@fonderie/auth 5.1.0 → 5.3.0

package/dist/index.cjs

@@ -126,6 +126,12 @@ var DEFAULTS = {
     account: { capacity: 3, refillPerSec: 3 / min(60) },
     accountField: "email"
   },
+  // reset: 10/15min per IP — the reset PIN is a 6-digit code looked up
+  // globally, so an unthrottled endpoint is brute-forceable into an account
+  // takeover. There's no email in the reset body to key an account bucket on,
+  // so this IP bucket is the guard. (Moving reset to a high-entropy opaque
+  // token is tracked as a follow-up hardening.)
+  reset: { ip: { capacity: 10, refillPerSec: 10 / min(15) } },
   // mfaVerify: 10/15min per IP — TOTP brute-force.
   mfaVerify: { ip: { capacity: 10, refillPerSec: 10 / min(15) } }
 };
@@ -731,17 +737,23 @@ var SessionModel = class {
     this.store = store;
   }
   store;
-  async create(userId, token, expiresAt, sid) {
+  async create(userId, token, expiresAt, sid, meta) {
     await this.store.query(
-      `INSERT INTO fonderie_sessions (user_id, token, expires_at, sid)
-			VALUES ($1, $2, $3, $4)
+      `INSERT INTO fonderie_sessions (user_id, token, expires_at, sid, user_agent, ip_address)
+			VALUES ($1, $2, $3, $4, $5, $6)
 			ON CONFLICT (token) DO NOTHING`,
-      [userId, token, expiresAt, sid ?? null]
+      [userId, token, expiresAt, sid ?? null, meta?.userAgent ?? null, meta?.ipAddress ?? null]
     );
   }
   async delete(token) {
     await this.store.query(`DELETE FROM fonderie_sessions WHERE token = $1`, [token]);
   }
+  // Delete the session an access token is bound to (by its sid claim). Lets
+  // logout revoke the current session without the client resending the refresh
+  // token — the access token already identifies its session.
+  async deleteBySid(sid) {
+    await this.store.query(`DELETE FROM fonderie_sessions WHERE sid = $1`, [sid]);
+  }
   // Revoke every session for a user (e.g. on password change). Access tokens
   // bound to these sessions via the sid claim die on their next request.
   async deleteByUser(userId) {
@@ -761,6 +773,42 @@ var SessionModel = class {
       [userId]
     );
   }
+  // Live sessions for the Active Sessions screen: unexpired only, carrying the
+  // sid so the caller can flag the current one (row.sid === the JWT's sid).
+  // No token — that never leaves the server.
+  async listLiveByUser(userId) {
+    return this.store.query(
+      `SELECT id, sid,
+			        user_agent AS "userAgent",
+			        ip_address AS "ipAddress",
+			        created_at AS "createdAt",
+			        expires_at AS "expiresAt"
+			 FROM fonderie_sessions
+			 WHERE user_id = $1 AND expires_at > now()
+			 ORDER BY created_at DESC`,
+      [userId]
+    );
+  }
+  // Terminate one session by row id, scoped to its owner (a user can never
+  // delete another user's session). Returns whether a row was removed.
+  async terminateById(userId, id) {
+    const rows = await this.store.query(
+      `DELETE FROM fonderie_sessions WHERE id = $1 AND user_id = $2 RETURNING id`,
+      [id, userId]
+    );
+    return rows.length > 0;
+  }
+  // Terminate all of a user's sessions except the current one (by sid).
+  // Returns the number of sessions removed.
+  async terminateOthers(userId, keepSid) {
+    const rows = await this.store.query(
+      `DELETE FROM fonderie_sessions
+			 WHERE user_id = $1 AND (sid IS DISTINCT FROM $2)
+			 RETURNING id`,
+      [userId, keepSid]
+    );
+    return rows.length;
+  }
   async exists(token) {
     const rows = await this.store.query(
       `SELECT id FROM fonderie_sessions WHERE token = $1 AND expires_at > now()`,
@@ -813,11 +861,92 @@ var BackupCodeModel = class {
   }
 };
 
+// src/models/login-event.model.ts
+var LoginEventModel = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  async record(e) {
+    await this.store.query(
+      `INSERT INTO fonderie_login_events
+			   (user_id, email_attempted, method, outcome, failure_reason, ip_address, user_agent)
+			 VALUES ($1, $2, $3, $4, $5, $6, $7)`,
+      [
+        e.userId,
+        e.emailAttempted ?? null,
+        e.method,
+        e.outcome,
+        e.failureReason ?? null,
+        e.ipAddress,
+        e.userAgent
+      ]
+    );
+  }
+  // Fire-and-forget variant for the login paths: recording history must never
+  // block or fail a login (same posture as the bus.emit(...).catch(() => {})
+  // notification sends).
+  recordSafe(e) {
+    void this.record(e).catch(() => {
+    });
+  }
+  // One page of a user's own login history, newest first. Keyset-paginated on
+  // (created_at, id) — mirrors audit's event list so the two log UIs share a
+  // cursor contract. The +1 over-fetch that detects a next page lives here so
+  // no outer clamp can shave it off.
+  async listByUser(query) {
+    const limit = Math.min(query.limit ?? 50, MAX_HISTORY_LIMIT);
+    const params = [query.userId];
+    const where = ["user_id = $1"];
+    if (query.outcome) {
+      params.push(query.outcome);
+      where.push(`outcome = $${params.length}`);
+    }
+    if (query.from) {
+      params.push(query.from);
+      where.push(`created_at >= $${params.length}`);
+    }
+    if (query.to) {
+      params.push(query.to);
+      where.push(`created_at <= $${params.length}`);
+    }
+    if (query.cursor) {
+      params.push(query.cursor.createdAt, query.cursor.id);
+      where.push(`(created_at, id) < ($${params.length - 1}::timestamptz, $${params.length}::uuid)`);
+    }
+    params.push(limit + 1);
+    const rows = await this.store.query(
+      `SELECT id, method, outcome, failure_reason AS "failureReason",
+			        ip_address AS "ipAddress", user_agent AS "userAgent",
+			        created_at AS "createdAt", created_at::text AS "createdAtRaw"
+			 FROM   fonderie_login_events
+			 WHERE  ${where.join(" AND ")}
+			 ORDER  BY created_at DESC, id DESC
+			 LIMIT  $${params.length}`,
+      params
+    );
+    return { events: rows.slice(0, limit), hasMore: rows.length > limit };
+  }
+};
+var MAX_HISTORY_LIMIT = 200;
+
+// src/services/request-meta.ts
+var UA_MAX = 512;
+function requestMeta(ctx) {
+  const ip = ctx.meta["clientIp"];
+  const ua = ctx.request.headers.get("user-agent");
+  return {
+    ipAddress: typeof ip === "string" && ip.length > 0 ? ip : null,
+    userAgent: ua && ua.length > 0 ? ua.slice(0, UA_MAX) : null
+  };
+}
+
 // src/controllers/mfa.controller.ts
 function mfaController(store, config, issuer, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
   const backupCodes = new BackupCodeModel(store);
+  const loginEvents = new LoginEventModel(store);
   const mfaCipher = makeMfaCipher(config.mfaSecretKey);
   return {
     // ── 1. Setup ───────────────────────────────────────────────
@@ -847,6 +976,16 @@ function mfaController(store, config, issuer, bus) {
     verify: async (ctx) => {
       const body = ctx.meta["body"];
       const token = body?.["token"];
+      const isLoginCompletion = ctx.user.mfaPending === true;
+      const meta = requestMeta(ctx);
+      const failedMfa = () => loginEvents.recordSafe({
+        userId: ctx.user.id,
+        emailAttempted: ctx.user.email,
+        method: "mfa",
+        outcome: "failed",
+        failureReason: "invalid_code",
+        ...meta
+      });
       if (typeof token !== "string") {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "token is required");
       }
@@ -887,6 +1026,7 @@ function mfaController(store, config, issuer, bus) {
         );
         const matched = checks.find((r) => r.match);
         if (!matched) {
+          if (isLoginCompletion) failedMfa();
           return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid backup code");
         }
         await backupCodes.consume(matched.id);
@@ -904,6 +1044,7 @@ function mfaController(store, config, issuer, bus) {
         }
         const secret = mfaCipher.decrypt(storedSecret);
         if (!verifyTotpToken(token, secret)) {
+          if (isLoginCompletion) failedMfa();
           return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid MFA token");
         }
         if (!ctx.user.mfaEnabled) {
@@ -914,7 +1055,16 @@ function mfaController(store, config, issuer, bus) {
         loginMethod: ctx.user.loginMethod,
         phoneVerified: ctx.user.phoneVerified
       });
-      await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+      await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
+      if (isLoginCompletion) {
+        loginEvents.recordSafe({
+          userId: ctx.user.id,
+          emailAttempted: ctx.user.email,
+          method: "mfa",
+          outcome: "success",
+          ...meta
+        });
+      }
       const fullUser = await users.findById(ctx.user.id);
       if (!fullUser) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.SERVER_ERROR, "SERVER_ERROR", "User not found after MFA verify");
@@ -1183,6 +1333,7 @@ function extractRefreshToken(ctx) {
 function authController(store, config, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
+  const loginEvents = new LoginEventModel(store);
   const passwordReset = new PasswordResetModel(store);
   const emailVerif = new EmailVerificationModel(store);
   const phoneVerif = new PhoneVerificationModel(store);
@@ -1252,7 +1403,7 @@ function authController(store, config, bus) {
         const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "email"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, requestMeta(ctx));
         const resolvedRegister = { ...config, ...config.resolve?.(ctx) };
         const requiresVerification = !!resolvedRegister.requireVerification && !user.emailVerifiedAt;
         return Response.json(
@@ -1316,7 +1467,7 @@ function authController(store, config, bus) {
         const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "phone"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, requestMeta(ctx));
         return Response.json(
           {
             reason: "USER_PHONE_REGISTERED",
@@ -1340,6 +1491,7 @@ function authController(store, config, bus) {
     },
     login: async (ctx) => {
       const body = ctx.meta["body"];
+      const meta = requestMeta(ctx);
       if (typeof body?.["email"] === "string" && typeof body?.["password"] === "string") {
         const { email: rawEmail, password: password2 } = body;
         const email2 = normalizeEmailSafe(rawEmail);
@@ -1348,6 +1500,14 @@ function authController(store, config, bus) {
         }
         const user = await users.findByEmail(email2);
         if (!user || !user.passwordHash) {
+          loginEvents.recordSafe({
+            userId: null,
+            emailAttempted: email2,
+            method: "password",
+            outcome: "failed",
+            failureReason: "unknown_email",
+            ...meta
+          });
           return (0, import_core5.setApiResponse)(import_core5.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
         const { valid, needsRehash } = await verifyPasswordForLogin(
@@ -1356,6 +1516,14 @@ function authController(store, config, bus) {
           config.legacyVerify
         );
         if (!valid) {
+          loginEvents.recordSafe({
+            userId: user.id,
+            emailAttempted: email2,
+            method: "password",
+            outcome: "failed",
+            failureReason: "bad_password",
+            ...meta
+          });
           return (0, import_core5.setApiResponse)(import_core5.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
         if (needsRehash) {
@@ -1377,7 +1545,14 @@ function authController(store, config, bus) {
         const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "email"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
+        loginEvents.recordSafe({
+          userId: user.id,
+          emailAttempted: email2,
+          method: "password",
+          outcome: "success",
+          ...meta
+        });
         const resolvedLogin = { ...config, ...config.resolve?.(ctx) };
         const requiresVerification = !!resolvedLogin.requireVerification && !user.emailVerifiedAt;
         return Response.json(
@@ -1422,7 +1597,7 @@ function authController(store, config, bus) {
         const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "phone"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
         return Response.json(
           {
             reason: "USER_PHONE_OTP_SENT",
@@ -1445,6 +1620,10 @@ function authController(store, config, bus) {
       );
     },
     logout: async (ctx) => {
+      const sid = ctx.user?.sid;
+      if (sid) {
+        await sessions.deleteBySid(sid).catch(() => void 0);
+      }
       const token = extractRefreshToken(ctx);
       if (token) {
         await sessions.delete(token).catch(() => void 0);
@@ -1483,7 +1662,7 @@ function authController(store, config, bus) {
         loginMethod: payload.loginMethod ?? "email",
         phoneVerified: payload.phoneVerified ?? false
       });
-      await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+      await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, requestMeta(ctx));
       return Response.json(
         {
           reason: "TOKENS_REFRESHED",
@@ -1617,7 +1796,7 @@ function authController(store, config, bus) {
           loginMethod: "phone",
           phoneVerified: true
         });
-        await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+        await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, requestMeta(ctx));
         const verifiedUser = await users.findById(ctx.user.id);
         if (!verifiedUser) {
           return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
@@ -1750,8 +1929,40 @@ function authController(store, config, bus) {
 
 // src/controllers/user.controller.ts
 var import_node_crypto5 = require("crypto");
-var import_core6 = require("@fonderie/core");
+var import_core7 = require("@fonderie/core");
 var import_events3 = require("@fonderie/events");
+
+// src/dtos/login-activity.ts
+var import_core6 = require("@fonderie/core");
+function toLoginEventDTO(row) {
+  return {
+    id: row.id,
+    method: row.method,
+    outcome: row.outcome,
+    failureReason: row.failureReason,
+    ipAddress: row.ipAddress,
+    userAgent: row.userAgent,
+    createdAt: row.createdAt instanceof Date ? row.createdAt.toISOString() : String(row.createdAt)
+  };
+}
+function toLoginHistoryPageDTO(page) {
+  const last = page.events[page.events.length - 1];
+  const nextCursor = page.hasMore && last ? (0, import_core6.encodeKeysetCursor)(last.createdAtRaw ?? last.createdAt.toISOString(), last.id) : null;
+  return { events: page.events.map(toLoginEventDTO), nextCursor };
+}
+var decodeLoginCursor = import_core6.decodeKeysetCursor;
+function toSessionDTO(row, currentSid) {
+  return {
+    id: row.id,
+    current: currentSid !== null && row.sid === currentSid,
+    ipAddress: row.ipAddress,
+    userAgent: row.userAgent,
+    createdAt: row.createdAt instanceof Date ? row.createdAt.toISOString() : String(row.createdAt),
+    expiresAt: row.expiresAt instanceof Date ? row.expiresAt.toISOString() : String(row.expiresAt)
+  };
+}
+
+// src/controllers/user.controller.ts
 function normalizePhone2(phone2) {
   return phone2.trim().replace(/[\s()\-\.]/g, "");
 }
@@ -1761,18 +1972,82 @@ function isValidPhone2(phone2) {
 function userController(store, config, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
+  const loginEvents = new LoginEventModel(store);
   const emailVerif = new EmailVerificationModel(store);
   const phoneVerif = new PhoneVerificationModel(store);
   return {
     me: async (ctx) => {
       const user = await users.findById(ctx.user.id);
       if (!user) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       }
-      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "USER_ACCOUNT_FETCHED", "User account fetched successful.", {
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "USER_ACCOUNT_FETCHED", "User account fetched successful.", {
         user: toUserDTO(user, ctx.user.phoneVerified)
       });
     },
+    // ── Login history (append-only; the caller's own attempts) ────────
+    loginHistory: async (ctx) => {
+      const params = new URL(ctx.request.url).searchParams;
+      const rawLimit = Number(params.get("limit") ?? 50);
+      const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.trunc(rawLimit), 1), 200) : 50;
+      const outcomeParam = params.get("outcome");
+      if (outcomeParam !== null && outcomeParam !== "success" && outcomeParam !== "failed") {
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "outcome must be 'success' or 'failed'");
+      }
+      const cursorParam = params.get("cursor");
+      let cursor = null;
+      if (cursorParam) {
+        cursor = decodeLoginCursor(cursorParam);
+        if (!cursor) {
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
+        }
+      }
+      const query = { userId: ctx.user.id, limit };
+      if (outcomeParam) query.outcome = outcomeParam;
+      if (cursor) query.cursor = cursor;
+      const from = params.get("from");
+      const to = params.get("to");
+      if (from) query.from = new Date(from);
+      if (to) query.to = new Date(to);
+      const page = await loginEvents.listByUser(query);
+      return (0, import_core7.setApiResponse)(
+        import_core7.HTTP.OK,
+        "LOGIN_HISTORY_FETCHED",
+        "Login history retrieved.",
+        toLoginHistoryPageDTO(page)
+      );
+    },
+    // ── Active sessions (live only; the caller's own) ─────────────────
+    listSessions: async (ctx) => {
+      const rows = await sessions.listLiveByUser(ctx.user.id);
+      const currentSid = ctx.user.sid ?? null;
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "SESSIONS_FETCHED", "Active sessions retrieved.", {
+        sessions: rows.map((r) => toSessionDTO(r, currentSid))
+      });
+    },
+    terminateSession: async (ctx) => {
+      const id = ctx.meta["params"]?.["id"];
+      if (!id) {
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.NOT_FOUND, "NOT_FOUND", "Session not found");
+      }
+      const removed = await sessions.terminateById(ctx.user.id, id);
+      if (!removed) {
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.NOT_FOUND, "NOT_FOUND", "Session not found");
+      }
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "SESSION_TERMINATED", "Session terminated.", { id });
+    },
+    terminateOtherSessions: async (ctx) => {
+      const currentSid = ctx.user.sid ?? null;
+      if (!currentSid) {
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.UNPROCESSABLE,
+          "NO_CURRENT_SESSION",
+          "Cannot terminate others without a current session context"
+        );
+      }
+      const count = await sessions.terminateOthers(ctx.user.id, currentSid);
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "SESSIONS_TERMINATED", "Other sessions terminated.", { count });
+    },
     updateProfile: async (ctx) => {
       const body = ctx.meta["body"];
       const allowed = ["firstName", "lastName", "avatarUrl"];
@@ -1781,18 +2056,18 @@ function userController(store, config, bus) {
         if (body?.[key] !== void 0) fields[key] = body[key];
       }
       if (Object.keys(fields).length === 0) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.UNPROCESSABLE,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "Provide at least one of: firstName, lastName, avatarUrl"
         );
       }
       const row = await users.update(ctx.user.id, fields);
       if (!row) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       }
       const updated = await users.findById(ctx.user.id);
-      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "PROFILE_UPDATED", "Profile updated.", {
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "PROFILE_UPDATED", "Profile updated.", {
         user: toUserDTO(updated, ctx.user.phoneVerified)
       });
     },
@@ -1809,14 +2084,14 @@ function userController(store, config, bus) {
       if (Object.keys(patch).length > 0) fields.patch = patch;
       const row = await users.updatePreferences(ctx.user.id, fields);
       if (!row) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.UNPROCESSABLE,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "Provide at least one preference field"
         );
       }
       const updated = await users.findById(ctx.user.id);
-      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "PREFERENCES_UPDATED", "Preferences updated.", {
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "PREFERENCES_UPDATED", "Preferences updated.", {
         user: toUserDTO(updated, ctx.user.phoneVerified)
       });
     },
@@ -1825,23 +2100,23 @@ function userController(store, config, bus) {
       const newEmail = body?.["email"];
       const normalised = typeof newEmail === "string" ? normalizeEmailSafe(newEmail) : null;
       if (!normalised) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.UNPROCESSABLE,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "A valid email address is required"
         );
       }
       const oldEmail = ctx.user.email;
       if (normalised === oldEmail) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.UNPROCESSABLE,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "New email must differ from current email"
         );
       }
       const existing = await users.findByEmail(normalised);
       if (existing) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.CONFLICT, "EMAIL_IN_USE", "Email already in use");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.CONFLICT, "EMAIL_IN_USE", "Email already in use");
       }
       const pin = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
@@ -1863,8 +2138,8 @@ function userController(store, config, bus) {
         }).catch(() => {
         });
       }
-      return (0, import_core6.setApiResponse)(
-        import_core6.HTTP.OK,
+      return (0, import_core7.setApiResponse)(
+        import_core7.HTTP.OK,
         "EMAIL_UPDATED",
         "Email updated. A verification code has been sent to your new address.",
         {
@@ -1876,8 +2151,8 @@ function userController(store, config, bus) {
       const body = ctx.meta["body"];
       const newPhone = body?.["phone"];
       if (!isValidPhone2(newPhone)) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.UNPROCESSABLE,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "A valid phone number is required"
         );
@@ -1885,7 +2160,7 @@ function userController(store, config, bus) {
       const normalised = normalizePhone2(newPhone);
       const existing = await users.findByPhone(normalised);
       if (existing) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.CONFLICT, "PHONE_IN_USE", "Phone number already in use");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.CONFLICT, "PHONE_IN_USE", "Phone number already in use");
       }
       const otp = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 10 * 60 * 1e3);
@@ -1907,8 +2182,8 @@ function userController(store, config, bus) {
         }).catch(() => {
         });
       }
-      return (0, import_core6.setApiResponse)(
-        import_core6.HTTP.OK,
+      return (0, import_core7.setApiResponse)(
+        import_core7.HTTP.OK,
         "PHONE_UPDATED",
         "Phone number updated. A verification code has been sent to your new number.",
         {
@@ -1921,22 +2196,22 @@ function userController(store, config, bus) {
       const currentPassword = body?.["currentPassword"];
       const newPassword = body?.["newPassword"];
       if (typeof currentPassword !== "string" || !currentPassword) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "currentPassword is required");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "currentPassword is required");
       }
       if (typeof newPassword !== "string" || newPassword.length < 8) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "newPassword must be at least 8 characters");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "newPassword must be at least 8 characters");
       }
       const user = await users.findById(ctx.user.id);
-      if (!user) return (0, import_core6.setApiResponse)(import_core6.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+      if (!user) return (0, import_core7.setApiResponse)(import_core7.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       const { hashPassword: hashPassword2, verifyPassword: verifyPassword2 } = await Promise.resolve().then(() => (init_password(), password_exports));
       const valid = await verifyPassword2(currentPassword, user.passwordHash ?? "");
       if (!valid) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_CREDENTIAL", "Current password is incorrect");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_CREDENTIAL", "Current password is incorrect");
       }
       const hash = await hashPassword2(newPassword);
       await users.updatePassword(ctx.user.id, hash);
       await sessions.deleteByUser(ctx.user.id);
-      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "PASSWORD_CHANGED", "Password updated successfully.");
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "PASSWORD_CHANGED", "Password updated successfully.");
     },
     deleteMe: async (ctx) => {
       const userId = ctx.user.id;
@@ -1961,7 +2236,7 @@ function userController(store, config, bus) {
     // no MFA secret, no session tokens (session metadata only).
     exportMe: async (ctx) => {
       const user = await users.findById(ctx.user.id);
-      if (!user) return (0, import_core6.setApiResponse)(import_core6.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+      if (!user) return (0, import_core7.setApiResponse)(import_core7.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       const sessionRows = await sessions.listByUser(ctx.user.id);
       const bundle = {
         exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -1970,8 +2245,8 @@ function userController(store, config, bus) {
           id: s.id,
           userAgent: s.userAgent,
           ipAddress: s.ipAddress,
-          createdAt: (0, import_core6.dateOrEmpty)(s.createdAt),
-          expiresAt: (0, import_core6.dateOrEmpty)(s.expiresAt)
+          createdAt: (0, import_core7.dateOrEmpty)(s.createdAt),
+          expiresAt: (0, import_core7.dateOrEmpty)(s.expiresAt)
         })),
         security: {
           mfaEnabled: user.mfaEnabled === true,
@@ -1990,22 +2265,23 @@ function userController(store, config, bus) {
         }
         bundle["modules"] = modules;
       }
-      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "DATA_EXPORT", "Your account data.", bundle);
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "DATA_EXPORT", "Your account data.", bundle);
     }
   };
 }
 
 // src/controllers/oauth.controller.ts
-var import_core7 = require("@fonderie/core");
+var import_core8 = require("@fonderie/core");
 function oauthController(store, config) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
+  const loginEvents = new LoginEventModel(store);
   return {
     googleInit: async (_ctx) => {
       const google = config.google;
       if (!google) {
-        return (0, import_core7.setApiResponse)(
-          import_core7.HTTP.NOT_IMPLEMENTED,
+        return (0, import_core8.setApiResponse)(
+          import_core8.HTTP.NOT_IMPLEMENTED,
           "NOT_CONFIGURED",
           "Google OAuth not configured"
         );
@@ -2017,8 +2293,8 @@ function oauthController(store, config) {
         scope: "openid email profile"
       });
       const url = `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
-      return (0, import_core7.setApiResponse)(
-        import_core7.HTTP.OK,
+      return (0, import_core8.setApiResponse)(
+        import_core8.HTTP.OK,
         "GOOGLE_AUTH_URL",
         "Redirect the user to the returned URL to begin Google OAuth.",
         { url }
@@ -2027,8 +2303,8 @@ function oauthController(store, config) {
     googleCallback: async (ctx) => {
       const google = config.google;
       if (!google) {
-        return (0, import_core7.setApiResponse)(
-          import_core7.HTTP.NOT_IMPLEMENTED,
+        return (0, import_core8.setApiResponse)(
+          import_core8.HTTP.NOT_IMPLEMENTED,
           "NOT_CONFIGURED",
           "Google OAuth not configured"
         );
@@ -2036,7 +2312,7 @@ function oauthController(store, config) {
       const url = new URL(ctx.request.url);
       const code = url.searchParams.get("code");
       if (!code) {
-        return (0, import_core7.setApiResponse)(import_core7.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
       }
       const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
         method: "POST",
@@ -2051,8 +2327,8 @@ function oauthController(store, config) {
       });
       const tokenData = await tokenRes.json();
       if (!tokenData.id_token) {
-        return (0, import_core7.setApiResponse)(
-          import_core7.HTTP.BAD_REQUEST,
+        return (0, import_core8.setApiResponse)(
+          import_core8.HTTP.BAD_REQUEST,
           "GOOGLE_AUTH_FAILED",
           "OAuth token exchange failed"
         );
@@ -2061,24 +2337,40 @@ function oauthController(store, config) {
         Buffer.from(tokenData.id_token.split(".")[1] ?? "", "base64url").toString()
       );
       if (!payload.email) {
-        return (0, import_core7.setApiResponse)(import_core7.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "No email in OAuth response");
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "No email in OAuth response");
       }
       const normalizedEmail = normalizeEmailSafe(payload.email);
       if (!normalizedEmail) {
-        return (0, import_core7.setApiResponse)(import_core7.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "Invalid email in OAuth response");
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "Invalid email in OAuth response");
       }
+      const meta = requestMeta(ctx);
       const upserted = await users.upsertByProvider(normalizedEmail, "google", payload.sub ?? "");
       if (!upserted) {
-        return (0, import_core7.setApiResponse)(import_core7.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
+        loginEvents.recordSafe({
+          userId: null,
+          emailAttempted: normalizedEmail,
+          method: "oauth-google",
+          outcome: "failed",
+          failureReason: "provider_upsert_failed",
+          ...meta
+        });
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
       }
       const fullUser = await users.findById(upserted.id);
       if (!fullUser) {
-        return (0, import_core7.setApiResponse)(import_core7.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
       }
       const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, {
         loginMethod: "google"
       });
-      await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+      await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
+      loginEvents.recordSafe({
+        userId: upserted.id,
+        emailAttempted: normalizedEmail,
+        method: "oauth-google",
+        outcome: "success",
+        ...meta
+      });
       return Response.json(
         {
           reason: "GOOGLE_AUTH_SUCCESS",
@@ -2121,7 +2413,7 @@ function buildAuthRoutes(store, config, bus) {
     R("refresh", "POST", "/auth/refresh", (0, import_middlewares.validate)(refreshSchema), auth.refresh),
     // Email — Password Recovery (Public)
     R("forgotPassword", "POST", "/auth/email/forgot", ipLimit("forgot"), (0, import_middlewares.validate)(forgotPasswordSchema), acctLimit("forgot"), auth.forgotPassword),
-    R("resetPassword", "POST", "/auth/email/reset", (0, import_middlewares.validate)(resetPasswordSchema), auth.resetPassword),
+    R("resetPassword", "POST", "/auth/email/reset", ipLimit("reset"), (0, import_middlewares.validate)(resetPasswordSchema), auth.resetPassword),
     // Verification (Protected — email or phone, determined by loginMethod)
     R("verifyEmail", "POST", "/auth/verify", import_middlewares2.requireAuth, (0, import_middlewares.validate)(verifySchema), auth.verify),
     R("sendVerification", "GET", "/auth/send-verification", import_middlewares2.requireAuth, auth.sendVerification),
@@ -2136,6 +2428,13 @@ function buildAuthRoutes(store, config, bus) {
     R("changePassword", "PUT", "/users/password", import_middlewares2.requireAuth, (0, import_middlewares.validate)(changePasswordSchema), user.changePassword),
     R("deleteMe", "DELETE", "/users", import_middlewares2.requireAuth, verifyGate, user.deleteMe),
     R("exportMe", "GET", "/users/export", import_middlewares2.requireAuth, user.exportMe),
+    // Security surfaces (Protected; the caller's own login history + sessions).
+    // The literal /others route is registered before /:id so it isn't
+    // captured as an id.
+    R("loginHistory", "GET", "/auth/login-history", import_middlewares2.requireAuth, user.loginHistory),
+    R("listSessions", "GET", "/auth/sessions", import_middlewares2.requireAuth, user.listSessions),
+    R("terminateOtherSessions", "DELETE", "/auth/sessions/others", import_middlewares2.requireAuth, user.terminateOtherSessions),
+    R("terminateSession", "DELETE", "/auth/sessions/:id", import_middlewares2.requireAuth, user.terminateSession),
     // MFA (email sessions only — requireVerified is always enforced here
     // because MFA is a security feature and email verification is meaningful)
     R("mfaSetup", "POST", "/auth/mfa/setup", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, mfa.setup),
@@ -2155,17 +2454,17 @@ function buildAuthRoutes(store, config, bus) {
 }
 
 // src/services/config-guard.ts
-var import_core8 = require("@fonderie/core");
+var import_core9 = require("@fonderie/core");
 var MODULE = "@fonderie/auth";
 function collectAuthConfigProblems(config) {
   const problems = [];
   const secret = config.jwtSecret ?? "";
-  const secretProblem = (0, import_core8.secretStrengthProblem)(secret);
+  const secretProblem = (0, import_core9.secretStrengthProblem)(secret);
   if (secretProblem === "too-short") {
     problems.push({
       module: MODULE,
       severity: "error",
-      message: `jwtSecret must be at least ${import_core8.MIN_SECRET_LENGTH} characters (got ${secret.length})`
+      message: `jwtSecret must be at least ${import_core9.MIN_SECRET_LENGTH} characters (got ${secret.length})`
     });
   } else if (secretProblem === "placeholder") {
     problems.push({
@@ -2189,7 +2488,7 @@ function collectAuthConfigProblems(config) {
         severity: "error",
         message: "google OAuth is configured but clientId, clientSecret, or redirectUri is missing"
       });
-    } else if (import_core8.PLACEHOLDER_SECRET.test(clientSecret)) {
+    } else if (import_core9.PLACEHOLDER_SECRET.test(clientSecret)) {
       problems.push({
         module: MODULE,
         severity: "error",
@@ -2256,7 +2555,10 @@ function withSession(store, config) {
         ...user,
         loginMethod: payload.loginMethod ?? "email",
         phoneVerified: payload.phoneVerified ?? false,
-        mfaPending: payload.mfaPending ?? false
+        mfaPending: payload.mfaPending ?? false,
+        // The session this request is authenticated on, so the sessions
+        // API can flag the current row and "terminate others" can spare it.
+        sid: payload.sid ?? null
       }
     });
     return next();