@fonderie/auth 7.0.1 → 7.1.1

package/brain/outcomes.md

@@ -61,6 +61,7 @@ user_id                  UUID PRIMARY KEY REFERENCES fonderie_users(id) ON DELET
 expires_at               TIMESTAMPTZ NOT NULL
 created_at               TIMESTAMPTZ NOT NULL DEFAULT now()
 pin                      TEXT NOT NULL UNIQUE
+token                    TEXT
 -- INDEX idx_fonderie_password_resets_pin (pin)
 ```
 

package/brain/signatures.md

@@ -58,6 +58,7 @@ interface IAuthConfig extends IAuthSecrets, IAuthRuntimeConfig {
     accessTokenDuration?: string;
     providers: ('email' | 'phone' | 'google' | 'github')[];
     appName?: string;
+    passwordResetUrl?: string;
     resolve?: (ctx: {
         meta: Record<string, unknown>;
     }) => Partial<IAuthRuntimeConfig>;

package/dist/index.cjs

@@ -201,7 +201,10 @@ var loginSchema = import_zod.z.union([
 ]);
 var refreshSchema = import_zod.z.object({ refreshToken: import_zod.z.string().min(1).optional() });
 var forgotPasswordSchema = import_zod.z.object({ email });
-var resetPasswordSchema = import_zod.z.object({ pin: sixDigitPin, password });
+var resetPasswordSchema = import_zod.z.union([
+  import_zod.z.object({ pin: sixDigitPin, password }),
+  import_zod.z.object({ token: import_zod.z.string().trim().min(32, "invalid reset token"), password })
+]);
 var verifySchema = import_zod.z.object({ token: sixDigitPin });
 var updateProfileSchema = import_zod.z.object({
   firstName: import_zod.z.string().max(100).nullable().optional(),
@@ -1146,7 +1149,7 @@ function mfaController(store, config, issuer, bus) {
 }
 
 // src/controllers/auth.controller.ts
-var import_node_crypto4 = require("crypto");
+var import_node_crypto5 = require("crypto");
 var import_events2 = require("@fonderie/events");
 var import_core5 = require("@fonderie/core");
 
@@ -1193,18 +1196,20 @@ function normalizeEmailSafe(email2) {
 }
 
 // src/models/password-reset.model.ts
+var import_node_crypto4 = require("crypto");
+var hashSecret = (value) => (0, import_node_crypto4.createHash)("sha256").update(value).digest("hex");
 var PasswordResetModel = class {
   constructor(store) {
     this.store = store;
   }
   store;
-  async create(userId, pin, expiresAt) {
+  async create(userId, pin, token, expiresAt) {
     await this.store.query(
-      `INSERT INTO fonderie_password_resets (user_id, pin, expires_at, created_at)
-			VALUES ($1, $2, $3, now())
+      `INSERT INTO fonderie_password_resets (user_id, pin, token, expires_at, created_at)
+			VALUES ($1, $2, $3, $4, now())
 			ON CONFLICT (user_id) DO UPDATE
-			SET pin = $2, expires_at = $3, created_at = now()`,
-      [userId, pin, expiresAt]
+			SET pin = $2, token = $3, expires_at = $4, created_at = now()`,
+      [userId, hashSecret(pin), hashSecret(token), expiresAt]
     );
   }
   async findLastSentAt(userId) {
@@ -1218,7 +1223,20 @@ var PasswordResetModel = class {
   async findByPin(pin) {
     const [row] = await this.store.query(
       `SELECT user_id, expires_at FROM fonderie_password_resets WHERE pin = $1`,
-      [pin]
+      [hashSecret(pin)]
+    );
+    if (!row) return null;
+    return { userId: row.user_id, expiresAt: new Date(row.expires_at) };
+  }
+  // Lookup by the high-entropy reset token. Unlike the 6-digit pin this is
+  // not brute-forceable, so the token path needs no rate limit. Empty/short
+  // values are refused before the query so a NULL/blank token column can
+  // never be matched.
+  async findByToken(token) {
+    if (typeof token !== "string" || token.length < 32) return null;
+    const [row] = await this.store.query(
+      `SELECT user_id, expires_at FROM fonderie_password_resets WHERE token = $1`,
+      [hashSecret(token)]
     );
     if (!row) return null;
     return { userId: row.user_id, expiresAt: new Date(row.expires_at) };
@@ -1371,7 +1389,7 @@ function authController(store, config, bus) {
         if (!row) {
           return (0, import_core5.setApiResponse)(import_core5.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
         }
-        const pin = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
+        const pin = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
         await emailVerif.create(row.id, pin, expiresAt);
         const user = await users.findById(row.id);
@@ -1435,7 +1453,7 @@ function authController(store, config, bus) {
           firstName ?? null,
           lastName ?? null
         );
-        const otp = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
+        const otp = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(id, normalizePhone(phone2), otp, expiresAt);
         const user = await users.findById(id);
@@ -1581,7 +1599,7 @@ function authController(store, config, bus) {
             "Account suspended. Please contact support."
           );
         }
-        const otp = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
+        const otp = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(user.id, normalizePhone(phone2), otp, expiresAt);
         bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1691,14 +1709,17 @@ function authController(store, config, bus) {
           "Password reset email sent (if account exists)."
         );
       }
-      const pin = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
+      const pin = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
+      const token = (0, import_node_crypto5.randomBytes)(32).toString("hex");
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60);
-      await passwordReset.create(user.id, pin, expiresAt);
+      await passwordReset.create(user.id, pin, token, expiresAt);
+      const base = resolved.passwordResetUrl;
+      const resetUrl = base ? `${base}${base.includes("?") ? "&" : "?"}token=${token}` : "";
       bus?.emit(import_events2.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.passwordReset,
         locale: user.locale,
         recipient: { email: email2, phone: null, deviceToken: null },
-        data: { pin }
+        data: { pin, token, resetUrl }
       }).catch(() => {
       });
       return (0, import_core5.setApiResponse)(
@@ -1711,19 +1732,9 @@ function authController(store, config, bus) {
       const body = ctx.meta["body"];
       const raw = body?.["pin"];
       const password2 = body?.["password"];
-      if (typeof raw !== "string" || typeof password2 !== "string") {
-        return (0, import_core5.setApiResponse)(
-          import_core5.HTTP.UNPROCESSABLE,
-          "INVALID_PARAMETER",
-          "pin and password are required"
-        );
-      }
-      if (!/^\d{6}$/.test(raw.trim())) {
-        return (0, import_core5.setApiResponse)(
-          import_core5.HTTP.UNPROCESSABLE,
-          "INVALID_PARAMETER",
-          "pin must be a 6-digit code"
-        );
+      const rawToken = body?.["token"];
+      if (typeof password2 !== "string") {
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "password is required");
       }
       if (password2.length < 8) {
         return (0, import_core5.setApiResponse)(
@@ -1732,10 +1743,25 @@ function authController(store, config, bus) {
           "password must be at least 8 characters"
         );
       }
-      const pin = raw.trim();
-      const row = await passwordReset.findByPin(pin);
+      let row;
+      if (typeof rawToken === "string" && rawToken.trim().length >= 32) {
+        row = await passwordReset.findByToken(rawToken.trim());
+      } else {
+        if (typeof raw !== "string" || !/^\d{6}$/.test(raw.trim())) {
+          return (0, import_core5.setApiResponse)(
+            import_core5.HTTP.UNPROCESSABLE,
+            "INVALID_PARAMETER",
+            "a 6-digit pin or a reset token is required"
+          );
+        }
+        row = await passwordReset.findByPin(raw.trim());
+      }
       if (!row || /* @__PURE__ */ new Date() > row.expiresAt) {
-        return (0, import_core5.setApiResponse)(import_core5.HTTP.BAD_REQUEST, "PASSWORD_RESET_FAILED", "Invalid or expired pin");
+        return (0, import_core5.setApiResponse)(
+          import_core5.HTTP.BAD_REQUEST,
+          "PASSWORD_RESET_FAILED",
+          "Invalid or expired reset credentials"
+        );
       }
       const passwordHash = await hashPassword(password2);
       await store.transaction(async (tx) => {
@@ -1867,7 +1893,7 @@ function authController(store, config, bus) {
             }
           );
         }
-        const otp = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
+        const otp = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
         const expiresAt2 = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(ctx.user.id, phone2, otp, expiresAt2);
         bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1907,7 +1933,7 @@ function authController(store, config, bus) {
           }
         );
       }
-      const pin = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
+      const pin = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1925,7 +1951,7 @@ function authController(store, config, bus) {
 }
 
 // src/controllers/user.controller.ts
-var import_node_crypto5 = require("crypto");
+var import_node_crypto6 = require("crypto");
 var import_core7 = require("@fonderie/core");
 var import_events3 = require("@fonderie/events");
 
@@ -2115,7 +2141,7 @@ function userController(store, config, bus) {
       if (existing) {
         return (0, import_core7.setApiResponse)(import_core7.HTTP.CONFLICT, "EMAIL_IN_USE", "Email already in use");
       }
-      const pin = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
+      const pin = (0, import_node_crypto6.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       await users.updateEmail(ctx.user.id, normalised);
@@ -2159,7 +2185,7 @@ function userController(store, config, bus) {
       if (existing) {
         return (0, import_core7.setApiResponse)(import_core7.HTTP.CONFLICT, "PHONE_IN_USE", "Phone number already in use");
       }
-      const otp = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
+      const otp = (0, import_node_crypto6.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 10 * 60 * 1e3);
       await phoneVerif.upsert(ctx.user.id, normalised, otp, expiresAt);
       await users.updatePhone(ctx.user.id, normalised);
@@ -2268,7 +2294,7 @@ function userController(store, config, bus) {
 }
 
 // src/controllers/oauth.controller.ts
-var import_node_crypto6 = require("crypto");
+var import_node_crypto7 = require("crypto");
 var import_core8 = require("@fonderie/core");
 function oauthController(store, config) {
   const users = new UserModel(store);
@@ -2284,7 +2310,7 @@ function oauthController(store, config) {
           "Google OAuth not configured"
         );
       }
-      const state = (0, import_node_crypto6.randomBytes)(16).toString("hex");
+      const state = (0, import_node_crypto7.randomBytes)(16).toString("hex");
       const params = new URLSearchParams({
         client_id: google.clientId,
         redirect_uri: google.redirectUri,
@@ -2750,7 +2776,11 @@ If you made this change, you're all set. If not, contact support right away \u20
 var SAMPLE_PAYLOADS = {
   [MESSAGE_KEYS.emailRegistration]: { firstName: "", pin: "123456" },
   [MESSAGE_KEYS.emailVerification]: { firstName: "Ada", pin: "123456" },
-  [MESSAGE_KEYS.passwordReset]: { pin: "123456" },
+  [MESSAGE_KEYS.passwordReset]: {
+    pin: "123456",
+    token: "0".repeat(64),
+    resetUrl: "https://app.example.com/reset?token=" + "0".repeat(64)
+  },
   [MESSAGE_KEYS.phoneOtp]: { otp: "123456" },
   [MESSAGE_KEYS.mfaEnabled]: {},
   [MESSAGE_KEYS.mfaDisabled]: {},