@fonderie/auth 5.2.0 → 5.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/brain/outcomes.md +1 -1
- package/brain/signatures.md +1 -1
- package/dist/index.cjs +7 -1
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +2 -2
- package/dist/index.d.ts +2 -2
- package/dist/index.js +7 -1
- package/dist/index.js.map +1 -1
- package/dist/middlewares/index.d.cts +1 -1
- package/dist/middlewares/index.d.ts +1 -1
- package/dist/{session-DJNd1xp_.d.cts → session-jITwnc3m.d.cts} +1 -1
- package/dist/{session-DJNd1xp_.d.ts → session-jITwnc3m.d.ts} +1 -1
- package/package.json +4 -4
package/brain/outcomes.md
CHANGED
|
@@ -129,7 +129,7 @@ Raw SQL ships in `node_modules/@fonderie/auth/dist/migrations/sql/` — read it
|
|
|
129
129
|
| Method | Path | Middleware chain (auth / validation / handler) |
|
|
130
130
|
|---|---|---|
|
|
131
131
|
| POST | `/auth/email/forgot` | `ipLimit('forgot') → validate(forgotPasswordSchema) → acctLimit('forgot') → auth.forgotPassword` |
|
|
132
|
-
| POST | `/auth/email/reset` | `validate(resetPasswordSchema) → auth.resetPassword` |
|
|
132
|
+
| POST | `/auth/email/reset` | `ipLimit('reset') → validate(resetPasswordSchema) → auth.resetPassword` |
|
|
133
133
|
| GET | `/auth/google` | `oauth.googleInit` |
|
|
134
134
|
| GET | `/auth/google/callback` | `oauth.googleCallback` |
|
|
135
135
|
| POST | `/auth/login` | `ipLimit('login') → validate(loginSchema) → acctLimit('login') → auth.login` |
|
package/brain/signatures.md
CHANGED
|
@@ -203,5 +203,5 @@ interface IAuthRateLimitConfig {
|
|
|
203
203
|
rules?: Partial<Record<AuthLimitedRoute, IRateLimitRule | false>>;
|
|
204
204
|
}
|
|
205
205
|
|
|
206
|
-
type AuthLimitedRoute = 'login' | 'register' | 'forgot' | 'mfaVerify';
|
|
206
|
+
type AuthLimitedRoute = 'login' | 'register' | 'forgot' | 'reset' | 'mfaVerify';
|
|
207
207
|
```
|
package/dist/index.cjs
CHANGED
|
@@ -126,6 +126,12 @@ var DEFAULTS = {
|
|
|
126
126
|
account: { capacity: 3, refillPerSec: 3 / min(60) },
|
|
127
127
|
accountField: "email"
|
|
128
128
|
},
|
|
129
|
+
// reset: 10/15min per IP — the reset PIN is a 6-digit code looked up
|
|
130
|
+
// globally, so an unthrottled endpoint is brute-forceable into an account
|
|
131
|
+
// takeover. There's no email in the reset body to key an account bucket on,
|
|
132
|
+
// so this IP bucket is the guard. (Moving reset to a high-entropy opaque
|
|
133
|
+
// token is tracked as a follow-up hardening.)
|
|
134
|
+
reset: { ip: { capacity: 10, refillPerSec: 10 / min(15) } },
|
|
129
135
|
// mfaVerify: 10/15min per IP — TOTP brute-force.
|
|
130
136
|
mfaVerify: { ip: { capacity: 10, refillPerSec: 10 / min(15) } }
|
|
131
137
|
};
|
|
@@ -2407,7 +2413,7 @@ function buildAuthRoutes(store, config, bus) {
|
|
|
2407
2413
|
R("refresh", "POST", "/auth/refresh", (0, import_middlewares.validate)(refreshSchema), auth.refresh),
|
|
2408
2414
|
// Email — Password Recovery (Public)
|
|
2409
2415
|
R("forgotPassword", "POST", "/auth/email/forgot", ipLimit("forgot"), (0, import_middlewares.validate)(forgotPasswordSchema), acctLimit("forgot"), auth.forgotPassword),
|
|
2410
|
-
R("resetPassword", "POST", "/auth/email/reset", (0, import_middlewares.validate)(resetPasswordSchema), auth.resetPassword),
|
|
2416
|
+
R("resetPassword", "POST", "/auth/email/reset", ipLimit("reset"), (0, import_middlewares.validate)(resetPasswordSchema), auth.resetPassword),
|
|
2411
2417
|
// Verification (Protected — email or phone, determined by loginMethod)
|
|
2412
2418
|
R("verifyEmail", "POST", "/auth/verify", import_middlewares2.requireAuth, (0, import_middlewares.validate)(verifySchema), auth.verify),
|
|
2413
2419
|
R("sendVerification", "GET", "/auth/send-verification", import_middlewares2.requireAuth, auth.sendVerification),
|