@fonderie/auth 5.3.0 → 7.0.0

package/dist/index.d.cts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.cjs';
 import { IFonderieModule, IReadinessProblem, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-jITwnc3m.cjs';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-jITwnc3m.cjs';
+import { I as IAuthConfig } from './session-Db6KZca3.cjs';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-Db6KZca3.cjs';
 export { IUserDTO, toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';

package/dist/index.d.ts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.js';
 import { IFonderieModule, IReadinessProblem, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-jITwnc3m.js';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-jITwnc3m.js';
+import { I as IAuthConfig } from './session-Db6KZca3.js';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-Db6KZca3.js';
 export { IUserDTO, toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';

package/dist/index.js

@@ -92,6 +92,9 @@ var DEFAULTS = {
   // so this IP bucket is the guard. (Moving reset to a high-entropy opaque
   // token is tracked as a follow-up hardening.)
   reset: { ip: { capacity: 10, refillPerSec: 10 / min(15) } },
+  // verify: 10/15min per IP — /auth/verify checks a 6-digit email/phone OTP,
+  // and in the phone flow that OTP is the login credential itself.
+  verify: { ip: { capacity: 10, refillPerSec: 10 / min(15) } },
   // mfaVerify: 10/15min per IP — TOTP brute-force.
   mfaVerify: { ip: { capacity: 10, refillPerSec: 10 / min(15) } }
 };
@@ -1424,23 +1427,17 @@ function authController(store, config, bus) {
           reqOpts2
         ).catch(() => {
         });
-        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
-          loginMethod: "phone"
-        });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, requestMeta(ctx));
+        const otpToken = issueMfaPendingToken(user.id, config, "phone");
         return Response.json(
           {
             reason: "USER_PHONE_REGISTERED",
             explanation: "Account created. A verification code has been sent to your phone.",
             result: {
-              tokens: { access: accessToken, refresh: refreshToken },
+              otpToken,
               user: toUserDTO(user)
             }
           },
-          {
-            status: 202,
-            headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
-          }
+          { status: 202 }
         );
       }
       return setApiResponse3(
@@ -1554,23 +1551,14 @@ function authController(store, config, bus) {
           recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
         }).catch(() => {
         });
-        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
-          loginMethod: "phone"
-        });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
+        const otpToken = issueMfaPendingToken(user.id, config, "phone");
         return Response.json(
           {
             reason: "USER_PHONE_OTP_SENT",
             explanation: "A verification code has been sent to your phone.",
-            result: {
-              tokens: { access: accessToken, refresh: refreshToken },
-              user: toUserDTO(user, false)
-            }
+            result: { otpToken }
           },
-          {
-            status: 202,
-            headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
-          }
+          { status: 202 }
         );
       }
       return setApiResponse3(
@@ -1716,12 +1704,18 @@ function authController(store, config, bus) {
             passwordHash,
             row.userId
           ]),
-          tx.query(`DELETE FROM fonderie_password_resets WHERE user_id = $1`, [row.userId])
+          tx.query(`DELETE FROM fonderie_password_resets WHERE user_id = $1`, [row.userId]),
+          // Revoke every session: the reset exists because the account may
+          // be compromised — a stolen session must not survive it.
+          tx.query(`DELETE FROM fonderie_sessions WHERE user_id = $1`, [row.userId])
         ]);
       });
       return setApiResponse3(HTTP3.OK, "PASSWORD_RESET_SUCCESSFUL", "Password reset successfully.");
     },
     verify: async (ctx) => {
+      if (ctx.user.mfaPending && ctx.user.loginMethod !== "phone") {
+        return setApiResponse3(HTTP3.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
+      }
       if (ctx.user.loginMethod !== "phone" && ctx.user.emailVerifiedAt) {
         return setApiResponse3(HTTP3.OK, "VERIFIED", "Email verified successfully.", {
           verified: true,
@@ -1808,6 +1802,9 @@ function authController(store, config, bus) {
       });
     },
     sendVerification: async (ctx) => {
+      if (ctx.user.mfaPending && ctx.user.loginMethod !== "phone") {
+        return setApiResponse3(HTTP3.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
+      }
       const resolved = { ...config, ...config.resolve?.(ctx) };
       const cooldown = resolved.verificationCooldown ?? DEFAULT_VERIFICATION_COOLDOWN;
       if (ctx.user.loginMethod === "phone") {
@@ -2231,7 +2228,8 @@ function userController(store, config, bus) {
 }
 
 // src/controllers/oauth.controller.ts
-import { setApiResponse as setApiResponse5, HTTP as HTTP5 } from "@fonderie/core";
+import { randomBytes as randomBytes3 } from "crypto";
+import { setApiResponse as setApiResponse5, HTTP as HTTP5, constantTimeEqual as constantTimeEqual2 } from "@fonderie/core";
 function oauthController(store, config) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
@@ -2246,18 +2244,30 @@ function oauthController(store, config) {
           "Google OAuth not configured"
         );
       }
+      const state = randomBytes3(16).toString("hex");
       const params = new URLSearchParams({
         client_id: google.clientId,
         redirect_uri: google.redirectUri,
         response_type: "code",
-        scope: "openid email profile"
+        scope: "openid email profile",
+        state
       });
       const url = `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
-      return setApiResponse5(
-        HTTP5.OK,
-        "GOOGLE_AUTH_URL",
-        "Redirect the user to the returned URL to begin Google OAuth.",
-        { url }
+      const secure = config.secureCookies ?? process.env["NODE_ENV"] === "production" ? "; Secure" : "";
+      return Response.json(
+        {
+          reason: "GOOGLE_AUTH_URL",
+          explanation: "Redirect the user to the returned URL to begin Google OAuth.",
+          result: { url }
+        },
+        {
+          status: 200,
+          // SameSite=Lax (not Strict): the cookie must be sent on the
+          // top-level cross-site redirect back from Google.
+          headers: cookieHeaders([
+            `oauth_state=${state}; HttpOnly; SameSite=Lax; Path=/; Max-Age=600${secure}`
+          ])
+        }
       );
     },
     googleCallback: async (ctx) => {
@@ -2274,6 +2284,16 @@ function oauthController(store, config) {
       if (!code) {
         return setApiResponse5(HTTP5.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
       }
+      const returnedState = url.searchParams.get("state") ?? "";
+      const cookieHeader = ctx.request.headers.get("cookie") ?? "";
+      const expectedState = cookieHeader.match(/(?:^|;\s*)oauth_state=([^;]+)/)?.[1] ?? "";
+      if (!returnedState || !expectedState || !constantTimeEqual2(Buffer.from(returnedState), Buffer.from(expectedState))) {
+        return setApiResponse5(
+          HTTP5.BAD_REQUEST,
+          "GOOGLE_AUTH_FAILED",
+          "OAuth state mismatch \u2014 restart the sign-in flow"
+        );
+      }
       const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
         method: "POST",
         headers: { "content-type": "application/x-www-form-urlencoded" },
@@ -2296,9 +2316,25 @@ function oauthController(store, config) {
       const payload = JSON.parse(
         Buffer.from(tokenData.id_token.split(".")[1] ?? "", "base64url").toString()
       );
+      if (payload.aud !== google.clientId) {
+        return setApiResponse5(HTTP5.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token audience mismatch");
+      }
+      if (payload.iss !== "https://accounts.google.com" && payload.iss !== "accounts.google.com") {
+        return setApiResponse5(HTTP5.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token issuer mismatch");
+      }
+      if (typeof payload.exp !== "number" || payload.exp * 1e3 < Date.now()) {
+        return setApiResponse5(HTTP5.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token expired");
+      }
       if (!payload.email) {
         return setApiResponse5(HTTP5.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "No email in OAuth response");
       }
+      if (payload.email_verified !== true) {
+        return setApiResponse5(
+          HTTP5.BAD_REQUEST,
+          "GOOGLE_AUTH_FAILED",
+          "Google account email is not verified"
+        );
+      }
       const normalizedEmail = normalizeEmailSafe(payload.email);
       if (!normalizedEmail) {
         return setApiResponse5(HTTP5.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "Invalid email in OAuth response");
@@ -2342,7 +2378,11 @@ function oauthController(store, config) {
         },
         {
           status: 200,
-          headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
+          headers: cookieHeaders([
+            ...tokenPairCookies(accessToken, refreshToken, config),
+            // One-time value — clear it once the flow completes.
+            "oauth_state=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0"
+          ])
         }
       );
     }
@@ -2374,9 +2414,13 @@ function buildAuthRoutes(store, config, bus) {
     // Email — Password Recovery (Public)
     R("forgotPassword", "POST", "/auth/email/forgot", ipLimit("forgot"), validate(forgotPasswordSchema), acctLimit("forgot"), auth.forgotPassword),
     R("resetPassword", "POST", "/auth/email/reset", ipLimit("reset"), validate(resetPasswordSchema), auth.resetPassword),
-    // Verification (Protected — email or phone, determined by loginMethod)
-    R("verifyEmail", "POST", "/auth/verify", requireAuth, validate(verifySchema), auth.verify),
-    R("sendVerification", "GET", "/auth/send-verification", requireAuth, auth.sendVerification),
+    // Verification (email or phone, determined by loginMethod). requireAnyAuth,
+    // not requireAuth: the phone-OTP flow reaches these with a short-lived
+    // pending token (login/register no longer issue real tokens before the OTP
+    // round-trip); the controllers reject pending tokens for any other flow.
+    // ipLimit guards the 6-digit OTP against brute force (like mfaVerify).
+    R("verifyEmail", "POST", "/auth/verify", ipLimit("verify"), requireAnyAuth, validate(verifySchema), auth.verify),
+    R("sendVerification", "GET", "/auth/send-verification", requireAnyAuth, auth.sendVerification),
     // Account Management (Protected)
     R("logout", "POST", "/auth/logout", requireAuth, validate(refreshSchema), auth.logout),
     // User Profile (Protected; writes also gate on requireVerification)