@fonderie/auth 7.1.0 → 7.1.1

package/dist/index.cjs

@@ -1149,7 +1149,7 @@ function mfaController(store, config, issuer, bus) {
 }
 
 // src/controllers/auth.controller.ts
-var import_node_crypto4 = require("crypto");
+var import_node_crypto5 = require("crypto");
 var import_events2 = require("@fonderie/events");
 var import_core5 = require("@fonderie/core");
 
@@ -1196,6 +1196,8 @@ function normalizeEmailSafe(email2) {
 }
 
 // src/models/password-reset.model.ts
+var import_node_crypto4 = require("crypto");
+var hashSecret = (value) => (0, import_node_crypto4.createHash)("sha256").update(value).digest("hex");
 var PasswordResetModel = class {
   constructor(store) {
     this.store = store;
@@ -1207,7 +1209,7 @@ var PasswordResetModel = class {
 			VALUES ($1, $2, $3, $4, now())
 			ON CONFLICT (user_id) DO UPDATE
 			SET pin = $2, token = $3, expires_at = $4, created_at = now()`,
-      [userId, pin, token, expiresAt]
+      [userId, hashSecret(pin), hashSecret(token), expiresAt]
     );
   }
   async findLastSentAt(userId) {
@@ -1221,7 +1223,7 @@ var PasswordResetModel = class {
   async findByPin(pin) {
     const [row] = await this.store.query(
       `SELECT user_id, expires_at FROM fonderie_password_resets WHERE pin = $1`,
-      [pin]
+      [hashSecret(pin)]
     );
     if (!row) return null;
     return { userId: row.user_id, expiresAt: new Date(row.expires_at) };
@@ -1234,7 +1236,7 @@ var PasswordResetModel = class {
     if (typeof token !== "string" || token.length < 32) return null;
     const [row] = await this.store.query(
       `SELECT user_id, expires_at FROM fonderie_password_resets WHERE token = $1`,
-      [token]
+      [hashSecret(token)]
     );
     if (!row) return null;
     return { userId: row.user_id, expiresAt: new Date(row.expires_at) };
@@ -1387,7 +1389,7 @@ function authController(store, config, bus) {
         if (!row) {
           return (0, import_core5.setApiResponse)(import_core5.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
         }
-        const pin = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
+        const pin = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
         await emailVerif.create(row.id, pin, expiresAt);
         const user = await users.findById(row.id);
@@ -1451,7 +1453,7 @@ function authController(store, config, bus) {
           firstName ?? null,
           lastName ?? null
         );
-        const otp = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
+        const otp = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(id, normalizePhone(phone2), otp, expiresAt);
         const user = await users.findById(id);
@@ -1597,7 +1599,7 @@ function authController(store, config, bus) {
             "Account suspended. Please contact support."
           );
         }
-        const otp = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
+        const otp = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(user.id, normalizePhone(phone2), otp, expiresAt);
         bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1707,8 +1709,8 @@ function authController(store, config, bus) {
           "Password reset email sent (if account exists)."
         );
       }
-      const pin = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
-      const token = (0, import_node_crypto4.randomBytes)(32).toString("hex");
+      const pin = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
+      const token = (0, import_node_crypto5.randomBytes)(32).toString("hex");
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60);
       await passwordReset.create(user.id, pin, token, expiresAt);
       const base = resolved.passwordResetUrl;
@@ -1891,7 +1893,7 @@ function authController(store, config, bus) {
             }
           );
         }
-        const otp = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
+        const otp = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
         const expiresAt2 = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(ctx.user.id, phone2, otp, expiresAt2);
         bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1931,7 +1933,7 @@ function authController(store, config, bus) {
           }
         );
       }
-      const pin = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
+      const pin = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1949,7 +1951,7 @@ function authController(store, config, bus) {
 }
 
 // src/controllers/user.controller.ts
-var import_node_crypto5 = require("crypto");
+var import_node_crypto6 = require("crypto");
 var import_core7 = require("@fonderie/core");
 var import_events3 = require("@fonderie/events");
 
@@ -2139,7 +2141,7 @@ function userController(store, config, bus) {
       if (existing) {
         return (0, import_core7.setApiResponse)(import_core7.HTTP.CONFLICT, "EMAIL_IN_USE", "Email already in use");
       }
-      const pin = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
+      const pin = (0, import_node_crypto6.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       await users.updateEmail(ctx.user.id, normalised);
@@ -2183,7 +2185,7 @@ function userController(store, config, bus) {
       if (existing) {
         return (0, import_core7.setApiResponse)(import_core7.HTTP.CONFLICT, "PHONE_IN_USE", "Phone number already in use");
       }
-      const otp = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
+      const otp = (0, import_node_crypto6.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 10 * 60 * 1e3);
       await phoneVerif.upsert(ctx.user.id, normalised, otp, expiresAt);
       await users.updatePhone(ctx.user.id, normalised);
@@ -2292,7 +2294,7 @@ function userController(store, config, bus) {
 }
 
 // src/controllers/oauth.controller.ts
-var import_node_crypto6 = require("crypto");
+var import_node_crypto7 = require("crypto");
 var import_core8 = require("@fonderie/core");
 function oauthController(store, config) {
   const users = new UserModel(store);
@@ -2308,7 +2310,7 @@ function oauthController(store, config) {
           "Google OAuth not configured"
         );
       }
-      const state = (0, import_node_crypto6.randomBytes)(16).toString("hex");
+      const state = (0, import_node_crypto7.randomBytes)(16).toString("hex");
       const params = new URLSearchParams({
         client_id: google.clientId,
         redirect_uri: google.redirectUri,