@fonderie/auth 1.3.2 → 2.1.0

package/brain/signatures.md

@@ -60,6 +60,7 @@ interface IAuthConfig extends IAuthSecrets, IAuthRuntimeConfig {
     resolve?: (ctx: {
         meta: Record<string, unknown>;
     }) => Partial<IAuthRuntimeConfig>;
+    routes?: Partial<Record<AuthRouteId, AuthRouteOverride>>;
 }
 
 interface IAuthSecrets {

package/dist/index.cjs

@@ -212,14 +212,19 @@ function tokenPairCookies(accessToken, refreshToken, config) {
   return [
     `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/${secure}`,
     `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh${secure}`
-  ].join(", ");
+  ];
 }
 function clearedTokenCookies(config) {
   const secure = secureAttr(config);
   return [
     `access_token=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0${secure}`,
     `refresh_token=; HttpOnly; SameSite=Strict; Path=/auth/refresh; Max-Age=0${secure}`
-  ].join(", ");
+  ];
+}
+function cookieHeaders(cookies) {
+  const headers = new Headers();
+  for (const c of cookies) headers.append("Set-Cookie", c);
+  return headers;
 }
 
 // src/controllers/mfa.controller.ts
@@ -816,9 +821,7 @@ function mfaController(store, config, issuer, bus) {
         },
         {
           status: 200,
-          headers: {
-            "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
-          }
+          headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
         }
       );
     },
@@ -1150,9 +1153,7 @@ function authController(store, config, bus) {
           },
           {
             status: 201,
-            headers: {
-              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
-            }
+            headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
           }
         );
       }
@@ -1212,9 +1213,7 @@ function authController(store, config, bus) {
           },
           {
             status: 202,
-            headers: {
-              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
-            }
+            headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
           }
         );
       }
@@ -1271,9 +1270,7 @@ function authController(store, config, bus) {
           },
           {
             status: 200,
-            headers: {
-              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
-            }
+            headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
           }
         );
       }
@@ -1314,9 +1311,7 @@ function authController(store, config, bus) {
           },
           {
             status: 202,
-            headers: {
-              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
-            }
+            headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
           }
         );
       }
@@ -1335,9 +1330,7 @@ function authController(store, config, bus) {
         { reason: "USER_LOGOUT", explanation: "Logged out successfully." },
         {
           status: 200,
-          headers: {
-            "Set-Cookie": clearedTokenCookies(config)
-          }
+          headers: cookieHeaders(clearedTokenCookies(config))
         }
       );
     },
@@ -1376,9 +1369,7 @@ function authController(store, config, bus) {
         },
         {
           status: 200,
-          headers: {
-            "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
-          }
+          headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
         }
       );
     },
@@ -1525,9 +1516,7 @@ function authController(store, config, bus) {
           },
           {
             status: 200,
-            headers: {
-              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
-            }
+            headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
           }
         );
       }
@@ -1831,9 +1820,7 @@ function userController(store, config, bus) {
         { reason: "ACCOUNT_DELETED", explanation: "Account successfully deleted." },
         {
           status: 200,
-          headers: {
-            "Set-Cookie": clearedTokenCookies(config)
-          }
+          headers: cookieHeaders(clearedTokenCookies(config))
         }
       );
     }
@@ -1935,9 +1922,7 @@ function oauthController(store, config) {
         },
         {
           status: 200,
-          headers: {
-            "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
-          }
+          headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
         }
       );
     }
@@ -1954,44 +1939,42 @@ function buildAuthRoutes(store, config, bus) {
   const passthrough = (_ctx, next) => next();
   const ipLimit = (route) => buildAuthIpLimiter(route, store, config.rateLimit) ?? passthrough;
   const acctLimit = (route) => buildAuthAccountLimiter(route, store, config.rateLimit) ?? passthrough;
+  const R = (id, method, path, ...handlers) => {
+    const o = config.routes?.[id];
+    if (!o) return [method, path, ...handlers];
+    if (typeof o === "string") return [method, o, ...handlers];
+    return [o.method ?? method, o.path ?? path, ...handlers];
+  };
   const routes = [
     // Registration & Login (Public)
-    ["POST", "/auth/register", ipLimit("register"), (0, import_middlewares.validate)(registerSchema), auth.register],
-    ["POST", "/auth/login", ipLimit("login"), (0, import_middlewares.validate)(loginSchema), acctLimit("login"), auth.login],
+    R("register", "POST", "/auth/register", ipLimit("register"), (0, import_middlewares.validate)(registerSchema), auth.register),
+    R("login", "POST", "/auth/login", ipLimit("login"), (0, import_middlewares.validate)(loginSchema), acctLimit("login"), auth.login),
     // Token Management (Public)
-    ["POST", "/auth/refresh", (0, import_middlewares.validate)(refreshSchema), auth.refresh],
+    R("refresh", "POST", "/auth/refresh", (0, import_middlewares.validate)(refreshSchema), auth.refresh),
     // Email — Password Recovery (Public)
-    ["POST", "/auth/email/forgot", ipLimit("forgot"), (0, import_middlewares.validate)(forgotPasswordSchema), acctLimit("forgot"), auth.forgotPassword],
-    ["POST", "/auth/email/reset", (0, import_middlewares.validate)(resetPasswordSchema), auth.resetPassword],
+    R("forgotPassword", "POST", "/auth/email/forgot", ipLimit("forgot"), (0, import_middlewares.validate)(forgotPasswordSchema), acctLimit("forgot"), auth.forgotPassword),
+    R("resetPassword", "POST", "/auth/email/reset", (0, import_middlewares.validate)(resetPasswordSchema), auth.resetPassword),
     // Verification (Protected — email or phone, determined by loginMethod)
-    ["POST", "/auth/verify", import_middlewares2.requireAuth, (0, import_middlewares.validate)(verifySchema), auth.verify],
-    ["GET", "/auth/send-verification", import_middlewares2.requireAuth, auth.sendVerification],
+    R("verifyEmail", "POST", "/auth/verify", import_middlewares2.requireAuth, (0, import_middlewares.validate)(verifySchema), auth.verify),
+    R("sendVerification", "GET", "/auth/send-verification", import_middlewares2.requireAuth, auth.sendVerification),
     // Account Management (Protected)
-    ["POST", "/auth/logout", import_middlewares2.requireAuth, (0, import_middlewares.validate)(refreshSchema), auth.logout],
+    R("logout", "POST", "/auth/logout", import_middlewares2.requireAuth, (0, import_middlewares.validate)(refreshSchema), auth.logout),
     // User Profile (Protected; writes also gate on requireVerification)
-    ["GET", "/users", import_middlewares2.requireAuth, user.me],
-    ["PUT", "/users/profile", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updateProfileSchema), user.updateProfile],
-    ["PUT", "/users/preferences", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updatePreferencesSchema), user.updatePreferences],
-    ["PUT", "/users/email", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updateEmailSchema), user.updateEmail],
-    ["PUT", "/users/phone", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updatePhoneSchema), user.updatePhone],
-    ["PUT", "/users/password", import_middlewares2.requireAuth, (0, import_middlewares.validate)(changePasswordSchema), user.changePassword],
-    ["DELETE", "/users", import_middlewares2.requireAuth, verifyGate, user.deleteMe],
+    R("me", "GET", "/users", import_middlewares2.requireAuth, user.me),
+    R("updateProfile", "PUT", "/users/profile", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updateProfileSchema), user.updateProfile),
+    R("updatePreferences", "PUT", "/users/preferences", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updatePreferencesSchema), user.updatePreferences),
+    R("updateEmail", "PUT", "/users/email", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updateEmailSchema), user.updateEmail),
+    R("updatePhone", "PUT", "/users/phone", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updatePhoneSchema), user.updatePhone),
+    R("changePassword", "PUT", "/users/password", import_middlewares2.requireAuth, (0, import_middlewares.validate)(changePasswordSchema), user.changePassword),
+    R("deleteMe", "DELETE", "/users", import_middlewares2.requireAuth, verifyGate, user.deleteMe),
     // MFA (email sessions only — requireVerified is always enforced here
     // because MFA is a security feature and email verification is meaningful)
-    ["POST", "/auth/mfa/setup", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, mfa.setup],
+    R("mfaSetup", "POST", "/auth/mfa/setup", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, mfa.setup),
     // /auth/mfa/verify accepts both mfaPending tokens (TOTP/backup-code login)
     // and full tokens (setup confirmation), so requireAnyAuth is used here.
-    ["POST", "/auth/mfa/verify", ipLimit("mfaVerify"), import_middlewares2.requireAnyAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.verify],
-    ["POST", "/auth/mfa/disable", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.disable],
-    [
-      "POST",
-      "/auth/mfa/backup-codes",
-      import_middlewares2.requireAuth,
-      requireEmailLogin,
-      import_middlewares2.requireVerified,
-      (0, import_middlewares.validate)(mfaTokenSchema),
-      mfa.regenerateBackupCodes
-    ]
+    R("mfaVerify", "POST", "/auth/mfa/verify", ipLimit("mfaVerify"), import_middlewares2.requireAnyAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.verify),
+    R("mfaDisable", "POST", "/auth/mfa/disable", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.disable),
+    R("mfaBackupCodes", "POST", "/auth/mfa/backup-codes", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.regenerateBackupCodes)
   ];
   if (config.providers.includes("google")) {
     routes.push(