@fonderie/auth 2.0.0 → 3.0.0

package/dist/index.d.cts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.cjs';
 import { IFonderieModule, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-DbtCnbiG.cjs';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-DbtCnbiG.cjs';
+import { I as IAuthConfig } from './session-BoJjRB7t.cjs';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-BoJjRB7t.cjs';
 export { IUserDTO, toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';

package/dist/index.d.ts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.js';
 import { IFonderieModule, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-DbtCnbiG.js';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-DbtCnbiG.js';
+import { I as IAuthConfig } from './session-BoJjRB7t.js';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-BoJjRB7t.js';
 export { IUserDTO, toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';

package/dist/index.js

@@ -718,6 +718,7 @@ function mfaController(store, config, issuer, bus) {
         await users.confirmMfaSecret(ctx.user.id);
         bus?.emit(NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.mfaEnabled,
+          locale: ctx.user.locale,
           data: {},
           recipient: { email: ctx.user.email, phone: null, deviceToken: null }
         }).catch(() => {
@@ -809,6 +810,7 @@ function mfaController(store, config, issuer, bus) {
       await backupCodes.replace(ctx.user.id, codeHashes);
       bus?.emit(NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.mfaBackupCodesRegenerated,
+        locale: ctx.user.locale,
         data: {},
         recipient: { email: ctx.user.email, phone: null, deviceToken: null }
       }).catch(() => {
@@ -835,6 +837,7 @@ function mfaController(store, config, issuer, bus) {
       await Promise.all([users.disableMfa(ctx.user.id), backupCodes.deleteByUser(ctx.user.id)]);
       bus?.emit(NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.mfaDisabled,
+        locale: user.locale,
         data: {},
         recipient: { email: user.email, phone: null, deviceToken: null }
       }).catch(() => {
@@ -1082,6 +1085,7 @@ function authController(store, config, bus) {
           NOTIFICATION_EVENT2,
           {
             type: MESSAGE_KEYS.emailRegistration,
+            locale: user.locale,
             data: { pin, firstName: firstName ?? "" },
             recipient: { email: normalizedEmail, phone: null, deviceToken: null }
           },
@@ -1145,6 +1149,7 @@ function authController(store, config, bus) {
           NOTIFICATION_EVENT2,
           {
             type: MESSAGE_KEYS.phoneOtp,
+            locale: user.locale,
             data: { otp },
             recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
           },
@@ -1257,6 +1262,7 @@ function authController(store, config, bus) {
         await phoneVerif.upsert(user.id, normalizePhone(phone2), otp, expiresAt);
         bus?.emit(NOTIFICATION_EVENT2, {
           type: MESSAGE_KEYS.phoneOtp,
+          locale: user.locale,
           data: { otp },
           recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
         }).catch(() => {
@@ -1371,6 +1377,7 @@ function authController(store, config, bus) {
       await passwordReset.create(user.id, pin, expiresAt);
       bus?.emit(NOTIFICATION_EVENT2, {
         type: MESSAGE_KEYS.passwordReset,
+        locale: user.locale,
         recipient: { email: email2, phone: null, deviceToken: null },
         data: { pin }
       }).catch(() => {
@@ -1537,6 +1544,7 @@ function authController(store, config, bus) {
         await phoneVerif.upsert(ctx.user.id, phone2, otp, expiresAt2);
         bus?.emit(NOTIFICATION_EVENT2, {
           type: MESSAGE_KEYS.phoneOtp,
+          locale: ctx.user.locale,
           data: { otp },
           recipient: { email: null, phone: phone2, deviceToken: null }
         }).catch(() => {
@@ -1576,6 +1584,7 @@ function authController(store, config, bus) {
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       bus?.emit(NOTIFICATION_EVENT2, {
         type: MESSAGE_KEYS.emailVerification,
+        locale: ctx.user.locale,
         recipient: { email: ctx.user.email, phone: null, deviceToken: null },
         data: { pin }
       }).catch(() => {
@@ -1687,6 +1696,7 @@ function userController(store, config, bus) {
       await users.updateEmail(ctx.user.id, normalised);
       bus?.emit(NOTIFICATION_EVENT3, {
         type: MESSAGE_KEYS.emailVerification,
+        locale: ctx.user.locale,
         data: { pin },
         recipient: { email: normalised, phone: null, deviceToken: null }
       }).catch(() => {
@@ -1694,6 +1704,7 @@ function userController(store, config, bus) {
       if (oldEmail) {
         bus?.emit(NOTIFICATION_EVENT3, {
           type: MESSAGE_KEYS.emailChanged,
+          locale: ctx.user.locale,
           data: { newEmail: normalised },
           recipient: { email: oldEmail, phone: null, deviceToken: null }
         }).catch(() => {
@@ -1729,6 +1740,7 @@ function userController(store, config, bus) {
       await users.updatePhone(ctx.user.id, normalised);
       bus?.emit(NOTIFICATION_EVENT3, {
         type: MESSAGE_KEYS.phoneOtp,
+        locale: ctx.user.locale,
         data: { otp },
         recipient: { email: null, phone: normalised, deviceToken: null }
       }).catch(() => {
@@ -1736,6 +1748,7 @@ function userController(store, config, bus) {
       if (ctx.user.email) {
         bus?.emit(NOTIFICATION_EVENT3, {
           type: MESSAGE_KEYS.phoneChanged,
+          locale: ctx.user.locale,
           data: {},
           recipient: { email: ctx.user.email, phone: null, deviceToken: null }
         }).catch(() => {
@@ -1904,44 +1917,42 @@ function buildAuthRoutes(store, config, bus) {
   const passthrough = (_ctx, next) => next();
   const ipLimit = (route) => buildAuthIpLimiter(route, store, config.rateLimit) ?? passthrough;
   const acctLimit = (route) => buildAuthAccountLimiter(route, store, config.rateLimit) ?? passthrough;
+  const R = (id, method, path, ...handlers) => {
+    const o = config.routes?.[id];
+    if (!o) return [method, path, ...handlers];
+    if (typeof o === "string") return [method, o, ...handlers];
+    return [o.method ?? method, o.path ?? path, ...handlers];
+  };
   const routes = [
     // Registration & Login (Public)
-    ["POST", "/auth/register", ipLimit("register"), validate(registerSchema), auth.register],
-    ["POST", "/auth/login", ipLimit("login"), validate(loginSchema), acctLimit("login"), auth.login],
+    R("register", "POST", "/auth/register", ipLimit("register"), validate(registerSchema), auth.register),
+    R("login", "POST", "/auth/login", ipLimit("login"), validate(loginSchema), acctLimit("login"), auth.login),
     // Token Management (Public)
-    ["POST", "/auth/refresh", validate(refreshSchema), auth.refresh],
+    R("refresh", "POST", "/auth/refresh", validate(refreshSchema), auth.refresh),
     // Email — Password Recovery (Public)
-    ["POST", "/auth/email/forgot", ipLimit("forgot"), validate(forgotPasswordSchema), acctLimit("forgot"), auth.forgotPassword],
-    ["POST", "/auth/email/reset", validate(resetPasswordSchema), auth.resetPassword],
+    R("forgotPassword", "POST", "/auth/email/forgot", ipLimit("forgot"), validate(forgotPasswordSchema), acctLimit("forgot"), auth.forgotPassword),
+    R("resetPassword", "POST", "/auth/email/reset", validate(resetPasswordSchema), auth.resetPassword),
     // Verification (Protected — email or phone, determined by loginMethod)
-    ["POST", "/auth/verify", requireAuth, validate(verifySchema), auth.verify],
-    ["GET", "/auth/send-verification", requireAuth, auth.sendVerification],
+    R("verifyEmail", "POST", "/auth/verify", requireAuth, validate(verifySchema), auth.verify),
+    R("sendVerification", "GET", "/auth/send-verification", requireAuth, auth.sendVerification),
     // Account Management (Protected)
-    ["POST", "/auth/logout", requireAuth, validate(refreshSchema), auth.logout],
+    R("logout", "POST", "/auth/logout", requireAuth, validate(refreshSchema), auth.logout),
     // User Profile (Protected; writes also gate on requireVerification)
-    ["GET", "/users", requireAuth, user.me],
-    ["PUT", "/users/profile", requireAuth, verifyGate, validate(updateProfileSchema), user.updateProfile],
-    ["PUT", "/users/preferences", requireAuth, verifyGate, validate(updatePreferencesSchema), user.updatePreferences],
-    ["PUT", "/users/email", requireAuth, verifyGate, validate(updateEmailSchema), user.updateEmail],
-    ["PUT", "/users/phone", requireAuth, verifyGate, validate(updatePhoneSchema), user.updatePhone],
-    ["PUT", "/users/password", requireAuth, validate(changePasswordSchema), user.changePassword],
-    ["DELETE", "/users", requireAuth, verifyGate, user.deleteMe],
+    R("me", "GET", "/users", requireAuth, user.me),
+    R("updateProfile", "PUT", "/users/profile", requireAuth, verifyGate, validate(updateProfileSchema), user.updateProfile),
+    R("updatePreferences", "PUT", "/users/preferences", requireAuth, verifyGate, validate(updatePreferencesSchema), user.updatePreferences),
+    R("updateEmail", "PUT", "/users/email", requireAuth, verifyGate, validate(updateEmailSchema), user.updateEmail),
+    R("updatePhone", "PUT", "/users/phone", requireAuth, verifyGate, validate(updatePhoneSchema), user.updatePhone),
+    R("changePassword", "PUT", "/users/password", requireAuth, validate(changePasswordSchema), user.changePassword),
+    R("deleteMe", "DELETE", "/users", requireAuth, verifyGate, user.deleteMe),
     // MFA (email sessions only — requireVerified is always enforced here
     // because MFA is a security feature and email verification is meaningful)
-    ["POST", "/auth/mfa/setup", requireAuth, requireEmailLogin, requireVerified, mfa.setup],
+    R("mfaSetup", "POST", "/auth/mfa/setup", requireAuth, requireEmailLogin, requireVerified, mfa.setup),
     // /auth/mfa/verify accepts both mfaPending tokens (TOTP/backup-code login)
     // and full tokens (setup confirmation), so requireAnyAuth is used here.
-    ["POST", "/auth/mfa/verify", ipLimit("mfaVerify"), requireAnyAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.verify],
-    ["POST", "/auth/mfa/disable", requireAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.disable],
-    [
-      "POST",
-      "/auth/mfa/backup-codes",
-      requireAuth,
-      requireEmailLogin,
-      requireVerified,
-      validate(mfaTokenSchema),
-      mfa.regenerateBackupCodes
-    ]
+    R("mfaVerify", "POST", "/auth/mfa/verify", ipLimit("mfaVerify"), requireAnyAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.verify),
+    R("mfaDisable", "POST", "/auth/mfa/disable", requireAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.disable),
+    R("mfaBackupCodes", "POST", "/auth/mfa/backup-codes", requireAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.regenerateBackupCodes)
   ];
   if (config.providers.includes("google")) {
     routes.push(