@fonderie/auth 5.0.4 → 5.2.0

package/dist/index.cjs

@@ -70,6 +70,7 @@ var index_exports = {};
 __export(index_exports, {
   AUTH_CONFIG_KEYS: () => AUTH_CONFIG_KEYS,
   AuthModule: () => AuthModule,
+  DEFAULT_TEMPLATES: () => DEFAULT_TEMPLATES,
   MESSAGE_KEYS: () => MESSAGE_KEYS,
   buildAuthAccountLimiter: () => buildAuthAccountLimiter,
   buildAuthIpLimiter: () => buildAuthIpLimiter,
@@ -730,17 +731,23 @@ var SessionModel = class {
     this.store = store;
   }
   store;
-  async create(userId, token, expiresAt, sid) {
+  async create(userId, token, expiresAt, sid, meta) {
     await this.store.query(
-      `INSERT INTO fonderie_sessions (user_id, token, expires_at, sid)
-			VALUES ($1, $2, $3, $4)
+      `INSERT INTO fonderie_sessions (user_id, token, expires_at, sid, user_agent, ip_address)
+			VALUES ($1, $2, $3, $4, $5, $6)
 			ON CONFLICT (token) DO NOTHING`,
-      [userId, token, expiresAt, sid ?? null]
+      [userId, token, expiresAt, sid ?? null, meta?.userAgent ?? null, meta?.ipAddress ?? null]
     );
   }
   async delete(token) {
     await this.store.query(`DELETE FROM fonderie_sessions WHERE token = $1`, [token]);
   }
+  // Delete the session an access token is bound to (by its sid claim). Lets
+  // logout revoke the current session without the client resending the refresh
+  // token — the access token already identifies its session.
+  async deleteBySid(sid) {
+    await this.store.query(`DELETE FROM fonderie_sessions WHERE sid = $1`, [sid]);
+  }
   // Revoke every session for a user (e.g. on password change). Access tokens
   // bound to these sessions via the sid claim die on their next request.
   async deleteByUser(userId) {
@@ -760,6 +767,42 @@ var SessionModel = class {
       [userId]
     );
   }
+  // Live sessions for the Active Sessions screen: unexpired only, carrying the
+  // sid so the caller can flag the current one (row.sid === the JWT's sid).
+  // No token — that never leaves the server.
+  async listLiveByUser(userId) {
+    return this.store.query(
+      `SELECT id, sid,
+			        user_agent AS "userAgent",
+			        ip_address AS "ipAddress",
+			        created_at AS "createdAt",
+			        expires_at AS "expiresAt"
+			 FROM fonderie_sessions
+			 WHERE user_id = $1 AND expires_at > now()
+			 ORDER BY created_at DESC`,
+      [userId]
+    );
+  }
+  // Terminate one session by row id, scoped to its owner (a user can never
+  // delete another user's session). Returns whether a row was removed.
+  async terminateById(userId, id) {
+    const rows = await this.store.query(
+      `DELETE FROM fonderie_sessions WHERE id = $1 AND user_id = $2 RETURNING id`,
+      [id, userId]
+    );
+    return rows.length > 0;
+  }
+  // Terminate all of a user's sessions except the current one (by sid).
+  // Returns the number of sessions removed.
+  async terminateOthers(userId, keepSid) {
+    const rows = await this.store.query(
+      `DELETE FROM fonderie_sessions
+			 WHERE user_id = $1 AND (sid IS DISTINCT FROM $2)
+			 RETURNING id`,
+      [userId, keepSid]
+    );
+    return rows.length;
+  }
   async exists(token) {
     const rows = await this.store.query(
       `SELECT id FROM fonderie_sessions WHERE token = $1 AND expires_at > now()`,
@@ -812,11 +855,92 @@ var BackupCodeModel = class {
   }
 };
 
+// src/models/login-event.model.ts
+var LoginEventModel = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  async record(e) {
+    await this.store.query(
+      `INSERT INTO fonderie_login_events
+			   (user_id, email_attempted, method, outcome, failure_reason, ip_address, user_agent)
+			 VALUES ($1, $2, $3, $4, $5, $6, $7)`,
+      [
+        e.userId,
+        e.emailAttempted ?? null,
+        e.method,
+        e.outcome,
+        e.failureReason ?? null,
+        e.ipAddress,
+        e.userAgent
+      ]
+    );
+  }
+  // Fire-and-forget variant for the login paths: recording history must never
+  // block or fail a login (same posture as the bus.emit(...).catch(() => {})
+  // notification sends).
+  recordSafe(e) {
+    void this.record(e).catch(() => {
+    });
+  }
+  // One page of a user's own login history, newest first. Keyset-paginated on
+  // (created_at, id) — mirrors audit's event list so the two log UIs share a
+  // cursor contract. The +1 over-fetch that detects a next page lives here so
+  // no outer clamp can shave it off.
+  async listByUser(query) {
+    const limit = Math.min(query.limit ?? 50, MAX_HISTORY_LIMIT);
+    const params = [query.userId];
+    const where = ["user_id = $1"];
+    if (query.outcome) {
+      params.push(query.outcome);
+      where.push(`outcome = $${params.length}`);
+    }
+    if (query.from) {
+      params.push(query.from);
+      where.push(`created_at >= $${params.length}`);
+    }
+    if (query.to) {
+      params.push(query.to);
+      where.push(`created_at <= $${params.length}`);
+    }
+    if (query.cursor) {
+      params.push(query.cursor.createdAt, query.cursor.id);
+      where.push(`(created_at, id) < ($${params.length - 1}::timestamptz, $${params.length}::uuid)`);
+    }
+    params.push(limit + 1);
+    const rows = await this.store.query(
+      `SELECT id, method, outcome, failure_reason AS "failureReason",
+			        ip_address AS "ipAddress", user_agent AS "userAgent",
+			        created_at AS "createdAt", created_at::text AS "createdAtRaw"
+			 FROM   fonderie_login_events
+			 WHERE  ${where.join(" AND ")}
+			 ORDER  BY created_at DESC, id DESC
+			 LIMIT  $${params.length}`,
+      params
+    );
+    return { events: rows.slice(0, limit), hasMore: rows.length > limit };
+  }
+};
+var MAX_HISTORY_LIMIT = 200;
+
+// src/services/request-meta.ts
+var UA_MAX = 512;
+function requestMeta(ctx) {
+  const ip = ctx.meta["clientIp"];
+  const ua = ctx.request.headers.get("user-agent");
+  return {
+    ipAddress: typeof ip === "string" && ip.length > 0 ? ip : null,
+    userAgent: ua && ua.length > 0 ? ua.slice(0, UA_MAX) : null
+  };
+}
+
 // src/controllers/mfa.controller.ts
 function mfaController(store, config, issuer, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
   const backupCodes = new BackupCodeModel(store);
+  const loginEvents = new LoginEventModel(store);
   const mfaCipher = makeMfaCipher(config.mfaSecretKey);
   return {
     // ── 1. Setup ───────────────────────────────────────────────
@@ -846,6 +970,16 @@ function mfaController(store, config, issuer, bus) {
     verify: async (ctx) => {
       const body = ctx.meta["body"];
       const token = body?.["token"];
+      const isLoginCompletion = ctx.user.mfaPending === true;
+      const meta = requestMeta(ctx);
+      const failedMfa = () => loginEvents.recordSafe({
+        userId: ctx.user.id,
+        emailAttempted: ctx.user.email,
+        method: "mfa",
+        outcome: "failed",
+        failureReason: "invalid_code",
+        ...meta
+      });
       if (typeof token !== "string") {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "token is required");
       }
@@ -886,6 +1020,7 @@ function mfaController(store, config, issuer, bus) {
         );
         const matched = checks.find((r) => r.match);
         if (!matched) {
+          if (isLoginCompletion) failedMfa();
           return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid backup code");
         }
         await backupCodes.consume(matched.id);
@@ -903,6 +1038,7 @@ function mfaController(store, config, issuer, bus) {
         }
         const secret = mfaCipher.decrypt(storedSecret);
         if (!verifyTotpToken(token, secret)) {
+          if (isLoginCompletion) failedMfa();
           return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid MFA token");
         }
         if (!ctx.user.mfaEnabled) {
@@ -913,7 +1049,16 @@ function mfaController(store, config, issuer, bus) {
         loginMethod: ctx.user.loginMethod,
         phoneVerified: ctx.user.phoneVerified
       });
-      await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+      await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
+      if (isLoginCompletion) {
+        loginEvents.recordSafe({
+          userId: ctx.user.id,
+          emailAttempted: ctx.user.email,
+          method: "mfa",
+          outcome: "success",
+          ...meta
+        });
+      }
       const fullUser = await users.findById(ctx.user.id);
       if (!fullUser) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.SERVER_ERROR, "SERVER_ERROR", "User not found after MFA verify");
@@ -1182,6 +1327,7 @@ function extractRefreshToken(ctx) {
 function authController(store, config, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
+  const loginEvents = new LoginEventModel(store);
   const passwordReset = new PasswordResetModel(store);
   const emailVerif = new EmailVerificationModel(store);
   const phoneVerif = new PhoneVerificationModel(store);
@@ -1251,7 +1397,7 @@ function authController(store, config, bus) {
         const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "email"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, requestMeta(ctx));
         const resolvedRegister = { ...config, ...config.resolve?.(ctx) };
         const requiresVerification = !!resolvedRegister.requireVerification && !user.emailVerifiedAt;
         return Response.json(
@@ -1315,7 +1461,7 @@ function authController(store, config, bus) {
         const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "phone"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, requestMeta(ctx));
         return Response.json(
           {
             reason: "USER_PHONE_REGISTERED",
@@ -1339,6 +1485,7 @@ function authController(store, config, bus) {
     },
     login: async (ctx) => {
       const body = ctx.meta["body"];
+      const meta = requestMeta(ctx);
       if (typeof body?.["email"] === "string" && typeof body?.["password"] === "string") {
         const { email: rawEmail, password: password2 } = body;
         const email2 = normalizeEmailSafe(rawEmail);
@@ -1347,6 +1494,14 @@ function authController(store, config, bus) {
         }
         const user = await users.findByEmail(email2);
         if (!user || !user.passwordHash) {
+          loginEvents.recordSafe({
+            userId: null,
+            emailAttempted: email2,
+            method: "password",
+            outcome: "failed",
+            failureReason: "unknown_email",
+            ...meta
+          });
           return (0, import_core5.setApiResponse)(import_core5.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
         const { valid, needsRehash } = await verifyPasswordForLogin(
@@ -1355,6 +1510,14 @@ function authController(store, config, bus) {
           config.legacyVerify
         );
         if (!valid) {
+          loginEvents.recordSafe({
+            userId: user.id,
+            emailAttempted: email2,
+            method: "password",
+            outcome: "failed",
+            failureReason: "bad_password",
+            ...meta
+          });
           return (0, import_core5.setApiResponse)(import_core5.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
         if (needsRehash) {
@@ -1376,7 +1539,14 @@ function authController(store, config, bus) {
         const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "email"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
+        loginEvents.recordSafe({
+          userId: user.id,
+          emailAttempted: email2,
+          method: "password",
+          outcome: "success",
+          ...meta
+        });
         const resolvedLogin = { ...config, ...config.resolve?.(ctx) };
         const requiresVerification = !!resolvedLogin.requireVerification && !user.emailVerifiedAt;
         return Response.json(
@@ -1421,7 +1591,7 @@ function authController(store, config, bus) {
         const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "phone"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
         return Response.json(
           {
             reason: "USER_PHONE_OTP_SENT",
@@ -1444,6 +1614,10 @@ function authController(store, config, bus) {
       );
     },
     logout: async (ctx) => {
+      const sid = ctx.user?.sid;
+      if (sid) {
+        await sessions.deleteBySid(sid).catch(() => void 0);
+      }
       const token = extractRefreshToken(ctx);
       if (token) {
         await sessions.delete(token).catch(() => void 0);
@@ -1482,7 +1656,7 @@ function authController(store, config, bus) {
         loginMethod: payload.loginMethod ?? "email",
         phoneVerified: payload.phoneVerified ?? false
       });
-      await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+      await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, requestMeta(ctx));
       return Response.json(
         {
           reason: "TOKENS_REFRESHED",
@@ -1616,7 +1790,7 @@ function authController(store, config, bus) {
           loginMethod: "phone",
           phoneVerified: true
         });
-        await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+        await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, requestMeta(ctx));
         const verifiedUser = await users.findById(ctx.user.id);
         if (!verifiedUser) {
           return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
@@ -1749,8 +1923,40 @@ function authController(store, config, bus) {
 
 // src/controllers/user.controller.ts
 var import_node_crypto5 = require("crypto");
-var import_core6 = require("@fonderie/core");
+var import_core7 = require("@fonderie/core");
 var import_events3 = require("@fonderie/events");
+
+// src/dtos/login-activity.ts
+var import_core6 = require("@fonderie/core");
+function toLoginEventDTO(row) {
+  return {
+    id: row.id,
+    method: row.method,
+    outcome: row.outcome,
+    failureReason: row.failureReason,
+    ipAddress: row.ipAddress,
+    userAgent: row.userAgent,
+    createdAt: row.createdAt instanceof Date ? row.createdAt.toISOString() : String(row.createdAt)
+  };
+}
+function toLoginHistoryPageDTO(page) {
+  const last = page.events[page.events.length - 1];
+  const nextCursor = page.hasMore && last ? (0, import_core6.encodeKeysetCursor)(last.createdAtRaw ?? last.createdAt.toISOString(), last.id) : null;
+  return { events: page.events.map(toLoginEventDTO), nextCursor };
+}
+var decodeLoginCursor = import_core6.decodeKeysetCursor;
+function toSessionDTO(row, currentSid) {
+  return {
+    id: row.id,
+    current: currentSid !== null && row.sid === currentSid,
+    ipAddress: row.ipAddress,
+    userAgent: row.userAgent,
+    createdAt: row.createdAt instanceof Date ? row.createdAt.toISOString() : String(row.createdAt),
+    expiresAt: row.expiresAt instanceof Date ? row.expiresAt.toISOString() : String(row.expiresAt)
+  };
+}
+
+// src/controllers/user.controller.ts
 function normalizePhone2(phone2) {
   return phone2.trim().replace(/[\s()\-\.]/g, "");
 }
@@ -1760,18 +1966,82 @@ function isValidPhone2(phone2) {
 function userController(store, config, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
+  const loginEvents = new LoginEventModel(store);
   const emailVerif = new EmailVerificationModel(store);
   const phoneVerif = new PhoneVerificationModel(store);
   return {
     me: async (ctx) => {
       const user = await users.findById(ctx.user.id);
       if (!user) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       }
-      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "USER_ACCOUNT_FETCHED", "User account fetched successful.", {
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "USER_ACCOUNT_FETCHED", "User account fetched successful.", {
         user: toUserDTO(user, ctx.user.phoneVerified)
       });
     },
+    // ── Login history (append-only; the caller's own attempts) ────────
+    loginHistory: async (ctx) => {
+      const params = new URL(ctx.request.url).searchParams;
+      const rawLimit = Number(params.get("limit") ?? 50);
+      const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.trunc(rawLimit), 1), 200) : 50;
+      const outcomeParam = params.get("outcome");
+      if (outcomeParam !== null && outcomeParam !== "success" && outcomeParam !== "failed") {
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "outcome must be 'success' or 'failed'");
+      }
+      const cursorParam = params.get("cursor");
+      let cursor = null;
+      if (cursorParam) {
+        cursor = decodeLoginCursor(cursorParam);
+        if (!cursor) {
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
+        }
+      }
+      const query = { userId: ctx.user.id, limit };
+      if (outcomeParam) query.outcome = outcomeParam;
+      if (cursor) query.cursor = cursor;
+      const from = params.get("from");
+      const to = params.get("to");
+      if (from) query.from = new Date(from);
+      if (to) query.to = new Date(to);
+      const page = await loginEvents.listByUser(query);
+      return (0, import_core7.setApiResponse)(
+        import_core7.HTTP.OK,
+        "LOGIN_HISTORY_FETCHED",
+        "Login history retrieved.",
+        toLoginHistoryPageDTO(page)
+      );
+    },
+    // ── Active sessions (live only; the caller's own) ─────────────────
+    listSessions: async (ctx) => {
+      const rows = await sessions.listLiveByUser(ctx.user.id);
+      const currentSid = ctx.user.sid ?? null;
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "SESSIONS_FETCHED", "Active sessions retrieved.", {
+        sessions: rows.map((r) => toSessionDTO(r, currentSid))
+      });
+    },
+    terminateSession: async (ctx) => {
+      const id = ctx.meta["params"]?.["id"];
+      if (!id) {
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.NOT_FOUND, "NOT_FOUND", "Session not found");
+      }
+      const removed = await sessions.terminateById(ctx.user.id, id);
+      if (!removed) {
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.NOT_FOUND, "NOT_FOUND", "Session not found");
+      }
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "SESSION_TERMINATED", "Session terminated.", { id });
+    },
+    terminateOtherSessions: async (ctx) => {
+      const currentSid = ctx.user.sid ?? null;
+      if (!currentSid) {
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.UNPROCESSABLE,
+          "NO_CURRENT_SESSION",
+          "Cannot terminate others without a current session context"
+        );
+      }
+      const count = await sessions.terminateOthers(ctx.user.id, currentSid);
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "SESSIONS_TERMINATED", "Other sessions terminated.", { count });
+    },
     updateProfile: async (ctx) => {
       const body = ctx.meta["body"];
       const allowed = ["firstName", "lastName", "avatarUrl"];
@@ -1780,18 +2050,18 @@ function userController(store, config, bus) {
         if (body?.[key] !== void 0) fields[key] = body[key];
       }
       if (Object.keys(fields).length === 0) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.UNPROCESSABLE,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "Provide at least one of: firstName, lastName, avatarUrl"
         );
       }
       const row = await users.update(ctx.user.id, fields);
       if (!row) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       }
       const updated = await users.findById(ctx.user.id);
-      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "PROFILE_UPDATED", "Profile updated.", {
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "PROFILE_UPDATED", "Profile updated.", {
         user: toUserDTO(updated, ctx.user.phoneVerified)
       });
     },
@@ -1808,14 +2078,14 @@ function userController(store, config, bus) {
       if (Object.keys(patch).length > 0) fields.patch = patch;
       const row = await users.updatePreferences(ctx.user.id, fields);
       if (!row) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.UNPROCESSABLE,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "Provide at least one preference field"
         );
       }
       const updated = await users.findById(ctx.user.id);
-      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "PREFERENCES_UPDATED", "Preferences updated.", {
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "PREFERENCES_UPDATED", "Preferences updated.", {
         user: toUserDTO(updated, ctx.user.phoneVerified)
       });
     },
@@ -1824,23 +2094,23 @@ function userController(store, config, bus) {
       const newEmail = body?.["email"];
       const normalised = typeof newEmail === "string" ? normalizeEmailSafe(newEmail) : null;
       if (!normalised) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.UNPROCESSABLE,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "A valid email address is required"
         );
       }
       const oldEmail = ctx.user.email;
       if (normalised === oldEmail) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.UNPROCESSABLE,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "New email must differ from current email"
         );
       }
       const existing = await users.findByEmail(normalised);
       if (existing) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.CONFLICT, "EMAIL_IN_USE", "Email already in use");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.CONFLICT, "EMAIL_IN_USE", "Email already in use");
       }
       const pin = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
@@ -1862,8 +2132,8 @@ function userController(store, config, bus) {
         }).catch(() => {
         });
       }
-      return (0, import_core6.setApiResponse)(
-        import_core6.HTTP.OK,
+      return (0, import_core7.setApiResponse)(
+        import_core7.HTTP.OK,
         "EMAIL_UPDATED",
         "Email updated. A verification code has been sent to your new address.",
         {
@@ -1875,8 +2145,8 @@ function userController(store, config, bus) {
       const body = ctx.meta["body"];
       const newPhone = body?.["phone"];
       if (!isValidPhone2(newPhone)) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.UNPROCESSABLE,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "A valid phone number is required"
         );
@@ -1884,7 +2154,7 @@ function userController(store, config, bus) {
       const normalised = normalizePhone2(newPhone);
       const existing = await users.findByPhone(normalised);
       if (existing) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.CONFLICT, "PHONE_IN_USE", "Phone number already in use");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.CONFLICT, "PHONE_IN_USE", "Phone number already in use");
       }
       const otp = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 10 * 60 * 1e3);
@@ -1906,8 +2176,8 @@ function userController(store, config, bus) {
         }).catch(() => {
         });
       }
-      return (0, import_core6.setApiResponse)(
-        import_core6.HTTP.OK,
+      return (0, import_core7.setApiResponse)(
+        import_core7.HTTP.OK,
         "PHONE_UPDATED",
         "Phone number updated. A verification code has been sent to your new number.",
         {
@@ -1920,22 +2190,22 @@ function userController(store, config, bus) {
       const currentPassword = body?.["currentPassword"];
       const newPassword = body?.["newPassword"];
       if (typeof currentPassword !== "string" || !currentPassword) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "currentPassword is required");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "currentPassword is required");
       }
       if (typeof newPassword !== "string" || newPassword.length < 8) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "newPassword must be at least 8 characters");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "newPassword must be at least 8 characters");
       }
       const user = await users.findById(ctx.user.id);
-      if (!user) return (0, import_core6.setApiResponse)(import_core6.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+      if (!user) return (0, import_core7.setApiResponse)(import_core7.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       const { hashPassword: hashPassword2, verifyPassword: verifyPassword2 } = await Promise.resolve().then(() => (init_password(), password_exports));
       const valid = await verifyPassword2(currentPassword, user.passwordHash ?? "");
       if (!valid) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_CREDENTIAL", "Current password is incorrect");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_CREDENTIAL", "Current password is incorrect");
       }
       const hash = await hashPassword2(newPassword);
       await users.updatePassword(ctx.user.id, hash);
       await sessions.deleteByUser(ctx.user.id);
-      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "PASSWORD_CHANGED", "Password updated successfully.");
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "PASSWORD_CHANGED", "Password updated successfully.");
     },
     deleteMe: async (ctx) => {
       const userId = ctx.user.id;
@@ -1960,7 +2230,7 @@ function userController(store, config, bus) {
     // no MFA secret, no session tokens (session metadata only).
     exportMe: async (ctx) => {
       const user = await users.findById(ctx.user.id);
-      if (!user) return (0, import_core6.setApiResponse)(import_core6.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+      if (!user) return (0, import_core7.setApiResponse)(import_core7.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       const sessionRows = await sessions.listByUser(ctx.user.id);
       const bundle = {
         exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -1969,8 +2239,8 @@ function userController(store, config, bus) {
           id: s.id,
           userAgent: s.userAgent,
           ipAddress: s.ipAddress,
-          createdAt: (0, import_core6.dateOrEmpty)(s.createdAt),
-          expiresAt: (0, import_core6.dateOrEmpty)(s.expiresAt)
+          createdAt: (0, import_core7.dateOrEmpty)(s.createdAt),
+          expiresAt: (0, import_core7.dateOrEmpty)(s.expiresAt)
         })),
         security: {
           mfaEnabled: user.mfaEnabled === true,
@@ -1989,22 +2259,23 @@ function userController(store, config, bus) {
         }
         bundle["modules"] = modules;
       }
-      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "DATA_EXPORT", "Your account data.", bundle);
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "DATA_EXPORT", "Your account data.", bundle);
     }
   };
 }
 
 // src/controllers/oauth.controller.ts
-var import_core7 = require("@fonderie/core");
+var import_core8 = require("@fonderie/core");
 function oauthController(store, config) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
+  const loginEvents = new LoginEventModel(store);
   return {
     googleInit: async (_ctx) => {
       const google = config.google;
       if (!google) {
-        return (0, import_core7.setApiResponse)(
-          import_core7.HTTP.NOT_IMPLEMENTED,
+        return (0, import_core8.setApiResponse)(
+          import_core8.HTTP.NOT_IMPLEMENTED,
           "NOT_CONFIGURED",
           "Google OAuth not configured"
         );
@@ -2016,8 +2287,8 @@ function oauthController(store, config) {
         scope: "openid email profile"
       });
       const url = `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
-      return (0, import_core7.setApiResponse)(
-        import_core7.HTTP.OK,
+      return (0, import_core8.setApiResponse)(
+        import_core8.HTTP.OK,
         "GOOGLE_AUTH_URL",
         "Redirect the user to the returned URL to begin Google OAuth.",
         { url }
@@ -2026,8 +2297,8 @@ function oauthController(store, config) {
     googleCallback: async (ctx) => {
       const google = config.google;
       if (!google) {
-        return (0, import_core7.setApiResponse)(
-          import_core7.HTTP.NOT_IMPLEMENTED,
+        return (0, import_core8.setApiResponse)(
+          import_core8.HTTP.NOT_IMPLEMENTED,
           "NOT_CONFIGURED",
           "Google OAuth not configured"
         );
@@ -2035,7 +2306,7 @@ function oauthController(store, config) {
       const url = new URL(ctx.request.url);
       const code = url.searchParams.get("code");
       if (!code) {
-        return (0, import_core7.setApiResponse)(import_core7.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
       }
       const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
         method: "POST",
@@ -2050,8 +2321,8 @@ function oauthController(store, config) {
       });
       const tokenData = await tokenRes.json();
       if (!tokenData.id_token) {
-        return (0, import_core7.setApiResponse)(
-          import_core7.HTTP.BAD_REQUEST,
+        return (0, import_core8.setApiResponse)(
+          import_core8.HTTP.BAD_REQUEST,
           "GOOGLE_AUTH_FAILED",
           "OAuth token exchange failed"
         );
@@ -2060,24 +2331,40 @@ function oauthController(store, config) {
         Buffer.from(tokenData.id_token.split(".")[1] ?? "", "base64url").toString()
       );
       if (!payload.email) {
-        return (0, import_core7.setApiResponse)(import_core7.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "No email in OAuth response");
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "No email in OAuth response");
       }
       const normalizedEmail = normalizeEmailSafe(payload.email);
       if (!normalizedEmail) {
-        return (0, import_core7.setApiResponse)(import_core7.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "Invalid email in OAuth response");
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "Invalid email in OAuth response");
       }
+      const meta = requestMeta(ctx);
       const upserted = await users.upsertByProvider(normalizedEmail, "google", payload.sub ?? "");
       if (!upserted) {
-        return (0, import_core7.setApiResponse)(import_core7.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
+        loginEvents.recordSafe({
+          userId: null,
+          emailAttempted: normalizedEmail,
+          method: "oauth-google",
+          outcome: "failed",
+          failureReason: "provider_upsert_failed",
+          ...meta
+        });
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
       }
       const fullUser = await users.findById(upserted.id);
       if (!fullUser) {
-        return (0, import_core7.setApiResponse)(import_core7.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
       }
       const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, {
         loginMethod: "google"
       });
-      await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+      await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
+      loginEvents.recordSafe({
+        userId: upserted.id,
+        emailAttempted: normalizedEmail,
+        method: "oauth-google",
+        outcome: "success",
+        ...meta
+      });
       return Response.json(
         {
           reason: "GOOGLE_AUTH_SUCCESS",
@@ -2135,6 +2422,13 @@ function buildAuthRoutes(store, config, bus) {
     R("changePassword", "PUT", "/users/password", import_middlewares2.requireAuth, (0, import_middlewares.validate)(changePasswordSchema), user.changePassword),
     R("deleteMe", "DELETE", "/users", import_middlewares2.requireAuth, verifyGate, user.deleteMe),
     R("exportMe", "GET", "/users/export", import_middlewares2.requireAuth, user.exportMe),
+    // Security surfaces (Protected; the caller's own login history + sessions).
+    // The literal /others route is registered before /:id so it isn't
+    // captured as an id.
+    R("loginHistory", "GET", "/auth/login-history", import_middlewares2.requireAuth, user.loginHistory),
+    R("listSessions", "GET", "/auth/sessions", import_middlewares2.requireAuth, user.listSessions),
+    R("terminateOtherSessions", "DELETE", "/auth/sessions/others", import_middlewares2.requireAuth, user.terminateOtherSessions),
+    R("terminateSession", "DELETE", "/auth/sessions/:id", import_middlewares2.requireAuth, user.terminateSession),
     // MFA (email sessions only — requireVerified is always enforced here
     // because MFA is a security feature and email verification is meaningful)
     R("mfaSetup", "POST", "/auth/mfa/setup", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, mfa.setup),
@@ -2154,17 +2448,17 @@ function buildAuthRoutes(store, config, bus) {
 }
 
 // src/services/config-guard.ts
-var import_core8 = require("@fonderie/core");
+var import_core9 = require("@fonderie/core");
 var MODULE = "@fonderie/auth";
 function collectAuthConfigProblems(config) {
   const problems = [];
   const secret = config.jwtSecret ?? "";
-  const secretProblem = (0, import_core8.secretStrengthProblem)(secret);
+  const secretProblem = (0, import_core9.secretStrengthProblem)(secret);
   if (secretProblem === "too-short") {
     problems.push({
       module: MODULE,
       severity: "error",
-      message: `jwtSecret must be at least ${import_core8.MIN_SECRET_LENGTH} characters (got ${secret.length})`
+      message: `jwtSecret must be at least ${import_core9.MIN_SECRET_LENGTH} characters (got ${secret.length})`
     });
   } else if (secretProblem === "placeholder") {
     problems.push({
@@ -2188,7 +2482,7 @@ function collectAuthConfigProblems(config) {
         severity: "error",
         message: "google OAuth is configured but clientId, clientSecret, or redirectUri is missing"
       });
-    } else if (import_core8.PLACEHOLDER_SECRET.test(clientSecret)) {
+    } else if (import_core9.PLACEHOLDER_SECRET.test(clientSecret)) {
       problems.push({
         module: MODULE,
         severity: "error",
@@ -2255,7 +2549,10 @@ function withSession(store, config) {
         ...user,
         loginMethod: payload.loginMethod ?? "email",
         phoneVerified: payload.phoneVerified ?? false,
-        mfaPending: payload.mfaPending ?? false
+        mfaPending: payload.mfaPending ?? false,
+        // The session this request is authenticated on, so the sessions
+        // API can flag the current row and "terminate others" can spare it.
+        sid: payload.sid ?? null
       }
     });
     return next();
@@ -2296,6 +2593,122 @@ var AuthModule = class {
   }
 };
 
+// src/templates.ts
+var DEFAULT_TEMPLATES = {
+  [MESSAGE_KEYS.emailRegistration]: {
+    subject: "Confirm your account",
+    html: `<h1>Welcome aboard</h1>
+<p>Hi {{firstName}},</p>
+<p>Thanks for signing up. Confirm your account with this code:</p>
+<p><span class="pin-code">{{pin}}</span></p>
+<p class="muted">This code expires in 24 hours. If you didn&rsquo;t create an account, you can safely ignore this email.</p>`,
+    text: `Welcome aboard
+
+Hi {{firstName}},
+
+Thanks for signing up. Confirm your account with this code: {{pin}}
+
+This code expires in 24 hours. If you didn't create an account, you can safely ignore this email.`
+  },
+  [MESSAGE_KEYS.emailVerification]: {
+    subject: "Your verification code",
+    html: `<h1>Verify your email</h1>
+<p>Hi {{firstName}},</p>
+<p>Use this code to finish setting up your account:</p>
+<p><span class="pin-code">{{pin}}</span></p>
+<p class="muted">This code expires in 24 hours. If you didn&rsquo;t create an account, you can safely ignore this email.</p>`,
+    text: `Verify your email
+
+Hi {{firstName}},
+
+Use this code to finish setting up your account: {{pin}}
+
+This code expires in 24 hours. If you didn't create an account, you can safely ignore this email.`
+  },
+  [MESSAGE_KEYS.passwordReset]: {
+    subject: "Reset your password",
+    html: `<h1>Reset your password</h1>
+<p>We received a request to reset your password. Use this code to continue:</p>
+<p><span class="pin-code">{{pin}}</span></p>
+<p class="muted">This code expires soon. If you didn&rsquo;t request a reset, no action is needed &mdash; your password stays the same.</p>`,
+    text: `Reset your password
+
+We received a request to reset your password. Use this code to continue: {{pin}}
+
+This code expires soon. If you didn't request a reset, no action is needed \u2014 your password stays the same.`
+  },
+  // SMS — text only, no subject/html.
+  [MESSAGE_KEYS.phoneOtp]: {
+    text: "{{otp}} is your verification code. It expires in 10 minutes."
+  },
+  [MESSAGE_KEYS.mfaEnabled]: {
+    subject: "Two-factor authentication is on",
+    html: `<h1>Two-factor authentication enabled</h1>
+<p>Two-factor authentication was just turned on for your account. From now on you&rsquo;ll enter a code from your authenticator app when you sign in.</p>
+<p class="muted">If you didn&rsquo;t do this, contact support right away &mdash; someone may have access to your account.</p>`,
+    text: `Two-factor authentication enabled
+
+Two-factor authentication was just turned on for your account. From now on you'll enter a code from your authenticator app when you sign in.
+
+If you didn't do this, contact support right away \u2014 someone may have access to your account.`
+  },
+  [MESSAGE_KEYS.mfaDisabled]: {
+    subject: "Two-factor authentication is off",
+    html: `<h1>Two-factor authentication disabled</h1>
+<p>Two-factor authentication was just turned off for your account. Your account is now protected by your password alone.</p>
+<p class="muted">If you didn&rsquo;t do this, contact support right away and re-enable two-factor authentication &mdash; someone may have access to your account.</p>`,
+    text: `Two-factor authentication disabled
+
+Two-factor authentication was just turned off for your account. Your account is now protected by your password alone.
+
+If you didn't do this, contact support right away and re-enable two-factor authentication \u2014 someone may have access to your account.`
+  },
+  [MESSAGE_KEYS.mfaBackupCodesRegenerated]: {
+    subject: "Your backup codes were regenerated",
+    html: `<h1>New backup codes generated</h1>
+<p>A new set of two-factor backup codes was just generated for your account. Your previous backup codes no longer work.</p>
+<p class="muted">If you didn&rsquo;t do this, contact support right away &mdash; someone may have access to your account.</p>`,
+    text: `New backup codes generated
+
+A new set of two-factor backup codes was just generated for your account. Your previous backup codes no longer work.
+
+If you didn't do this, contact support right away \u2014 someone may have access to your account.`
+  },
+  [MESSAGE_KEYS.emailChanged]: {
+    subject: "Your email address was changed",
+    html: `<h1>Your email was changed</h1>
+<p>The email address on your account was just changed to <strong>{{newEmail}}</strong>.</p>
+<p class="muted">If you made this change, you&rsquo;re all set. If not, contact support right away &mdash; someone may have access to your account.</p>`,
+    text: `Your email was changed
+
+The email address on your account was just changed to {{newEmail}}.
+
+If you made this change, you're all set. If not, contact support right away \u2014 someone may have access to your account.`
+  },
+  [MESSAGE_KEYS.phoneChanged]: {
+    subject: "Your phone number was changed",
+    html: `<h1>Your phone number was changed</h1>
+<p>The phone number on your account was just updated.</p>
+<p class="muted">If you made this change, you&rsquo;re all set. If not, contact support right away &mdash; someone may have access to your account.</p>`,
+    text: `Your phone number was changed
+
+The phone number on your account was just updated.
+
+If you made this change, you're all set. If not, contact support right away \u2014 someone may have access to your account.`
+  }
+};
+var SAMPLE_PAYLOADS = {
+  [MESSAGE_KEYS.emailRegistration]: { firstName: "", pin: "123456" },
+  [MESSAGE_KEYS.emailVerification]: { firstName: "Ada", pin: "123456" },
+  [MESSAGE_KEYS.passwordReset]: { pin: "123456" },
+  [MESSAGE_KEYS.phoneOtp]: { otp: "123456" },
+  [MESSAGE_KEYS.mfaEnabled]: {},
+  [MESSAGE_KEYS.mfaDisabled]: {},
+  [MESSAGE_KEYS.mfaBackupCodesRegenerated]: {},
+  [MESSAGE_KEYS.emailChanged]: { newEmail: "new@example.com" },
+  [MESSAGE_KEYS.phoneChanged]: {}
+};
+
 // src/middlewares/require-auth.ts
 var import_middlewares3 = require("@fonderie/core/middlewares");
 
@@ -2369,6 +2782,7 @@ function startUserRetention(store, options) {
 0 && (module.exports = {
   AUTH_CONFIG_KEYS,
   AuthModule,
+  DEFAULT_TEMPLATES,
   MESSAGE_KEYS,
   buildAuthAccountLimiter,
   buildAuthIpLimiter,