@fonderie/auth 1.2.0 → 1.3.0

package/dist/index.d.cts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.cjs';
 import { IFonderieModule, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-C54ksYE8.cjs';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-C54ksYE8.cjs';
+import { I as IAuthConfig } from './session-DbtCnbiG.cjs';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-DbtCnbiG.cjs';
 export { IUserDTO, toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';

package/dist/index.d.ts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.js';
 import { IFonderieModule, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-C54ksYE8.js';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-C54ksYE8.js';
+import { I as IAuthConfig } from './session-DbtCnbiG.js';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-DbtCnbiG.js';
 export { IUserDTO, toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';

package/dist/index.js

@@ -219,6 +219,7 @@ var EVENT_KEYS = {
 };
 
 // src/services/jwt.ts
+import { randomUUID } from "crypto";
 import jwt from "jsonwebtoken";
 function issueMfaPendingToken(userId, config, loginMethod) {
   return jwt.sign(
@@ -235,19 +236,21 @@ function issueMfaPendingToken(userId, config, loginMethod) {
 }
 function issueTokenPair(userId, config, options) {
   const duration = config.sessionDuration ?? "7d";
+  const accessDuration = config.accessTokenDuration ?? "24h";
   const loginMethod = options.loginMethod;
   const phoneVerified = options.phoneVerified ?? false;
+  const sid = randomUUID();
   const accessToken = jwt.sign(
-    { sub: userId, type: "access", loginMethod, phoneVerified },
+    { sub: userId, type: "access", loginMethod, phoneVerified, sid },
     config.jwtSecret,
-    { expiresIn: "24h" }
+    { expiresIn: accessDuration }
   );
   const refreshToken = jwt.sign(
-    { sub: userId, type: "refresh", loginMethod, phoneVerified },
+    { sub: userId, type: "refresh", loginMethod, phoneVerified, sid },
     config.jwtSecret,
     { expiresIn: duration }
   );
-  return { accessToken, refreshToken };
+  return { accessToken, refreshToken, sid };
 }
 function refreshTokenExpiry(token) {
   const decoded = jwt.decode(token);
@@ -603,12 +606,12 @@ var SessionModel = class {
     this.store = store;
   }
   store;
-  async create(userId, token, expiresAt) {
+  async create(userId, token, expiresAt, sid) {
     await this.store.query(
-      `INSERT INTO fonderie_sessions (user_id, token, expires_at)
-			VALUES ($1, $2, $3)
+      `INSERT INTO fonderie_sessions (user_id, token, expires_at, sid)
+			VALUES ($1, $2, $3, $4)
 			ON CONFLICT (token) DO NOTHING`,
-      [userId, token, expiresAt]
+      [userId, token, expiresAt, sid ?? null]
     );
   }
   async delete(token) {
@@ -621,6 +624,14 @@ var SessionModel = class {
     );
     return rows.length > 0;
   }
+  // Liveness check for session-bound access tokens (by the sid claim).
+  async aliveBySid(sid) {
+    const rows = await this.store.query(
+      `SELECT id FROM fonderie_sessions WHERE sid = $1 AND expires_at > now()`,
+      [sid]
+    );
+    return rows.length > 0;
+  }
 };
 
 // src/models/backup-code.model.ts
@@ -751,10 +762,10 @@ function mfaController(store, config, issuer, bus) {
           await users.enableMfa(ctx.user.id);
         }
       }
-      const { accessToken, refreshToken } = issueTokenPair(ctx.user.id, config, {
+      const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, config, {
         loginMethod: ctx.user.loginMethod
       });
-      await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken));
+      await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
       const fullUser = await users.findById(ctx.user.id);
       if (!fullUser) {
         return setApiResponse2(HTTP2.SERVER_ERROR, "SERVER_ERROR", "User not found after MFA verify");
@@ -1086,10 +1097,10 @@ function authController(store, config, bus) {
           reqOpts
         ).catch(() => {
         });
-        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "email"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         const resolvedRegister = { ...config, ...config.resolve?.(ctx) };
         const requiresVerification = !!resolvedRegister.requireVerification && !user.emailVerifiedAt;
         return Response.json(
@@ -1151,10 +1162,10 @@ function authController(store, config, bus) {
           reqOpts2
         ).catch(() => {
         });
-        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "phone"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         return Response.json(
           {
             reason: "USER_PHONE_REGISTERED",
@@ -1207,10 +1218,10 @@ function authController(store, config, bus) {
             mfaToken
           });
         }
-        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "email"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         const resolvedLogin = { ...config, ...config.resolve?.(ctx) };
         const requiresVerification = !!resolvedLogin.requireVerification && !user.emailVerifiedAt;
         return Response.json(
@@ -1253,10 +1264,10 @@ function authController(store, config, bus) {
           recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
         }).catch(() => {
         });
-        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "phone"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         return Response.json(
           {
             reason: "USER_PHONE_OTP_SENT",
@@ -1317,11 +1328,11 @@ function authController(store, config, bus) {
         return setApiResponse3(HTTP3.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
       }
       await sessions.delete(token);
-      const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+      const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
         loginMethod: payload.loginMethod ?? "email",
         phoneVerified: payload.phoneVerified ?? false
       });
-      await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+      await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
       return Response.json(
         {
           reason: "TOKENS_REFRESHED",
@@ -1452,11 +1463,11 @@ function authController(store, config, bus) {
           );
         }
         await phoneVerif.deleteByUser(ctx.user.id);
-        const { accessToken, refreshToken } = issueTokenPair(ctx.user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, config, {
           loginMethod: "phone",
           phoneVerified: true
         });
-        await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         const verifiedUser = await users.findById(ctx.user.id);
         if (!verifiedUser) {
           return setApiResponse3(HTTP3.NOT_FOUND, "NOT_FOUND", "User not found");
@@ -1874,10 +1885,10 @@ function oauthController(store, config) {
       if (!fullUser) {
         return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
       }
-      const { accessToken, refreshToken } = issueTokenPair(upserted.id, config, {
+      const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, {
         loginMethod: "google"
       });
-      await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken));
+      await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
       return Response.json(
         {
           reason: "GOOGLE_AUTH_SUCCESS",
@@ -1959,6 +1970,7 @@ function buildAuthRoutes(store, config, bus) {
 // src/middlewares/session.ts
 function withSession(store, config) {
   const users = new UserModel(store);
+  const sessions = new SessionModel(store);
   return async (ctx, next) => {
     const token = extractToken(ctx.request);
     if (!token) {
@@ -1968,6 +1980,9 @@ function withSession(store, config) {
     if (!payload || payload.type !== "access") {
       return next();
     }
+    if (payload.sid && !await sessions.aliveBySid(payload.sid)) {
+      return next();
+    }
     const user = await users.findById(payload.sub);
     if (!user || user.suspended || user.deletedAt) {
       return next();