reason: "Email not verified" });
+      throw this.errors.UnauthorizedError("Email not verified", "EMAIL_NOT_VERIFIED");
+    }
+    const sessionId = input.sessionId || crypto4.randomUUID();
+    const tokens = this.tokenManager.createTokenPair({
+      id: user.id,
+      email: user.email,
+      role: user.role,
+      sessionId
+    });
+    const refreshTtlSeconds = TokenManager.parseExpiry(this.tokenManager.getRefreshTokenExpiry()) / 1e3;
+    await this.tokenRevocation.storeRefreshToken(user.id, TokenManager.extractJti(tokens.refreshToken), refreshTtlSeconds);
+    const sseToken = this.tokenManager.createSseToken(user.id);
+    const sseTtlSeconds = TokenManager.parseExpiry(this.tokenManager.getSseTokenExpiry()) / 1e3;
+    await this.tokenRevocation.storeSseToken(TokenManager.extractJti(sseToken), user.id, sseTtlSeconds);
+    await this.config.redis.setex(
+      `${this.config.keyPrefix}session:created:${sessionId}`,
+      this.config.absoluteTimeout,
+      Date.now().toString()
+    );
+    await this.config.redis.setex(
+      `${this.config.keyPrefix}session:activity:${sessionId}`,
+      this.config.inactivityTimeout,
+      Date.now().toString()
+    );
+    await this.sessionManager.trackUserSession(user.id, sessionId);
+    const result = { ...tokens, sseToken, sessionId };
+    await this.config.redis.setex(idempotencyKey, 90, JSON.stringify(result));
+    this.audit.log("EXCHANGE_SUCCESS", { userId: user.id, email: user.email });
+    return result;
+  }
+  async verifyToken(input) {
+    let decoded;
+    try {
+      decoded = this.tokenManager.verifyToken(input.token);
+    } catch (err) {
+      if (err.name === "TokenExpiredError") {
+        throw this.errors.TokenExpiredError();
+      }
+      throw this.errors.InvalidTokenError();
+    }
+    if (decoded.version !== this.config.currentVersion) {
+      throw this.errors.InvalidTokenError("TOKEN_VERSION_MISMATCH");
+    }
+    if (decoded.type !== "access") {
+      throw this.errors.InvalidTokenError("INVALID_TOKEN_TYPE");
+    }
+    const [isRevoked, sessionWasRevoked] = await Promise.all([
+      decoded.jti ? this.tokenRevocation.isAccessTokenRevoked(decoded.jti) : Promise.resolve(false),
+      decoded.sessionId ? this.tokenRevocation.isSessionRevoked(decoded.sessionId) : Promise.resolve(false)
+    ]);
+    if (isRevoked) throw this.errors.TokenRevokedError();
+    if (sessionWasRevoked) throw this.errors.TokenRevokedError();
+    if (decoded.sessionId && input.ipAddress && input.userAgent) {
+      const metadataKey = `${this.config.keyPrefix}session:metadata:${decoded.sessionId}`;
+      const storedMetadata = await this.config.redis.get(metadataKey);
+      if (storedMetadata) {
+        let metadata;
+        try {
+          metadata = JSON.parse(storedMetadata);
+        } catch {
+          metadata = { deviceId: null, ipAddress: input.ipAddress, userAgent: input.userAgent, lastActivity: Date.now() };
+        }
+        if (metadata.deviceId == null) {
+          metadata.deviceId = crypto4.createHash("sha256").update(`${input.userAgent}|${input.ipAddress}`).digest("hex").substring(0, 32);
+          metadata.ipAddress = input.ipAddress;
+          metadata.userAgent = input.userAgent;
+          metadata.lastActivity = Date.now();
+          await this.config.redis.setex(metadataKey, this.config.sessionMetadataTtl, JSON.stringify(metadata));
+        } else {
+          const req = { headers: { "user-agent": input.userAgent }, ip: input.ipAddress };
+          const binding = validateSessionBinding(req, metadata);
+          if (!binding.valid) {
+            await this.tokenRevocation.revokeAllRefreshTokens(decoded.id);
+            this.audit.log("SESSION_HIJACK_DETECTED", {
+              userId: decoded.id,
+              sessionId: decoded.sessionId,
+              reason: binding.reason
+            });
+            throw this.errors.SessionHijackError(binding.reason);
+          }
+          metadata.lastActivity = Date.now();
+          await this.config.redis.setex(metadataKey, this.config.sessionMetadataTtl, JSON.stringify(metadata));
+        }
+      }
+    }
+    const user = await this.userStore.findById(decoded.id);
+    if (!user) throw this.errors.UnauthorizedError("User not found", "USER_NOT_FOUND");
+    if (!user.emailVerified) throw this.errors.EmailNotVerifiedError();
+    if (user.bannedAt) throw this.errors.AccountBannedError(user.banReason, user.bannedAt);
+    return {
+      user,
+      payload: {
+        id: decoded.id,
+        email: decoded.email,
+        role: decoded.role,
+        jti: decoded.jti,
+        sessionId: decoded.sessionId
+      }
+    };
+  }
+  async refresh(input) {
+    let decoded;
+    try {
+      decoded = this.tokenManager.verifyToken(input.refreshToken, "refresh");
+    } catch {
+      throw this.errors.UnauthorizedError("Invalid refresh token", "INVALID_TOKEN");
+    }
+    const lockKey = `${this.config.keyPrefix}refresh:lock:${decoded.sessionId}`;
+    const lockResult = await this.config.redis.set(lockKey, "1", "EX", DEFAULTS.refreshLockTtlSeconds, "NX");
+    if (lockResult !== "OK") {
+      throw this.errors.BadRequestError("Refresh already in progress", "REFRESH_IN_PROGRESS");
+    }
+    try {
+      const dedupeKey = `${this.config.keyPrefix}refresh:dedupe:${decoded.id}:${decoded.jti}`;
+      const cached = await this.config.redis.get(dedupeKey);
+      if (cached) return JSON.parse(cached);
+      const sessionRevokedKey = `${this.config.keyPrefix}session:revoked:${decoded.sessionId}`;
+      if (await this.config.redis.get(sessionRevokedKey) === "1") {
+        throw this.errors.UnauthorizedError("Session revoked", "SESSION_REVOKED");
+      }
+      const createdKey = `${this.config.keyPrefix}session:created:${decoded.sessionId}`;
+      if (await this.config.redis.exists(createdKey) !== 1) {
+        throw this.errors.UnauthorizedError("Session expired", "SESSION_TIMEOUT");
+      }
+      const newTokens = this.tokenManager.createTokenPair({
+        id: decoded.id,
+        email: decoded.email,
+        role: decoded.role,
+        sessionId: decoded.sessionId
+      });
+      const refreshTtlSeconds = TokenManager.parseExpiry(this.tokenManager.getRefreshTokenExpiry()) / 1e3;
+      await this.tokenRevocation.rotateRefreshToken(
+        decoded.id,
+        decoded.jti,
+        TokenManager.extractJti(newTokens.refreshToken),
+        refreshTtlSeconds
+      );
+      const newSseToken = this.tokenManager.createSseToken(decoded.id);
+      const sseTtlSeconds = TokenManager.parseExpiry(this.tokenManager.getSseTokenExpiry()) / 1e3;
+      await this.tokenRevocation.storeSseToken(TokenManager.extractJti(newSseToken), decoded.id, sseTtlSeconds);
+      const response = { ...newTokens, sseToken: newSseToken };
+      await this.config.redis.setex(dedupeKey, DEFAULTS.refreshDedupeTtlSeconds, JSON.stringify(response));
+      this.audit.log("TOKEN_REFRESHED", { userId: decoded.id, sessionId: decoded.sessionId });
+      return response;
+    } finally {
+      await this.config.redis.del(lockKey);
+    }
+  }
+  async logout(input) {
+    if (input.accessTokenJti && input.accessToken) {
+      const expiry = this.tokenManager.getAccessTokenExpiry();
+      const ttlSeconds = TokenManager.parseExpiry(expiry) / 1e3;
+      await this.tokenRevocation.revokeAccessToken(input.accessTokenJti, ttlSeconds);
+    }
+    if (input.logoutAll && input.userId) {
+      await this.tokenRevocation.revokeAllRefreshTokens(input.userId);
+      if (input.sessionId) {
+        await this.config.redis.setex(
+          `${this.config.keyPrefix}session:revoked:${input.sessionId}`,
+          DEFAULTS.revokedSessionTtl,
+          "1"
+        );
+      }
+      await this.sessionManager.revokeUserSession(input.userId, input.sessionId ?? "");
+      this.audit.log("LOGOUT_ALL_DEVICES", { userId: input.userId });
+    } else if (input.userId && input.sessionId) {
+      await this.sessionManager.revokeUserSession(input.userId, input.sessionId);
+      this.audit.log("LOGOUT", { userId: input.userId, sessionId: input.sessionId });
+    }
+  }
+  async getActiveSessions(userId) {
+    return this.sessionManager.getUserActiveSessions(userId);
+  }
+  async revokeSession(userId, sessionId) {
+    await this.sessionManager.revokeUserSession(userId, sessionId);
+    await this.tokenRevocation.markSessionRevoked(sessionId);
+    this.audit.log("SESSION_REVOKED", { userId, sessionId });
+  }
+  generateTwoFactor() {
+    const secret = this.totpManager.generateSecret();
+    const uri = this.totpManager.createUri(secret, "");
+    return { secret, uri };
+  }
+  createTwoFactorUri(secret, email) {
+    return this.totpManager.createUri(secret, email);
+  }
+  async verifyTwoFactor(input) {
+    return this.totpManager.verify(input.token, input.secret);
+  }
+  async recordLoginFailure(email) {
+    return this.accountLockout.recordFailedAttempt(email);
+  }
+  async clearLoginFailures(email) {
+    return this.accountLockout.clearFailedAttempts(email);
+  }
+  async isAccountLocked(email) {
+    return this.accountLockout.isAccountLocked(email);
+  }
+  log(event, data) {
+    this.audit.log(event, data);
+  }
+};
+
+// src/refresh/refreshLock.ts
+init_config();
+var RefreshLock = class {
+  constructor(redis, prefix = DEFAULTS.keyPrefix) {
+    this.redis = redis;
+    this.prefix = prefix;
+  }
+  redis;
+  prefix;
+  lockKey(sessionId) {
+    return `${this.prefix}refresh:lock:${sessionId}`;
+  }
+  async acquire(sessionId) {
+    try {
+      const result = await this.redis.setnx(
+        this.lockKey(sessionId),
+        "1"
+      );
+      return result === 1;
+    } catch (err) {
+      console.error("[RefreshLock] Failed to acquire lock:", err);
+      return false;
+    }
+  }
+  async release(sessionId) {
+    try {
+      await this.redis.del(this.lockKey(sessionId));
+    } catch (err) {
+      console.error("[RefreshLock] Failed to release lock:", err);
+    }
+  }
+  async isLocked(sessionId) {
+    try {
+      const val = await this.redis.get(this.lockKey(sessionId));
+      return !!val;
+    } catch (err) {
+      console.error("[RefreshLock] Failed to check lock status:", err);
+      return false;
+    }
+  }
+};
+
+// src/index.ts
+init_sessionTimeout();
 
 // src/middleware/middlewareFactory.ts
+init_config();
 var MiddlewareFactory = class {
   config;
   tokenManager;
@@ -1082,7 +1361,7 @@ var MiddlewareFactory = class {
     const CSRF_TOKEN_TTL = 3600;
     return {
       generateToken: async (userId, sessionId) => {
-        const token = crypto3.randomBytes(CSRF_TOKEN_LENGTH).toString("base64url");
+        const token = crypto4.randomBytes(CSRF_TOKEN_LENGTH).toString("base64url");
         const key = `${self.config.keyPrefix}csrf:${userId}:${sessionId}`;
         await self.config.redis.setex(key, CSRF_TOKEN_TTL, token);
         return token;
@@ -1093,7 +1372,7 @@ var MiddlewareFactory = class {
         const storedToken = await self.config.redis.get(key);
         if (!storedToken) return false;
         try {
-          return crypto3.timingSafeEqual(Buffer.from(token, "base64url"), Buffer.from(storedToken, "base64url"));
+          return crypto4.timingSafeEqual(Buffer.from(token, "base64url"), Buffer.from(storedToken, "base64url"));
         } catch {
           return false;
         }
@@ -1111,7 +1390,7 @@ var MiddlewareFactory = class {
           if (!stored || !csrfToken) return res.status(403).json({ success: false, message: "Invalid CSRF token", code: "CSRF_VALIDATION_FAILED" });
           let isValid = false;
           try {
-            isValid = crypto3.timingSafeEqual(Buffer.from(csrfToken, "base64url"), Buffer.from(stored, "base64url"));
+            isValid = crypto4.timingSafeEqual(Buffer.from(csrfToken, "base64url"), Buffer.from(stored, "base64url"));
           } catch {
             isValid = false;
           }
@@ -1180,11 +1459,11 @@ var MiddlewareFactory = class {
         throw self.errors.UnauthorizedError("Exchange proof expired", "PROOF_EXPIRED");
       }
       const proofPayload = `${userId}${email}${role}${sessionId}${timestamp}`;
-      const expected = crypto3.createHmac("sha256", self.config.hmacSecret).update(proofPayload).digest("hex");
+      const expected = crypto4.createHmac("sha256", self.config.hmacSecret).update(proofPayload).digest("hex");
       let valid = false;
       try {
         if (signature) {
-          valid = crypto3.timingSafeEqual(Buffer.from(signature, "hex"), Buffer.from(expected, "hex"));
+          valid = crypto4.timingSafeEqual(Buffer.from(signature, "hex"), Buffer.from(expected, "hex"));
         }
       } catch {
         valid = false;
@@ -1211,7 +1490,7 @@ var MiddlewareFactory = class {
         self.audit.log("EXCHANGE_FAILED", { userId, email, ip, reason: "Email not verified" });
         throw self.errors.UnauthorizedError("Email not verified", "EMAIL_NOT_VERIFIED");
       }
-      const sid = sessionId || crypto3.randomUUID();
+      const sid = sessionId || crypto4.randomUUID();
       const tokens = self.tokenManager.createTokenPair({
         id: user.id,
         email: user.email,
@@ -1357,6 +1636,6 @@ var logoutSchema = z.object({
 // src/index.ts
 init_config();
 
-export { AUDIT_SEVERITY, AccountBannedError, AccountLockout, AuditLog, BadRequestError, DEFAULTS, EmailNotVerifiedError, ForbiddenError, InvalidTokenError, MiddlewareFactory, RefreshLock, SessionHijackError, SessionManager, SessionTimeoutManager, TokenExpiredError, TokenManager, TokenRevocation, TokenRevokedError, TotpManager, UnauthorizedError, ValidationError, createSessionMetadata, defaultErrors, exchangeSchema, generateDeviceFingerprint, getClientIp, isPrivateIp, logoutSchema, looksLikeServerToServerRequest, looksLikeServerToServerUA, normalizeUserAgent, refreshSchema, resolveConfig, validateSessionBinding };
+export { AUDIT_SEVERITY, AccountBannedError, AccountLockout, AuditLog, AuthService, BadRequestError, DEFAULTS, EmailNotVerifiedError, ForbiddenError, InvalidTokenError, MiddlewareFactory, RefreshLock, SessionHijackError, SessionManager, SessionTimeoutManager, TokenExpiredError, TokenManager, TokenRevocation, TokenRevokedError, TotpManager, UnauthorizedError, ValidationError, createSessionMetadata, defaultErrors, exchangeSchema, generateDeviceFingerprint, getClientIp, isPrivateIp, logoutSchema, looksLikeServerToServerRequest, looksLikeServerToServerUA, normalizeUserAgent, refreshSchema, resolveConfig, validateSessionBinding };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map