@fonderie/auth 7.0.1 → 7.1.0

package/brain/outcomes.md

@@ -61,6 +61,7 @@ user_id                  UUID PRIMARY KEY REFERENCES fonderie_users(id) ON DELET
 expires_at               TIMESTAMPTZ NOT NULL
 created_at               TIMESTAMPTZ NOT NULL DEFAULT now()
 pin                      TEXT NOT NULL UNIQUE
+token                    TEXT
 -- INDEX idx_fonderie_password_resets_pin (pin)
 ```
 

package/brain/signatures.md

@@ -58,6 +58,7 @@ interface IAuthConfig extends IAuthSecrets, IAuthRuntimeConfig {
     accessTokenDuration?: string;
     providers: ('email' | 'phone' | 'google' | 'github')[];
     appName?: string;
+    passwordResetUrl?: string;
     resolve?: (ctx: {
         meta: Record<string, unknown>;
     }) => Partial<IAuthRuntimeConfig>;

package/dist/index.cjs

@@ -201,7 +201,10 @@ var loginSchema = import_zod.z.union([
 ]);
 var refreshSchema = import_zod.z.object({ refreshToken: import_zod.z.string().min(1).optional() });
 var forgotPasswordSchema = import_zod.z.object({ email });
-var resetPasswordSchema = import_zod.z.object({ pin: sixDigitPin, password });
+var resetPasswordSchema = import_zod.z.union([
+  import_zod.z.object({ pin: sixDigitPin, password }),
+  import_zod.z.object({ token: import_zod.z.string().trim().min(32, "invalid reset token"), password })
+]);
 var verifySchema = import_zod.z.object({ token: sixDigitPin });
 var updateProfileSchema = import_zod.z.object({
   firstName: import_zod.z.string().max(100).nullable().optional(),
@@ -1198,13 +1201,13 @@ var PasswordResetModel = class {
     this.store = store;
   }
   store;
-  async create(userId, pin, expiresAt) {
+  async create(userId, pin, token, expiresAt) {
     await this.store.query(
-      `INSERT INTO fonderie_password_resets (user_id, pin, expires_at, created_at)
-			VALUES ($1, $2, $3, now())
+      `INSERT INTO fonderie_password_resets (user_id, pin, token, expires_at, created_at)
+			VALUES ($1, $2, $3, $4, now())
 			ON CONFLICT (user_id) DO UPDATE
-			SET pin = $2, expires_at = $3, created_at = now()`,
-      [userId, pin, expiresAt]
+			SET pin = $2, token = $3, expires_at = $4, created_at = now()`,
+      [userId, pin, token, expiresAt]
     );
   }
   async findLastSentAt(userId) {
@@ -1223,6 +1226,19 @@ var PasswordResetModel = class {
     if (!row) return null;
     return { userId: row.user_id, expiresAt: new Date(row.expires_at) };
   }
+  // Lookup by the high-entropy reset token. Unlike the 6-digit pin this is
+  // not brute-forceable, so the token path needs no rate limit. Empty/short
+  // values are refused before the query so a NULL/blank token column can
+  // never be matched.
+  async findByToken(token) {
+    if (typeof token !== "string" || token.length < 32) return null;
+    const [row] = await this.store.query(
+      `SELECT user_id, expires_at FROM fonderie_password_resets WHERE token = $1`,
+      [token]
+    );
+    if (!row) return null;
+    return { userId: row.user_id, expiresAt: new Date(row.expires_at) };
+  }
   async deleteByUser(userId) {
     await this.store.query(`DELETE FROM fonderie_password_resets WHERE user_id = $1`, [userId]);
   }
@@ -1692,13 +1708,16 @@ function authController(store, config, bus) {
         );
       }
       const pin = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
+      const token = (0, import_node_crypto4.randomBytes)(32).toString("hex");
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60);
-      await passwordReset.create(user.id, pin, expiresAt);
+      await passwordReset.create(user.id, pin, token, expiresAt);
+      const base = resolved.passwordResetUrl;
+      const resetUrl = base ? `${base}${base.includes("?") ? "&" : "?"}token=${token}` : "";
       bus?.emit(import_events2.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.passwordReset,
         locale: user.locale,
         recipient: { email: email2, phone: null, deviceToken: null },
-        data: { pin }
+        data: { pin, token, resetUrl }
       }).catch(() => {
       });
       return (0, import_core5.setApiResponse)(
@@ -1711,19 +1730,9 @@ function authController(store, config, bus) {
       const body = ctx.meta["body"];
       const raw = body?.["pin"];
       const password2 = body?.["password"];
-      if (typeof raw !== "string" || typeof password2 !== "string") {
-        return (0, import_core5.setApiResponse)(
-          import_core5.HTTP.UNPROCESSABLE,
-          "INVALID_PARAMETER",
-          "pin and password are required"
-        );
-      }
-      if (!/^\d{6}$/.test(raw.trim())) {
-        return (0, import_core5.setApiResponse)(
-          import_core5.HTTP.UNPROCESSABLE,
-          "INVALID_PARAMETER",
-          "pin must be a 6-digit code"
-        );
+      const rawToken = body?.["token"];
+      if (typeof password2 !== "string") {
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "password is required");
       }
       if (password2.length < 8) {
         return (0, import_core5.setApiResponse)(
@@ -1732,10 +1741,25 @@ function authController(store, config, bus) {
           "password must be at least 8 characters"
         );
       }
-      const pin = raw.trim();
-      const row = await passwordReset.findByPin(pin);
+      let row;
+      if (typeof rawToken === "string" && rawToken.trim().length >= 32) {
+        row = await passwordReset.findByToken(rawToken.trim());
+      } else {
+        if (typeof raw !== "string" || !/^\d{6}$/.test(raw.trim())) {
+          return (0, import_core5.setApiResponse)(
+            import_core5.HTTP.UNPROCESSABLE,
+            "INVALID_PARAMETER",
+            "a 6-digit pin or a reset token is required"
+          );
+        }
+        row = await passwordReset.findByPin(raw.trim());
+      }
       if (!row || /* @__PURE__ */ new Date() > row.expiresAt) {
-        return (0, import_core5.setApiResponse)(import_core5.HTTP.BAD_REQUEST, "PASSWORD_RESET_FAILED", "Invalid or expired pin");
+        return (0, import_core5.setApiResponse)(
+          import_core5.HTTP.BAD_REQUEST,
+          "PASSWORD_RESET_FAILED",
+          "Invalid or expired reset credentials"
+        );
       }
       const passwordHash = await hashPassword(password2);
       await store.transaction(async (tx) => {
@@ -2750,7 +2774,11 @@ If you made this change, you're all set. If not, contact support right away \u20
 var SAMPLE_PAYLOADS = {
   [MESSAGE_KEYS.emailRegistration]: { firstName: "", pin: "123456" },
   [MESSAGE_KEYS.emailVerification]: { firstName: "Ada", pin: "123456" },
-  [MESSAGE_KEYS.passwordReset]: { pin: "123456" },
+  [MESSAGE_KEYS.passwordReset]: {
+    pin: "123456",
+    token: "0".repeat(64),
+    resetUrl: "https://app.example.com/reset?token=" + "0".repeat(64)
+  },
   [MESSAGE_KEYS.phoneOtp]: { otp: "123456" },
   [MESSAGE_KEYS.mfaEnabled]: {},
   [MESSAGE_KEYS.mfaDisabled]: {},