@fonderie/auth 1.1.1 → 1.3.0

package/dist/index.d.cts

@@ -2,11 +2,12 @@ export { IMfaChallenge, ISession, IUser } from './types.cjs';
 import { IFonderieModule, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-BGjjwz5_.cjs';
-export { A as AUTH_CONFIG_KEYS, a as AuthMessageKey, b as IAuthRuntimeConfig, c as IAuthSecrets, M as MESSAGE_KEYS, w as withSession } from './session-BGjjwz5_.cjs';
+import { I as IAuthConfig } from './session-DbtCnbiG.cjs';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-DbtCnbiG.cjs';
 export { IUserDTO, toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';
+import '@fonderie/rate-limit';
 
 declare class AuthModule implements IFonderieModule {
     private store;

package/dist/index.d.ts

@@ -2,11 +2,12 @@ export { IMfaChallenge, ISession, IUser } from './types.js';
 import { IFonderieModule, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-BGjjwz5_.js';
-export { A as AUTH_CONFIG_KEYS, a as AuthMessageKey, b as IAuthRuntimeConfig, c as IAuthSecrets, M as MESSAGE_KEYS, w as withSession } from './session-BGjjwz5_.js';
+import { I as IAuthConfig } from './session-DbtCnbiG.js';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-DbtCnbiG.js';
 export { IUserDTO, toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';
+import '@fonderie/rate-limit';
 
 declare class AuthModule implements IFonderieModule {
     private store;

package/dist/index.js

@@ -48,6 +48,60 @@ var requireEmailLogin = async (ctx, next) => {
 // src/middlewares/validate.ts
 import { validate } from "@fonderie/core/middlewares";
 
+// src/services/rate-limit.ts
+import {
+  byBodyField,
+  byIp,
+  rateLimit,
+  StoreAdapterStore
+} from "@fonderie/rate-limit";
+var min = (n) => n * 60;
+var DEFAULTS = {
+  // login: 10/15min per IP AND 5/15min per account (credential stuffing
+  // rotates IPs, so the per-account bucket is the one that bites).
+  login: {
+    ip: { capacity: 10, refillPerSec: 10 / min(15) },
+    account: { capacity: 5, refillPerSec: 5 / min(15) },
+    accountField: "email"
+  },
+  // register: 5/hour per IP — signup abuse is IP-shaped.
+  register: { ip: { capacity: 5, refillPerSec: 5 / min(60) } },
+  // forgot: 5/hour per IP AND 3/hour per account (email-bombing protection).
+  forgot: {
+    ip: { capacity: 5, refillPerSec: 5 / min(60) },
+    account: { capacity: 3, refillPerSec: 3 / min(60) },
+    accountField: "email"
+  },
+  // mfaVerify: 10/15min per IP — TOTP brute-force.
+  mfaVerify: { ip: { capacity: 10, refillPerSec: 10 / min(15) } }
+};
+function resolve(route, store, config) {
+  if (config === false) return null;
+  const override = config?.rules?.[route];
+  if (override === false) return null;
+  const backing = config?.store ?? new StoreAdapterStore(store);
+  const def = DEFAULTS[route];
+  return {
+    store: backing,
+    ipRule: override ?? def.ip,
+    ...def.account && def.accountField ? { account: { rule: def.account, field: def.accountField } } : {}
+  };
+}
+function buildAuthIpLimiter(route, store, config) {
+  const r = resolve(route, store, config);
+  if (!r) return null;
+  return rateLimit({ store: r.store, rule: r.ipRule, key: byIp(`auth:${route}`) });
+}
+function buildAuthAccountLimiter(route, store, config) {
+  const r = resolve(route, store, config);
+  if (!r || !r.account) return null;
+  return rateLimit({
+    store: r.store,
+    rule: r.account.rule,
+    key: byBodyField(`auth:${route}`, r.account.field)
+  });
+}
+
 // src/schemas.ts
 var schemas_exports = {};
 __export(schemas_exports, {
@@ -165,6 +219,7 @@ var EVENT_KEYS = {
 };
 
 // src/services/jwt.ts
+import { randomUUID } from "crypto";
 import jwt from "jsonwebtoken";
 function issueMfaPendingToken(userId, config, loginMethod) {
   return jwt.sign(
@@ -181,19 +236,21 @@ function issueMfaPendingToken(userId, config, loginMethod) {
 }
 function issueTokenPair(userId, config, options) {
   const duration = config.sessionDuration ?? "7d";
+  const accessDuration = config.accessTokenDuration ?? "24h";
   const loginMethod = options.loginMethod;
   const phoneVerified = options.phoneVerified ?? false;
+  const sid = randomUUID();
   const accessToken = jwt.sign(
-    { sub: userId, type: "access", loginMethod, phoneVerified },
+    { sub: userId, type: "access", loginMethod, phoneVerified, sid },
     config.jwtSecret,
-    { expiresIn: "24h" }
+    { expiresIn: accessDuration }
   );
   const refreshToken = jwt.sign(
-    { sub: userId, type: "refresh", loginMethod, phoneVerified },
+    { sub: userId, type: "refresh", loginMethod, phoneVerified, sid },
     config.jwtSecret,
     { expiresIn: duration }
   );
-  return { accessToken, refreshToken };
+  return { accessToken, refreshToken, sid };
 }
 function refreshTokenExpiry(token) {
   const decoded = jwt.decode(token);
@@ -549,12 +606,12 @@ var SessionModel = class {
     this.store = store;
   }
   store;
-  async create(userId, token, expiresAt) {
+  async create(userId, token, expiresAt, sid) {
     await this.store.query(
-      `INSERT INTO fonderie_sessions (user_id, token, expires_at)
-			VALUES ($1, $2, $3)
+      `INSERT INTO fonderie_sessions (user_id, token, expires_at, sid)
+			VALUES ($1, $2, $3, $4)
 			ON CONFLICT (token) DO NOTHING`,
-      [userId, token, expiresAt]
+      [userId, token, expiresAt, sid ?? null]
     );
   }
   async delete(token) {
@@ -567,6 +624,14 @@ var SessionModel = class {
     );
     return rows.length > 0;
   }
+  // Liveness check for session-bound access tokens (by the sid claim).
+  async aliveBySid(sid) {
+    const rows = await this.store.query(
+      `SELECT id FROM fonderie_sessions WHERE sid = $1 AND expires_at > now()`,
+      [sid]
+    );
+    return rows.length > 0;
+  }
 };
 
 // src/models/backup-code.model.ts
@@ -697,10 +762,10 @@ function mfaController(store, config, issuer, bus) {
           await users.enableMfa(ctx.user.id);
         }
       }
-      const { accessToken, refreshToken } = issueTokenPair(ctx.user.id, config, {
+      const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, config, {
         loginMethod: ctx.user.loginMethod
       });
-      await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken));
+      await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
       const fullUser = await users.findById(ctx.user.id);
       if (!fullUser) {
         return setApiResponse2(HTTP2.SERVER_ERROR, "SERVER_ERROR", "User not found after MFA verify");
@@ -1032,10 +1097,10 @@ function authController(store, config, bus) {
           reqOpts
         ).catch(() => {
         });
-        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "email"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         const resolvedRegister = { ...config, ...config.resolve?.(ctx) };
         const requiresVerification = !!resolvedRegister.requireVerification && !user.emailVerifiedAt;
         return Response.json(
@@ -1097,10 +1162,10 @@ function authController(store, config, bus) {
           reqOpts2
         ).catch(() => {
         });
-        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "phone"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         return Response.json(
           {
             reason: "USER_PHONE_REGISTERED",
@@ -1153,10 +1218,10 @@ function authController(store, config, bus) {
             mfaToken
           });
         }
-        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "email"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         const resolvedLogin = { ...config, ...config.resolve?.(ctx) };
         const requiresVerification = !!resolvedLogin.requireVerification && !user.emailVerifiedAt;
         return Response.json(
@@ -1199,10 +1264,10 @@ function authController(store, config, bus) {
           recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
         }).catch(() => {
         });
-        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "phone"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         return Response.json(
           {
             reason: "USER_PHONE_OTP_SENT",
@@ -1263,11 +1328,11 @@ function authController(store, config, bus) {
         return setApiResponse3(HTTP3.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
       }
       await sessions.delete(token);
-      const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+      const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
         loginMethod: payload.loginMethod ?? "email",
         phoneVerified: payload.phoneVerified ?? false
       });
-      await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+      await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
       return Response.json(
         {
           reason: "TOKENS_REFRESHED",
@@ -1398,11 +1463,11 @@ function authController(store, config, bus) {
           );
         }
         await phoneVerif.deleteByUser(ctx.user.id);
-        const { accessToken, refreshToken } = issueTokenPair(ctx.user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, config, {
           loginMethod: "phone",
           phoneVerified: true
         });
-        await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         const verifiedUser = await users.findById(ctx.user.id);
         if (!verifiedUser) {
           return setApiResponse3(HTTP3.NOT_FOUND, "NOT_FOUND", "User not found");
@@ -1820,10 +1885,10 @@ function oauthController(store, config) {
       if (!fullUser) {
         return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
       }
-      const { accessToken, refreshToken } = issueTokenPair(upserted.id, config, {
+      const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, {
         loginMethod: "google"
       });
-      await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken));
+      await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
       return Response.json(
         {
           reason: "GOOGLE_AUTH_SUCCESS",
@@ -1851,14 +1916,17 @@ function buildAuthRoutes(store, config, bus) {
   const oauth = oauthController(store, config);
   const mfa = mfaController(store, config, config.appName ?? "Fonderie", bus);
   const verifyGate = config.requireVerification ? requireVerified : (_ctx, next) => next();
+  const passthrough = (_ctx, next) => next();
+  const ipLimit = (route) => buildAuthIpLimiter(route, store, config.rateLimit) ?? passthrough;
+  const acctLimit = (route) => buildAuthAccountLimiter(route, store, config.rateLimit) ?? passthrough;
   const routes = [
     // Registration & Login (Public)
-    ["POST", "/auth/register", validate(registerSchema), auth.register],
-    ["POST", "/auth/login", validate(loginSchema), auth.login],
+    ["POST", "/auth/register", ipLimit("register"), validate(registerSchema), auth.register],
+    ["POST", "/auth/login", ipLimit("login"), validate(loginSchema), acctLimit("login"), auth.login],
     // Token Management (Public)
     ["POST", "/auth/refresh", validate(refreshSchema), auth.refresh],
     // Email — Password Recovery (Public)
-    ["POST", "/auth/email/forgot", validate(forgotPasswordSchema), auth.forgotPassword],
+    ["POST", "/auth/email/forgot", ipLimit("forgot"), validate(forgotPasswordSchema), acctLimit("forgot"), auth.forgotPassword],
     ["POST", "/auth/email/reset", validate(resetPasswordSchema), auth.resetPassword],
     // Verification (Protected — email or phone, determined by loginMethod)
     ["POST", "/auth/verify", requireAuth, validate(verifySchema), auth.verify],
@@ -1878,7 +1946,7 @@ function buildAuthRoutes(store, config, bus) {
     ["POST", "/auth/mfa/setup", requireAuth, requireEmailLogin, requireVerified, mfa.setup],
     // /auth/mfa/verify accepts both mfaPending tokens (TOTP/backup-code login)
     // and full tokens (setup confirmation), so requireAnyAuth is used here.
-    ["POST", "/auth/mfa/verify", requireAnyAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.verify],
+    ["POST", "/auth/mfa/verify", ipLimit("mfaVerify"), requireAnyAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.verify],
     ["POST", "/auth/mfa/disable", requireAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.disable],
     [
       "POST",
@@ -1902,6 +1970,7 @@ function buildAuthRoutes(store, config, bus) {
 // src/middlewares/session.ts
 function withSession(store, config) {
   const users = new UserModel(store);
+  const sessions = new SessionModel(store);
   return async (ctx, next) => {
     const token = extractToken(ctx.request);
     if (!token) {
@@ -1911,6 +1980,9 @@ function withSession(store, config) {
     if (!payload || payload.type !== "access") {
       return next();
     }
+    if (payload.sid && !await sessions.aliveBySid(payload.sid)) {
+      return next();
+    }
     const user = await users.findById(payload.sub);
     if (!user || user.suspended || user.deletedAt) {
       return next();
@@ -1962,6 +2034,8 @@ export {
   AUTH_CONFIG_KEYS,
   AuthModule,
   MESSAGE_KEYS,
+  buildAuthAccountLimiter,
+  buildAuthIpLimiter,
   normalizeEmail,
   normalizeEmailSafe,
   requireAuth2 as requireAuth,