@fonderie/auth 2.1.0 → 4.0.0

package/dist/index.d.cts

@@ -1,9 +1,9 @@
 export { IMfaChallenge, ISession, IUser } from './types.cjs';
-import { IFonderieModule, IFonderieApp } from '@fonderie/core';
+import { IFonderieModule, IReadinessProblem, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-BoJjRB7t.cjs';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-BoJjRB7t.cjs';
+import { I as IAuthConfig } from './session-DxsmQjXX.cjs';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-DxsmQjXX.cjs';
 export { IUserDTO, toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';
@@ -15,6 +15,7 @@ declare class AuthModule implements IFonderieModule {
     private bus?;
     readonly name = "@fonderie/auth";
     constructor(store: IStoreAdapter, config: IAuthConfig, bus?: EventBus | undefined);
+    checkReadiness(): IReadinessProblem[];
     install(app: IFonderieApp): void;
 }
 
@@ -99,4 +100,24 @@ declare namespace schemas {
 declare function normalizeEmail(email: string): string;
 declare function normalizeEmailSafe(email: string): string | null;
 
-export { AuthModule, type ChangePasswordInput, IAuthConfig, type LoginInput, type RegisterInput, type ResetPasswordInput, normalizeEmail, normalizeEmailSafe, schemas };
+interface IImportUser {
+    id?: string;
+    email: string;
+    passwordHash?: string | null;
+    firstName?: string | null;
+    lastName?: string | null;
+    phone?: string | null;
+    profileImageUrl?: string | null;
+    locale?: string;
+    timezone?: string;
+    emailVerifiedAt?: Date | null;
+    mfaEnabled?: boolean;
+    createdAt?: Date;
+}
+declare function importUser(store: IStoreAdapter, user: IImportUser): Promise<{
+    id: string;
+}>;
+
+declare function validateAuthConfig(config: IAuthConfig): void;
+
+export { AuthModule, type ChangePasswordInput, IAuthConfig, type IImportUser, type LoginInput, type RegisterInput, type ResetPasswordInput, importUser, normalizeEmail, normalizeEmailSafe, schemas, validateAuthConfig };

package/dist/index.d.ts

@@ -1,9 +1,9 @@
 export { IMfaChallenge, ISession, IUser } from './types.js';
-import { IFonderieModule, IFonderieApp } from '@fonderie/core';
+import { IFonderieModule, IReadinessProblem, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-BoJjRB7t.js';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-BoJjRB7t.js';
+import { I as IAuthConfig } from './session-DxsmQjXX.js';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, M as MESSAGE_KEYS, f as buildAuthAccountLimiter, g as buildAuthIpLimiter, w as withSession } from './session-DxsmQjXX.js';
 export { IUserDTO, toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';
@@ -15,6 +15,7 @@ declare class AuthModule implements IFonderieModule {
     private bus?;
     readonly name = "@fonderie/auth";
     constructor(store: IStoreAdapter, config: IAuthConfig, bus?: EventBus | undefined);
+    checkReadiness(): IReadinessProblem[];
     install(app: IFonderieApp): void;
 }
 
@@ -99,4 +100,24 @@ declare namespace schemas {
 declare function normalizeEmail(email: string): string;
 declare function normalizeEmailSafe(email: string): string | null;
 
-export { AuthModule, type ChangePasswordInput, IAuthConfig, type LoginInput, type RegisterInput, type ResetPasswordInput, normalizeEmail, normalizeEmailSafe, schemas };
+interface IImportUser {
+    id?: string;
+    email: string;
+    passwordHash?: string | null;
+    firstName?: string | null;
+    lastName?: string | null;
+    phone?: string | null;
+    profileImageUrl?: string | null;
+    locale?: string;
+    timezone?: string;
+    emailVerifiedAt?: Date | null;
+    mfaEnabled?: boolean;
+    createdAt?: Date;
+}
+declare function importUser(store: IStoreAdapter, user: IImportUser): Promise<{
+    id: string;
+}>;
+
+declare function validateAuthConfig(config: IAuthConfig): void;
+
+export { AuthModule, type ChangePasswordInput, IAuthConfig, type IImportUser, type LoginInput, type RegisterInput, type ResetPasswordInput, importUser, normalizeEmail, normalizeEmailSafe, schemas, validateAuthConfig };

package/dist/index.js

@@ -12,7 +12,8 @@ var __export = (target, all) => {
 var password_exports = {};
 __export(password_exports, {
   hashPassword: () => hashPassword,
-  verifyPassword: () => verifyPassword
+  verifyPassword: () => verifyPassword,
+  verifyPasswordForLogin: () => verifyPasswordForLogin
 });
 import bcrypt from "bcryptjs";
 async function hashPassword(plain) {
@@ -21,6 +22,19 @@ async function hashPassword(plain) {
 async function verifyPassword(plain, hash) {
   return bcrypt.compare(plain, hash);
 }
+async function verifyPasswordForLogin(plain, hash, legacyVerify) {
+  if (await verifyPassword(plain, hash)) return { valid: true, needsRehash: false };
+  if (legacyVerify) {
+    let legacyOk = false;
+    try {
+      legacyOk = await legacyVerify(plain, hash);
+    } catch {
+      legacyOk = false;
+    }
+    if (legacyOk) return { valid: true, needsRehash: true };
+  }
+  return { valid: false, needsRehash: false };
+}
 var ROUNDS;
 var init_password = __esm({
   "src/services/password.ts"() {
@@ -718,6 +732,7 @@ function mfaController(store, config, issuer, bus) {
         await users.confirmMfaSecret(ctx.user.id);
         bus?.emit(NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.mfaEnabled,
+          locale: ctx.user.locale,
           data: {},
           recipient: { email: ctx.user.email, phone: null, deviceToken: null }
         }).catch(() => {
@@ -809,6 +824,7 @@ function mfaController(store, config, issuer, bus) {
       await backupCodes.replace(ctx.user.id, codeHashes);
       bus?.emit(NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.mfaBackupCodesRegenerated,
+        locale: ctx.user.locale,
         data: {},
         recipient: { email: ctx.user.email, phone: null, deviceToken: null }
       }).catch(() => {
@@ -835,6 +851,7 @@ function mfaController(store, config, issuer, bus) {
       await Promise.all([users.disableMfa(ctx.user.id), backupCodes.deleteByUser(ctx.user.id)]);
       bus?.emit(NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.mfaDisabled,
+        locale: user.locale,
         data: {},
         recipient: { email: user.email, phone: null, deviceToken: null }
       }).catch(() => {
@@ -1082,6 +1099,7 @@ function authController(store, config, bus) {
           NOTIFICATION_EVENT2,
           {
             type: MESSAGE_KEYS.emailRegistration,
+            locale: user.locale,
             data: { pin, firstName: firstName ?? "" },
             recipient: { email: normalizedEmail, phone: null, deviceToken: null }
           },
@@ -1145,6 +1163,7 @@ function authController(store, config, bus) {
           NOTIFICATION_EVENT2,
           {
             type: MESSAGE_KEYS.phoneOtp,
+            locale: user.locale,
             data: { otp },
             recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
           },
@@ -1200,10 +1219,17 @@ function authController(store, config, bus) {
         if (!user || !user.passwordHash) {
           return setApiResponse3(HTTP3.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
-        const valid = await verifyPassword(password2, user.passwordHash);
+        const { valid, needsRehash } = await verifyPasswordForLogin(
+          password2,
+          user.passwordHash,
+          config.legacyVerify
+        );
         if (!valid) {
           return setApiResponse3(HTTP3.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
+        if (needsRehash) {
+          await users.updatePassword(user.id, await hashPassword(password2));
+        }
         if (user.suspended) {
           return setApiResponse3(
             HTTP3.FORBIDDEN,
@@ -1257,6 +1283,7 @@ function authController(store, config, bus) {
         await phoneVerif.upsert(user.id, normalizePhone(phone2), otp, expiresAt);
         bus?.emit(NOTIFICATION_EVENT2, {
           type: MESSAGE_KEYS.phoneOtp,
+          locale: user.locale,
           data: { otp },
           recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
         }).catch(() => {
@@ -1371,6 +1398,7 @@ function authController(store, config, bus) {
       await passwordReset.create(user.id, pin, expiresAt);
       bus?.emit(NOTIFICATION_EVENT2, {
         type: MESSAGE_KEYS.passwordReset,
+        locale: user.locale,
         recipient: { email: email2, phone: null, deviceToken: null },
         data: { pin }
       }).catch(() => {
@@ -1537,6 +1565,7 @@ function authController(store, config, bus) {
         await phoneVerif.upsert(ctx.user.id, phone2, otp, expiresAt2);
         bus?.emit(NOTIFICATION_EVENT2, {
           type: MESSAGE_KEYS.phoneOtp,
+          locale: ctx.user.locale,
           data: { otp },
           recipient: { email: null, phone: phone2, deviceToken: null }
         }).catch(() => {
@@ -1576,6 +1605,7 @@ function authController(store, config, bus) {
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       bus?.emit(NOTIFICATION_EVENT2, {
         type: MESSAGE_KEYS.emailVerification,
+        locale: ctx.user.locale,
         recipient: { email: ctx.user.email, phone: null, deviceToken: null },
         data: { pin }
       }).catch(() => {
@@ -1687,6 +1717,7 @@ function userController(store, config, bus) {
       await users.updateEmail(ctx.user.id, normalised);
       bus?.emit(NOTIFICATION_EVENT3, {
         type: MESSAGE_KEYS.emailVerification,
+        locale: ctx.user.locale,
         data: { pin },
         recipient: { email: normalised, phone: null, deviceToken: null }
       }).catch(() => {
@@ -1694,6 +1725,7 @@ function userController(store, config, bus) {
       if (oldEmail) {
         bus?.emit(NOTIFICATION_EVENT3, {
           type: MESSAGE_KEYS.emailChanged,
+          locale: ctx.user.locale,
           data: { newEmail: normalised },
           recipient: { email: oldEmail, phone: null, deviceToken: null }
         }).catch(() => {
@@ -1729,6 +1761,7 @@ function userController(store, config, bus) {
       await users.updatePhone(ctx.user.id, normalised);
       bus?.emit(NOTIFICATION_EVENT3, {
         type: MESSAGE_KEYS.phoneOtp,
+        locale: ctx.user.locale,
         data: { otp },
         recipient: { email: null, phone: normalised, deviceToken: null }
       }).catch(() => {
@@ -1736,6 +1769,7 @@ function userController(store, config, bus) {
       if (ctx.user.email) {
         bus?.emit(NOTIFICATION_EVENT3, {
           type: MESSAGE_KEYS.phoneChanged,
+          locale: ctx.user.locale,
           data: {},
           recipient: { email: ctx.user.email, phone: null, deviceToken: null }
         }).catch(() => {
@@ -1950,6 +1984,53 @@ function buildAuthRoutes(store, config, bus) {
   return routes;
 }
 
+// src/services/config-guard.ts
+var MODULE = "@fonderie/auth";
+var PLACEHOLDER_SECRET = /dev-secret|test-secret|changeme|change-me|your[-_]secret|placeholder|example|insecure|min-32-chars/i;
+var MIN_SECRET_LENGTH = 32;
+function collectAuthConfigProblems(config) {
+  const problems = [];
+  const secret = config.jwtSecret ?? "";
+  if (secret.length < MIN_SECRET_LENGTH) {
+    problems.push({
+      module: MODULE,
+      severity: "error",
+      message: `jwtSecret must be at least ${MIN_SECRET_LENGTH} characters (got ${secret.length})`
+    });
+  } else if (PLACEHOLDER_SECRET.test(secret)) {
+    problems.push({
+      module: MODULE,
+      severity: "error",
+      message: "jwtSecret looks like a placeholder or dev-default value"
+    });
+  }
+  if (config.secureCookies === false) {
+    problems.push({
+      module: MODULE,
+      severity: "warning",
+      message: "secureCookies is false \u2014 auth cookies may be sent over non-HTTPS connections in production"
+    });
+  }
+  return problems;
+}
+function validateAuthConfig(config) {
+  const isProduction = process.env["NODE_ENV"] === "production";
+  const problems = collectAuthConfigProblems(config);
+  const errors = problems.filter((p) => p.severity === "error");
+  if (isProduction && errors.length > 0) {
+    throw new Error(
+      `[auth] insecure config \u2014 ${errors.map((e) => e.message).join("; ")}. Set a long, random jwtSecret (e.g. \`openssl rand -base64 32\`). Refusing to boot in production.`
+    );
+  }
+  if (isProduction) {
+    for (const p of problems) console.warn(`[auth] ${p.message}`);
+  } else {
+    for (const p of errors) {
+      console.warn(`[auth] ${p.message} (insecure \u2014 would refuse to boot in production)`);
+    }
+  }
+}
+
 // src/middlewares/session.ts
 function withSession(store, config) {
   const users = new UserModel(store);
@@ -1997,11 +2078,16 @@ var AuthModule = class {
     this.store = store;
     this.config = config;
     this.bus = bus;
+    validateAuthConfig(config);
   }
   store;
   config;
   bus;
   name = "@fonderie/auth";
+  // Report config problems for app.checkProductionReadiness() (data, not throw).
+  checkReadiness() {
+    return collectAuthConfigProblems(this.config);
+  }
   install(app) {
     app.use(withSession(this.store, this.config));
     const routes = buildAuthRoutes(this.store, this.config, this.bus);
@@ -2013,18 +2099,52 @@ var AuthModule = class {
 
 // src/middlewares/require-auth.ts
 import { requireAuth as requireAuth2, requireAnyAuth as requireAnyAuth2 } from "@fonderie/core/middlewares";
+
+// src/migrate.ts
+async function importUser(store, user) {
+  const cols = [];
+  const vals = [];
+  const placeholders = [];
+  const add = (col, val) => {
+    cols.push(col);
+    vals.push(val);
+    placeholders.push(`$${vals.length}`);
+  };
+  if (user.id !== void 0) add("id", user.id);
+  add("email", user.email.toLowerCase().trim());
+  if (user.passwordHash !== void 0) add("password_hash", user.passwordHash);
+  if (user.firstName !== void 0) add("first_name", user.firstName);
+  if (user.lastName !== void 0) add("last_name", user.lastName);
+  if (user.phone !== void 0) add("phone", user.phone);
+  if (user.profileImageUrl !== void 0) add("profile_image_url", user.profileImageUrl);
+  if (user.locale !== void 0) add("locale", user.locale);
+  if (user.timezone !== void 0) add("timezone", user.timezone);
+  if (user.emailVerifiedAt !== void 0) add("email_verified_at", user.emailVerifiedAt);
+  if (user.mfaEnabled !== void 0) add("mfa_enabled", user.mfaEnabled);
+  if (user.createdAt !== void 0) add("created_at", user.createdAt);
+  const [row] = await store.query(
+    `INSERT INTO fonderie_users (${cols.join(", ")})
+		 VALUES (${placeholders.join(", ")})
+		 RETURNING id`,
+    vals
+  );
+  if (!row) throw new Error("[auth] importUser: insert returned no row");
+  return row;
+}
 export {
   AUTH_CONFIG_KEYS,
   AuthModule,
   MESSAGE_KEYS,
   buildAuthAccountLimiter,
   buildAuthIpLimiter,
+  importUser,
   normalizeEmail,
   normalizeEmailSafe,
   requireAuth2 as requireAuth,
   schemas_exports as schemas,
   toUserDTO,
   validate,
+  validateAuthConfig,
   withSession
 };
 //# sourceMappingURL=index.js.map