@fonderie/auth 5.3.0 → 7.0.0

package/brain/outcomes.md

@@ -141,11 +141,11 @@ Raw SQL ships in `node_modules/@fonderie/auth/dist/migrations/sql/` — read it
 | POST | `/auth/mfa/verify` | `ipLimit('mfaVerify') → requireAnyAuth → requireEmailLogin → requireVerified → validate(mfaTokenSchema) → mfa.verify` |
 | POST | `/auth/refresh` | `validate(refreshSchema) → auth.refresh` |
 | POST | `/auth/register` | `ipLimit('register') → validate(registerSchema) → auth.register` |
-| GET | `/auth/send-verification` | `requireAuth → auth.sendVerification` |
+| GET | `/auth/send-verification` | `requireAnyAuth → auth.sendVerification` |
 | GET | `/auth/sessions` | `requireAuth → user.listSessions` |
 | DELETE | `/auth/sessions/:id` | `requireAuth → user.terminateSession` |
 | DELETE | `/auth/sessions/others` | `requireAuth → user.terminateOtherSessions` |
-| POST | `/auth/verify` | `requireAuth → validate(verifySchema) → auth.verify` |
+| POST | `/auth/verify` | `ipLimit('verify') → requireAnyAuth → validate(verifySchema) → auth.verify` |
 | DELETE | `/users` | `requireAuth → verifyGate → user.deleteMe` |
 | GET | `/users` | `requireAuth → user.me` |
 | PUT | `/users/email` | `requireAuth → verifyGate → validate(updateEmailSchema) → user.updateEmail` |

package/brain/signatures.md

@@ -203,5 +203,5 @@ interface IAuthRateLimitConfig {
     rules?: Partial<Record<AuthLimitedRoute, IRateLimitRule | false>>;
 }
 
-type AuthLimitedRoute = 'login' | 'register' | 'forgot' | 'reset' | 'mfaVerify';
+type AuthLimitedRoute = 'login' | 'register' | 'forgot' | 'reset' | 'verify' | 'mfaVerify';
 ```

package/dist/index.cjs

@@ -132,6 +132,9 @@ var DEFAULTS = {
   // so this IP bucket is the guard. (Moving reset to a high-entropy opaque
   // token is tracked as a follow-up hardening.)
   reset: { ip: { capacity: 10, refillPerSec: 10 / min(15) } },
+  // verify: 10/15min per IP — /auth/verify checks a 6-digit email/phone OTP,
+  // and in the phone flow that OTP is the login credential itself.
+  verify: { ip: { capacity: 10, refillPerSec: 10 / min(15) } },
   // mfaVerify: 10/15min per IP — TOTP brute-force.
   mfaVerify: { ip: { capacity: 10, refillPerSec: 10 / min(15) } }
 };
@@ -1464,23 +1467,17 @@ function authController(store, config, bus) {
           reqOpts2
         ).catch(() => {
         });
-        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
-          loginMethod: "phone"
-        });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, requestMeta(ctx));
+        const otpToken = issueMfaPendingToken(user.id, config, "phone");
         return Response.json(
           {
             reason: "USER_PHONE_REGISTERED",
             explanation: "Account created. A verification code has been sent to your phone.",
             result: {
-              tokens: { access: accessToken, refresh: refreshToken },
+              otpToken,
               user: toUserDTO(user)
             }
           },
-          {
-            status: 202,
-            headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
-          }
+          { status: 202 }
         );
       }
       return (0, import_core5.setApiResponse)(
@@ -1594,23 +1591,14 @@ function authController(store, config, bus) {
           recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
         }).catch(() => {
         });
-        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
-          loginMethod: "phone"
-        });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
+        const otpToken = issueMfaPendingToken(user.id, config, "phone");
         return Response.json(
           {
             reason: "USER_PHONE_OTP_SENT",
             explanation: "A verification code has been sent to your phone.",
-            result: {
-              tokens: { access: accessToken, refresh: refreshToken },
-              user: toUserDTO(user, false)
-            }
+            result: { otpToken }
           },
-          {
-            status: 202,
-            headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
-          }
+          { status: 202 }
         );
       }
       return (0, import_core5.setApiResponse)(
@@ -1756,12 +1744,18 @@ function authController(store, config, bus) {
             passwordHash,
             row.userId
           ]),
-          tx.query(`DELETE FROM fonderie_password_resets WHERE user_id = $1`, [row.userId])
+          tx.query(`DELETE FROM fonderie_password_resets WHERE user_id = $1`, [row.userId]),
+          // Revoke every session: the reset exists because the account may
+          // be compromised — a stolen session must not survive it.
+          tx.query(`DELETE FROM fonderie_sessions WHERE user_id = $1`, [row.userId])
         ]);
       });
       return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "PASSWORD_RESET_SUCCESSFUL", "Password reset successfully.");
     },
     verify: async (ctx) => {
+      if (ctx.user.mfaPending && ctx.user.loginMethod !== "phone") {
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
+      }
       if (ctx.user.loginMethod !== "phone" && ctx.user.emailVerifiedAt) {
         return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "VERIFIED", "Email verified successfully.", {
           verified: true,
@@ -1848,6 +1842,9 @@ function authController(store, config, bus) {
       });
     },
     sendVerification: async (ctx) => {
+      if (ctx.user.mfaPending && ctx.user.loginMethod !== "phone") {
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
+      }
       const resolved = { ...config, ...config.resolve?.(ctx) };
       const cooldown = resolved.verificationCooldown ?? DEFAULT_VERIFICATION_COOLDOWN;
       if (ctx.user.loginMethod === "phone") {
@@ -2271,6 +2268,7 @@ function userController(store, config, bus) {
 }
 
 // src/controllers/oauth.controller.ts
+var import_node_crypto6 = require("crypto");
 var import_core8 = require("@fonderie/core");
 function oauthController(store, config) {
   const users = new UserModel(store);
@@ -2286,18 +2284,30 @@ function oauthController(store, config) {
           "Google OAuth not configured"
         );
       }
+      const state = (0, import_node_crypto6.randomBytes)(16).toString("hex");
       const params = new URLSearchParams({
         client_id: google.clientId,
         redirect_uri: google.redirectUri,
         response_type: "code",
-        scope: "openid email profile"
+        scope: "openid email profile",
+        state
       });
       const url = `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
-      return (0, import_core8.setApiResponse)(
-        import_core8.HTTP.OK,
-        "GOOGLE_AUTH_URL",
-        "Redirect the user to the returned URL to begin Google OAuth.",
-        { url }
+      const secure = config.secureCookies ?? process.env["NODE_ENV"] === "production" ? "; Secure" : "";
+      return Response.json(
+        {
+          reason: "GOOGLE_AUTH_URL",
+          explanation: "Redirect the user to the returned URL to begin Google OAuth.",
+          result: { url }
+        },
+        {
+          status: 200,
+          // SameSite=Lax (not Strict): the cookie must be sent on the
+          // top-level cross-site redirect back from Google.
+          headers: cookieHeaders([
+            `oauth_state=${state}; HttpOnly; SameSite=Lax; Path=/; Max-Age=600${secure}`
+          ])
+        }
       );
     },
     googleCallback: async (ctx) => {
@@ -2314,6 +2324,16 @@ function oauthController(store, config) {
       if (!code) {
         return (0, import_core8.setApiResponse)(import_core8.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
       }
+      const returnedState = url.searchParams.get("state") ?? "";
+      const cookieHeader = ctx.request.headers.get("cookie") ?? "";
+      const expectedState = cookieHeader.match(/(?:^|;\s*)oauth_state=([^;]+)/)?.[1] ?? "";
+      if (!returnedState || !expectedState || !(0, import_core8.constantTimeEqual)(Buffer.from(returnedState), Buffer.from(expectedState))) {
+        return (0, import_core8.setApiResponse)(
+          import_core8.HTTP.BAD_REQUEST,
+          "GOOGLE_AUTH_FAILED",
+          "OAuth state mismatch \u2014 restart the sign-in flow"
+        );
+      }
       const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
         method: "POST",
         headers: { "content-type": "application/x-www-form-urlencoded" },
@@ -2336,9 +2356,25 @@ function oauthController(store, config) {
       const payload = JSON.parse(
         Buffer.from(tokenData.id_token.split(".")[1] ?? "", "base64url").toString()
       );
+      if (payload.aud !== google.clientId) {
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token audience mismatch");
+      }
+      if (payload.iss !== "https://accounts.google.com" && payload.iss !== "accounts.google.com") {
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token issuer mismatch");
+      }
+      if (typeof payload.exp !== "number" || payload.exp * 1e3 < Date.now()) {
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token expired");
+      }
       if (!payload.email) {
         return (0, import_core8.setApiResponse)(import_core8.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "No email in OAuth response");
       }
+      if (payload.email_verified !== true) {
+        return (0, import_core8.setApiResponse)(
+          import_core8.HTTP.BAD_REQUEST,
+          "GOOGLE_AUTH_FAILED",
+          "Google account email is not verified"
+        );
+      }
       const normalizedEmail = normalizeEmailSafe(payload.email);
       if (!normalizedEmail) {
         return (0, import_core8.setApiResponse)(import_core8.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "Invalid email in OAuth response");
@@ -2382,7 +2418,11 @@ function oauthController(store, config) {
         },
         {
           status: 200,
-          headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
+          headers: cookieHeaders([
+            ...tokenPairCookies(accessToken, refreshToken, config),
+            // One-time value — clear it once the flow completes.
+            "oauth_state=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0"
+          ])
         }
       );
     }
@@ -2414,9 +2454,13 @@ function buildAuthRoutes(store, config, bus) {
     // Email — Password Recovery (Public)
     R("forgotPassword", "POST", "/auth/email/forgot", ipLimit("forgot"), (0, import_middlewares.validate)(forgotPasswordSchema), acctLimit("forgot"), auth.forgotPassword),
     R("resetPassword", "POST", "/auth/email/reset", ipLimit("reset"), (0, import_middlewares.validate)(resetPasswordSchema), auth.resetPassword),
-    // Verification (Protected — email or phone, determined by loginMethod)
-    R("verifyEmail", "POST", "/auth/verify", import_middlewares2.requireAuth, (0, import_middlewares.validate)(verifySchema), auth.verify),
-    R("sendVerification", "GET", "/auth/send-verification", import_middlewares2.requireAuth, auth.sendVerification),
+    // Verification (email or phone, determined by loginMethod). requireAnyAuth,
+    // not requireAuth: the phone-OTP flow reaches these with a short-lived
+    // pending token (login/register no longer issue real tokens before the OTP
+    // round-trip); the controllers reject pending tokens for any other flow.
+    // ipLimit guards the 6-digit OTP against brute force (like mfaVerify).
+    R("verifyEmail", "POST", "/auth/verify", ipLimit("verify"), import_middlewares2.requireAnyAuth, (0, import_middlewares.validate)(verifySchema), auth.verify),
+    R("sendVerification", "GET", "/auth/send-verification", import_middlewares2.requireAnyAuth, auth.sendVerification),
     // Account Management (Protected)
     R("logout", "POST", "/auth/logout", import_middlewares2.requireAuth, (0, import_middlewares.validate)(refreshSchema), auth.logout),
     // User Profile (Protected; writes also gate on requireVerification)