@fonderie/auth 1.1.1 → 1.2.0

package/dist/index.cjs

@@ -57,6 +57,8 @@ __export(index_exports, {
   AUTH_CONFIG_KEYS: () => AUTH_CONFIG_KEYS,
   AuthModule: () => AuthModule,
   MESSAGE_KEYS: () => MESSAGE_KEYS,
+  buildAuthAccountLimiter: () => buildAuthAccountLimiter,
+  buildAuthIpLimiter: () => buildAuthIpLimiter,
   normalizeEmail: () => normalizeEmail,
   normalizeEmailSafe: () => normalizeEmailSafe,
   requireAuth: () => import_middlewares3.requireAuth,
@@ -86,6 +88,55 @@ var requireEmailLogin = async (ctx, next) => {
 // src/middlewares/validate.ts
 var import_middlewares = require("@fonderie/core/middlewares");
 
+// src/services/rate-limit.ts
+var import_rate_limit = require("@fonderie/rate-limit");
+var min = (n) => n * 60;
+var DEFAULTS = {
+  // login: 10/15min per IP AND 5/15min per account (credential stuffing
+  // rotates IPs, so the per-account bucket is the one that bites).
+  login: {
+    ip: { capacity: 10, refillPerSec: 10 / min(15) },
+    account: { capacity: 5, refillPerSec: 5 / min(15) },
+    accountField: "email"
+  },
+  // register: 5/hour per IP — signup abuse is IP-shaped.
+  register: { ip: { capacity: 5, refillPerSec: 5 / min(60) } },
+  // forgot: 5/hour per IP AND 3/hour per account (email-bombing protection).
+  forgot: {
+    ip: { capacity: 5, refillPerSec: 5 / min(60) },
+    account: { capacity: 3, refillPerSec: 3 / min(60) },
+    accountField: "email"
+  },
+  // mfaVerify: 10/15min per IP — TOTP brute-force.
+  mfaVerify: { ip: { capacity: 10, refillPerSec: 10 / min(15) } }
+};
+function resolve(route, store, config) {
+  if (config === false) return null;
+  const override = config?.rules?.[route];
+  if (override === false) return null;
+  const backing = config?.store ?? new import_rate_limit.StoreAdapterStore(store);
+  const def = DEFAULTS[route];
+  return {
+    store: backing,
+    ipRule: override ?? def.ip,
+    ...def.account && def.accountField ? { account: { rule: def.account, field: def.accountField } } : {}
+  };
+}
+function buildAuthIpLimiter(route, store, config) {
+  const r = resolve(route, store, config);
+  if (!r) return null;
+  return (0, import_rate_limit.rateLimit)({ store: r.store, rule: r.ipRule, key: (0, import_rate_limit.byIp)(`auth:${route}`) });
+}
+function buildAuthAccountLimiter(route, store, config) {
+  const r = resolve(route, store, config);
+  if (!r || !r.account) return null;
+  return (0, import_rate_limit.rateLimit)({
+    store: r.store,
+    rule: r.account.rule,
+    key: (0, import_rate_limit.byBodyField)(`auth:${route}`, r.account.field)
+  });
+}
+
 // src/schemas.ts
 var schemas_exports = {};
 __export(schemas_exports, {
@@ -1889,14 +1940,17 @@ function buildAuthRoutes(store, config, bus) {
   const oauth = oauthController(store, config);
   const mfa = mfaController(store, config, config.appName ?? "Fonderie", bus);
   const verifyGate = config.requireVerification ? import_middlewares2.requireVerified : (_ctx, next) => next();
+  const passthrough = (_ctx, next) => next();
+  const ipLimit = (route) => buildAuthIpLimiter(route, store, config.rateLimit) ?? passthrough;
+  const acctLimit = (route) => buildAuthAccountLimiter(route, store, config.rateLimit) ?? passthrough;
   const routes = [
     // Registration & Login (Public)
-    ["POST", "/auth/register", (0, import_middlewares.validate)(registerSchema), auth.register],
-    ["POST", "/auth/login", (0, import_middlewares.validate)(loginSchema), auth.login],
+    ["POST", "/auth/register", ipLimit("register"), (0, import_middlewares.validate)(registerSchema), auth.register],
+    ["POST", "/auth/login", ipLimit("login"), (0, import_middlewares.validate)(loginSchema), acctLimit("login"), auth.login],
     // Token Management (Public)
     ["POST", "/auth/refresh", (0, import_middlewares.validate)(refreshSchema), auth.refresh],
     // Email — Password Recovery (Public)
-    ["POST", "/auth/email/forgot", (0, import_middlewares.validate)(forgotPasswordSchema), auth.forgotPassword],
+    ["POST", "/auth/email/forgot", ipLimit("forgot"), (0, import_middlewares.validate)(forgotPasswordSchema), acctLimit("forgot"), auth.forgotPassword],
     ["POST", "/auth/email/reset", (0, import_middlewares.validate)(resetPasswordSchema), auth.resetPassword],
     // Verification (Protected — email or phone, determined by loginMethod)
     ["POST", "/auth/verify", import_middlewares2.requireAuth, (0, import_middlewares.validate)(verifySchema), auth.verify],
@@ -1916,7 +1970,7 @@ function buildAuthRoutes(store, config, bus) {
     ["POST", "/auth/mfa/setup", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, mfa.setup],
     // /auth/mfa/verify accepts both mfaPending tokens (TOTP/backup-code login)
     // and full tokens (setup confirmation), so requireAnyAuth is used here.
-    ["POST", "/auth/mfa/verify", import_middlewares2.requireAnyAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.verify],
+    ["POST", "/auth/mfa/verify", ipLimit("mfaVerify"), import_middlewares2.requireAnyAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.verify],
     ["POST", "/auth/mfa/disable", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.disable],
     [
       "POST",
@@ -2001,6 +2055,8 @@ var import_middlewares3 = require("@fonderie/core/middlewares");
   AUTH_CONFIG_KEYS,
   AuthModule,
   MESSAGE_KEYS,
+  buildAuthAccountLimiter,
+  buildAuthIpLimiter,
   normalizeEmail,
   normalizeEmailSafe,
   requireAuth,