@fonderie/auth 5.2.0 → 6.0.0

package/dist/index.d.cts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.cjs';
 import { IFonderieModule, IReadinessProblem, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-DJNd1xp_.cjs';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-DJNd1xp_.cjs';
+import { I as IAuthConfig } from './session-Db6KZca3.cjs';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-Db6KZca3.cjs';
 export { IUserDTO, toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';

package/dist/index.d.ts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.js';
 import { IFonderieModule, IReadinessProblem, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-DJNd1xp_.js';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-DJNd1xp_.js';
+import { I as IAuthConfig } from './session-Db6KZca3.js';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-Db6KZca3.js';
 export { IUserDTO, toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';

package/dist/index.js

@@ -86,6 +86,15 @@ var DEFAULTS = {
     account: { capacity: 3, refillPerSec: 3 / min(60) },
     accountField: "email"
   },
+  // reset: 10/15min per IP — the reset PIN is a 6-digit code looked up
+  // globally, so an unthrottled endpoint is brute-forceable into an account
+  // takeover. There's no email in the reset body to key an account bucket on,
+  // so this IP bucket is the guard. (Moving reset to a high-entropy opaque
+  // token is tracked as a follow-up hardening.)
+  reset: { ip: { capacity: 10, refillPerSec: 10 / min(15) } },
+  // verify: 10/15min per IP — /auth/verify checks a 6-digit email/phone OTP,
+  // and in the phone flow that OTP is the login credential itself.
+  verify: { ip: { capacity: 10, refillPerSec: 10 / min(15) } },
   // mfaVerify: 10/15min per IP — TOTP brute-force.
   mfaVerify: { ip: { capacity: 10, refillPerSec: 10 / min(15) } }
 };
@@ -1418,23 +1427,17 @@ function authController(store, config, bus) {
           reqOpts2
         ).catch(() => {
         });
-        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
-          loginMethod: "phone"
-        });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, requestMeta(ctx));
+        const otpToken = issueMfaPendingToken(user.id, config, "phone");
         return Response.json(
           {
             reason: "USER_PHONE_REGISTERED",
             explanation: "Account created. A verification code has been sent to your phone.",
             result: {
-              tokens: { access: accessToken, refresh: refreshToken },
+              otpToken,
               user: toUserDTO(user)
             }
           },
-          {
-            status: 202,
-            headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
-          }
+          { status: 202 }
         );
       }
       return setApiResponse3(
@@ -1548,23 +1551,14 @@ function authController(store, config, bus) {
           recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
         }).catch(() => {
         });
-        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
-          loginMethod: "phone"
-        });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
+        const otpToken = issueMfaPendingToken(user.id, config, "phone");
         return Response.json(
           {
             reason: "USER_PHONE_OTP_SENT",
             explanation: "A verification code has been sent to your phone.",
-            result: {
-              tokens: { access: accessToken, refresh: refreshToken },
-              user: toUserDTO(user, false)
-            }
+            result: { otpToken }
           },
-          {
-            status: 202,
-            headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
-          }
+          { status: 202 }
         );
       }
       return setApiResponse3(
@@ -1716,6 +1710,9 @@ function authController(store, config, bus) {
       return setApiResponse3(HTTP3.OK, "PASSWORD_RESET_SUCCESSFUL", "Password reset successfully.");
     },
     verify: async (ctx) => {
+      if (ctx.user.mfaPending && ctx.user.loginMethod !== "phone") {
+        return setApiResponse3(HTTP3.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
+      }
       if (ctx.user.loginMethod !== "phone" && ctx.user.emailVerifiedAt) {
         return setApiResponse3(HTTP3.OK, "VERIFIED", "Email verified successfully.", {
           verified: true,
@@ -1802,6 +1799,9 @@ function authController(store, config, bus) {
       });
     },
     sendVerification: async (ctx) => {
+      if (ctx.user.mfaPending && ctx.user.loginMethod !== "phone") {
+        return setApiResponse3(HTTP3.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
+      }
       const resolved = { ...config, ...config.resolve?.(ctx) };
       const cooldown = resolved.verificationCooldown ?? DEFAULT_VERIFICATION_COOLDOWN;
       if (ctx.user.loginMethod === "phone") {
@@ -2367,10 +2367,14 @@ function buildAuthRoutes(store, config, bus) {
     R("refresh", "POST", "/auth/refresh", validate(refreshSchema), auth.refresh),
     // Email — Password Recovery (Public)
     R("forgotPassword", "POST", "/auth/email/forgot", ipLimit("forgot"), validate(forgotPasswordSchema), acctLimit("forgot"), auth.forgotPassword),
-    R("resetPassword", "POST", "/auth/email/reset", validate(resetPasswordSchema), auth.resetPassword),
-    // Verification (Protected — email or phone, determined by loginMethod)
-    R("verifyEmail", "POST", "/auth/verify", requireAuth, validate(verifySchema), auth.verify),
-    R("sendVerification", "GET", "/auth/send-verification", requireAuth, auth.sendVerification),
+    R("resetPassword", "POST", "/auth/email/reset", ipLimit("reset"), validate(resetPasswordSchema), auth.resetPassword),
+    // Verification (email or phone, determined by loginMethod). requireAnyAuth,
+    // not requireAuth: the phone-OTP flow reaches these with a short-lived
+    // pending token (login/register no longer issue real tokens before the OTP
+    // round-trip); the controllers reject pending tokens for any other flow.
+    // ipLimit guards the 6-digit OTP against brute force (like mfaVerify).
+    R("verifyEmail", "POST", "/auth/verify", ipLimit("verify"), requireAnyAuth, validate(verifySchema), auth.verify),
+    R("sendVerification", "GET", "/auth/send-verification", requireAnyAuth, auth.sendVerification),
     // Account Management (Protected)
     R("logout", "POST", "/auth/logout", requireAuth, validate(refreshSchema), auth.logout),
     // User Profile (Protected; writes also gate on requireVerification)