@fonderie/auth 7.0.1 → 7.1.1

package/dist/index.d.cts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.cjs';
 import { IFonderieModule, IReadinessProblem, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-Db6KZca3.cjs';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-Db6KZca3.cjs';
+import { I as IAuthConfig } from './session-6B77MAFn.cjs';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-6B77MAFn.cjs';
 export { IUserDTO, toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';
@@ -107,10 +107,13 @@ declare const refreshSchema: z.ZodObject<{
 declare const forgotPasswordSchema: z.ZodObject<{
     email: z.ZodPipe<z.ZodString, z.ZodEmail>;
 }, z.core.$strip>;
-declare const resetPasswordSchema: z.ZodObject<{
+declare const resetPasswordSchema: z.ZodUnion<readonly [z.ZodObject<{
     pin: z.ZodString;
     password: z.ZodString;
-}, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    token: z.ZodString;
+    password: z.ZodString;
+}, z.core.$strip>]>;
 declare const verifySchema: z.ZodObject<{
     token: z.ZodString;
 }, z.core.$strip>;

package/dist/index.d.ts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.js';
 import { IFonderieModule, IReadinessProblem, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-Db6KZca3.js';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-Db6KZca3.js';
+import { I as IAuthConfig } from './session-6B77MAFn.js';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-6B77MAFn.js';
 export { IUserDTO, toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';
@@ -107,10 +107,13 @@ declare const refreshSchema: z.ZodObject<{
 declare const forgotPasswordSchema: z.ZodObject<{
     email: z.ZodPipe<z.ZodString, z.ZodEmail>;
 }, z.core.$strip>;
-declare const resetPasswordSchema: z.ZodObject<{
+declare const resetPasswordSchema: z.ZodUnion<readonly [z.ZodObject<{
     pin: z.ZodString;
     password: z.ZodString;
-}, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    token: z.ZodString;
+    password: z.ZodString;
+}, z.core.$strip>]>;
 declare const verifySchema: z.ZodObject<{
     token: z.ZodString;
 }, z.core.$strip>;

package/dist/index.js

@@ -161,7 +161,10 @@ var loginSchema = z.union([
 ]);
 var refreshSchema = z.object({ refreshToken: z.string().min(1).optional() });
 var forgotPasswordSchema = z.object({ email });
-var resetPasswordSchema = z.object({ pin: sixDigitPin, password });
+var resetPasswordSchema = z.union([
+  z.object({ pin: sixDigitPin, password }),
+  z.object({ token: z.string().trim().min(32, "invalid reset token"), password })
+]);
 var verifySchema = z.object({ token: sixDigitPin });
 var updateProfileSchema = z.object({
   firstName: z.string().max(100).nullable().optional(),
@@ -1106,7 +1109,7 @@ function mfaController(store, config, issuer, bus) {
 }
 
 // src/controllers/auth.controller.ts
-import { randomInt } from "crypto";
+import { randomBytes as randomBytes3, randomInt } from "crypto";
 import { NOTIFICATION_EVENT as NOTIFICATION_EVENT2 } from "@fonderie/events";
 import { setApiResponse as setApiResponse3, HTTP as HTTP3 } from "@fonderie/core";
 
@@ -1153,18 +1156,20 @@ function normalizeEmailSafe(email2) {
 }
 
 // src/models/password-reset.model.ts
+import { createHash } from "crypto";
+var hashSecret = (value) => createHash("sha256").update(value).digest("hex");
 var PasswordResetModel = class {
   constructor(store) {
     this.store = store;
   }
   store;
-  async create(userId, pin, expiresAt) {
+  async create(userId, pin, token, expiresAt) {
     await this.store.query(
-      `INSERT INTO fonderie_password_resets (user_id, pin, expires_at, created_at)
-			VALUES ($1, $2, $3, now())
+      `INSERT INTO fonderie_password_resets (user_id, pin, token, expires_at, created_at)
+			VALUES ($1, $2, $3, $4, now())
 			ON CONFLICT (user_id) DO UPDATE
-			SET pin = $2, expires_at = $3, created_at = now()`,
-      [userId, pin, expiresAt]
+			SET pin = $2, token = $3, expires_at = $4, created_at = now()`,
+      [userId, hashSecret(pin), hashSecret(token), expiresAt]
     );
   }
   async findLastSentAt(userId) {
@@ -1178,7 +1183,20 @@ var PasswordResetModel = class {
   async findByPin(pin) {
     const [row] = await this.store.query(
       `SELECT user_id, expires_at FROM fonderie_password_resets WHERE pin = $1`,
-      [pin]
+      [hashSecret(pin)]
+    );
+    if (!row) return null;
+    return { userId: row.user_id, expiresAt: new Date(row.expires_at) };
+  }
+  // Lookup by the high-entropy reset token. Unlike the 6-digit pin this is
+  // not brute-forceable, so the token path needs no rate limit. Empty/short
+  // values are refused before the query so a NULL/blank token column can
+  // never be matched.
+  async findByToken(token) {
+    if (typeof token !== "string" || token.length < 32) return null;
+    const [row] = await this.store.query(
+      `SELECT user_id, expires_at FROM fonderie_password_resets WHERE token = $1`,
+      [hashSecret(token)]
     );
     if (!row) return null;
     return { userId: row.user_id, expiresAt: new Date(row.expires_at) };
@@ -1652,13 +1670,16 @@ function authController(store, config, bus) {
         );
       }
       const pin = randomInt(1e5, 1e6).toString();
+      const token = randomBytes3(32).toString("hex");
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60);
-      await passwordReset.create(user.id, pin, expiresAt);
+      await passwordReset.create(user.id, pin, token, expiresAt);
+      const base = resolved.passwordResetUrl;
+      const resetUrl = base ? `${base}${base.includes("?") ? "&" : "?"}token=${token}` : "";
       bus?.emit(NOTIFICATION_EVENT2, {
         type: MESSAGE_KEYS.passwordReset,
         locale: user.locale,
         recipient: { email: email2, phone: null, deviceToken: null },
-        data: { pin }
+        data: { pin, token, resetUrl }
       }).catch(() => {
       });
       return setApiResponse3(
@@ -1671,19 +1692,9 @@ function authController(store, config, bus) {
       const body = ctx.meta["body"];
       const raw = body?.["pin"];
       const password2 = body?.["password"];
-      if (typeof raw !== "string" || typeof password2 !== "string") {
-        return setApiResponse3(
-          HTTP3.UNPROCESSABLE,
-          "INVALID_PARAMETER",
-          "pin and password are required"
-        );
-      }
-      if (!/^\d{6}$/.test(raw.trim())) {
-        return setApiResponse3(
-          HTTP3.UNPROCESSABLE,
-          "INVALID_PARAMETER",
-          "pin must be a 6-digit code"
-        );
+      const rawToken = body?.["token"];
+      if (typeof password2 !== "string") {
+        return setApiResponse3(HTTP3.UNPROCESSABLE, "INVALID_PARAMETER", "password is required");
       }
       if (password2.length < 8) {
         return setApiResponse3(
@@ -1692,10 +1703,25 @@ function authController(store, config, bus) {
           "password must be at least 8 characters"
         );
       }
-      const pin = raw.trim();
-      const row = await passwordReset.findByPin(pin);
+      let row;
+      if (typeof rawToken === "string" && rawToken.trim().length >= 32) {
+        row = await passwordReset.findByToken(rawToken.trim());
+      } else {
+        if (typeof raw !== "string" || !/^\d{6}$/.test(raw.trim())) {
+          return setApiResponse3(
+            HTTP3.UNPROCESSABLE,
+            "INVALID_PARAMETER",
+            "a 6-digit pin or a reset token is required"
+          );
+        }
+        row = await passwordReset.findByPin(raw.trim());
+      }
       if (!row || /* @__PURE__ */ new Date() > row.expiresAt) {
-        return setApiResponse3(HTTP3.BAD_REQUEST, "PASSWORD_RESET_FAILED", "Invalid or expired pin");
+        return setApiResponse3(
+          HTTP3.BAD_REQUEST,
+          "PASSWORD_RESET_FAILED",
+          "Invalid or expired reset credentials"
+        );
       }
       const passwordHash = await hashPassword(password2);
       await store.transaction(async (tx) => {
@@ -2228,7 +2254,7 @@ function userController(store, config, bus) {
 }
 
 // src/controllers/oauth.controller.ts
-import { randomBytes as randomBytes3 } from "crypto";
+import { randomBytes as randomBytes4 } from "crypto";
 import { setApiResponse as setApiResponse5, HTTP as HTTP5, constantTimeEqual as constantTimeEqual2 } from "@fonderie/core";
 function oauthController(store, config) {
   const users = new UserModel(store);
@@ -2244,7 +2270,7 @@ function oauthController(store, config) {
           "Google OAuth not configured"
         );
       }
-      const state = randomBytes3(16).toString("hex");
+      const state = randomBytes4(16).toString("hex");
       const params = new URLSearchParams({
         client_id: google.clientId,
         redirect_uri: google.redirectUri,
@@ -2710,7 +2736,11 @@ If you made this change, you're all set. If not, contact support right away \u20
 var SAMPLE_PAYLOADS = {
   [MESSAGE_KEYS.emailRegistration]: { firstName: "", pin: "123456" },
   [MESSAGE_KEYS.emailVerification]: { firstName: "Ada", pin: "123456" },
-  [MESSAGE_KEYS.passwordReset]: { pin: "123456" },
+  [MESSAGE_KEYS.passwordReset]: {
+    pin: "123456",
+    token: "0".repeat(64),
+    resetUrl: "https://app.example.com/reset?token=" + "0".repeat(64)
+  },
   [MESSAGE_KEYS.phoneOtp]: { otp: "123456" },
   [MESSAGE_KEYS.mfaEnabled]: {},
   [MESSAGE_KEYS.mfaDisabled]: {},