@fonderie/auth 1.3.2 → 2.1.0

package/dist/index.d.cts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.cjs';
 import { IFonderieModule, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-DbtCnbiG.cjs';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-DbtCnbiG.cjs';
+import { I as IAuthConfig } from './session-BoJjRB7t.cjs';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-BoJjRB7t.cjs';
 export { IUserDTO, toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';

package/dist/index.d.ts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.js';
 import { IFonderieModule, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-DbtCnbiG.js';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-DbtCnbiG.js';
+import { I as IAuthConfig } from './session-BoJjRB7t.js';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-BoJjRB7t.js';
 export { IUserDTO, toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';

package/dist/index.js

@@ -177,14 +177,19 @@ function tokenPairCookies(accessToken, refreshToken, config) {
   return [
     `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/${secure}`,
     `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh${secure}`
-  ].join(", ");
+  ];
 }
 function clearedTokenCookies(config) {
   const secure = secureAttr(config);
   return [
     `access_token=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0${secure}`,
     `refresh_token=; HttpOnly; SameSite=Strict; Path=/auth/refresh; Max-Age=0${secure}`
-  ].join(", ");
+  ];
+}
+function cookieHeaders(cookies) {
+  const headers = new Headers();
+  for (const c of cookies) headers.append("Set-Cookie", c);
+  return headers;
 }
 
 // src/controllers/mfa.controller.ts
@@ -781,9 +786,7 @@ function mfaController(store, config, issuer, bus) {
         },
         {
           status: 200,
-          headers: {
-            "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
-          }
+          headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
         }
       );
     },
@@ -1115,9 +1118,7 @@ function authController(store, config, bus) {
           },
           {
             status: 201,
-            headers: {
-              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
-            }
+            headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
           }
         );
       }
@@ -1177,9 +1178,7 @@ function authController(store, config, bus) {
           },
           {
             status: 202,
-            headers: {
-              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
-            }
+            headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
           }
         );
       }
@@ -1236,9 +1235,7 @@ function authController(store, config, bus) {
           },
           {
             status: 200,
-            headers: {
-              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
-            }
+            headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
           }
         );
       }
@@ -1279,9 +1276,7 @@ function authController(store, config, bus) {
           },
           {
             status: 202,
-            headers: {
-              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
-            }
+            headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
           }
         );
       }
@@ -1300,9 +1295,7 @@ function authController(store, config, bus) {
         { reason: "USER_LOGOUT", explanation: "Logged out successfully." },
         {
           status: 200,
-          headers: {
-            "Set-Cookie": clearedTokenCookies(config)
-          }
+          headers: cookieHeaders(clearedTokenCookies(config))
         }
       );
     },
@@ -1341,9 +1334,7 @@ function authController(store, config, bus) {
         },
         {
           status: 200,
-          headers: {
-            "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
-          }
+          headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
         }
       );
     },
@@ -1490,9 +1481,7 @@ function authController(store, config, bus) {
           },
           {
             status: 200,
-            headers: {
-              "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
-            }
+            headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
           }
         );
       }
@@ -1796,9 +1785,7 @@ function userController(store, config, bus) {
         { reason: "ACCOUNT_DELETED", explanation: "Account successfully deleted." },
         {
           status: 200,
-          headers: {
-            "Set-Cookie": clearedTokenCookies(config)
-          }
+          headers: cookieHeaders(clearedTokenCookies(config))
         }
       );
     }
@@ -1900,9 +1887,7 @@ function oauthController(store, config) {
         },
         {
           status: 200,
-          headers: {
-            "Set-Cookie": tokenPairCookies(accessToken, refreshToken, config)
-          }
+          headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
         }
       );
     }
@@ -1919,44 +1904,42 @@ function buildAuthRoutes(store, config, bus) {
   const passthrough = (_ctx, next) => next();
   const ipLimit = (route) => buildAuthIpLimiter(route, store, config.rateLimit) ?? passthrough;
   const acctLimit = (route) => buildAuthAccountLimiter(route, store, config.rateLimit) ?? passthrough;
+  const R = (id, method, path, ...handlers) => {
+    const o = config.routes?.[id];
+    if (!o) return [method, path, ...handlers];
+    if (typeof o === "string") return [method, o, ...handlers];
+    return [o.method ?? method, o.path ?? path, ...handlers];
+  };
   const routes = [
     // Registration & Login (Public)
-    ["POST", "/auth/register", ipLimit("register"), validate(registerSchema), auth.register],
-    ["POST", "/auth/login", ipLimit("login"), validate(loginSchema), acctLimit("login"), auth.login],
+    R("register", "POST", "/auth/register", ipLimit("register"), validate(registerSchema), auth.register),
+    R("login", "POST", "/auth/login", ipLimit("login"), validate(loginSchema), acctLimit("login"), auth.login),
     // Token Management (Public)
-    ["POST", "/auth/refresh", validate(refreshSchema), auth.refresh],
+    R("refresh", "POST", "/auth/refresh", validate(refreshSchema), auth.refresh),
     // Email — Password Recovery (Public)
-    ["POST", "/auth/email/forgot", ipLimit("forgot"), validate(forgotPasswordSchema), acctLimit("forgot"), auth.forgotPassword],
-    ["POST", "/auth/email/reset", validate(resetPasswordSchema), auth.resetPassword],
+    R("forgotPassword", "POST", "/auth/email/forgot", ipLimit("forgot"), validate(forgotPasswordSchema), acctLimit("forgot"), auth.forgotPassword),
+    R("resetPassword", "POST", "/auth/email/reset", validate(resetPasswordSchema), auth.resetPassword),
     // Verification (Protected — email or phone, determined by loginMethod)
-    ["POST", "/auth/verify", requireAuth, validate(verifySchema), auth.verify],
-    ["GET", "/auth/send-verification", requireAuth, auth.sendVerification],
+    R("verifyEmail", "POST", "/auth/verify", requireAuth, validate(verifySchema), auth.verify),
+    R("sendVerification", "GET", "/auth/send-verification", requireAuth, auth.sendVerification),
     // Account Management (Protected)
-    ["POST", "/auth/logout", requireAuth, validate(refreshSchema), auth.logout],
+    R("logout", "POST", "/auth/logout", requireAuth, validate(refreshSchema), auth.logout),
     // User Profile (Protected; writes also gate on requireVerification)
-    ["GET", "/users", requireAuth, user.me],
-    ["PUT", "/users/profile", requireAuth, verifyGate, validate(updateProfileSchema), user.updateProfile],
-    ["PUT", "/users/preferences", requireAuth, verifyGate, validate(updatePreferencesSchema), user.updatePreferences],
-    ["PUT", "/users/email", requireAuth, verifyGate, validate(updateEmailSchema), user.updateEmail],
-    ["PUT", "/users/phone", requireAuth, verifyGate, validate(updatePhoneSchema), user.updatePhone],
-    ["PUT", "/users/password", requireAuth, validate(changePasswordSchema), user.changePassword],
-    ["DELETE", "/users", requireAuth, verifyGate, user.deleteMe],
+    R("me", "GET", "/users", requireAuth, user.me),
+    R("updateProfile", "PUT", "/users/profile", requireAuth, verifyGate, validate(updateProfileSchema), user.updateProfile),
+    R("updatePreferences", "PUT", "/users/preferences", requireAuth, verifyGate, validate(updatePreferencesSchema), user.updatePreferences),
+    R("updateEmail", "PUT", "/users/email", requireAuth, verifyGate, validate(updateEmailSchema), user.updateEmail),
+    R("updatePhone", "PUT", "/users/phone", requireAuth, verifyGate, validate(updatePhoneSchema), user.updatePhone),
+    R("changePassword", "PUT", "/users/password", requireAuth, validate(changePasswordSchema), user.changePassword),
+    R("deleteMe", "DELETE", "/users", requireAuth, verifyGate, user.deleteMe),
     // MFA (email sessions only — requireVerified is always enforced here
     // because MFA is a security feature and email verification is meaningful)
-    ["POST", "/auth/mfa/setup", requireAuth, requireEmailLogin, requireVerified, mfa.setup],
+    R("mfaSetup", "POST", "/auth/mfa/setup", requireAuth, requireEmailLogin, requireVerified, mfa.setup),
     // /auth/mfa/verify accepts both mfaPending tokens (TOTP/backup-code login)
     // and full tokens (setup confirmation), so requireAnyAuth is used here.
-    ["POST", "/auth/mfa/verify", ipLimit("mfaVerify"), requireAnyAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.verify],
-    ["POST", "/auth/mfa/disable", requireAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.disable],
-    [
-      "POST",
-      "/auth/mfa/backup-codes",
-      requireAuth,
-      requireEmailLogin,
-      requireVerified,
-      validate(mfaTokenSchema),
-      mfa.regenerateBackupCodes
-    ]
+    R("mfaVerify", "POST", "/auth/mfa/verify", ipLimit("mfaVerify"), requireAnyAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.verify),
+    R("mfaDisable", "POST", "/auth/mfa/disable", requireAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.disable),
+    R("mfaBackupCodes", "POST", "/auth/mfa/backup-codes", requireAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.regenerateBackupCodes)
   ];
   if (config.providers.includes("google")) {
     routes.push(