@fonderie/auth 1.0.0 → 1.1.1

package/dist/index.js

@@ -45,6 +45,94 @@ var requireEmailLogin = async (ctx, next) => {
   return next();
 };
 
+// src/middlewares/validate.ts
+import { validate } from "@fonderie/core/middlewares";
+
+// src/schemas.ts
+var schemas_exports = {};
+__export(schemas_exports, {
+  changePasswordSchema: () => changePasswordSchema,
+  forgotPasswordSchema: () => forgotPasswordSchema,
+  loginSchema: () => loginSchema,
+  mfaTokenSchema: () => mfaTokenSchema,
+  refreshSchema: () => refreshSchema,
+  registerSchema: () => registerSchema,
+  resetPasswordSchema: () => resetPasswordSchema,
+  updateEmailSchema: () => updateEmailSchema,
+  updatePhoneSchema: () => updatePhoneSchema,
+  updatePreferencesSchema: () => updatePreferencesSchema,
+  updateProfileSchema: () => updateProfileSchema,
+  verifySchema: () => verifySchema
+});
+import { z } from "zod";
+var email = z.string().trim().pipe(z.email());
+var password = z.string().min(8, "password must be at least 8 characters").max(128);
+var phone = z.string().refine((v) => /^\+?[1-9]\d{6,14}$/.test(v.replace(/[\s\-()]/g, "")), "Invalid phone number");
+var sixDigitPin = z.string().trim().regex(/^\d{6}$/, "must be a 6-digit code");
+var registerSchema = z.union([
+  z.object({
+    email,
+    password,
+    firstName: z.string().max(100).nullish(),
+    lastName: z.string().max(100).nullish()
+  }),
+  z.object({ phone })
+]);
+var loginSchema = z.union([
+  z.object({ email, password: z.string().min(1).max(128) }),
+  z.object({ phone })
+]);
+var refreshSchema = z.object({ refreshToken: z.string().min(1).optional() });
+var forgotPasswordSchema = z.object({ email });
+var resetPasswordSchema = z.object({ pin: sixDigitPin, password });
+var verifySchema = z.object({ token: sixDigitPin });
+var updateProfileSchema = z.object({
+  firstName: z.string().max(100).nullable().optional(),
+  lastName: z.string().max(100).nullable().optional(),
+  avatarUrl: z.string().trim().pipe(z.url()).nullable().optional()
+}).refine(
+  (o) => Object.values(o).some((v) => v !== void 0),
+  "Provide at least one of: firstName, lastName, avatarUrl"
+);
+var updatePreferencesSchema = z.object({
+  locale: z.string().max(35).optional(),
+  timezone: z.string().max(64).optional(),
+  notifications: z.unknown().optional(),
+  emailDigest: z.unknown().optional(),
+  dateFormat: z.unknown().optional(),
+  timeFormat: z.unknown().optional()
+}).refine(
+  (o) => Object.values(o).some((v) => v !== void 0),
+  "Provide at least one preference field"
+);
+var updateEmailSchema = z.object({ email });
+var updatePhoneSchema = z.object({ phone });
+var changePasswordSchema = z.object({
+  currentPassword: z.string().min(1).max(128),
+  newPassword: password
+});
+var mfaTokenSchema = z.object({ token: z.string().trim().min(6).max(64) });
+
+// src/services/cookies.ts
+function secureAttr(config) {
+  const secure = config.secureCookies ?? process.env["NODE_ENV"] === "production";
+  return secure ? "; Secure" : "";
+}
+function tokenPairCookies(accessToken, refreshToken, config) {
+  const secure = secureAttr(config);
+  return [
+    `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/${secure}`,
+    `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh${secure}`
+  ].join(", ");
+}
+function clearedTokenCookies(config) {
+  const secure = secureAttr(config);
+  return [
+    `access_token=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0${secure}`,
+    `refresh_token=; HttpOnly; SameSite=Strict; Path=/auth/refresh; Max-Age=0${secure}`
+  ].join(", ");
+}
+
 // src/controllers/mfa.controller.ts
 import QRCode from "qrcode";
 import { setApiResponse as setApiResponse2, HTTP as HTTP2 } from "@fonderie/core";
@@ -181,7 +269,7 @@ function base32Encode(buf) {
 function generateTotpSecret() {
   return base32Encode(randomBytes(20));
 }
-function generateTotpUri(email, secret, issuer) {
+function generateTotpUri(email2, secret, issuer) {
   const params = new URLSearchParams({
     secret,
     issuer,
@@ -189,7 +277,7 @@ function generateTotpUri(email, secret, issuer) {
     digits: String(DIGITS),
     period: String(STEP)
   });
-  return `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(email)}?${params}`;
+  return `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(email2)}?${params}`;
 }
 function verifyTotpToken(token, secret) {
   const t = timeCounter();
@@ -281,21 +369,21 @@ var UserModel = class {
     );
     return row ?? null;
   }
-  async findByEmail(email) {
+  async findByEmail(email2) {
     const [row] = await this.store.query(
       `SELECT ${USER_COLUMNS} FROM fonderie_users WHERE email = $1 AND deleted_at IS NULL`,
-      [email]
+      [email2]
     );
     return row ?? null;
   }
-  async findByPhone(phone) {
+  async findByPhone(phone2) {
     const [row] = await this.store.query(
       `SELECT ${USER_COLUMNS} FROM fonderie_users WHERE phone = $1 AND deleted_at IS NULL`,
-      [phone]
+      [phone2]
     );
     return row ?? null;
   }
-  async findOrCreateByPhone(phone, firstName = null, lastName = null) {
+  async findOrCreateByPhone(phone2, firstName = null, lastName = null) {
     const [row] = await this.store.query(
       `INSERT INTO fonderie_users (phone, first_name, last_name)
 			VALUES ($1, $2, $3)
@@ -304,16 +392,16 @@ var UserModel = class {
 			    last_name  = COALESCE(EXCLUDED.last_name,  fonderie_users.last_name),
 			    updated_at = now()
 			RETURNING id`,
-      [phone, firstName, lastName]
+      [phone2, firstName, lastName]
     );
     return row;
   }
-  async create(email, passwordHash, firstName, lastName) {
+  async create(email2, passwordHash, firstName, lastName) {
     const [row] = await this.store.query(
       `INSERT INTO fonderie_users (email, password_hash, first_name, last_name)
 			VALUES ($1, $2, $3, $4)
 			RETURNING id`,
-      [email.toLowerCase().trim(), passwordHash, firstName, lastName]
+      [email2.toLowerCase().trim(), passwordHash, firstName, lastName]
     );
     return row ?? null;
   }
@@ -400,16 +488,16 @@ var UserModel = class {
       [id]
     );
   }
-  async updateEmail(id, email) {
+  async updateEmail(id, email2) {
     await this.store.query(
       `UPDATE fonderie_users SET email = $1, email_verified_at = NULL, updated_at = now() WHERE id = $2`,
-      [email.toLowerCase().trim(), id]
+      [email2.toLowerCase().trim(), id]
     );
   }
-  async updatePhone(id, phone) {
+  async updatePhone(id, phone2) {
     await this.store.query(
       `UPDATE fonderie_users SET phone = $1, updated_at = now() WHERE id = $2`,
-      [phone, id]
+      [phone2, id]
     );
   }
   async updatePreferences(id, fields) {
@@ -442,14 +530,14 @@ var UserModel = class {
     );
     return row?.mfa_secret ?? null;
   }
-  async upsertByProvider(email, provider, providerId) {
+  async upsertByProvider(email2, provider, providerId) {
     const [row] = await this.store.query(
       `INSERT INTO fonderie_users (email, email_verified_at, provider, provider_id)
 			VALUES ($1, now(), $2, $3)
 			ON CONFLICT (email) DO UPDATE
 			SET provider = $2, provider_id = $3
 			RETURNING id`,
-      [email, provider, providerId]
+      [email2, provider, providerId]
     );
     return row ?? null;
   }
@@ -629,10 +717,7 @@ function mfaController(store, config, issuer, bus) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-              `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-            ].join(", ")
+            "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
           }
         }
       );
@@ -706,11 +791,11 @@ function checkCooldown(lastSentAt, cooldownMs) {
 init_password();
 
 // src/services/email.ts
-function normalizeEmail(email) {
-  if (typeof email !== "string" || email.length === 0) {
+function normalizeEmail(email2) {
+  if (typeof email2 !== "string" || email2.length === 0) {
     throw new Error("Invalid email");
   }
-  const lower = email.trim().toLowerCase();
+  const lower = email2.trim().toLowerCase();
   if (lower.length === 0) {
     throw new Error("Email cannot be empty");
   }
@@ -730,9 +815,9 @@ function normalizeEmail(email) {
   }
   return `${normalizedLocal}@${domain}`;
 }
-function normalizeEmailSafe(email) {
+function normalizeEmailSafe(email2) {
   try {
-    return normalizeEmail(email);
+    return normalizeEmail(email2);
   } catch {
     return null;
   }
@@ -833,13 +918,13 @@ var PhoneVerificationModel = class {
     this.store = store;
   }
   store;
-  async upsert(userId, phone, otp, expiresAt) {
+  async upsert(userId, phone2, otp, expiresAt) {
     await this.store.query(
       `INSERT INTO fonderie_phone_verifications (phone, user_id, otp, expires_at)
 			VALUES ($1, $2, $3, $4)
 			ON CONFLICT (phone) DO UPDATE
 			SET user_id = $2, otp = $3, expires_at = $4, created_at = now()`,
-      [phone, userId, otp, expiresAt]
+      [phone2, userId, otp, expiresAt]
     );
   }
   async findByUser(userId, otp) {
@@ -864,11 +949,11 @@ var PhoneVerificationModel = class {
 };
 
 // src/controllers/auth.controller.ts
-function normalizePhone(phone) {
-  return phone.trim().replace(/[\s()\-\.]/g, "");
+function normalizePhone(phone2) {
+  return phone2.trim().replace(/[\s()\-\.]/g, "");
 }
-function isValidPhone(phone) {
-  return typeof phone === "string" && /^\+?[1-9]\d{6,14}$/.test(normalizePhone(phone));
+function isValidPhone(phone2) {
+  return typeof phone2 === "string" && /^\+?[1-9]\d{6,14}$/.test(normalizePhone(phone2));
 }
 function extractRefreshToken(ctx) {
   const body = ctx.meta["body"];
@@ -889,13 +974,13 @@ function authController(store, config, bus) {
   return {
     register: async (ctx) => {
       const body = ctx.meta["body"];
-      const { email, password, phone, firstName = null, lastName = null } = body ?? {};
-      if (typeof email === "string" && typeof password === "string") {
-        const normalizedEmail = normalizeEmailSafe(email);
+      const { email: email2, password: password2, phone: phone2, firstName = null, lastName = null } = body ?? {};
+      if (typeof email2 === "string" && typeof password2 === "string") {
+        const normalizedEmail = normalizeEmailSafe(email2);
         if (!normalizedEmail) {
           return setApiResponse3(HTTP3.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
         }
-        if (password.length < 8) {
+        if (password2.length < 8) {
           return setApiResponse3(
             HTTP3.UNPROCESSABLE,
             "INVALID_PARAMETER",
@@ -906,7 +991,7 @@ function authController(store, config, bus) {
         if (existing) {
           return setApiResponse3(HTTP3.CONFLICT, "USER_ALREADY_EXISTS", "Email already registered");
         }
-        const passwordHash = await hashPassword(password);
+        const passwordHash = await hashPassword(password2);
         const row = await users.create(
           normalizedEmail,
           passwordHash,
@@ -966,27 +1051,24 @@ function authController(store, config, bus) {
           {
             status: 201,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
       }
-      if (isValidPhone(phone)) {
-        const existing = await users.findByPhone(normalizePhone(phone));
+      if (isValidPhone(phone2)) {
+        const existing = await users.findByPhone(normalizePhone(phone2));
         if (existing) {
           return setApiResponse3(HTTP3.CONFLICT, "USER_ALREADY_EXISTS", "Phone already registered");
         }
         const { id } = await users.findOrCreateByPhone(
-          normalizePhone(phone),
+          normalizePhone(phone2),
           firstName ?? null,
           lastName ?? null
         );
         const otp = randomInt(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
-        await phoneVerif.upsert(id, normalizePhone(phone), otp, expiresAt);
+        await phoneVerif.upsert(id, normalizePhone(phone2), otp, expiresAt);
         const user = await users.findById(id);
         if (!user) {
           return setApiResponse3(HTTP3.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
@@ -998,7 +1080,7 @@ function authController(store, config, bus) {
           {
             type: MESSAGE_KEYS.phoneOtp,
             data: { otp },
-            recipient: { email: null, phone: normalizePhone(phone), deviceToken: null }
+            recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
           },
           reqOpts2
         ).catch(() => {
@@ -1031,10 +1113,7 @@ function authController(store, config, bus) {
           {
             status: 202,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
@@ -1048,16 +1127,16 @@ function authController(store, config, bus) {
     login: async (ctx) => {
       const body = ctx.meta["body"];
       if (typeof body?.["email"] === "string" && typeof body?.["password"] === "string") {
-        const { email: rawEmail, password } = body;
-        const email = normalizeEmailSafe(rawEmail);
-        if (!email) {
+        const { email: rawEmail, password: password2 } = body;
+        const email2 = normalizeEmailSafe(rawEmail);
+        if (!email2) {
           return setApiResponse3(HTTP3.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
         }
-        const user = await users.findByEmail(email);
+        const user = await users.findByEmail(email2);
         if (!user || !user.passwordHash) {
           return setApiResponse3(HTTP3.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
-        const valid = await verifyPassword(password, user.passwordHash);
+        const valid = await verifyPassword(password2, user.passwordHash);
         if (!valid) {
           return setApiResponse3(HTTP3.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
@@ -1093,17 +1172,14 @@ function authController(store, config, bus) {
           {
             status: 200,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
       }
-      const phone = body?.["phone"];
-      if (isValidPhone(phone)) {
-        const user = await users.findByPhone(normalizePhone(phone));
+      const phone2 = body?.["phone"];
+      if (isValidPhone(phone2)) {
+        const user = await users.findByPhone(normalizePhone(phone2));
         if (!user) {
           return setApiResponse3(HTTP3.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
@@ -1116,11 +1192,11 @@ function authController(store, config, bus) {
         }
         const otp = randomInt(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
-        await phoneVerif.upsert(user.id, normalizePhone(phone), otp, expiresAt);
+        await phoneVerif.upsert(user.id, normalizePhone(phone2), otp, expiresAt);
         bus?.emit(NOTIFICATION_EVENT2, {
           type: MESSAGE_KEYS.phoneOtp,
           data: { otp },
-          recipient: { email: null, phone: normalizePhone(phone), deviceToken: null }
+          recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
         }).catch(() => {
         });
         const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
@@ -1139,10 +1215,7 @@ function authController(store, config, bus) {
           {
             status: 202,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
@@ -1163,10 +1236,7 @@ function authController(store, config, bus) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              "access_token=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0",
-              "refresh_token=; HttpOnly; SameSite=Strict; Path=/auth/refresh; Max-Age=0"
-            ].join(", ")
+            "Set-Cookie": clearedTokenCookies(config)
           }
         }
       );
@@ -1207,10 +1277,7 @@ function authController(store, config, bus) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-              `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-            ].join(", ")
+            "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
           }
         }
       );
@@ -1221,11 +1288,11 @@ function authController(store, config, bus) {
       if (typeof rawEmail !== "string") {
         return setApiResponse3(HTTP3.UNPROCESSABLE, "INVALID_PARAMETER", "email is required");
       }
-      const email = normalizeEmailSafe(rawEmail);
-      if (!email) {
+      const email2 = normalizeEmailSafe(rawEmail);
+      if (!email2) {
         return setApiResponse3(HTTP3.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
       }
-      const user = await users.findByEmail(email);
+      const user = await users.findByEmail(email2);
       if (!user) {
         return setApiResponse3(
           HTTP3.OK,
@@ -1238,12 +1305,9 @@ function authController(store, config, bus) {
       const remaining = checkCooldown(await passwordReset.findLastSentAt(user.id), cooldown);
       if (remaining > 0) {
         return setApiResponse3(
-          HTTP3.TOO_MANY_REQUESTS,
-          "VERIFICATION_COOLDOWN",
-          "Please wait before requesting a new password reset code.",
-          {
-            retryAfter: Math.ceil(remaining / 1e3)
-          }
+          HTTP3.OK,
+          "PASSWORD_RESET_EMAIL_SENT",
+          "Password reset email sent (if account exists)."
         );
       }
       const pin = randomInt(1e5, 1e6).toString();
@@ -1251,7 +1315,7 @@ function authController(store, config, bus) {
       await passwordReset.create(user.id, pin, expiresAt);
       bus?.emit(NOTIFICATION_EVENT2, {
         type: MESSAGE_KEYS.passwordReset,
-        recipient: { email, phone: null, deviceToken: null },
+        recipient: { email: email2, phone: null, deviceToken: null },
         data: { pin }
       }).catch(() => {
       });
@@ -1264,8 +1328,8 @@ function authController(store, config, bus) {
     resetPassword: async (ctx) => {
       const body = ctx.meta["body"];
       const raw = body?.["pin"];
-      const password = body?.["password"];
-      if (typeof raw !== "string" || typeof password !== "string") {
+      const password2 = body?.["password"];
+      if (typeof raw !== "string" || typeof password2 !== "string") {
         return setApiResponse3(
           HTTP3.UNPROCESSABLE,
           "INVALID_PARAMETER",
@@ -1279,7 +1343,7 @@ function authController(store, config, bus) {
           "pin must be a 6-digit code"
         );
       }
-      if (password.length < 8) {
+      if (password2.length < 8) {
         return setApiResponse3(
           HTTP3.UNPROCESSABLE,
           "INVALID_PARAMETER",
@@ -1291,7 +1355,7 @@ function authController(store, config, bus) {
       if (!row || /* @__PURE__ */ new Date() > row.expiresAt) {
         return setApiResponse3(HTTP3.BAD_REQUEST, "PASSWORD_RESET_FAILED", "Invalid or expired pin");
       }
-      const passwordHash = await hashPassword(password);
+      const passwordHash = await hashPassword(password2);
       await store.transaction(async (tx) => {
         await Promise.all([
           tx.query(`UPDATE fonderie_users SET password_hash = $1 WHERE id = $2`, [
@@ -1362,10 +1426,7 @@ function authController(store, config, bus) {
           {
             status: 200,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
@@ -1398,8 +1459,8 @@ function authController(store, config, bus) {
       const resolved = { ...config, ...config.resolve?.(ctx) };
       const cooldown = resolved.verificationCooldown ?? DEFAULT_VERIFICATION_COOLDOWN;
       if (ctx.user.loginMethod === "phone") {
-        const phone = ctx.user.phone;
-        if (!phone) {
+        const phone2 = ctx.user.phone;
+        if (!phone2) {
           return setApiResponse3(
             HTTP3.BAD_REQUEST,
             "NO_PHONE_ON_ACCOUNT",
@@ -1419,11 +1480,11 @@ function authController(store, config, bus) {
         }
         const otp = randomInt(1e5, 1e6).toString();
         const expiresAt2 = new Date(Date.now() + OTP_TTL_MS);
-        await phoneVerif.upsert(ctx.user.id, phone, otp, expiresAt2);
+        await phoneVerif.upsert(ctx.user.id, phone2, otp, expiresAt2);
         bus?.emit(NOTIFICATION_EVENT2, {
           type: MESSAGE_KEYS.phoneOtp,
           data: { otp },
-          recipient: { email: null, phone, deviceToken: null }
+          recipient: { email: null, phone: phone2, deviceToken: null }
         }).catch(() => {
         });
         return setApiResponse3(
@@ -1476,13 +1537,13 @@ function authController(store, config, bus) {
 import { randomInt as randomInt2 } from "crypto";
 import { setApiResponse as setApiResponse4, HTTP as HTTP4 } from "@fonderie/core";
 import { NOTIFICATION_EVENT as NOTIFICATION_EVENT3 } from "@fonderie/events";
-function normalizePhone2(phone) {
-  return phone.trim().replace(/[\s()\-\.]/g, "");
+function normalizePhone2(phone2) {
+  return phone2.trim().replace(/[\s()\-\.]/g, "");
 }
-function isValidPhone2(phone) {
-  return typeof phone === "string" && /^\+?[1-9]\d{6,14}$/.test(normalizePhone2(phone));
+function isValidPhone2(phone2) {
+  return typeof phone2 === "string" && /^\+?[1-9]\d{6,14}$/.test(normalizePhone2(phone2));
 }
-function userController(store, bus) {
+function userController(store, config, bus) {
   const users = new UserModel(store);
   const emailVerif = new EmailVerificationModel(store);
   const phoneVerif = new PhoneVerificationModel(store);
@@ -1671,10 +1732,7 @@ function userController(store, bus) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              "access_token=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0",
-              "refresh_token=; HttpOnly; SameSite=Strict; Path=/auth/refresh; Max-Age=0"
-            ].join(", ")
+            "Set-Cookie": clearedTokenCookies(config)
           }
         }
       );
@@ -1778,10 +1836,7 @@ function oauthController(store, config) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-              `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-            ].join(", ")
+            "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
           }
         }
       );
@@ -1791,46 +1846,47 @@ function oauthController(store, config) {
 
 // src/routes.ts
 function buildAuthRoutes(store, config, bus) {
-  const user = userController(store, bus);
+  const user = userController(store, config, bus);
   const auth = authController(store, config, bus);
   const oauth = oauthController(store, config);
   const mfa = mfaController(store, config, config.appName ?? "Fonderie", bus);
   const verifyGate = config.requireVerification ? requireVerified : (_ctx, next) => next();
   const routes = [
     // Registration & Login (Public)
-    ["POST", "/auth/register", auth.register],
-    ["POST", "/auth/login", auth.login],
+    ["POST", "/auth/register", validate(registerSchema), auth.register],
+    ["POST", "/auth/login", validate(loginSchema), auth.login],
     // Token Management (Public)
-    ["POST", "/auth/refresh", auth.refresh],
+    ["POST", "/auth/refresh", validate(refreshSchema), auth.refresh],
     // Email — Password Recovery (Public)
-    ["POST", "/auth/email/forgot", auth.forgotPassword],
-    ["POST", "/auth/email/reset", auth.resetPassword],
+    ["POST", "/auth/email/forgot", validate(forgotPasswordSchema), auth.forgotPassword],
+    ["POST", "/auth/email/reset", validate(resetPasswordSchema), auth.resetPassword],
     // Verification (Protected — email or phone, determined by loginMethod)
-    ["POST", "/auth/verify", requireAuth, auth.verify],
+    ["POST", "/auth/verify", requireAuth, validate(verifySchema), auth.verify],
     ["GET", "/auth/send-verification", requireAuth, auth.sendVerification],
     // Account Management (Protected)
-    ["POST", "/auth/logout", requireAuth, auth.logout],
+    ["POST", "/auth/logout", requireAuth, validate(refreshSchema), auth.logout],
     // User Profile (Protected; writes also gate on requireVerification)
     ["GET", "/users", requireAuth, user.me],
-    ["PUT", "/users/profile", requireAuth, verifyGate, user.updateProfile],
-    ["PUT", "/users/preferences", requireAuth, verifyGate, user.updatePreferences],
-    ["PUT", "/users/email", requireAuth, verifyGate, user.updateEmail],
-    ["PUT", "/users/phone", requireAuth, verifyGate, user.updatePhone],
-    ["PUT", "/users/password", requireAuth, user.changePassword],
+    ["PUT", "/users/profile", requireAuth, verifyGate, validate(updateProfileSchema), user.updateProfile],
+    ["PUT", "/users/preferences", requireAuth, verifyGate, validate(updatePreferencesSchema), user.updatePreferences],
+    ["PUT", "/users/email", requireAuth, verifyGate, validate(updateEmailSchema), user.updateEmail],
+    ["PUT", "/users/phone", requireAuth, verifyGate, validate(updatePhoneSchema), user.updatePhone],
+    ["PUT", "/users/password", requireAuth, validate(changePasswordSchema), user.changePassword],
     ["DELETE", "/users", requireAuth, verifyGate, user.deleteMe],
     // MFA (email sessions only — requireVerified is always enforced here
     // because MFA is a security feature and email verification is meaningful)
     ["POST", "/auth/mfa/setup", requireAuth, requireEmailLogin, requireVerified, mfa.setup],
     // /auth/mfa/verify accepts both mfaPending tokens (TOTP/backup-code login)
     // and full tokens (setup confirmation), so requireAnyAuth is used here.
-    ["POST", "/auth/mfa/verify", requireAnyAuth, requireEmailLogin, requireVerified, mfa.verify],
-    ["POST", "/auth/mfa/disable", requireAuth, requireEmailLogin, requireVerified, mfa.disable],
+    ["POST", "/auth/mfa/verify", requireAnyAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.verify],
+    ["POST", "/auth/mfa/disable", requireAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.disable],
     [
       "POST",
       "/auth/mfa/backup-codes",
       requireAuth,
       requireEmailLogin,
       requireVerified,
+      validate(mfaTokenSchema),
       mfa.regenerateBackupCodes
     ]
   ];
@@ -1909,7 +1965,9 @@ export {
   normalizeEmail,
   normalizeEmailSafe,
   requireAuth2 as requireAuth,
+  schemas_exports as schemas,
   toUserDTO,
+  validate,
   withSession
 };
 //# sourceMappingURL=index.js.map