@fonderie/auth 5.1.0 → 5.3.0

package/dist/index.d.cts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.cjs';
 import { IFonderieModule, IReadinessProblem, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-CTSCI09F.cjs';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-CTSCI09F.cjs';
+import { I as IAuthConfig } from './session-jITwnc3m.cjs';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-jITwnc3m.cjs';
 export { IUserDTO, toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';
@@ -65,6 +65,28 @@ declare const DEFAULT_TEMPLATES: {
     };
 };
 
+interface ILoginEventDTO {
+    id: string;
+    method: string;
+    outcome: string;
+    failureReason: string | null;
+    ipAddress: string | null;
+    userAgent: string | null;
+    createdAt: string;
+}
+interface ILoginHistoryPageDTO {
+    events: ILoginEventDTO[];
+    nextCursor: string | null;
+}
+interface ISessionDTO {
+    id: string;
+    current: boolean;
+    ipAddress: string | null;
+    userAgent: string | null;
+    createdAt: string;
+    expiresAt: string;
+}
+
 declare const registerSchema: z.ZodUnion<readonly [z.ZodObject<{
     email: z.ZodPipe<z.ZodString, z.ZodEmail>;
     password: z.ZodString;
@@ -183,4 +205,4 @@ declare function startUserRetention(store: IStoreAdapter, options: IUserRetentio
 
 declare function validateAuthConfig(config: IAuthConfig): void;
 
-export { AuthModule, type ChangePasswordInput, DEFAULT_TEMPLATES, IAuthConfig, type IImportUser, type IPurgeOptions, type IUserRetentionScheduleOptions, type LoginInput, type RegisterInput, type ResetPasswordInput, importUser, normalizeEmail, normalizeEmailSafe, purgeSoftDeletedUsers, schemas, startUserRetention, validateAuthConfig };
+export { AuthModule, type ChangePasswordInput, DEFAULT_TEMPLATES, IAuthConfig, type IImportUser, type ILoginEventDTO, type ILoginHistoryPageDTO, type IPurgeOptions, type ISessionDTO, type IUserRetentionScheduleOptions, type LoginInput, type RegisterInput, type ResetPasswordInput, importUser, normalizeEmail, normalizeEmailSafe, purgeSoftDeletedUsers, schemas, startUserRetention, validateAuthConfig };

package/dist/index.d.ts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.js';
 import { IFonderieModule, IReadinessProblem, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-CTSCI09F.js';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-CTSCI09F.js';
+import { I as IAuthConfig } from './session-jITwnc3m.js';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-jITwnc3m.js';
 export { IUserDTO, toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';
@@ -65,6 +65,28 @@ declare const DEFAULT_TEMPLATES: {
     };
 };
 
+interface ILoginEventDTO {
+    id: string;
+    method: string;
+    outcome: string;
+    failureReason: string | null;
+    ipAddress: string | null;
+    userAgent: string | null;
+    createdAt: string;
+}
+interface ILoginHistoryPageDTO {
+    events: ILoginEventDTO[];
+    nextCursor: string | null;
+}
+interface ISessionDTO {
+    id: string;
+    current: boolean;
+    ipAddress: string | null;
+    userAgent: string | null;
+    createdAt: string;
+    expiresAt: string;
+}
+
 declare const registerSchema: z.ZodUnion<readonly [z.ZodObject<{
     email: z.ZodPipe<z.ZodString, z.ZodEmail>;
     password: z.ZodString;
@@ -183,4 +205,4 @@ declare function startUserRetention(store: IStoreAdapter, options: IUserRetentio
 
 declare function validateAuthConfig(config: IAuthConfig): void;
 
-export { AuthModule, type ChangePasswordInput, DEFAULT_TEMPLATES, IAuthConfig, type IImportUser, type IPurgeOptions, type IUserRetentionScheduleOptions, type LoginInput, type RegisterInput, type ResetPasswordInput, importUser, normalizeEmail, normalizeEmailSafe, purgeSoftDeletedUsers, schemas, startUserRetention, validateAuthConfig };
+export { AuthModule, type ChangePasswordInput, DEFAULT_TEMPLATES, IAuthConfig, type IImportUser, type ILoginEventDTO, type ILoginHistoryPageDTO, type IPurgeOptions, type ISessionDTO, type IUserRetentionScheduleOptions, type LoginInput, type RegisterInput, type ResetPasswordInput, importUser, normalizeEmail, normalizeEmailSafe, purgeSoftDeletedUsers, schemas, startUserRetention, validateAuthConfig };

package/dist/index.js

@@ -86,6 +86,12 @@ var DEFAULTS = {
     account: { capacity: 3, refillPerSec: 3 / min(60) },
     accountField: "email"
   },
+  // reset: 10/15min per IP — the reset PIN is a 6-digit code looked up
+  // globally, so an unthrottled endpoint is brute-forceable into an account
+  // takeover. There's no email in the reset body to key an account bucket on,
+  // so this IP bucket is the guard. (Moving reset to a high-entropy opaque
+  // token is tracked as a follow-up hardening.)
+  reset: { ip: { capacity: 10, refillPerSec: 10 / min(15) } },
   // mfaVerify: 10/15min per IP — TOTP brute-force.
   mfaVerify: { ip: { capacity: 10, refillPerSec: 10 / min(15) } }
 };
@@ -691,17 +697,23 @@ var SessionModel = class {
     this.store = store;
   }
   store;
-  async create(userId, token, expiresAt, sid) {
+  async create(userId, token, expiresAt, sid, meta) {
     await this.store.query(
-      `INSERT INTO fonderie_sessions (user_id, token, expires_at, sid)
-			VALUES ($1, $2, $3, $4)
+      `INSERT INTO fonderie_sessions (user_id, token, expires_at, sid, user_agent, ip_address)
+			VALUES ($1, $2, $3, $4, $5, $6)
 			ON CONFLICT (token) DO NOTHING`,
-      [userId, token, expiresAt, sid ?? null]
+      [userId, token, expiresAt, sid ?? null, meta?.userAgent ?? null, meta?.ipAddress ?? null]
     );
   }
   async delete(token) {
     await this.store.query(`DELETE FROM fonderie_sessions WHERE token = $1`, [token]);
   }
+  // Delete the session an access token is bound to (by its sid claim). Lets
+  // logout revoke the current session without the client resending the refresh
+  // token — the access token already identifies its session.
+  async deleteBySid(sid) {
+    await this.store.query(`DELETE FROM fonderie_sessions WHERE sid = $1`, [sid]);
+  }
   // Revoke every session for a user (e.g. on password change). Access tokens
   // bound to these sessions via the sid claim die on their next request.
   async deleteByUser(userId) {
@@ -721,6 +733,42 @@ var SessionModel = class {
       [userId]
     );
   }
+  // Live sessions for the Active Sessions screen: unexpired only, carrying the
+  // sid so the caller can flag the current one (row.sid === the JWT's sid).
+  // No token — that never leaves the server.
+  async listLiveByUser(userId) {
+    return this.store.query(
+      `SELECT id, sid,
+			        user_agent AS "userAgent",
+			        ip_address AS "ipAddress",
+			        created_at AS "createdAt",
+			        expires_at AS "expiresAt"
+			 FROM fonderie_sessions
+			 WHERE user_id = $1 AND expires_at > now()
+			 ORDER BY created_at DESC`,
+      [userId]
+    );
+  }
+  // Terminate one session by row id, scoped to its owner (a user can never
+  // delete another user's session). Returns whether a row was removed.
+  async terminateById(userId, id) {
+    const rows = await this.store.query(
+      `DELETE FROM fonderie_sessions WHERE id = $1 AND user_id = $2 RETURNING id`,
+      [id, userId]
+    );
+    return rows.length > 0;
+  }
+  // Terminate all of a user's sessions except the current one (by sid).
+  // Returns the number of sessions removed.
+  async terminateOthers(userId, keepSid) {
+    const rows = await this.store.query(
+      `DELETE FROM fonderie_sessions
+			 WHERE user_id = $1 AND (sid IS DISTINCT FROM $2)
+			 RETURNING id`,
+      [userId, keepSid]
+    );
+    return rows.length;
+  }
   async exists(token) {
     const rows = await this.store.query(
       `SELECT id FROM fonderie_sessions WHERE token = $1 AND expires_at > now()`,
@@ -773,11 +821,92 @@ var BackupCodeModel = class {
   }
 };
 
+// src/models/login-event.model.ts
+var LoginEventModel = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  async record(e) {
+    await this.store.query(
+      `INSERT INTO fonderie_login_events
+			   (user_id, email_attempted, method, outcome, failure_reason, ip_address, user_agent)
+			 VALUES ($1, $2, $3, $4, $5, $6, $7)`,
+      [
+        e.userId,
+        e.emailAttempted ?? null,
+        e.method,
+        e.outcome,
+        e.failureReason ?? null,
+        e.ipAddress,
+        e.userAgent
+      ]
+    );
+  }
+  // Fire-and-forget variant for the login paths: recording history must never
+  // block or fail a login (same posture as the bus.emit(...).catch(() => {})
+  // notification sends).
+  recordSafe(e) {
+    void this.record(e).catch(() => {
+    });
+  }
+  // One page of a user's own login history, newest first. Keyset-paginated on
+  // (created_at, id) — mirrors audit's event list so the two log UIs share a
+  // cursor contract. The +1 over-fetch that detects a next page lives here so
+  // no outer clamp can shave it off.
+  async listByUser(query) {
+    const limit = Math.min(query.limit ?? 50, MAX_HISTORY_LIMIT);
+    const params = [query.userId];
+    const where = ["user_id = $1"];
+    if (query.outcome) {
+      params.push(query.outcome);
+      where.push(`outcome = $${params.length}`);
+    }
+    if (query.from) {
+      params.push(query.from);
+      where.push(`created_at >= $${params.length}`);
+    }
+    if (query.to) {
+      params.push(query.to);
+      where.push(`created_at <= $${params.length}`);
+    }
+    if (query.cursor) {
+      params.push(query.cursor.createdAt, query.cursor.id);
+      where.push(`(created_at, id) < ($${params.length - 1}::timestamptz, $${params.length}::uuid)`);
+    }
+    params.push(limit + 1);
+    const rows = await this.store.query(
+      `SELECT id, method, outcome, failure_reason AS "failureReason",
+			        ip_address AS "ipAddress", user_agent AS "userAgent",
+			        created_at AS "createdAt", created_at::text AS "createdAtRaw"
+			 FROM   fonderie_login_events
+			 WHERE  ${where.join(" AND ")}
+			 ORDER  BY created_at DESC, id DESC
+			 LIMIT  $${params.length}`,
+      params
+    );
+    return { events: rows.slice(0, limit), hasMore: rows.length > limit };
+  }
+};
+var MAX_HISTORY_LIMIT = 200;
+
+// src/services/request-meta.ts
+var UA_MAX = 512;
+function requestMeta(ctx) {
+  const ip = ctx.meta["clientIp"];
+  const ua = ctx.request.headers.get("user-agent");
+  return {
+    ipAddress: typeof ip === "string" && ip.length > 0 ? ip : null,
+    userAgent: ua && ua.length > 0 ? ua.slice(0, UA_MAX) : null
+  };
+}
+
 // src/controllers/mfa.controller.ts
 function mfaController(store, config, issuer, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
   const backupCodes = new BackupCodeModel(store);
+  const loginEvents = new LoginEventModel(store);
   const mfaCipher = makeMfaCipher(config.mfaSecretKey);
   return {
     // ── 1. Setup ───────────────────────────────────────────────
@@ -807,6 +936,16 @@ function mfaController(store, config, issuer, bus) {
     verify: async (ctx) => {
       const body = ctx.meta["body"];
       const token = body?.["token"];
+      const isLoginCompletion = ctx.user.mfaPending === true;
+      const meta = requestMeta(ctx);
+      const failedMfa = () => loginEvents.recordSafe({
+        userId: ctx.user.id,
+        emailAttempted: ctx.user.email,
+        method: "mfa",
+        outcome: "failed",
+        failureReason: "invalid_code",
+        ...meta
+      });
       if (typeof token !== "string") {
         return setApiResponse2(HTTP2.UNPROCESSABLE, "INVALID_PARAMETER", "token is required");
       }
@@ -847,6 +986,7 @@ function mfaController(store, config, issuer, bus) {
         );
         const matched = checks.find((r) => r.match);
         if (!matched) {
+          if (isLoginCompletion) failedMfa();
           return setApiResponse2(HTTP2.UNAUTHORIZED, "INVALID_CODE", "Invalid backup code");
         }
         await backupCodes.consume(matched.id);
@@ -864,6 +1004,7 @@ function mfaController(store, config, issuer, bus) {
         }
         const secret = mfaCipher.decrypt(storedSecret);
         if (!verifyTotpToken(token, secret)) {
+          if (isLoginCompletion) failedMfa();
           return setApiResponse2(HTTP2.UNAUTHORIZED, "INVALID_CODE", "Invalid MFA token");
         }
         if (!ctx.user.mfaEnabled) {
@@ -874,7 +1015,16 @@ function mfaController(store, config, issuer, bus) {
         loginMethod: ctx.user.loginMethod,
         phoneVerified: ctx.user.phoneVerified
       });
-      await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+      await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
+      if (isLoginCompletion) {
+        loginEvents.recordSafe({
+          userId: ctx.user.id,
+          emailAttempted: ctx.user.email,
+          method: "mfa",
+          outcome: "success",
+          ...meta
+        });
+      }
       const fullUser = await users.findById(ctx.user.id);
       if (!fullUser) {
         return setApiResponse2(HTTP2.SERVER_ERROR, "SERVER_ERROR", "User not found after MFA verify");
@@ -1143,6 +1293,7 @@ function extractRefreshToken(ctx) {
 function authController(store, config, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
+  const loginEvents = new LoginEventModel(store);
   const passwordReset = new PasswordResetModel(store);
   const emailVerif = new EmailVerificationModel(store);
   const phoneVerif = new PhoneVerificationModel(store);
@@ -1212,7 +1363,7 @@ function authController(store, config, bus) {
         const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "email"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, requestMeta(ctx));
         const resolvedRegister = { ...config, ...config.resolve?.(ctx) };
         const requiresVerification = !!resolvedRegister.requireVerification && !user.emailVerifiedAt;
         return Response.json(
@@ -1276,7 +1427,7 @@ function authController(store, config, bus) {
         const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "phone"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, requestMeta(ctx));
         return Response.json(
           {
             reason: "USER_PHONE_REGISTERED",
@@ -1300,6 +1451,7 @@ function authController(store, config, bus) {
     },
     login: async (ctx) => {
       const body = ctx.meta["body"];
+      const meta = requestMeta(ctx);
       if (typeof body?.["email"] === "string" && typeof body?.["password"] === "string") {
         const { email: rawEmail, password: password2 } = body;
         const email2 = normalizeEmailSafe(rawEmail);
@@ -1308,6 +1460,14 @@ function authController(store, config, bus) {
         }
         const user = await users.findByEmail(email2);
         if (!user || !user.passwordHash) {
+          loginEvents.recordSafe({
+            userId: null,
+            emailAttempted: email2,
+            method: "password",
+            outcome: "failed",
+            failureReason: "unknown_email",
+            ...meta
+          });
           return setApiResponse3(HTTP3.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
         const { valid, needsRehash } = await verifyPasswordForLogin(
@@ -1316,6 +1476,14 @@ function authController(store, config, bus) {
           config.legacyVerify
         );
         if (!valid) {
+          loginEvents.recordSafe({
+            userId: user.id,
+            emailAttempted: email2,
+            method: "password",
+            outcome: "failed",
+            failureReason: "bad_password",
+            ...meta
+          });
           return setApiResponse3(HTTP3.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
         if (needsRehash) {
@@ -1337,7 +1505,14 @@ function authController(store, config, bus) {
         const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "email"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
+        loginEvents.recordSafe({
+          userId: user.id,
+          emailAttempted: email2,
+          method: "password",
+          outcome: "success",
+          ...meta
+        });
         const resolvedLogin = { ...config, ...config.resolve?.(ctx) };
         const requiresVerification = !!resolvedLogin.requireVerification && !user.emailVerifiedAt;
         return Response.json(
@@ -1382,7 +1557,7 @@ function authController(store, config, bus) {
         const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "phone"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
         return Response.json(
           {
             reason: "USER_PHONE_OTP_SENT",
@@ -1405,6 +1580,10 @@ function authController(store, config, bus) {
       );
     },
     logout: async (ctx) => {
+      const sid = ctx.user?.sid;
+      if (sid) {
+        await sessions.deleteBySid(sid).catch(() => void 0);
+      }
       const token = extractRefreshToken(ctx);
       if (token) {
         await sessions.delete(token).catch(() => void 0);
@@ -1443,7 +1622,7 @@ function authController(store, config, bus) {
         loginMethod: payload.loginMethod ?? "email",
         phoneVerified: payload.phoneVerified ?? false
       });
-      await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+      await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, requestMeta(ctx));
       return Response.json(
         {
           reason: "TOKENS_REFRESHED",
@@ -1577,7 +1756,7 @@ function authController(store, config, bus) {
           loginMethod: "phone",
           phoneVerified: true
         });
-        await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+        await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, requestMeta(ctx));
         const verifiedUser = await users.findById(ctx.user.id);
         if (!verifiedUser) {
           return setApiResponse3(HTTP3.NOT_FOUND, "NOT_FOUND", "User not found");
@@ -1712,6 +1891,38 @@ function authController(store, config, bus) {
 import { randomInt as randomInt2 } from "crypto";
 import { setApiResponse as setApiResponse4, HTTP as HTTP4, dateOrEmpty as dateOrEmpty2 } from "@fonderie/core";
 import { NOTIFICATION_EVENT as NOTIFICATION_EVENT3 } from "@fonderie/events";
+
+// src/dtos/login-activity.ts
+import { encodeKeysetCursor, decodeKeysetCursor } from "@fonderie/core";
+function toLoginEventDTO(row) {
+  return {
+    id: row.id,
+    method: row.method,
+    outcome: row.outcome,
+    failureReason: row.failureReason,
+    ipAddress: row.ipAddress,
+    userAgent: row.userAgent,
+    createdAt: row.createdAt instanceof Date ? row.createdAt.toISOString() : String(row.createdAt)
+  };
+}
+function toLoginHistoryPageDTO(page) {
+  const last = page.events[page.events.length - 1];
+  const nextCursor = page.hasMore && last ? encodeKeysetCursor(last.createdAtRaw ?? last.createdAt.toISOString(), last.id) : null;
+  return { events: page.events.map(toLoginEventDTO), nextCursor };
+}
+var decodeLoginCursor = decodeKeysetCursor;
+function toSessionDTO(row, currentSid) {
+  return {
+    id: row.id,
+    current: currentSid !== null && row.sid === currentSid,
+    ipAddress: row.ipAddress,
+    userAgent: row.userAgent,
+    createdAt: row.createdAt instanceof Date ? row.createdAt.toISOString() : String(row.createdAt),
+    expiresAt: row.expiresAt instanceof Date ? row.expiresAt.toISOString() : String(row.expiresAt)
+  };
+}
+
+// src/controllers/user.controller.ts
 function normalizePhone2(phone2) {
   return phone2.trim().replace(/[\s()\-\.]/g, "");
 }
@@ -1721,6 +1932,7 @@ function isValidPhone2(phone2) {
 function userController(store, config, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
+  const loginEvents = new LoginEventModel(store);
   const emailVerif = new EmailVerificationModel(store);
   const phoneVerif = new PhoneVerificationModel(store);
   return {
@@ -1733,6 +1945,69 @@ function userController(store, config, bus) {
         user: toUserDTO(user, ctx.user.phoneVerified)
       });
     },
+    // ── Login history (append-only; the caller's own attempts) ────────
+    loginHistory: async (ctx) => {
+      const params = new URL(ctx.request.url).searchParams;
+      const rawLimit = Number(params.get("limit") ?? 50);
+      const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.trunc(rawLimit), 1), 200) : 50;
+      const outcomeParam = params.get("outcome");
+      if (outcomeParam !== null && outcomeParam !== "success" && outcomeParam !== "failed") {
+        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "outcome must be 'success' or 'failed'");
+      }
+      const cursorParam = params.get("cursor");
+      let cursor = null;
+      if (cursorParam) {
+        cursor = decodeLoginCursor(cursorParam);
+        if (!cursor) {
+          return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
+        }
+      }
+      const query = { userId: ctx.user.id, limit };
+      if (outcomeParam) query.outcome = outcomeParam;
+      if (cursor) query.cursor = cursor;
+      const from = params.get("from");
+      const to = params.get("to");
+      if (from) query.from = new Date(from);
+      if (to) query.to = new Date(to);
+      const page = await loginEvents.listByUser(query);
+      return setApiResponse4(
+        HTTP4.OK,
+        "LOGIN_HISTORY_FETCHED",
+        "Login history retrieved.",
+        toLoginHistoryPageDTO(page)
+      );
+    },
+    // ── Active sessions (live only; the caller's own) ─────────────────
+    listSessions: async (ctx) => {
+      const rows = await sessions.listLiveByUser(ctx.user.id);
+      const currentSid = ctx.user.sid ?? null;
+      return setApiResponse4(HTTP4.OK, "SESSIONS_FETCHED", "Active sessions retrieved.", {
+        sessions: rows.map((r) => toSessionDTO(r, currentSid))
+      });
+    },
+    terminateSession: async (ctx) => {
+      const id = ctx.meta["params"]?.["id"];
+      if (!id) {
+        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Session not found");
+      }
+      const removed = await sessions.terminateById(ctx.user.id, id);
+      if (!removed) {
+        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Session not found");
+      }
+      return setApiResponse4(HTTP4.OK, "SESSION_TERMINATED", "Session terminated.", { id });
+    },
+    terminateOtherSessions: async (ctx) => {
+      const currentSid = ctx.user.sid ?? null;
+      if (!currentSid) {
+        return setApiResponse4(
+          HTTP4.UNPROCESSABLE,
+          "NO_CURRENT_SESSION",
+          "Cannot terminate others without a current session context"
+        );
+      }
+      const count = await sessions.terminateOthers(ctx.user.id, currentSid);
+      return setApiResponse4(HTTP4.OK, "SESSIONS_TERMINATED", "Other sessions terminated.", { count });
+    },
     updateProfile: async (ctx) => {
       const body = ctx.meta["body"];
       const allowed = ["firstName", "lastName", "avatarUrl"];
@@ -1960,6 +2235,7 @@ import { setApiResponse as setApiResponse5, HTTP as HTTP5 } from "@fonderie/core
 function oauthController(store, config) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
+  const loginEvents = new LoginEventModel(store);
   return {
     googleInit: async (_ctx) => {
       const google = config.google;
@@ -2027,8 +2303,17 @@ function oauthController(store, config) {
       if (!normalizedEmail) {
         return setApiResponse5(HTTP5.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "Invalid email in OAuth response");
       }
+      const meta = requestMeta(ctx);
       const upserted = await users.upsertByProvider(normalizedEmail, "google", payload.sub ?? "");
       if (!upserted) {
+        loginEvents.recordSafe({
+          userId: null,
+          emailAttempted: normalizedEmail,
+          method: "oauth-google",
+          outcome: "failed",
+          failureReason: "provider_upsert_failed",
+          ...meta
+        });
         return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
       }
       const fullUser = await users.findById(upserted.id);
@@ -2038,7 +2323,14 @@ function oauthController(store, config) {
       const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, {
         loginMethod: "google"
       });
-      await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
+      await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
+      loginEvents.recordSafe({
+        userId: upserted.id,
+        emailAttempted: normalizedEmail,
+        method: "oauth-google",
+        outcome: "success",
+        ...meta
+      });
       return Response.json(
         {
           reason: "GOOGLE_AUTH_SUCCESS",
@@ -2081,7 +2373,7 @@ function buildAuthRoutes(store, config, bus) {
     R("refresh", "POST", "/auth/refresh", validate(refreshSchema), auth.refresh),
     // Email — Password Recovery (Public)
     R("forgotPassword", "POST", "/auth/email/forgot", ipLimit("forgot"), validate(forgotPasswordSchema), acctLimit("forgot"), auth.forgotPassword),
-    R("resetPassword", "POST", "/auth/email/reset", validate(resetPasswordSchema), auth.resetPassword),
+    R("resetPassword", "POST", "/auth/email/reset", ipLimit("reset"), validate(resetPasswordSchema), auth.resetPassword),
     // Verification (Protected — email or phone, determined by loginMethod)
     R("verifyEmail", "POST", "/auth/verify", requireAuth, validate(verifySchema), auth.verify),
     R("sendVerification", "GET", "/auth/send-verification", requireAuth, auth.sendVerification),
@@ -2096,6 +2388,13 @@ function buildAuthRoutes(store, config, bus) {
     R("changePassword", "PUT", "/users/password", requireAuth, validate(changePasswordSchema), user.changePassword),
     R("deleteMe", "DELETE", "/users", requireAuth, verifyGate, user.deleteMe),
     R("exportMe", "GET", "/users/export", requireAuth, user.exportMe),
+    // Security surfaces (Protected; the caller's own login history + sessions).
+    // The literal /others route is registered before /:id so it isn't
+    // captured as an id.
+    R("loginHistory", "GET", "/auth/login-history", requireAuth, user.loginHistory),
+    R("listSessions", "GET", "/auth/sessions", requireAuth, user.listSessions),
+    R("terminateOtherSessions", "DELETE", "/auth/sessions/others", requireAuth, user.terminateOtherSessions),
+    R("terminateSession", "DELETE", "/auth/sessions/:id", requireAuth, user.terminateSession),
     // MFA (email sessions only — requireVerified is always enforced here
     // because MFA is a security feature and email verification is meaningful)
     R("mfaSetup", "POST", "/auth/mfa/setup", requireAuth, requireEmailLogin, requireVerified, mfa.setup),
@@ -2216,7 +2515,10 @@ function withSession(store, config) {
         ...user,
         loginMethod: payload.loginMethod ?? "email",
         phoneVerified: payload.phoneVerified ?? false,
-        mfaPending: payload.mfaPending ?? false
+        mfaPending: payload.mfaPending ?? false,
+        // The session this request is authenticated on, so the sessions
+        // API can flag the current row and "terminate others" can spare it.
+        sid: payload.sid ?? null
       }
     });
     return next();