@fonderie/auth 2.1.0 → 4.0.0

package/brain/signatures.md

@@ -49,6 +49,7 @@ interface IMfaChallenge {
 
 new AuthModule(store: IStoreAdapter, config: IAuthConfig, bus?: EventBus | undefined): AuthModule
   .name: "@fonderie/auth"
+  .checkReadiness(): IReadinessProblem[]
   .install(app: IFonderieApp): void
 
 interface IAuthConfig extends IAuthSecrets, IAuthRuntimeConfig {
@@ -61,6 +62,7 @@ interface IAuthConfig extends IAuthSecrets, IAuthRuntimeConfig {
         meta: Record<string, unknown>;
     }) => Partial<IAuthRuntimeConfig>;
     routes?: Partial<Record<AuthRouteId, AuthRouteOverride>>;
+    legacyVerify?: (plain: string, hash: string) => boolean | Promise<boolean>;
 }
 
 interface IAuthSecrets {
@@ -127,6 +129,25 @@ function normalizeEmail(email: string): string
 
 function normalizeEmailSafe(email: string): string | null
 
+function importUser(store: IStoreAdapter, user: IImportUser): Promise<{ id: string; }>
+
+interface IImportUser {
+    id?: string;
+    email: string;
+    passwordHash?: string | null;
+    firstName?: string | null;
+    lastName?: string | null;
+    phone?: string | null;
+    profileImageUrl?: string | null;
+    locale?: string;
+    timezone?: string;
+    emailVerifiedAt?: Date | null;
+    mfaEnabled?: boolean;
+    createdAt?: Date;
+}
+
+function validateAuthConfig(config: IAuthConfig): void
+
 function buildAuthIpLimiter(route: AuthLimitedRoute, store: IStoreAdapter, config: false | IAuthRateLimitConfig | undefined): Middleware | null
 
 function buildAuthAccountLimiter(route: AuthLimitedRoute, store: IStoreAdapter, config: false | IAuthRateLimitConfig | undefined): Middleware | null

package/dist/index.cjs

@@ -34,7 +34,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var password_exports = {};
 __export(password_exports, {
   hashPassword: () => hashPassword,
-  verifyPassword: () => verifyPassword
+  verifyPassword: () => verifyPassword,
+  verifyPasswordForLogin: () => verifyPasswordForLogin
 });
 async function hashPassword(plain) {
   return import_bcryptjs.default.hash(plain, ROUNDS);
@@ -42,6 +43,19 @@ async function hashPassword(plain) {
 async function verifyPassword(plain, hash) {
   return import_bcryptjs.default.compare(plain, hash);
 }
+async function verifyPasswordForLogin(plain, hash, legacyVerify) {
+  if (await verifyPassword(plain, hash)) return { valid: true, needsRehash: false };
+  if (legacyVerify) {
+    let legacyOk = false;
+    try {
+      legacyOk = await legacyVerify(plain, hash);
+    } catch {
+      legacyOk = false;
+    }
+    if (legacyOk) return { valid: true, needsRehash: true };
+  }
+  return { valid: false, needsRehash: false };
+}
 var import_bcryptjs, ROUNDS;
 var init_password = __esm({
   "src/services/password.ts"() {
@@ -59,12 +73,14 @@ __export(index_exports, {
   MESSAGE_KEYS: () => MESSAGE_KEYS,
   buildAuthAccountLimiter: () => buildAuthAccountLimiter,
   buildAuthIpLimiter: () => buildAuthIpLimiter,
+  importUser: () => importUser,
   normalizeEmail: () => normalizeEmail,
   normalizeEmailSafe: () => normalizeEmailSafe,
   requireAuth: () => import_middlewares3.requireAuth,
   schemas: () => schemas_exports,
   toUserDTO: () => toUserDTO,
   validate: () => import_middlewares.validate,
+  validateAuthConfig: () => validateAuthConfig,
   withSession: () => withSession
 });
 module.exports = __toCommonJS(index_exports);
@@ -753,6 +769,7 @@ function mfaController(store, config, issuer, bus) {
         await users.confirmMfaSecret(ctx.user.id);
         bus?.emit(import_events.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.mfaEnabled,
+          locale: ctx.user.locale,
           data: {},
           recipient: { email: ctx.user.email, phone: null, deviceToken: null }
         }).catch(() => {
@@ -844,6 +861,7 @@ function mfaController(store, config, issuer, bus) {
       await backupCodes.replace(ctx.user.id, codeHashes);
       bus?.emit(import_events.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.mfaBackupCodesRegenerated,
+        locale: ctx.user.locale,
         data: {},
         recipient: { email: ctx.user.email, phone: null, deviceToken: null }
       }).catch(() => {
@@ -870,6 +888,7 @@ function mfaController(store, config, issuer, bus) {
       await Promise.all([users.disableMfa(ctx.user.id), backupCodes.deleteByUser(ctx.user.id)]);
       bus?.emit(import_events.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.mfaDisabled,
+        locale: user.locale,
         data: {},
         recipient: { email: user.email, phone: null, deviceToken: null }
       }).catch(() => {
@@ -1117,6 +1136,7 @@ function authController(store, config, bus) {
           import_events2.NOTIFICATION_EVENT,
           {
             type: MESSAGE_KEYS.emailRegistration,
+            locale: user.locale,
             data: { pin, firstName: firstName ?? "" },
             recipient: { email: normalizedEmail, phone: null, deviceToken: null }
           },
@@ -1180,6 +1200,7 @@ function authController(store, config, bus) {
           import_events2.NOTIFICATION_EVENT,
           {
             type: MESSAGE_KEYS.phoneOtp,
+            locale: user.locale,
             data: { otp },
             recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
           },
@@ -1235,10 +1256,17 @@ function authController(store, config, bus) {
         if (!user || !user.passwordHash) {
           return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
-        const valid = await verifyPassword(password2, user.passwordHash);
+        const { valid, needsRehash } = await verifyPasswordForLogin(
+          password2,
+          user.passwordHash,
+          config.legacyVerify
+        );
         if (!valid) {
           return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
+        if (needsRehash) {
+          await users.updatePassword(user.id, await hashPassword(password2));
+        }
         if (user.suspended) {
           return (0, import_core4.setApiResponse)(
             import_core4.HTTP.FORBIDDEN,
@@ -1292,6 +1320,7 @@ function authController(store, config, bus) {
         await phoneVerif.upsert(user.id, normalizePhone(phone2), otp, expiresAt);
         bus?.emit(import_events2.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.phoneOtp,
+          locale: user.locale,
           data: { otp },
           recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
         }).catch(() => {
@@ -1406,6 +1435,7 @@ function authController(store, config, bus) {
       await passwordReset.create(user.id, pin, expiresAt);
       bus?.emit(import_events2.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.passwordReset,
+        locale: user.locale,
         recipient: { email: email2, phone: null, deviceToken: null },
         data: { pin }
       }).catch(() => {
@@ -1572,6 +1602,7 @@ function authController(store, config, bus) {
         await phoneVerif.upsert(ctx.user.id, phone2, otp, expiresAt2);
         bus?.emit(import_events2.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.phoneOtp,
+          locale: ctx.user.locale,
           data: { otp },
           recipient: { email: null, phone: phone2, deviceToken: null }
         }).catch(() => {
@@ -1611,6 +1642,7 @@ function authController(store, config, bus) {
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       bus?.emit(import_events2.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.emailVerification,
+        locale: ctx.user.locale,
         recipient: { email: ctx.user.email, phone: null, deviceToken: null },
         data: { pin }
       }).catch(() => {
@@ -1722,6 +1754,7 @@ function userController(store, config, bus) {
       await users.updateEmail(ctx.user.id, normalised);
       bus?.emit(import_events3.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.emailVerification,
+        locale: ctx.user.locale,
         data: { pin },
         recipient: { email: normalised, phone: null, deviceToken: null }
       }).catch(() => {
@@ -1729,6 +1762,7 @@ function userController(store, config, bus) {
       if (oldEmail) {
         bus?.emit(import_events3.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.emailChanged,
+          locale: ctx.user.locale,
           data: { newEmail: normalised },
           recipient: { email: oldEmail, phone: null, deviceToken: null }
         }).catch(() => {
@@ -1764,6 +1798,7 @@ function userController(store, config, bus) {
       await users.updatePhone(ctx.user.id, normalised);
       bus?.emit(import_events3.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.phoneOtp,
+        locale: ctx.user.locale,
         data: { otp },
         recipient: { email: null, phone: normalised, deviceToken: null }
       }).catch(() => {
@@ -1771,6 +1806,7 @@ function userController(store, config, bus) {
       if (ctx.user.email) {
         bus?.emit(import_events3.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.phoneChanged,
+          locale: ctx.user.locale,
           data: {},
           recipient: { email: ctx.user.email, phone: null, deviceToken: null }
         }).catch(() => {
@@ -1985,6 +2021,53 @@ function buildAuthRoutes(store, config, bus) {
   return routes;
 }
 
+// src/services/config-guard.ts
+var MODULE = "@fonderie/auth";
+var PLACEHOLDER_SECRET = /dev-secret|test-secret|changeme|change-me|your[-_]secret|placeholder|example|insecure|min-32-chars/i;
+var MIN_SECRET_LENGTH = 32;
+function collectAuthConfigProblems(config) {
+  const problems = [];
+  const secret = config.jwtSecret ?? "";
+  if (secret.length < MIN_SECRET_LENGTH) {
+    problems.push({
+      module: MODULE,
+      severity: "error",
+      message: `jwtSecret must be at least ${MIN_SECRET_LENGTH} characters (got ${secret.length})`
+    });
+  } else if (PLACEHOLDER_SECRET.test(secret)) {
+    problems.push({
+      module: MODULE,
+      severity: "error",
+      message: "jwtSecret looks like a placeholder or dev-default value"
+    });
+  }
+  if (config.secureCookies === false) {
+    problems.push({
+      module: MODULE,
+      severity: "warning",
+      message: "secureCookies is false \u2014 auth cookies may be sent over non-HTTPS connections in production"
+    });
+  }
+  return problems;
+}
+function validateAuthConfig(config) {
+  const isProduction = process.env["NODE_ENV"] === "production";
+  const problems = collectAuthConfigProblems(config);
+  const errors = problems.filter((p) => p.severity === "error");
+  if (isProduction && errors.length > 0) {
+    throw new Error(
+      `[auth] insecure config \u2014 ${errors.map((e) => e.message).join("; ")}. Set a long, random jwtSecret (e.g. \`openssl rand -base64 32\`). Refusing to boot in production.`
+    );
+  }
+  if (isProduction) {
+    for (const p of problems) console.warn(`[auth] ${p.message}`);
+  } else {
+    for (const p of errors) {
+      console.warn(`[auth] ${p.message} (insecure \u2014 would refuse to boot in production)`);
+    }
+  }
+}
+
 // src/middlewares/session.ts
 function withSession(store, config) {
   const users = new UserModel(store);
@@ -2032,11 +2115,16 @@ var AuthModule = class {
     this.store = store;
     this.config = config;
     this.bus = bus;
+    validateAuthConfig(config);
   }
   store;
   config;
   bus;
   name = "@fonderie/auth";
+  // Report config problems for app.checkProductionReadiness() (data, not throw).
+  checkReadiness() {
+    return collectAuthConfigProblems(this.config);
+  }
   install(app) {
     app.use(withSession(this.store, this.config));
     const routes = buildAuthRoutes(this.store, this.config, this.bus);
@@ -2048,6 +2136,38 @@ var AuthModule = class {
 
 // src/middlewares/require-auth.ts
 var import_middlewares3 = require("@fonderie/core/middlewares");
+
+// src/migrate.ts
+async function importUser(store, user) {
+  const cols = [];
+  const vals = [];
+  const placeholders = [];
+  const add = (col, val) => {
+    cols.push(col);
+    vals.push(val);
+    placeholders.push(`$${vals.length}`);
+  };
+  if (user.id !== void 0) add("id", user.id);
+  add("email", user.email.toLowerCase().trim());
+  if (user.passwordHash !== void 0) add("password_hash", user.passwordHash);
+  if (user.firstName !== void 0) add("first_name", user.firstName);
+  if (user.lastName !== void 0) add("last_name", user.lastName);
+  if (user.phone !== void 0) add("phone", user.phone);
+  if (user.profileImageUrl !== void 0) add("profile_image_url", user.profileImageUrl);
+  if (user.locale !== void 0) add("locale", user.locale);
+  if (user.timezone !== void 0) add("timezone", user.timezone);
+  if (user.emailVerifiedAt !== void 0) add("email_verified_at", user.emailVerifiedAt);
+  if (user.mfaEnabled !== void 0) add("mfa_enabled", user.mfaEnabled);
+  if (user.createdAt !== void 0) add("created_at", user.createdAt);
+  const [row] = await store.query(
+    `INSERT INTO fonderie_users (${cols.join(", ")})
+		 VALUES (${placeholders.join(", ")})
+		 RETURNING id`,
+    vals
+  );
+  if (!row) throw new Error("[auth] importUser: insert returned no row");
+  return row;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AUTH_CONFIG_KEYS,
@@ -2055,12 +2175,14 @@ var import_middlewares3 = require("@fonderie/core/middlewares");
   MESSAGE_KEYS,
   buildAuthAccountLimiter,
   buildAuthIpLimiter,
+  importUser,
   normalizeEmail,
   normalizeEmailSafe,
   requireAuth,
   schemas,
   toUserDTO,
   validate,
+  validateAuthConfig,
   withSession
 });
 //# sourceMappingURL=index.cjs.map