@fonderie/auth 1.1.1 → 1.3.0

package/dist/index.cjs

@@ -57,6 +57,8 @@ __export(index_exports, {
   AUTH_CONFIG_KEYS: () => AUTH_CONFIG_KEYS,
   AuthModule: () => AuthModule,
   MESSAGE_KEYS: () => MESSAGE_KEYS,
+  buildAuthAccountLimiter: () => buildAuthAccountLimiter,
+  buildAuthIpLimiter: () => buildAuthIpLimiter,
   normalizeEmail: () => normalizeEmail,
   normalizeEmailSafe: () => normalizeEmailSafe,
   requireAuth: () => import_middlewares3.requireAuth,
@@ -86,6 +88,55 @@ var requireEmailLogin = async (ctx, next) => {
 // src/middlewares/validate.ts
 var import_middlewares = require("@fonderie/core/middlewares");
 
+// src/services/rate-limit.ts
+var import_rate_limit = require("@fonderie/rate-limit");
+var min = (n) => n * 60;
+var DEFAULTS = {
+  // login: 10/15min per IP AND 5/15min per account (credential stuffing
+  // rotates IPs, so the per-account bucket is the one that bites).
+  login: {
+    ip: { capacity: 10, refillPerSec: 10 / min(15) },
+    account: { capacity: 5, refillPerSec: 5 / min(15) },
+    accountField: "email"
+  },
+  // register: 5/hour per IP — signup abuse is IP-shaped.
+  register: { ip: { capacity: 5, refillPerSec: 5 / min(60) } },
+  // forgot: 5/hour per IP AND 3/hour per account (email-bombing protection).
+  forgot: {
+    ip: { capacity: 5, refillPerSec: 5 / min(60) },
+    account: { capacity: 3, refillPerSec: 3 / min(60) },
+    accountField: "email"
+  },
+  // mfaVerify: 10/15min per IP — TOTP brute-force.
+  mfaVerify: { ip: { capacity: 10, refillPerSec: 10 / min(15) } }
+};
+function resolve(route, store, config) {
+  if (config === false) return null;
+  const override = config?.rules?.[route];
+  if (override === false) return null;
+  const backing = config?.store ?? new import_rate_limit.StoreAdapterStore(store);
+  const def = DEFAULTS[route];
+  return {
+    store: backing,
+    ipRule: override ?? def.ip,
+    ...def.account && def.accountField ? { account: { rule: def.account, field: def.accountField } } : {}
+  };
+}
+function buildAuthIpLimiter(route, store, config) {
+  const r = resolve(route, store, config);
+  if (!r) return null;
+  return (0, import_rate_limit.rateLimit)({ store: r.store, rule: r.ipRule, key: (0, import_rate_limit.byIp)(`auth:${route}`) });
+}
+function buildAuthAccountLimiter(route, store, config) {
+  const r = resolve(route, store, config);
+  if (!r || !r.account) return null;
+  return (0, import_rate_limit.rateLimit)({
+    store: r.store,
+    rule: r.account.rule,
+    key: (0, import_rate_limit.byBodyField)(`auth:${route}`, r.account.field)
+  });
+}
+
 // src/schemas.ts
 var schemas_exports = {};
 __export(schemas_exports, {
@@ -203,6 +254,7 @@ var EVENT_KEYS = {
 };
 
 // src/services/jwt.ts
+var import_node_crypto = require("crypto");
 var import_jsonwebtoken = __toESM(require("jsonwebtoken"), 1);
 function issueMfaPendingToken(userId, config, loginMethod) {
   return import_jsonwebtoken.default.sign(
@@ -219,19 +271,21 @@ function issueMfaPendingToken(userId, config, loginMethod) {
 }
 function issueTokenPair(userId, config, options) {
   const duration = config.sessionDuration ?? "7d";
+  const accessDuration = config.accessTokenDuration ?? "24h";
   const loginMethod = options.loginMethod;
   const phoneVerified = options.phoneVerified ?? false;
+  const sid = (0, import_node_crypto.randomUUID)();
   const accessToken = import_jsonwebtoken.default.sign(
-    { sub: userId, type: "access", loginMethod, phoneVerified },
+    { sub: userId, type: "access", loginMethod, phoneVerified, sid },
     config.jwtSecret,
-    { expiresIn: "24h" }
+    { expiresIn: accessDuration }
   );
   const refreshToken = import_jsonwebtoken.default.sign(
-    { sub: userId, type: "refresh", loginMethod, phoneVerified },
+    { sub: userId, type: "refresh", loginMethod, phoneVerified, sid },
     config.jwtSecret,
     { expiresIn: duration }
   );
-  return { accessToken, refreshToken };
+  return { accessToken, refreshToken, sid };
 }
 function refreshTokenExpiry(token) {
   const decoded = import_jsonwebtoken.default.decode(token);
@@ -246,7 +300,7 @@ function verifyToken(token, config) {
 }
 
 // src/services/mfa.ts
-var import_node_crypto = require("crypto");
+var import_node_crypto2 = require("crypto");
 var STEP = 30;
 var DRIFT = 1;
 var DIGITS = 6;
@@ -258,7 +312,7 @@ function hotp(secret, counter) {
     c >>= 8;
   }
   const key = Buffer.from(base32Decode(secret));
-  const hmac = (0, import_node_crypto.createHmac)("sha1", key).update(buf).digest();
+  const hmac = (0, import_node_crypto2.createHmac)("sha1", key).update(buf).digest();
   const offset = (hmac[19] ?? 0) & 15;
   const code = (((hmac[offset] ?? 0) & 127) << 24 | ((hmac[offset + 1] ?? 0) & 255) << 16 | ((hmac[offset + 2] ?? 0) & 255) << 8 | (hmac[offset + 3] ?? 0) & 255) % Math.pow(10, DIGITS);
   return code.toString().padStart(DIGITS, "0");
@@ -305,7 +359,7 @@ function base32Encode(buf) {
   return output;
 }
 function generateTotpSecret() {
-  return base32Encode((0, import_node_crypto.randomBytes)(20));
+  return base32Encode((0, import_node_crypto2.randomBytes)(20));
 }
 function generateTotpUri(email2, secret, issuer) {
   const params = new URLSearchParams({
@@ -327,7 +381,7 @@ function verifyTotpToken(token, secret) {
   return false;
 }
 function generateBackupCodes(count = 8) {
-  return Array.from({ length: count }, () => (0, import_node_crypto.randomBytes)(4).toString("hex").toUpperCase());
+  return Array.from({ length: count }, () => (0, import_node_crypto2.randomBytes)(4).toString("hex").toUpperCase());
 }
 
 // src/controllers/mfa.controller.ts
@@ -587,12 +641,12 @@ var SessionModel = class {
     this.store = store;
   }
   store;
-  async create(userId, token, expiresAt) {
+  async create(userId, token, expiresAt, sid) {
     await this.store.query(
-      `INSERT INTO fonderie_sessions (user_id, token, expires_at)
-			VALUES ($1, $2, $3)
+      `INSERT INTO fonderie_sessions (user_id, token, expires_at, sid)
+			VALUES ($1, $2, $3, $4)
 			ON CONFLICT (token) DO NOTHING`,
-      [userId, token, expiresAt]
+      [userId, token, expiresAt, sid ?? null]
     );
   }
   async delete(token) {
@@ -605,6 +659,14 @@ var SessionModel = class {
     );
     return rows.length > 0;
   }
+  // Liveness check for session-bound access tokens (by the sid claim).
+  async aliveBySid(sid) {
+    const rows = await this.store.query(
+      `SELECT id FROM fonderie_sessions WHERE sid = $1 AND expires_at > now()`,
+      [sid]
+    );
+    return rows.length > 0;
+  }
 };
 
 // src/models/backup-code.model.ts
@@ -735,10 +797,10 @@ function mfaController(store, config, issuer, bus) {
           await users.enableMfa(ctx.user.id);
         }
       }
-      const { accessToken, refreshToken } = issueTokenPair(ctx.user.id, config, {
+      const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, config, {
         loginMethod: ctx.user.loginMethod
       });
-      await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken));
+      await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
       const fullUser = await users.findById(ctx.user.id);
       if (!fullUser) {
         return (0, import_core3.setApiResponse)(import_core3.HTTP.SERVER_ERROR, "SERVER_ERROR", "User not found after MFA verify");
@@ -815,7 +877,7 @@ function mfaController(store, config, issuer, bus) {
 }
 
 // src/controllers/auth.controller.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 var import_events2 = require("@fonderie/events");
 var import_core4 = require("@fonderie/core");
 
@@ -1039,7 +1101,7 @@ function authController(store, config, bus) {
         if (!row) {
           return (0, import_core4.setApiResponse)(import_core4.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
         }
-        const pin = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
+        const pin = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
         await emailVerif.create(row.id, pin, expiresAt);
         const user = await users.findById(row.id);
@@ -1070,10 +1132,10 @@ function authController(store, config, bus) {
           reqOpts
         ).catch(() => {
         });
-        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "email"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         const resolvedRegister = { ...config, ...config.resolve?.(ctx) };
         const requiresVerification = !!resolvedRegister.requireVerification && !user.emailVerifiedAt;
         return Response.json(
@@ -1104,7 +1166,7 @@ function authController(store, config, bus) {
           firstName ?? null,
           lastName ?? null
         );
-        const otp = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
+        const otp = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(id, normalizePhone(phone2), otp, expiresAt);
         const user = await users.findById(id);
@@ -1135,10 +1197,10 @@ function authController(store, config, bus) {
           reqOpts2
         ).catch(() => {
         });
-        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "phone"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         return Response.json(
           {
             reason: "USER_PHONE_REGISTERED",
@@ -1191,10 +1253,10 @@ function authController(store, config, bus) {
             mfaToken
           });
         }
-        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "email"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         const resolvedLogin = { ...config, ...config.resolve?.(ctx) };
         const requiresVerification = !!resolvedLogin.requireVerification && !user.emailVerifiedAt;
         return Response.json(
@@ -1228,7 +1290,7 @@ function authController(store, config, bus) {
             "Account suspended. Please contact support."
           );
         }
-        const otp = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
+        const otp = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(user.id, normalizePhone(phone2), otp, expiresAt);
         bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1237,10 +1299,10 @@ function authController(store, config, bus) {
           recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
         }).catch(() => {
         });
-        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "phone"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         return Response.json(
           {
             reason: "USER_PHONE_OTP_SENT",
@@ -1301,11 +1363,11 @@ function authController(store, config, bus) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
       }
       await sessions.delete(token);
-      const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+      const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
         loginMethod: payload.loginMethod ?? "email",
         phoneVerified: payload.phoneVerified ?? false
       });
-      await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+      await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
       return Response.json(
         {
           reason: "TOKENS_REFRESHED",
@@ -1348,7 +1410,7 @@ function authController(store, config, bus) {
           "Password reset email sent (if account exists)."
         );
       }
-      const pin = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
+      const pin = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60);
       await passwordReset.create(user.id, pin, expiresAt);
       bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1436,11 +1498,11 @@ function authController(store, config, bus) {
           );
         }
         await phoneVerif.deleteByUser(ctx.user.id);
-        const { accessToken, refreshToken } = issueTokenPair(ctx.user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, config, {
           loginMethod: "phone",
           phoneVerified: true
         });
-        await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         const verifiedUser = await users.findById(ctx.user.id);
         if (!verifiedUser) {
           return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
@@ -1516,7 +1578,7 @@ function authController(store, config, bus) {
             }
           );
         }
-        const otp = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
+        const otp = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
         const expiresAt2 = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(ctx.user.id, phone2, otp, expiresAt2);
         bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1555,7 +1617,7 @@ function authController(store, config, bus) {
           }
         );
       }
-      const pin = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
+      const pin = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1572,7 +1634,7 @@ function authController(store, config, bus) {
 }
 
 // src/controllers/user.controller.ts
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var import_core5 = require("@fonderie/core");
 var import_events3 = require("@fonderie/events");
 function normalizePhone2(phone2) {
@@ -1665,7 +1727,7 @@ function userController(store, config, bus) {
       if (existing) {
         return (0, import_core5.setApiResponse)(import_core5.HTTP.CONFLICT, "EMAIL_IN_USE", "Email already in use");
       }
-      const pin = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
+      const pin = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       await users.updateEmail(ctx.user.id, normalised);
@@ -1707,7 +1769,7 @@ function userController(store, config, bus) {
       if (existing) {
         return (0, import_core5.setApiResponse)(import_core5.HTTP.CONFLICT, "PHONE_IN_USE", "Phone number already in use");
       }
-      const otp = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
+      const otp = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 10 * 60 * 1e3);
       await phoneVerif.upsert(ctx.user.id, normalised, otp, expiresAt);
       await users.updatePhone(ctx.user.id, normalised);
@@ -1858,10 +1920,10 @@ function oauthController(store, config) {
       if (!fullUser) {
         return (0, import_core6.setApiResponse)(import_core6.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
       }
-      const { accessToken, refreshToken } = issueTokenPair(upserted.id, config, {
+      const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, {
         loginMethod: "google"
       });
-      await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken));
+      await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
       return Response.json(
         {
           reason: "GOOGLE_AUTH_SUCCESS",
@@ -1889,14 +1951,17 @@ function buildAuthRoutes(store, config, bus) {
   const oauth = oauthController(store, config);
   const mfa = mfaController(store, config, config.appName ?? "Fonderie", bus);
   const verifyGate = config.requireVerification ? import_middlewares2.requireVerified : (_ctx, next) => next();
+  const passthrough = (_ctx, next) => next();
+  const ipLimit = (route) => buildAuthIpLimiter(route, store, config.rateLimit) ?? passthrough;
+  const acctLimit = (route) => buildAuthAccountLimiter(route, store, config.rateLimit) ?? passthrough;
   const routes = [
     // Registration & Login (Public)
-    ["POST", "/auth/register", (0, import_middlewares.validate)(registerSchema), auth.register],
-    ["POST", "/auth/login", (0, import_middlewares.validate)(loginSchema), auth.login],
+    ["POST", "/auth/register", ipLimit("register"), (0, import_middlewares.validate)(registerSchema), auth.register],
+    ["POST", "/auth/login", ipLimit("login"), (0, import_middlewares.validate)(loginSchema), acctLimit("login"), auth.login],
     // Token Management (Public)
     ["POST", "/auth/refresh", (0, import_middlewares.validate)(refreshSchema), auth.refresh],
     // Email — Password Recovery (Public)
-    ["POST", "/auth/email/forgot", (0, import_middlewares.validate)(forgotPasswordSchema), auth.forgotPassword],
+    ["POST", "/auth/email/forgot", ipLimit("forgot"), (0, import_middlewares.validate)(forgotPasswordSchema), acctLimit("forgot"), auth.forgotPassword],
     ["POST", "/auth/email/reset", (0, import_middlewares.validate)(resetPasswordSchema), auth.resetPassword],
     // Verification (Protected — email or phone, determined by loginMethod)
     ["POST", "/auth/verify", import_middlewares2.requireAuth, (0, import_middlewares.validate)(verifySchema), auth.verify],
@@ -1916,7 +1981,7 @@ function buildAuthRoutes(store, config, bus) {
     ["POST", "/auth/mfa/setup", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, mfa.setup],
     // /auth/mfa/verify accepts both mfaPending tokens (TOTP/backup-code login)
     // and full tokens (setup confirmation), so requireAnyAuth is used here.
-    ["POST", "/auth/mfa/verify", import_middlewares2.requireAnyAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.verify],
+    ["POST", "/auth/mfa/verify", ipLimit("mfaVerify"), import_middlewares2.requireAnyAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.verify],
     ["POST", "/auth/mfa/disable", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.disable],
     [
       "POST",
@@ -1940,6 +2005,7 @@ function buildAuthRoutes(store, config, bus) {
 // src/middlewares/session.ts
 function withSession(store, config) {
   const users = new UserModel(store);
+  const sessions = new SessionModel(store);
   return async (ctx, next) => {
     const token = extractToken(ctx.request);
     if (!token) {
@@ -1949,6 +2015,9 @@ function withSession(store, config) {
     if (!payload || payload.type !== "access") {
       return next();
     }
+    if (payload.sid && !await sessions.aliveBySid(payload.sid)) {
+      return next();
+    }
     const user = await users.findById(payload.sub);
     if (!user || user.suspended || user.deletedAt) {
       return next();
@@ -2001,6 +2070,8 @@ var import_middlewares3 = require("@fonderie/core/middlewares");
   AUTH_CONFIG_KEYS,
   AuthModule,
   MESSAGE_KEYS,
+  buildAuthAccountLimiter,
+  buildAuthIpLimiter,
   normalizeEmail,
   normalizeEmailSafe,
   requireAuth,