@fonderie/auth 1.1.0 → 1.1.1

package/dist/index.cjs

@@ -151,6 +151,26 @@ var changePasswordSchema = import_zod.z.object({
 });
 var mfaTokenSchema = import_zod.z.object({ token: import_zod.z.string().trim().min(6).max(64) });
 
+// src/services/cookies.ts
+function secureAttr(config) {
+  const secure = config.secureCookies ?? process.env["NODE_ENV"] === "production";
+  return secure ? "; Secure" : "";
+}
+function tokenPairCookies(accessToken, refreshToken, config) {
+  const secure = secureAttr(config);
+  return [
+    `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/${secure}`,
+    `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh${secure}`
+  ].join(", ");
+}
+function clearedTokenCookies(config) {
+  const secure = secureAttr(config);
+  return [
+    `access_token=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0${secure}`,
+    `refresh_token=; HttpOnly; SameSite=Strict; Path=/auth/refresh; Max-Age=0${secure}`
+  ].join(", ");
+}
+
 // src/controllers/mfa.controller.ts
 var import_qrcode = __toESM(require("qrcode"), 1);
 var import_core3 = require("@fonderie/core");
@@ -735,10 +755,7 @@ function mfaController(store, config, issuer, bus) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-              `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-            ].join(", ")
+            "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
           }
         }
       );
@@ -1072,10 +1089,7 @@ function authController(store, config, bus) {
           {
             status: 201,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
@@ -1137,10 +1151,7 @@ function authController(store, config, bus) {
           {
             status: 202,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
@@ -1199,10 +1210,7 @@ function authController(store, config, bus) {
           {
             status: 200,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
@@ -1245,10 +1253,7 @@ function authController(store, config, bus) {
           {
             status: 202,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
@@ -1269,10 +1274,7 @@ function authController(store, config, bus) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              "access_token=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0",
-              "refresh_token=; HttpOnly; SameSite=Strict; Path=/auth/refresh; Max-Age=0"
-            ].join(", ")
+            "Set-Cookie": clearedTokenCookies(config)
           }
         }
       );
@@ -1313,10 +1315,7 @@ function authController(store, config, bus) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-              `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-            ].join(", ")
+            "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
           }
         }
       );
@@ -1344,12 +1343,9 @@ function authController(store, config, bus) {
       const remaining = checkCooldown(await passwordReset.findLastSentAt(user.id), cooldown);
       if (remaining > 0) {
         return (0, import_core4.setApiResponse)(
-          import_core4.HTTP.TOO_MANY_REQUESTS,
-          "VERIFICATION_COOLDOWN",
-          "Please wait before requesting a new password reset code.",
-          {
-            retryAfter: Math.ceil(remaining / 1e3)
-          }
+          import_core4.HTTP.OK,
+          "PASSWORD_RESET_EMAIL_SENT",
+          "Password reset email sent (if account exists)."
         );
       }
       const pin = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
@@ -1468,10 +1464,7 @@ function authController(store, config, bus) {
           {
             status: 200,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
@@ -1588,7 +1581,7 @@ function normalizePhone2(phone2) {
 function isValidPhone2(phone2) {
   return typeof phone2 === "string" && /^\+?[1-9]\d{6,14}$/.test(normalizePhone2(phone2));
 }
-function userController(store, bus) {
+function userController(store, config, bus) {
   const users = new UserModel(store);
   const emailVerif = new EmailVerificationModel(store);
   const phoneVerif = new PhoneVerificationModel(store);
@@ -1777,10 +1770,7 @@ function userController(store, bus) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              "access_token=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0",
-              "refresh_token=; HttpOnly; SameSite=Strict; Path=/auth/refresh; Max-Age=0"
-            ].join(", ")
+            "Set-Cookie": clearedTokenCookies(config)
           }
         }
       );
@@ -1884,10 +1874,7 @@ function oauthController(store, config) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-              `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-            ].join(", ")
+            "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
           }
         }
       );
@@ -1897,7 +1884,7 @@ function oauthController(store, config) {
 
 // src/routes.ts
 function buildAuthRoutes(store, config, bus) {
-  const user = userController(store, bus);
+  const user = userController(store, config, bus);
   const auth = authController(store, config, bus);
   const oauth = oauthController(store, config);
   const mfa = mfaController(store, config, config.appName ?? "Fonderie", bus);