@fonderie/auth 1.2.0 → 1.3.0

package/dist/index.cjs

@@ -254,6 +254,7 @@ var EVENT_KEYS = {
 };
 
 // src/services/jwt.ts
+var import_node_crypto = require("crypto");
 var import_jsonwebtoken = __toESM(require("jsonwebtoken"), 1);
 function issueMfaPendingToken(userId, config, loginMethod) {
   return import_jsonwebtoken.default.sign(
@@ -270,19 +271,21 @@ function issueMfaPendingToken(userId, config, loginMethod) {
 }
 function issueTokenPair(userId, config, options) {
   const duration = config.sessionDuration ?? "7d";
+  const accessDuration = config.accessTokenDuration ?? "24h";
   const loginMethod = options.loginMethod;
   const phoneVerified = options.phoneVerified ?? false;
+  const sid = (0, import_node_crypto.randomUUID)();
   const accessToken = import_jsonwebtoken.default.sign(
-    { sub: userId, type: "access", loginMethod, phoneVerified },
+    { sub: userId, type: "access", loginMethod, phoneVerified, sid },
     config.jwtSecret,
-    { expiresIn: "24h" }
+    { expiresIn: accessDuration }
   );
   const refreshToken = import_jsonwebtoken.default.sign(
-    { sub: userId, type: "refresh", loginMethod, phoneVerified },
+    { sub: userId, type: "refresh", loginMethod, phoneVerified, sid },
     config.jwtSecret,
     { expiresIn: duration }
   );
-  return { accessToken, refreshToken };
+  return { accessToken, refreshToken, sid };
 }
 function refreshTokenExpiry(token) {
   const decoded = import_jsonwebtoken.default.decode(token);
@@ -297,7 +300,7 @@ function verifyToken(token, config) {
 }
 
 // src/services/mfa.ts
-var import_node_crypto = require("crypto");
+var import_node_crypto2 = require("crypto");
 var STEP = 30;
 var DRIFT = 1;
 var DIGITS = 6;
@@ -309,7 +312,7 @@ function hotp(secret, counter) {
     c >>= 8;
   }
   const key = Buffer.from(base32Decode(secret));
-  const hmac = (0, import_node_crypto.createHmac)("sha1", key).update(buf).digest();
+  const hmac = (0, import_node_crypto2.createHmac)("sha1", key).update(buf).digest();
   const offset = (hmac[19] ?? 0) & 15;
   const code = (((hmac[offset] ?? 0) & 127) << 24 | ((hmac[offset + 1] ?? 0) & 255) << 16 | ((hmac[offset + 2] ?? 0) & 255) << 8 | (hmac[offset + 3] ?? 0) & 255) % Math.pow(10, DIGITS);
   return code.toString().padStart(DIGITS, "0");
@@ -356,7 +359,7 @@ function base32Encode(buf) {
   return output;
 }
 function generateTotpSecret() {
-  return base32Encode((0, import_node_crypto.randomBytes)(20));
+  return base32Encode((0, import_node_crypto2.randomBytes)(20));
 }
 function generateTotpUri(email2, secret, issuer) {
   const params = new URLSearchParams({
@@ -378,7 +381,7 @@ function verifyTotpToken(token, secret) {
   return false;
 }
 function generateBackupCodes(count = 8) {
-  return Array.from({ length: count }, () => (0, import_node_crypto.randomBytes)(4).toString("hex").toUpperCase());
+  return Array.from({ length: count }, () => (0, import_node_crypto2.randomBytes)(4).toString("hex").toUpperCase());
 }
 
 // src/controllers/mfa.controller.ts
@@ -638,12 +641,12 @@ var SessionModel = class {
     this.store = store;
   }
   store;
-  async create(userId, token, expiresAt) {
+  async create(userId, token, expiresAt, sid) {
     await this.store.query(
-      `INSERT INTO fonderie_sessions (user_id, token, expires_at)
-			VALUES ($1, $2, $3)
+      `INSERT INTO fonderie_sessions (user_id, token, expires_at, sid)
+			VALUES ($1, $2, $3, $4)
 			ON CONFLICT (token) DO NOTHING`,
-      [userId, token, expiresAt]
+      [userId, token, expiresAt, sid ?? null]
     );
   }
   async delete(token) {
@@ -656,6 +659,14 @@ var SessionModel = class {
     );
     return rows.length > 0;
   }
+  // Liveness check for session-bound access tokens (by the sid claim).
+  async aliveBySid(sid) {
+    const rows = await this.store.query(
+      `SELECT id FROM fonderie_sessions WHERE sid = $1 AND expires_at > now()`,
+      [sid]
+    );
+    return rows.length > 0;
+  }
 };
 
 // src/models/backup-code.model.ts
@@ -786,10 +797,10 @@ function mfaController(store, config, issuer, bus) {
           await users.enableMfa(ctx.user.id);
         }
       }
-      const { accessToken, refreshToken } = issueTokenPair(ctx.user.id, config, {
+      const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, config, {
         loginMethod: ctx.user.loginMethod
       });
-      await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken));
+      await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
       const fullUser = await users.findById(ctx.user.id);
       if (!fullUser) {
         return (0, import_core3.setApiResponse)(import_core3.HTTP.SERVER_ERROR, "SERVER_ERROR", "User not found after MFA verify");
@@ -866,7 +877,7 @@ function mfaController(store, config, issuer, bus) {
 }
 
 // src/controllers/auth.controller.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 var import_events2 = require("@fonderie/events");
 var import_core4 = require("@fonderie/core");
 
@@ -1090,7 +1101,7 @@ function authController(store, config, bus) {
         if (!row) {
           return (0, import_core4.setApiResponse)(import_core4.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
         }
-        const pin = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
+        const pin = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
         await emailVerif.create(row.id, pin, expiresAt);
         const user = await users.findById(row.id);
@@ -1121,10 +1132,10 @@ function authController(store, config, bus) {
           reqOpts
         ).catch(() => {
         });
-        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "email"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         const resolvedRegister = { ...config, ...config.resolve?.(ctx) };
         const requiresVerification = !!resolvedRegister.requireVerification && !user.emailVerifiedAt;
         return Response.json(
@@ -1155,7 +1166,7 @@ function authController(store, config, bus) {
           firstName ?? null,
           lastName ?? null
         );
-        const otp = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
+        const otp = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(id, normalizePhone(phone2), otp, expiresAt);
         const user = await users.findById(id);
@@ -1186,10 +1197,10 @@ function authController(store, config, bus) {
           reqOpts2
         ).catch(() => {
         });
-        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "phone"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         return Response.json(
           {
             reason: "USER_PHONE_REGISTERED",
@@ -1242,10 +1253,10 @@ function authController(store, config, bus) {
             mfaToken
           });
         }
-        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "email"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         const resolvedLogin = { ...config, ...config.resolve?.(ctx) };
         const requiresVerification = !!resolvedLogin.requireVerification && !user.emailVerifiedAt;
         return Response.json(
@@ -1279,7 +1290,7 @@ function authController(store, config, bus) {
             "Account suspended. Please contact support."
           );
         }
-        const otp = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
+        const otp = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(user.id, normalizePhone(phone2), otp, expiresAt);
         bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1288,10 +1299,10 @@ function authController(store, config, bus) {
           recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
         }).catch(() => {
         });
-        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "phone"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         return Response.json(
           {
             reason: "USER_PHONE_OTP_SENT",
@@ -1352,11 +1363,11 @@ function authController(store, config, bus) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
       }
       await sessions.delete(token);
-      const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+      const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
         loginMethod: payload.loginMethod ?? "email",
         phoneVerified: payload.phoneVerified ?? false
       });
-      await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+      await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
       return Response.json(
         {
           reason: "TOKENS_REFRESHED",
@@ -1399,7 +1410,7 @@ function authController(store, config, bus) {
           "Password reset email sent (if account exists)."
         );
       }
-      const pin = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
+      const pin = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60);
       await passwordReset.create(user.id, pin, expiresAt);
       bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1487,11 +1498,11 @@ function authController(store, config, bus) {
           );
         }
         await phoneVerif.deleteByUser(ctx.user.id);
-        const { accessToken, refreshToken } = issueTokenPair(ctx.user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, config, {
           loginMethod: "phone",
           phoneVerified: true
         });
-        await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         const verifiedUser = await users.findById(ctx.user.id);
         if (!verifiedUser) {
           return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
@@ -1567,7 +1578,7 @@ function authController(store, config, bus) {
             }
           );
         }
-        const otp = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
+        const otp = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
         const expiresAt2 = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(ctx.user.id, phone2, otp, expiresAt2);
         bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1606,7 +1617,7 @@ function authController(store, config, bus) {
           }
         );
       }
-      const pin = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
+      const pin = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1623,7 +1634,7 @@ function authController(store, config, bus) {
 }
 
 // src/controllers/user.controller.ts
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var import_core5 = require("@fonderie/core");
 var import_events3 = require("@fonderie/events");
 function normalizePhone2(phone2) {
@@ -1716,7 +1727,7 @@ function userController(store, config, bus) {
       if (existing) {
         return (0, import_core5.setApiResponse)(import_core5.HTTP.CONFLICT, "EMAIL_IN_USE", "Email already in use");
       }
-      const pin = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
+      const pin = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       await users.updateEmail(ctx.user.id, normalised);
@@ -1758,7 +1769,7 @@ function userController(store, config, bus) {
       if (existing) {
         return (0, import_core5.setApiResponse)(import_core5.HTTP.CONFLICT, "PHONE_IN_USE", "Phone number already in use");
       }
-      const otp = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
+      const otp = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 10 * 60 * 1e3);
       await phoneVerif.upsert(ctx.user.id, normalised, otp, expiresAt);
       await users.updatePhone(ctx.user.id, normalised);
@@ -1909,10 +1920,10 @@ function oauthController(store, config) {
       if (!fullUser) {
         return (0, import_core6.setApiResponse)(import_core6.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
       }
-      const { accessToken, refreshToken } = issueTokenPair(upserted.id, config, {
+      const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, {
         loginMethod: "google"
       });
-      await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken));
+      await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
       return Response.json(
         {
           reason: "GOOGLE_AUTH_SUCCESS",
@@ -1994,6 +2005,7 @@ function buildAuthRoutes(store, config, bus) {
 // src/middlewares/session.ts
 function withSession(store, config) {
   const users = new UserModel(store);
+  const sessions = new SessionModel(store);
   return async (ctx, next) => {
     const token = extractToken(ctx.request);
     if (!token) {
@@ -2003,6 +2015,9 @@ function withSession(store, config) {
     if (!payload || payload.type !== "access") {
       return next();
     }
+    if (payload.sid && !await sessions.aliveBySid(payload.sid)) {
+      return next();
+    }
     const user = await users.findById(payload.sub);
     if (!user || user.suspended || user.deletedAt) {
       return next();