@fonderie/auth 1.1.0 → 1.2.0

package/dist/index.d.cts

@@ -2,11 +2,12 @@ export { IMfaChallenge, ISession, IUser } from './types.cjs';
 import { IFonderieModule, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-CLD1WPJs.cjs';
-export { A as AUTH_CONFIG_KEYS, a as AuthMessageKey, b as IAuthRuntimeConfig, c as IAuthSecrets, M as MESSAGE_KEYS, w as withSession } from './session-CLD1WPJs.cjs';
+import { I as IAuthConfig } from './session-C54ksYE8.cjs';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-C54ksYE8.cjs';
 export { IUserDTO, toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';
+import '@fonderie/rate-limit';
 
 declare class AuthModule implements IFonderieModule {
     private store;

package/dist/index.d.ts

@@ -2,11 +2,12 @@ export { IMfaChallenge, ISession, IUser } from './types.js';
 import { IFonderieModule, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-CLD1WPJs.js';
-export { A as AUTH_CONFIG_KEYS, a as AuthMessageKey, b as IAuthRuntimeConfig, c as IAuthSecrets, M as MESSAGE_KEYS, w as withSession } from './session-CLD1WPJs.js';
+import { I as IAuthConfig } from './session-C54ksYE8.js';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-C54ksYE8.js';
 export { IUserDTO, toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';
+import '@fonderie/rate-limit';
 
 declare class AuthModule implements IFonderieModule {
     private store;

package/dist/index.js

@@ -48,6 +48,60 @@ var requireEmailLogin = async (ctx, next) => {
 // src/middlewares/validate.ts
 import { validate } from "@fonderie/core/middlewares";
 
+// src/services/rate-limit.ts
+import {
+  byBodyField,
+  byIp,
+  rateLimit,
+  StoreAdapterStore
+} from "@fonderie/rate-limit";
+var min = (n) => n * 60;
+var DEFAULTS = {
+  // login: 10/15min per IP AND 5/15min per account (credential stuffing
+  // rotates IPs, so the per-account bucket is the one that bites).
+  login: {
+    ip: { capacity: 10, refillPerSec: 10 / min(15) },
+    account: { capacity: 5, refillPerSec: 5 / min(15) },
+    accountField: "email"
+  },
+  // register: 5/hour per IP — signup abuse is IP-shaped.
+  register: { ip: { capacity: 5, refillPerSec: 5 / min(60) } },
+  // forgot: 5/hour per IP AND 3/hour per account (email-bombing protection).
+  forgot: {
+    ip: { capacity: 5, refillPerSec: 5 / min(60) },
+    account: { capacity: 3, refillPerSec: 3 / min(60) },
+    accountField: "email"
+  },
+  // mfaVerify: 10/15min per IP — TOTP brute-force.
+  mfaVerify: { ip: { capacity: 10, refillPerSec: 10 / min(15) } }
+};
+function resolve(route, store, config) {
+  if (config === false) return null;
+  const override = config?.rules?.[route];
+  if (override === false) return null;
+  const backing = config?.store ?? new StoreAdapterStore(store);
+  const def = DEFAULTS[route];
+  return {
+    store: backing,
+    ipRule: override ?? def.ip,
+    ...def.account && def.accountField ? { account: { rule: def.account, field: def.accountField } } : {}
+  };
+}
+function buildAuthIpLimiter(route, store, config) {
+  const r = resolve(route, store, config);
+  if (!r) return null;
+  return rateLimit({ store: r.store, rule: r.ipRule, key: byIp(`auth:${route}`) });
+}
+function buildAuthAccountLimiter(route, store, config) {
+  const r = resolve(route, store, config);
+  if (!r || !r.account) return null;
+  return rateLimit({
+    store: r.store,
+    rule: r.account.rule,
+    key: byBodyField(`auth:${route}`, r.account.field)
+  });
+}
+
 // src/schemas.ts
 var schemas_exports = {};
 __export(schemas_exports, {
@@ -113,6 +167,26 @@ var changePasswordSchema = z.object({
 });
 var mfaTokenSchema = z.object({ token: z.string().trim().min(6).max(64) });
 
+// src/services/cookies.ts
+function secureAttr(config) {
+  const secure = config.secureCookies ?? process.env["NODE_ENV"] === "production";
+  return secure ? "; Secure" : "";
+}
+function tokenPairCookies(accessToken, refreshToken, config) {
+  const secure = secureAttr(config);
+  return [
+    `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/${secure}`,
+    `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh${secure}`
+  ].join(", ");
+}
+function clearedTokenCookies(config) {
+  const secure = secureAttr(config);
+  return [
+    `access_token=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0${secure}`,
+    `refresh_token=; HttpOnly; SameSite=Strict; Path=/auth/refresh; Max-Age=0${secure}`
+  ].join(", ");
+}
+
 // src/controllers/mfa.controller.ts
 import QRCode from "qrcode";
 import { setApiResponse as setApiResponse2, HTTP as HTTP2 } from "@fonderie/core";
@@ -697,10 +771,7 @@ function mfaController(store, config, issuer, bus) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-              `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-            ].join(", ")
+            "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
           }
         }
       );
@@ -1034,10 +1105,7 @@ function authController(store, config, bus) {
           {
             status: 201,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
@@ -1099,10 +1167,7 @@ function authController(store, config, bus) {
           {
             status: 202,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
@@ -1161,10 +1226,7 @@ function authController(store, config, bus) {
           {
             status: 200,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
@@ -1207,10 +1269,7 @@ function authController(store, config, bus) {
           {
             status: 202,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
@@ -1231,10 +1290,7 @@ function authController(store, config, bus) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              "access_token=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0",
-              "refresh_token=; HttpOnly; SameSite=Strict; Path=/auth/refresh; Max-Age=0"
-            ].join(", ")
+            "Set-Cookie": clearedTokenCookies(config)
           }
         }
       );
@@ -1275,10 +1331,7 @@ function authController(store, config, bus) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-              `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-            ].join(", ")
+            "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
           }
         }
       );
@@ -1306,12 +1359,9 @@ function authController(store, config, bus) {
       const remaining = checkCooldown(await passwordReset.findLastSentAt(user.id), cooldown);
       if (remaining > 0) {
         return setApiResponse3(
-          HTTP3.TOO_MANY_REQUESTS,
-          "VERIFICATION_COOLDOWN",
-          "Please wait before requesting a new password reset code.",
-          {
-            retryAfter: Math.ceil(remaining / 1e3)
-          }
+          HTTP3.OK,
+          "PASSWORD_RESET_EMAIL_SENT",
+          "Password reset email sent (if account exists)."
         );
       }
       const pin = randomInt(1e5, 1e6).toString();
@@ -1430,10 +1480,7 @@ function authController(store, config, bus) {
           {
             status: 200,
             headers: {
-              "Set-Cookie": [
-                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-              ].join(", ")
+              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
             }
           }
         );
@@ -1550,7 +1597,7 @@ function normalizePhone2(phone2) {
 function isValidPhone2(phone2) {
   return typeof phone2 === "string" && /^\+?[1-9]\d{6,14}$/.test(normalizePhone2(phone2));
 }
-function userController(store, bus) {
+function userController(store, config, bus) {
   const users = new UserModel(store);
   const emailVerif = new EmailVerificationModel(store);
   const phoneVerif = new PhoneVerificationModel(store);
@@ -1739,10 +1786,7 @@ function userController(store, bus) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              "access_token=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0",
-              "refresh_token=; HttpOnly; SameSite=Strict; Path=/auth/refresh; Max-Age=0"
-            ].join(", ")
+            "Set-Cookie": clearedTokenCookies(config)
           }
         }
       );
@@ -1846,10 +1890,7 @@ function oauthController(store, config) {
         {
           status: 200,
           headers: {
-            "Set-Cookie": [
-              `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
-              `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
-            ].join(", ")
+            "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
           }
         }
       );
@@ -1859,19 +1900,22 @@ function oauthController(store, config) {
 
 // src/routes.ts
 function buildAuthRoutes(store, config, bus) {
-  const user = userController(store, bus);
+  const user = userController(store, config, bus);
   const auth = authController(store, config, bus);
   const oauth = oauthController(store, config);
   const mfa = mfaController(store, config, config.appName ?? "Fonderie", bus);
   const verifyGate = config.requireVerification ? requireVerified : (_ctx, next) => next();
+  const passthrough = (_ctx, next) => next();
+  const ipLimit = (route) => buildAuthIpLimiter(route, store, config.rateLimit) ?? passthrough;
+  const acctLimit = (route) => buildAuthAccountLimiter(route, store, config.rateLimit) ?? passthrough;
   const routes = [
     // Registration & Login (Public)
-    ["POST", "/auth/register", validate(registerSchema), auth.register],
-    ["POST", "/auth/login", validate(loginSchema), auth.login],
+    ["POST", "/auth/register", ipLimit("register"), validate(registerSchema), auth.register],
+    ["POST", "/auth/login", ipLimit("login"), validate(loginSchema), acctLimit("login"), auth.login],
     // Token Management (Public)
     ["POST", "/auth/refresh", validate(refreshSchema), auth.refresh],
     // Email — Password Recovery (Public)
-    ["POST", "/auth/email/forgot", validate(forgotPasswordSchema), auth.forgotPassword],
+    ["POST", "/auth/email/forgot", ipLimit("forgot"), validate(forgotPasswordSchema), acctLimit("forgot"), auth.forgotPassword],
     ["POST", "/auth/email/reset", validate(resetPasswordSchema), auth.resetPassword],
     // Verification (Protected — email or phone, determined by loginMethod)
     ["POST", "/auth/verify", requireAuth, validate(verifySchema), auth.verify],
@@ -1891,7 +1935,7 @@ function buildAuthRoutes(store, config, bus) {
     ["POST", "/auth/mfa/setup", requireAuth, requireEmailLogin, requireVerified, mfa.setup],
     // /auth/mfa/verify accepts both mfaPending tokens (TOTP/backup-code login)
     // and full tokens (setup confirmation), so requireAnyAuth is used here.
-    ["POST", "/auth/mfa/verify", requireAnyAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.verify],
+    ["POST", "/auth/mfa/verify", ipLimit("mfaVerify"), requireAnyAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.verify],
     ["POST", "/auth/mfa/disable", requireAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.disable],
     [
       "POST",
@@ -1975,6 +2019,8 @@ export {
   AUTH_CONFIG_KEYS,
   AuthModule,
   MESSAGE_KEYS,
+  buildAuthAccountLimiter,
+  buildAuthIpLimiter,
   normalizeEmail,
   normalizeEmailSafe,
   requireAuth2 as requireAuth,