@fonderie/auth 5.2.0 → 6.0.0

package/brain/outcomes.md

@@ -129,7 +129,7 @@ Raw SQL ships in `node_modules/@fonderie/auth/dist/migrations/sql/` — read it
 | Method | Path | Middleware chain (auth / validation / handler) |
 |---|---|---|
 | POST | `/auth/email/forgot` | `ipLimit('forgot') → validate(forgotPasswordSchema) → acctLimit('forgot') → auth.forgotPassword` |
-| POST | `/auth/email/reset` | `validate(resetPasswordSchema) → auth.resetPassword` |
+| POST | `/auth/email/reset` | `ipLimit('reset') → validate(resetPasswordSchema) → auth.resetPassword` |
 | GET | `/auth/google` | `oauth.googleInit` |
 | GET | `/auth/google/callback` | `oauth.googleCallback` |
 | POST | `/auth/login` | `ipLimit('login') → validate(loginSchema) → acctLimit('login') → auth.login` |
@@ -141,11 +141,11 @@ Raw SQL ships in `node_modules/@fonderie/auth/dist/migrations/sql/` — read it
 | POST | `/auth/mfa/verify` | `ipLimit('mfaVerify') → requireAnyAuth → requireEmailLogin → requireVerified → validate(mfaTokenSchema) → mfa.verify` |
 | POST | `/auth/refresh` | `validate(refreshSchema) → auth.refresh` |
 | POST | `/auth/register` | `ipLimit('register') → validate(registerSchema) → auth.register` |
-| GET | `/auth/send-verification` | `requireAuth → auth.sendVerification` |
+| GET | `/auth/send-verification` | `requireAnyAuth → auth.sendVerification` |
 | GET | `/auth/sessions` | `requireAuth → user.listSessions` |
 | DELETE | `/auth/sessions/:id` | `requireAuth → user.terminateSession` |
 | DELETE | `/auth/sessions/others` | `requireAuth → user.terminateOtherSessions` |
-| POST | `/auth/verify` | `requireAuth → validate(verifySchema) → auth.verify` |
+| POST | `/auth/verify` | `ipLimit('verify') → requireAnyAuth → validate(verifySchema) → auth.verify` |
 | DELETE | `/users` | `requireAuth → verifyGate → user.deleteMe` |
 | GET | `/users` | `requireAuth → user.me` |
 | PUT | `/users/email` | `requireAuth → verifyGate → validate(updateEmailSchema) → user.updateEmail` |

package/brain/signatures.md

@@ -203,5 +203,5 @@ interface IAuthRateLimitConfig {
     rules?: Partial<Record<AuthLimitedRoute, IRateLimitRule | false>>;
 }
 
-type AuthLimitedRoute = 'login' | 'register' | 'forgot' | 'mfaVerify';
+type AuthLimitedRoute = 'login' | 'register' | 'forgot' | 'reset' | 'verify' | 'mfaVerify';
 ```

package/dist/index.cjs

@@ -126,6 +126,15 @@ var DEFAULTS = {
     account: { capacity: 3, refillPerSec: 3 / min(60) },
     accountField: "email"
   },
+  // reset: 10/15min per IP — the reset PIN is a 6-digit code looked up
+  // globally, so an unthrottled endpoint is brute-forceable into an account
+  // takeover. There's no email in the reset body to key an account bucket on,
+  // so this IP bucket is the guard. (Moving reset to a high-entropy opaque
+  // token is tracked as a follow-up hardening.)
+  reset: { ip: { capacity: 10, refillPerSec: 10 / min(15) } },
+  // verify: 10/15min per IP — /auth/verify checks a 6-digit email/phone OTP,
+  // and in the phone flow that OTP is the login credential itself.
+  verify: { ip: { capacity: 10, refillPerSec: 10 / min(15) } },
   // mfaVerify: 10/15min per IP — TOTP brute-force.
   mfaVerify: { ip: { capacity: 10, refillPerSec: 10 / min(15) } }
 };
@@ -1458,23 +1467,17 @@ function authController(store, config, bus) {
           reqOpts2
         ).catch(() => {
         });
-        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
-          loginMethod: "phone"
-        });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, requestMeta(ctx));
+        const otpToken = issueMfaPendingToken(user.id, config, "phone");
         return Response.json(
           {
             reason: "USER_PHONE_REGISTERED",
             explanation: "Account created. A verification code has been sent to your phone.",
             result: {
-              tokens: { access: accessToken, refresh: refreshToken },
+              otpToken,
               user: toUserDTO(user)
             }
           },
-          {
-            status: 202,
-            headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
-          }
+          { status: 202 }
         );
       }
       return (0, import_core5.setApiResponse)(
@@ -1588,23 +1591,14 @@ function authController(store, config, bus) {
           recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
         }).catch(() => {
         });
-        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
-          loginMethod: "phone"
-        });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
+        const otpToken = issueMfaPendingToken(user.id, config, "phone");
         return Response.json(
           {
             reason: "USER_PHONE_OTP_SENT",
             explanation: "A verification code has been sent to your phone.",
-            result: {
-              tokens: { access: accessToken, refresh: refreshToken },
-              user: toUserDTO(user, false)
-            }
+            result: { otpToken }
           },
-          {
-            status: 202,
-            headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
-          }
+          { status: 202 }
         );
       }
       return (0, import_core5.setApiResponse)(
@@ -1756,6 +1750,9 @@ function authController(store, config, bus) {
       return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "PASSWORD_RESET_SUCCESSFUL", "Password reset successfully.");
     },
     verify: async (ctx) => {
+      if (ctx.user.mfaPending && ctx.user.loginMethod !== "phone") {
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
+      }
       if (ctx.user.loginMethod !== "phone" && ctx.user.emailVerifiedAt) {
         return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "VERIFIED", "Email verified successfully.", {
           verified: true,
@@ -1842,6 +1839,9 @@ function authController(store, config, bus) {
       });
     },
     sendVerification: async (ctx) => {
+      if (ctx.user.mfaPending && ctx.user.loginMethod !== "phone") {
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
+      }
       const resolved = { ...config, ...config.resolve?.(ctx) };
       const cooldown = resolved.verificationCooldown ?? DEFAULT_VERIFICATION_COOLDOWN;
       if (ctx.user.loginMethod === "phone") {
@@ -2407,10 +2407,14 @@ function buildAuthRoutes(store, config, bus) {
     R("refresh", "POST", "/auth/refresh", (0, import_middlewares.validate)(refreshSchema), auth.refresh),
     // Email — Password Recovery (Public)
     R("forgotPassword", "POST", "/auth/email/forgot", ipLimit("forgot"), (0, import_middlewares.validate)(forgotPasswordSchema), acctLimit("forgot"), auth.forgotPassword),
-    R("resetPassword", "POST", "/auth/email/reset", (0, import_middlewares.validate)(resetPasswordSchema), auth.resetPassword),
-    // Verification (Protected — email or phone, determined by loginMethod)
-    R("verifyEmail", "POST", "/auth/verify", import_middlewares2.requireAuth, (0, import_middlewares.validate)(verifySchema), auth.verify),
-    R("sendVerification", "GET", "/auth/send-verification", import_middlewares2.requireAuth, auth.sendVerification),
+    R("resetPassword", "POST", "/auth/email/reset", ipLimit("reset"), (0, import_middlewares.validate)(resetPasswordSchema), auth.resetPassword),
+    // Verification (email or phone, determined by loginMethod). requireAnyAuth,
+    // not requireAuth: the phone-OTP flow reaches these with a short-lived
+    // pending token (login/register no longer issue real tokens before the OTP
+    // round-trip); the controllers reject pending tokens for any other flow.
+    // ipLimit guards the 6-digit OTP against brute force (like mfaVerify).
+    R("verifyEmail", "POST", "/auth/verify", ipLimit("verify"), import_middlewares2.requireAnyAuth, (0, import_middlewares.validate)(verifySchema), auth.verify),
+    R("sendVerification", "GET", "/auth/send-verification", import_middlewares2.requireAnyAuth, auth.sendVerification),
     // Account Management (Protected)
     R("logout", "POST", "/auth/logout", import_middlewares2.requireAuth, (0, import_middlewares.validate)(refreshSchema), auth.logout),
     // User Profile (Protected; writes also gate on requireVerification)