@fonderie/auth 1.0.0 → 1.1.1

package/dist/index.cjs

@@ -59,14 +59,16 @@ __export(index_exports, {
   MESSAGE_KEYS: () => MESSAGE_KEYS,
   normalizeEmail: () => normalizeEmail,
   normalizeEmailSafe: () => normalizeEmailSafe,
-  requireAuth: () => import_middlewares2.requireAuth,
+  requireAuth: () => import_middlewares3.requireAuth,
+  schemas: () => schemas_exports,
   toUserDTO: () => toUserDTO,
+  validate: () => import_middlewares.validate,
   withSession: () => withSession
 });
 module.exports = __toCommonJS(index_exports);
 
 // src/routes.ts
-var import_middlewares = require("@fonderie/core/middlewares");
+var import_middlewares2 = require("@fonderie/core/middlewares");
 
 // src/middlewares/require-email-login.ts
 var import_core = require("@fonderie/core");
@@ -81,6 +83,94 @@ var requireEmailLogin = async (ctx, next) => {
   return next();
 };
 
+// src/middlewares/validate.ts
+var import_middlewares = require("@fonderie/core/middlewares");
+
+// src/schemas.ts
+var schemas_exports = {};
+__export(schemas_exports, {
+  changePasswordSchema: () => changePasswordSchema,
+  forgotPasswordSchema: () => forgotPasswordSchema,
+  loginSchema: () => loginSchema,
+  mfaTokenSchema: () => mfaTokenSchema,
+  refreshSchema: () => refreshSchema,
+  registerSchema: () => registerSchema,
+  resetPasswordSchema: () => resetPasswordSchema,
+  updateEmailSchema: () => updateEmailSchema,
+  updatePhoneSchema: () => updatePhoneSchema,
+  updatePreferencesSchema: () => updatePreferencesSchema,
+  updateProfileSchema: () => updateProfileSchema,
+  verifySchema: () => verifySchema
+});
+var import_zod = require("zod");
+var email = import_zod.z.string().trim().pipe(import_zod.z.email());
+var password = import_zod.z.string().min(8, "password must be at least 8 characters").max(128);
+var phone = import_zod.z.string().refine((v) => /^\+?[1-9]\d{6,14}$/.test(v.replace(/[\s\-()]/g, "")), "Invalid phone number");
+var sixDigitPin = import_zod.z.string().trim().regex(/^\d{6}$/, "must be a 6-digit code");
+var registerSchema = import_zod.z.union([
+  import_zod.z.object({
+    email,
+    password,
+    firstName: import_zod.z.string().max(100).nullish(),
+    lastName: import_zod.z.string().max(100).nullish()
+  }),
+  import_zod.z.object({ phone })
+]);
+var loginSchema = import_zod.z.union([
+  import_zod.z.object({ email, password: import_zod.z.string().min(1).max(128) }),
+  import_zod.z.object({ phone })
+]);
+var refreshSchema = import_zod.z.object({ refreshToken: import_zod.z.string().min(1).optional() });
+var forgotPasswordSchema = import_zod.z.object({ email });
+var resetPasswordSchema = import_zod.z.object({ pin: sixDigitPin, password });
+var verifySchema = import_zod.z.object({ token: sixDigitPin });
+var updateProfileSchema = import_zod.z.object({
+  firstName: import_zod.z.string().max(100).nullable().optional(),
+  lastName: import_zod.z.string().max(100).nullable().optional(),
+  avatarUrl: import_zod.z.string().trim().pipe(import_zod.z.url()).nullable().optional()
+}).refine(
+  (o) => Object.values(o).some((v) => v !== void 0),
+  "Provide at least one of: firstName, lastName, avatarUrl"
+);
+var updatePreferencesSchema = import_zod.z.object({
+  locale: import_zod.z.string().max(35).optional(),
+  timezone: import_zod.z.string().max(64).optional(),
+  notifications: import_zod.z.unknown().optional(),
+  emailDigest: import_zod.z.unknown().optional(),
+  dateFormat: import_zod.z.unknown().optional(),
+  timeFormat: import_zod.z.unknown().optional()
+}).refine(
+  (o) => Object.values(o).some((v) => v !== void 0),
+  "Provide at least one preference field"
+);
+var updateEmailSchema = import_zod.z.object({ email });
+var updatePhoneSchema = import_zod.z.object({ phone });
+var changePasswordSchema = import_zod.z.object({
+  currentPassword: import_zod.z.string().min(1).max(128),
+  newPassword: password
+});
+var mfaTokenSchema = import_zod.z.object({ token: import_zod.z.string().trim().min(6).max(64) });
+
+// src/services/cookies.ts
+function secureAttr(config) {
+  const secure = config.secureCookies ?? process.env["NODE_ENV"] === "production";
+  return secure ? "; Secure" : "";
+}
+function tokenPairCookies(accessToken, refreshToken, config) {
+  const secure = secureAttr(config);
+  return [
+    `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/${secure}`,
+    `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh${secure}`
+  ].join(", ");
+}
+function clearedTokenCookies(config) {
+  const secure = secureAttr(config);
+  return [
+    `access_token=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0${secure}`,
+    `refresh_token=; HttpOnly; SameSite=Strict; Path=/auth/refresh; Max-Age=0${secure}`
+  ].join(", ");
+}
+
 // src/controllers/mfa.controller.ts
 var import_qrcode = __toESM(require("qrcode"), 1);
 var import_core3 = require("@fonderie/core");
@@ -217,7 +307,7 @@ function base32Encode(buf) {
 function generateTotpSecret() {
   return base32Encode((0, import_node_crypto.randomBytes)(20));
 }
-function generateTotpUri(email, secret, issuer) {
+function generateTotpUri(email2, secret, issuer) {
   const params = new URLSearchParams({
     secret,
     issuer,
@@ -225,7 +315,7 @@ function generateTotpUri(email, secret, issuer) {
     digits: String(DIGITS),
     period: String(STEP)
   });
-  return `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(email)}?${params}`;
+  return `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(email2)}?${params}`;
 }
 function verifyTotpToken(token, secret) {
   const t = timeCounter();
@@ -317,21 +407,21 @@ var UserModel = class {
     );
     return row ?? null;
   }
-  async findByEmail(email) {
+  async findByEmail(email2) {
     const [row] = await this.store.query(
       `SELECT ${USER_COLUMNS} FROM fonderie_users WHERE email = $1 AND deleted_at IS NULL`,
-      [email]
+      [email2]
     );
     return row ?? null;
   }
-  async findByPhone(phone) {
+  async findByPhone(phone2) {
     const [row] = await this.store.query(
       `SELECT ${USER_COLUMNS} FROM fonderie_users WHERE phone = $1 AND deleted_at IS NULL`,
-      [phone]
+      [phone2]
     );
     return row ?? null;
   }
-  async findOrCreateByPhone(phone, firstName = null, lastName = null) {
+  async findOrCreateByPhone(phone2, firstName = null, lastName = null) {
     const [row] = await this.store.query(
       `INSERT INTO fonderie_users (phone, first_name, last_name)
 			VALUES ($1, $2, $3)
@@ -340,16 +430,16 @@ var UserModel = class {
 			    last_name  = COALESCE(EXCLUDED.last_name,  fonderie_users.last_name),
 			    updated_at = now()
 			RETURNING id`,
-      [phone, firstName, lastName]
+      [phone2, firstName, lastName]
     );
     return row;
   }
-  async create(email, passwordHash, firstName, lastName) {
+  async create(email2, passwordHash, firstName, lastName) {
     const [row] = await this.store.query(
       `INSERT INTO fonderie_users (email, password_hash, first_name, last_name)
 			VALUES ($1, $2, $3, $4)
 			RETURNING id`,
-      [email.toLowerCase().trim(), passwordHash, firstName, lastName]
+      [email2.toLowerCase().trim(), passwordHash, firstName, lastName]
     );
     return row ?? null;
   }
@@ -436,16 +526,16 @@ var UserModel = class {
       [id]
     );
   }
-  async updateEmail(id, email) {
+  async updateEmail(id, email2) {
     await this.store.query(
       `UPDATE fonderie_users SET email = $1, email_verified_at = NULL, updated_at = now() WHERE id = $2`,
-      [email.toLowerCase().trim(), id]
+      [email2.toLowerCase().trim(), id]
     );
   }
-  async updatePhone(id, phone) {
+  async updatePhone(id, phone2) {
     await this.store.query(
       `UPDATE fonderie_users SET phone = $1, updated_at = now() WHERE id = $2`,
-      [phone, id]
+      [phone2, id]
     );
   }
   async updatePreferences(id, fields) {
@@ -478,14 +568,14 @@ var UserModel = class {
     );
     return row?.mfa_secret ?? null;
   }
-  async upsertByProvider(email, provider, providerId) {
+  async upsertByProvider(email2, provider, providerId) {
     const [row] = await this.store.query(
       `INSERT INTO fonderie_users (email, email_verified_at, provider, provider_id)
 			VALUES ($1, now(), $2, $3)
 			ON CONFLICT (email) DO UPDATE
 			SET provider = $2, provider_id = $3
 			RETURNING id`,
-      [email, provider, providerId]
+      [email2, provider, providerId]
     );
     return row ?? null;
   }
@@ -665,10 +755,7 @@ function mfaController(store, config, issuer, bus) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-              `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-            ].join(", ")
+            "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
           }
         }
       );
@@ -742,11 +829,11 @@ function checkCooldown(lastSentAt, cooldownMs) {
 init_password();
 
 // src/services/email.ts
-function normalizeEmail(email) {
-  if (typeof email !== "string" || email.length === 0) {
+function normalizeEmail(email2) {
+  if (typeof email2 !== "string" || email2.length === 0) {
     throw new Error("Invalid email");
   }
-  const lower = email.trim().toLowerCase();
+  const lower = email2.trim().toLowerCase();
   if (lower.length === 0) {
     throw new Error("Email cannot be empty");
   }
@@ -766,9 +853,9 @@ function normalizeEmail(email) {
   }
   return `${normalizedLocal}@${domain}`;
 }
-function normalizeEmailSafe(email) {
+function normalizeEmailSafe(email2) {
   try {
-    return normalizeEmail(email);
+    return normalizeEmail(email2);
   } catch {
     return null;
   }
@@ -869,13 +956,13 @@ var PhoneVerificationModel = class {
     this.store = store;
   }
   store;
-  async upsert(userId, phone, otp, expiresAt) {
+  async upsert(userId, phone2, otp, expiresAt) {
     await this.store.query(
       `INSERT INTO fonderie_phone_verifications (phone, user_id, otp, expires_at)
 			VALUES ($1, $2, $3, $4)
 			ON CONFLICT (phone) DO UPDATE
 			SET user_id = $2, otp = $3, expires_at = $4, created_at = now()`,
-      [phone, userId, otp, expiresAt]
+      [phone2, userId, otp, expiresAt]
     );
   }
   async findByUser(userId, otp) {
@@ -900,11 +987,11 @@ var PhoneVerificationModel = class {
 };
 
 // src/controllers/auth.controller.ts
-function normalizePhone(phone) {
-  return phone.trim().replace(/[\s()\-\.]/g, "");
+function normalizePhone(phone2) {
+  return phone2.trim().replace(/[\s()\-\.]/g, "");
 }
-function isValidPhone(phone) {
-  return typeof phone === "string" && /^\+?[1-9]\d{6,14}$/.test(normalizePhone(phone));
+function isValidPhone(phone2) {
+  return typeof phone2 === "string" && /^\+?[1-9]\d{6,14}$/.test(normalizePhone(phone2));
 }
 function extractRefreshToken(ctx) {
   const body = ctx.meta["body"];
@@ -925,13 +1012,13 @@ function authController(store, config, bus) {
   return {
     register: async (ctx) => {
       const body = ctx.meta["body"];
-      const { email, password, phone, firstName = null, lastName = null } = body ?? {};
-      if (typeof email === "string" && typeof password === "string") {
-        const normalizedEmail = normalizeEmailSafe(email);
+      const { email: email2, password: password2, phone: phone2, firstName = null, lastName = null } = body ?? {};
+      if (typeof email2 === "string" && typeof password2 === "string") {
+        const normalizedEmail = normalizeEmailSafe(email2);
         if (!normalizedEmail) {
           return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
         }
-        if (password.length < 8) {
+        if (password2.length < 8) {
           return (0, import_core4.setApiResponse)(
             import_core4.HTTP.UNPROCESSABLE,
             "INVALID_PARAMETER",
@@ -942,7 +1029,7 @@ function authController(store, config, bus) {
         if (existing) {
           return (0, import_core4.setApiResponse)(import_core4.HTTP.CONFLICT, "USER_ALREADY_EXISTS", "Email already registered");
         }
-        const passwordHash = await hashPassword(password);
+        const passwordHash = await hashPassword(password2);
         const row = await users.create(
           normalizedEmail,
           passwordHash,
@@ -1002,27 +1089,24 @@ function authController(store, config, bus) {
           {
             status: 201,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
       }
-      if (isValidPhone(phone)) {
-        const existing = await users.findByPhone(normalizePhone(phone));
+      if (isValidPhone(phone2)) {
+        const existing = await users.findByPhone(normalizePhone(phone2));
         if (existing) {
           return (0, import_core4.setApiResponse)(import_core4.HTTP.CONFLICT, "USER_ALREADY_EXISTS", "Phone already registered");
         }
         const { id } = await users.findOrCreateByPhone(
-          normalizePhone(phone),
+          normalizePhone(phone2),
           firstName ?? null,
           lastName ?? null
         );
         const otp = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
-        await phoneVerif.upsert(id, normalizePhone(phone), otp, expiresAt);
+        await phoneVerif.upsert(id, normalizePhone(phone2), otp, expiresAt);
         const user = await users.findById(id);
         if (!user) {
           return (0, import_core4.setApiResponse)(import_core4.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
@@ -1034,7 +1118,7 @@ function authController(store, config, bus) {
           {
             type: MESSAGE_KEYS.phoneOtp,
             data: { otp },
-            recipient: { email: null, phone: normalizePhone(phone), deviceToken: null }
+            recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
           },
           reqOpts2
         ).catch(() => {
@@ -1067,10 +1151,7 @@ function authController(store, config, bus) {
           {
             status: 202,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
@@ -1084,16 +1165,16 @@ function authController(store, config, bus) {
     login: async (ctx) => {
       const body = ctx.meta["body"];
       if (typeof body?.["email"] === "string" && typeof body?.["password"] === "string") {
-        const { email: rawEmail, password } = body;
-        const email = normalizeEmailSafe(rawEmail);
-        if (!email) {
+        const { email: rawEmail, password: password2 } = body;
+        const email2 = normalizeEmailSafe(rawEmail);
+        if (!email2) {
           return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
         }
-        const user = await users.findByEmail(email);
+        const user = await users.findByEmail(email2);
         if (!user || !user.passwordHash) {
           return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
-        const valid = await verifyPassword(password, user.passwordHash);
+        const valid = await verifyPassword(password2, user.passwordHash);
         if (!valid) {
           return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
@@ -1129,17 +1210,14 @@ function authController(store, config, bus) {
           {
             status: 200,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
       }
-      const phone = body?.["phone"];
-      if (isValidPhone(phone)) {
-        const user = await users.findByPhone(normalizePhone(phone));
+      const phone2 = body?.["phone"];
+      if (isValidPhone(phone2)) {
+        const user = await users.findByPhone(normalizePhone(phone2));
         if (!user) {
           return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
@@ -1152,11 +1230,11 @@ function authController(store, config, bus) {
         }
         const otp = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
-        await phoneVerif.upsert(user.id, normalizePhone(phone), otp, expiresAt);
+        await phoneVerif.upsert(user.id, normalizePhone(phone2), otp, expiresAt);
         bus?.emit(import_events2.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.phoneOtp,
           data: { otp },
-          recipient: { email: null, phone: normalizePhone(phone), deviceToken: null }
+          recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
         }).catch(() => {
         });
         const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
@@ -1175,10 +1253,7 @@ function authController(store, config, bus) {
           {
             status: 202,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
@@ -1199,10 +1274,7 @@ function authController(store, config, bus) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              "access_token=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0",
-              "refresh_token=; HttpOnly; SameSite=Strict; Path=/auth/refresh; Max-Age=0"
-            ].join(", ")
+            "Set-Cookie": clearedTokenCookies(config)
           }
         }
       );
@@ -1243,10 +1315,7 @@ function authController(store, config, bus) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-              `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-            ].join(", ")
+            "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
           }
         }
       );
@@ -1257,11 +1326,11 @@ function authController(store, config, bus) {
       if (typeof rawEmail !== "string") {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "email is required");
       }
-      const email = normalizeEmailSafe(rawEmail);
-      if (!email) {
+      const email2 = normalizeEmailSafe(rawEmail);
+      if (!email2) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
       }
-      const user = await users.findByEmail(email);
+      const user = await users.findByEmail(email2);
       if (!user) {
         return (0, import_core4.setApiResponse)(
           import_core4.HTTP.OK,
@@ -1274,12 +1343,9 @@ function authController(store, config, bus) {
       const remaining = checkCooldown(await passwordReset.findLastSentAt(user.id), cooldown);
       if (remaining > 0) {
         return (0, import_core4.setApiResponse)(
-          import_core4.HTTP.TOO_MANY_REQUESTS,
-          "VERIFICATION_COOLDOWN",
-          "Please wait before requesting a new password reset code.",
-          {
-            retryAfter: Math.ceil(remaining / 1e3)
-          }
+          import_core4.HTTP.OK,
+          "PASSWORD_RESET_EMAIL_SENT",
+          "Password reset email sent (if account exists)."
         );
       }
       const pin = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
@@ -1287,7 +1353,7 @@ function authController(store, config, bus) {
       await passwordReset.create(user.id, pin, expiresAt);
       bus?.emit(import_events2.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.passwordReset,
-        recipient: { email, phone: null, deviceToken: null },
+        recipient: { email: email2, phone: null, deviceToken: null },
         data: { pin }
       }).catch(() => {
       });
@@ -1300,8 +1366,8 @@ function authController(store, config, bus) {
     resetPassword: async (ctx) => {
       const body = ctx.meta["body"];
       const raw = body?.["pin"];
-      const password = body?.["password"];
-      if (typeof raw !== "string" || typeof password !== "string") {
+      const password2 = body?.["password"];
+      if (typeof raw !== "string" || typeof password2 !== "string") {
         return (0, import_core4.setApiResponse)(
           import_core4.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
@@ -1315,7 +1381,7 @@ function authController(store, config, bus) {
           "pin must be a 6-digit code"
         );
       }
-      if (password.length < 8) {
+      if (password2.length < 8) {
         return (0, import_core4.setApiResponse)(
           import_core4.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
@@ -1327,7 +1393,7 @@ function authController(store, config, bus) {
       if (!row || /* @__PURE__ */ new Date() > row.expiresAt) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.BAD_REQUEST, "PASSWORD_RESET_FAILED", "Invalid or expired pin");
       }
-      const passwordHash = await hashPassword(password);
+      const passwordHash = await hashPassword(password2);
       await store.transaction(async (tx) => {
         await Promise.all([
           tx.query(`UPDATE fonderie_users SET password_hash = $1 WHERE id = $2`, [
@@ -1398,10 +1464,7 @@ function authController(store, config, bus) {
           {
             status: 200,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
@@ -1434,8 +1497,8 @@ function authController(store, config, bus) {
       const resolved = { ...config, ...config.resolve?.(ctx) };
       const cooldown = resolved.verificationCooldown ?? DEFAULT_VERIFICATION_COOLDOWN;
       if (ctx.user.loginMethod === "phone") {
-        const phone = ctx.user.phone;
-        if (!phone) {
+        const phone2 = ctx.user.phone;
+        if (!phone2) {
           return (0, import_core4.setApiResponse)(
             import_core4.HTTP.BAD_REQUEST,
             "NO_PHONE_ON_ACCOUNT",
@@ -1455,11 +1518,11 @@ function authController(store, config, bus) {
         }
         const otp = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
         const expiresAt2 = new Date(Date.now() + OTP_TTL_MS);
-        await phoneVerif.upsert(ctx.user.id, phone, otp, expiresAt2);
+        await phoneVerif.upsert(ctx.user.id, phone2, otp, expiresAt2);
         bus?.emit(import_events2.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.phoneOtp,
           data: { otp },
-          recipient: { email: null, phone, deviceToken: null }
+          recipient: { email: null, phone: phone2, deviceToken: null }
         }).catch(() => {
         });
         return (0, import_core4.setApiResponse)(
@@ -1512,13 +1575,13 @@ function authController(store, config, bus) {
 var import_node_crypto3 = require("crypto");
 var import_core5 = require("@fonderie/core");
 var import_events3 = require("@fonderie/events");
-function normalizePhone2(phone) {
-  return phone.trim().replace(/[\s()\-\.]/g, "");
+function normalizePhone2(phone2) {
+  return phone2.trim().replace(/[\s()\-\.]/g, "");
 }
-function isValidPhone2(phone) {
-  return typeof phone === "string" && /^\+?[1-9]\d{6,14}$/.test(normalizePhone2(phone));
+function isValidPhone2(phone2) {
+  return typeof phone2 === "string" && /^\+?[1-9]\d{6,14}$/.test(normalizePhone2(phone2));
 }
-function userController(store, bus) {
+function userController(store, config, bus) {
   const users = new UserModel(store);
   const emailVerif = new EmailVerificationModel(store);
   const phoneVerif = new PhoneVerificationModel(store);
@@ -1707,10 +1770,7 @@ function userController(store, bus) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              "access_token=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0",
-              "refresh_token=; HttpOnly; SameSite=Strict; Path=/auth/refresh; Max-Age=0"
-            ].join(", ")
+            "Set-Cookie": clearedTokenCookies(config)
           }
         }
       );
@@ -1814,10 +1874,7 @@ function oauthController(store, config) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-              `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-            ].join(", ")
+            "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
           }
         }
       );
@@ -1827,46 +1884,47 @@ function oauthController(store, config) {
 
 // src/routes.ts
 function buildAuthRoutes(store, config, bus) {
-  const user = userController(store, bus);
+  const user = userController(store, config, bus);
   const auth = authController(store, config, bus);
   const oauth = oauthController(store, config);
   const mfa = mfaController(store, config, config.appName ?? "Fonderie", bus);
-  const verifyGate = config.requireVerification ? import_middlewares.requireVerified : (_ctx, next) => next();
+  const verifyGate = config.requireVerification ? import_middlewares2.requireVerified : (_ctx, next) => next();
   const routes = [
     // Registration & Login (Public)
-    ["POST", "/auth/register", auth.register],
-    ["POST", "/auth/login", auth.login],
+    ["POST", "/auth/register", (0, import_middlewares.validate)(registerSchema), auth.register],
+    ["POST", "/auth/login", (0, import_middlewares.validate)(loginSchema), auth.login],
     // Token Management (Public)
-    ["POST", "/auth/refresh", auth.refresh],
+    ["POST", "/auth/refresh", (0, import_middlewares.validate)(refreshSchema), auth.refresh],
     // Email — Password Recovery (Public)
-    ["POST", "/auth/email/forgot", auth.forgotPassword],
-    ["POST", "/auth/email/reset", auth.resetPassword],
+    ["POST", "/auth/email/forgot", (0, import_middlewares.validate)(forgotPasswordSchema), auth.forgotPassword],
+    ["POST", "/auth/email/reset", (0, import_middlewares.validate)(resetPasswordSchema), auth.resetPassword],
     // Verification (Protected — email or phone, determined by loginMethod)
-    ["POST", "/auth/verify", import_middlewares.requireAuth, auth.verify],
-    ["GET", "/auth/send-verification", import_middlewares.requireAuth, auth.sendVerification],
+    ["POST", "/auth/verify", import_middlewares2.requireAuth, (0, import_middlewares.validate)(verifySchema), auth.verify],
+    ["GET", "/auth/send-verification", import_middlewares2.requireAuth, auth.sendVerification],
     // Account Management (Protected)
-    ["POST", "/auth/logout", import_middlewares.requireAuth, auth.logout],
+    ["POST", "/auth/logout", import_middlewares2.requireAuth, (0, import_middlewares.validate)(refreshSchema), auth.logout],
     // User Profile (Protected; writes also gate on requireVerification)
-    ["GET", "/users", import_middlewares.requireAuth, user.me],
-    ["PUT", "/users/profile", import_middlewares.requireAuth, verifyGate, user.updateProfile],
-    ["PUT", "/users/preferences", import_middlewares.requireAuth, verifyGate, user.updatePreferences],
-    ["PUT", "/users/email", import_middlewares.requireAuth, verifyGate, user.updateEmail],
-    ["PUT", "/users/phone", import_middlewares.requireAuth, verifyGate, user.updatePhone],
-    ["PUT", "/users/password", import_middlewares.requireAuth, user.changePassword],
-    ["DELETE", "/users", import_middlewares.requireAuth, verifyGate, user.deleteMe],
+    ["GET", "/users", import_middlewares2.requireAuth, user.me],
+    ["PUT", "/users/profile", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updateProfileSchema), user.updateProfile],
+    ["PUT", "/users/preferences", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updatePreferencesSchema), user.updatePreferences],
+    ["PUT", "/users/email", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updateEmailSchema), user.updateEmail],
+    ["PUT", "/users/phone", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updatePhoneSchema), user.updatePhone],
+    ["PUT", "/users/password", import_middlewares2.requireAuth, (0, import_middlewares.validate)(changePasswordSchema), user.changePassword],
+    ["DELETE", "/users", import_middlewares2.requireAuth, verifyGate, user.deleteMe],
     // MFA (email sessions only — requireVerified is always enforced here
     // because MFA is a security feature and email verification is meaningful)
-    ["POST", "/auth/mfa/setup", import_middlewares.requireAuth, requireEmailLogin, import_middlewares.requireVerified, mfa.setup],
+    ["POST", "/auth/mfa/setup", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, mfa.setup],
     // /auth/mfa/verify accepts both mfaPending tokens (TOTP/backup-code login)
     // and full tokens (setup confirmation), so requireAnyAuth is used here.
-    ["POST", "/auth/mfa/verify", import_middlewares.requireAnyAuth, requireEmailLogin, import_middlewares.requireVerified, mfa.verify],
-    ["POST", "/auth/mfa/disable", import_middlewares.requireAuth, requireEmailLogin, import_middlewares.requireVerified, mfa.disable],
+    ["POST", "/auth/mfa/verify", import_middlewares2.requireAnyAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.verify],
+    ["POST", "/auth/mfa/disable", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.disable],
     [
       "POST",
       "/auth/mfa/backup-codes",
-      import_middlewares.requireAuth,
+      import_middlewares2.requireAuth,
       requireEmailLogin,
-      import_middlewares.requireVerified,
+      import_middlewares2.requireVerified,
+      (0, import_middlewares.validate)(mfaTokenSchema),
       mfa.regenerateBackupCodes
     ]
   ];
@@ -1937,7 +1995,7 @@ var AuthModule = class {
 };
 
 // src/middlewares/require-auth.ts
-var import_middlewares2 = require("@fonderie/core/middlewares");
+var import_middlewares3 = require("@fonderie/core/middlewares");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AUTH_CONFIG_KEYS,
@@ -1946,7 +2004,9 @@ var import_middlewares2 = require("@fonderie/core/middlewares");
   normalizeEmail,
   normalizeEmailSafe,
   requireAuth,
+  schemas,
   toUserDTO,
+  validate,
   withSession
 });
 //# sourceMappingURL=index.cjs.map