@fonderie/auth 2.0.0 → 3.0.0

package/brain/signatures.md

@@ -60,6 +60,7 @@ interface IAuthConfig extends IAuthSecrets, IAuthRuntimeConfig {
     resolve?: (ctx: {
         meta: Record<string, unknown>;
     }) => Partial<IAuthRuntimeConfig>;
+    routes?: Partial<Record<AuthRouteId, AuthRouteOverride>>;
 }
 
 interface IAuthSecrets {

package/dist/index.cjs

@@ -753,6 +753,7 @@ function mfaController(store, config, issuer, bus) {
         await users.confirmMfaSecret(ctx.user.id);
         bus?.emit(import_events.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.mfaEnabled,
+          locale: ctx.user.locale,
           data: {},
           recipient: { email: ctx.user.email, phone: null, deviceToken: null }
         }).catch(() => {
@@ -844,6 +845,7 @@ function mfaController(store, config, issuer, bus) {
       await backupCodes.replace(ctx.user.id, codeHashes);
       bus?.emit(import_events.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.mfaBackupCodesRegenerated,
+        locale: ctx.user.locale,
         data: {},
         recipient: { email: ctx.user.email, phone: null, deviceToken: null }
       }).catch(() => {
@@ -870,6 +872,7 @@ function mfaController(store, config, issuer, bus) {
       await Promise.all([users.disableMfa(ctx.user.id), backupCodes.deleteByUser(ctx.user.id)]);
       bus?.emit(import_events.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.mfaDisabled,
+        locale: user.locale,
         data: {},
         recipient: { email: user.email, phone: null, deviceToken: null }
       }).catch(() => {
@@ -1117,6 +1120,7 @@ function authController(store, config, bus) {
           import_events2.NOTIFICATION_EVENT,
           {
             type: MESSAGE_KEYS.emailRegistration,
+            locale: user.locale,
             data: { pin, firstName: firstName ?? "" },
             recipient: { email: normalizedEmail, phone: null, deviceToken: null }
           },
@@ -1180,6 +1184,7 @@ function authController(store, config, bus) {
           import_events2.NOTIFICATION_EVENT,
           {
             type: MESSAGE_KEYS.phoneOtp,
+            locale: user.locale,
             data: { otp },
             recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
           },
@@ -1292,6 +1297,7 @@ function authController(store, config, bus) {
         await phoneVerif.upsert(user.id, normalizePhone(phone2), otp, expiresAt);
         bus?.emit(import_events2.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.phoneOtp,
+          locale: user.locale,
           data: { otp },
           recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
         }).catch(() => {
@@ -1406,6 +1412,7 @@ function authController(store, config, bus) {
       await passwordReset.create(user.id, pin, expiresAt);
       bus?.emit(import_events2.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.passwordReset,
+        locale: user.locale,
         recipient: { email: email2, phone: null, deviceToken: null },
         data: { pin }
       }).catch(() => {
@@ -1572,6 +1579,7 @@ function authController(store, config, bus) {
         await phoneVerif.upsert(ctx.user.id, phone2, otp, expiresAt2);
         bus?.emit(import_events2.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.phoneOtp,
+          locale: ctx.user.locale,
           data: { otp },
           recipient: { email: null, phone: phone2, deviceToken: null }
         }).catch(() => {
@@ -1611,6 +1619,7 @@ function authController(store, config, bus) {
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       bus?.emit(import_events2.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.emailVerification,
+        locale: ctx.user.locale,
         recipient: { email: ctx.user.email, phone: null, deviceToken: null },
         data: { pin }
       }).catch(() => {
@@ -1722,6 +1731,7 @@ function userController(store, config, bus) {
       await users.updateEmail(ctx.user.id, normalised);
       bus?.emit(import_events3.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.emailVerification,
+        locale: ctx.user.locale,
         data: { pin },
         recipient: { email: normalised, phone: null, deviceToken: null }
       }).catch(() => {
@@ -1729,6 +1739,7 @@ function userController(store, config, bus) {
       if (oldEmail) {
         bus?.emit(import_events3.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.emailChanged,
+          locale: ctx.user.locale,
           data: { newEmail: normalised },
           recipient: { email: oldEmail, phone: null, deviceToken: null }
         }).catch(() => {
@@ -1764,6 +1775,7 @@ function userController(store, config, bus) {
       await users.updatePhone(ctx.user.id, normalised);
       bus?.emit(import_events3.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.phoneOtp,
+        locale: ctx.user.locale,
         data: { otp },
         recipient: { email: null, phone: normalised, deviceToken: null }
       }).catch(() => {
@@ -1771,6 +1783,7 @@ function userController(store, config, bus) {
       if (ctx.user.email) {
         bus?.emit(import_events3.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.phoneChanged,
+          locale: ctx.user.locale,
           data: {},
           recipient: { email: ctx.user.email, phone: null, deviceToken: null }
         }).catch(() => {
@@ -1939,44 +1952,42 @@ function buildAuthRoutes(store, config, bus) {
   const passthrough = (_ctx, next) => next();
   const ipLimit = (route) => buildAuthIpLimiter(route, store, config.rateLimit) ?? passthrough;
   const acctLimit = (route) => buildAuthAccountLimiter(route, store, config.rateLimit) ?? passthrough;
+  const R = (id, method, path, ...handlers) => {
+    const o = config.routes?.[id];
+    if (!o) return [method, path, ...handlers];
+    if (typeof o === "string") return [method, o, ...handlers];
+    return [o.method ?? method, o.path ?? path, ...handlers];
+  };
   const routes = [
     // Registration & Login (Public)
-    ["POST", "/auth/register", ipLimit("register"), (0, import_middlewares.validate)(registerSchema), auth.register],
-    ["POST", "/auth/login", ipLimit("login"), (0, import_middlewares.validate)(loginSchema), acctLimit("login"), auth.login],
+    R("register", "POST", "/auth/register", ipLimit("register"), (0, import_middlewares.validate)(registerSchema), auth.register),
+    R("login", "POST", "/auth/login", ipLimit("login"), (0, import_middlewares.validate)(loginSchema), acctLimit("login"), auth.login),
     // Token Management (Public)
-    ["POST", "/auth/refresh", (0, import_middlewares.validate)(refreshSchema), auth.refresh],
+    R("refresh", "POST", "/auth/refresh", (0, import_middlewares.validate)(refreshSchema), auth.refresh),
     // Email — Password Recovery (Public)
-    ["POST", "/auth/email/forgot", ipLimit("forgot"), (0, import_middlewares.validate)(forgotPasswordSchema), acctLimit("forgot"), auth.forgotPassword],
-    ["POST", "/auth/email/reset", (0, import_middlewares.validate)(resetPasswordSchema), auth.resetPassword],
+    R("forgotPassword", "POST", "/auth/email/forgot", ipLimit("forgot"), (0, import_middlewares.validate)(forgotPasswordSchema), acctLimit("forgot"), auth.forgotPassword),
+    R("resetPassword", "POST", "/auth/email/reset", (0, import_middlewares.validate)(resetPasswordSchema), auth.resetPassword),
     // Verification (Protected — email or phone, determined by loginMethod)
-    ["POST", "/auth/verify", import_middlewares2.requireAuth, (0, import_middlewares.validate)(verifySchema), auth.verify],
-    ["GET", "/auth/send-verification", import_middlewares2.requireAuth, auth.sendVerification],
+    R("verifyEmail", "POST", "/auth/verify", import_middlewares2.requireAuth, (0, import_middlewares.validate)(verifySchema), auth.verify),
+    R("sendVerification", "GET", "/auth/send-verification", import_middlewares2.requireAuth, auth.sendVerification),
     // Account Management (Protected)
-    ["POST", "/auth/logout", import_middlewares2.requireAuth, (0, import_middlewares.validate)(refreshSchema), auth.logout],
+    R("logout", "POST", "/auth/logout", import_middlewares2.requireAuth, (0, import_middlewares.validate)(refreshSchema), auth.logout),
     // User Profile (Protected; writes also gate on requireVerification)
-    ["GET", "/users", import_middlewares2.requireAuth, user.me],
-    ["PUT", "/users/profile", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updateProfileSchema), user.updateProfile],
-    ["PUT", "/users/preferences", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updatePreferencesSchema), user.updatePreferences],
-    ["PUT", "/users/email", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updateEmailSchema), user.updateEmail],
-    ["PUT", "/users/phone", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updatePhoneSchema), user.updatePhone],
-    ["PUT", "/users/password", import_middlewares2.requireAuth, (0, import_middlewares.validate)(changePasswordSchema), user.changePassword],
-    ["DELETE", "/users", import_middlewares2.requireAuth, verifyGate, user.deleteMe],
+    R("me", "GET", "/users", import_middlewares2.requireAuth, user.me),
+    R("updateProfile", "PUT", "/users/profile", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updateProfileSchema), user.updateProfile),
+    R("updatePreferences", "PUT", "/users/preferences", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updatePreferencesSchema), user.updatePreferences),
+    R("updateEmail", "PUT", "/users/email", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updateEmailSchema), user.updateEmail),
+    R("updatePhone", "PUT", "/users/phone", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updatePhoneSchema), user.updatePhone),
+    R("changePassword", "PUT", "/users/password", import_middlewares2.requireAuth, (0, import_middlewares.validate)(changePasswordSchema), user.changePassword),
+    R("deleteMe", "DELETE", "/users", import_middlewares2.requireAuth, verifyGate, user.deleteMe),
     // MFA (email sessions only — requireVerified is always enforced here
     // because MFA is a security feature and email verification is meaningful)
-    ["POST", "/auth/mfa/setup", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, mfa.setup],
+    R("mfaSetup", "POST", "/auth/mfa/setup", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, mfa.setup),
     // /auth/mfa/verify accepts both mfaPending tokens (TOTP/backup-code login)
     // and full tokens (setup confirmation), so requireAnyAuth is used here.
-    ["POST", "/auth/mfa/verify", ipLimit("mfaVerify"), import_middlewares2.requireAnyAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.verify],
-    ["POST", "/auth/mfa/disable", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.disable],
-    [
-      "POST",
-      "/auth/mfa/backup-codes",
-      import_middlewares2.requireAuth,
-      requireEmailLogin,
-      import_middlewares2.requireVerified,
-      (0, import_middlewares.validate)(mfaTokenSchema),
-      mfa.regenerateBackupCodes
-    ]
+    R("mfaVerify", "POST", "/auth/mfa/verify", ipLimit("mfaVerify"), import_middlewares2.requireAnyAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.verify),
+    R("mfaDisable", "POST", "/auth/mfa/disable", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.disable),
+    R("mfaBackupCodes", "POST", "/auth/mfa/backup-codes", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.regenerateBackupCodes)
   ];
   if (config.providers.includes("google")) {
     routes.push(