@fonderie/auth 7.1.0 → 7.2.0

package/brain/outcomes.md

@@ -129,6 +129,9 @@ Raw SQL ships in `node_modules/@fonderie/auth/dist/migrations/sql/` — read it
 
 | Method | Path | Middleware chain (auth / validation / handler) |
 |---|---|---|
+| GET | `/auth/apple` | `oauth.appleInit` |
+| POST | `/auth/apple/callback` | `oauth.appleCallback` |
+| POST | `/auth/apple/native` | `ipLimit('login') → validate(appleNativeSchema) → oauth.appleNative` |
 | POST | `/auth/email/forgot` | `ipLimit('forgot') → validate(forgotPasswordSchema) → acctLimit('forgot') → auth.forgotPassword` |
 | POST | `/auth/email/reset` | `ipLimit('reset') → validate(resetPasswordSchema) → auth.resetPassword` |
 | GET | `/auth/google` | `oauth.googleInit` |

package/brain/signatures.md

@@ -56,7 +56,7 @@ interface IAuthConfig extends IAuthSecrets, IAuthRuntimeConfig {
     secureCookies?: boolean;
     rateLimit?: IAuthRateLimitConfig | false;
     accessTokenDuration?: string;
-    providers: ('email' | 'phone' | 'google' | 'github')[];
+    providers: ('email' | 'phone' | 'google' | 'github' | 'apple')[];
     appName?: string;
     passwordResetUrl?: string;
     resolve?: (ctx: {
@@ -75,6 +75,14 @@ interface IAuthSecrets {
         clientSecret: string;
         redirectUri: string;
     };
+    apple?: {
+        clientId: string;
+        teamId: string;
+        keyId: string;
+        privateKey: string;
+        redirectUri: string;
+        nativeClientIds?: string[];
+    };
 }
 
 interface IAuthRuntimeConfig {
@@ -145,7 +153,7 @@ interface ISessionDTO {
 
 function validate(schema: IRequestSchema): Middleware
 
-namespace schemas — exports: ChangePasswordInput, LoginInput, RegisterInput, ResetPasswordInput, changePasswordSchema, forgotPasswordSchema, loginSchema, mfaTokenSchema, refreshSchema, registerSchema, resetPasswordSchema, updateEmailSchema, updatePhoneSchema, updatePreferencesSchema, updateProfileSchema, verifySchema
+namespace schemas — exports: ChangePasswordInput, LoginInput, RegisterInput, ResetPasswordInput, appleNativeSchema, changePasswordSchema, forgotPasswordSchema, loginSchema, mfaTokenSchema, refreshSchema, registerSchema, resetPasswordSchema, updateEmailSchema, updatePhoneSchema, updatePreferencesSchema, updateProfileSchema, verifySchema
 
 type RegisterInput = z.infer<typeof registerSchema>;
 

package/dist/index.cjs

@@ -168,6 +168,7 @@ function buildAuthAccountLimiter(route, store, config) {
 // src/schemas.ts
 var schemas_exports = {};
 __export(schemas_exports, {
+  appleNativeSchema: () => appleNativeSchema,
   changePasswordSchema: () => changePasswordSchema,
   forgotPasswordSchema: () => forgotPasswordSchema,
   loginSchema: () => loginSchema,
@@ -199,6 +200,12 @@ var loginSchema = import_zod.z.union([
   import_zod.z.object({ email, password: import_zod.z.string().min(1).max(128) }),
   import_zod.z.object({ phone })
 ]);
+var appleNativeSchema = import_zod.z.object({
+  identityToken: import_zod.z.string().min(1).max(8192),
+  // Optional nonce the app bound to the native request; when present we check
+  // it against the token's `nonce` claim to defend against replay.
+  nonce: import_zod.z.string().max(256).optional()
+});
 var refreshSchema = import_zod.z.object({ refreshToken: import_zod.z.string().min(1).optional() });
 var forgotPasswordSchema = import_zod.z.object({ email });
 var resetPasswordSchema = import_zod.z.union([
@@ -1149,7 +1156,7 @@ function mfaController(store, config, issuer, bus) {
 }
 
 // src/controllers/auth.controller.ts
-var import_node_crypto4 = require("crypto");
+var import_node_crypto5 = require("crypto");
 var import_events2 = require("@fonderie/events");
 var import_core5 = require("@fonderie/core");
 
@@ -1196,6 +1203,8 @@ function normalizeEmailSafe(email2) {
 }
 
 // src/models/password-reset.model.ts
+var import_node_crypto4 = require("crypto");
+var hashSecret = (value) => (0, import_node_crypto4.createHash)("sha256").update(value).digest("hex");
 var PasswordResetModel = class {
   constructor(store) {
     this.store = store;
@@ -1207,7 +1216,7 @@ var PasswordResetModel = class {
 			VALUES ($1, $2, $3, $4, now())
 			ON CONFLICT (user_id) DO UPDATE
 			SET pin = $2, token = $3, expires_at = $4, created_at = now()`,
-      [userId, pin, token, expiresAt]
+      [userId, hashSecret(pin), hashSecret(token), expiresAt]
     );
   }
   async findLastSentAt(userId) {
@@ -1221,7 +1230,7 @@ var PasswordResetModel = class {
   async findByPin(pin) {
     const [row] = await this.store.query(
       `SELECT user_id, expires_at FROM fonderie_password_resets WHERE pin = $1`,
-      [pin]
+      [hashSecret(pin)]
     );
     if (!row) return null;
     return { userId: row.user_id, expiresAt: new Date(row.expires_at) };
@@ -1234,7 +1243,7 @@ var PasswordResetModel = class {
     if (typeof token !== "string" || token.length < 32) return null;
     const [row] = await this.store.query(
       `SELECT user_id, expires_at FROM fonderie_password_resets WHERE token = $1`,
-      [token]
+      [hashSecret(token)]
     );
     if (!row) return null;
     return { userId: row.user_id, expiresAt: new Date(row.expires_at) };
@@ -1387,7 +1396,7 @@ function authController(store, config, bus) {
         if (!row) {
           return (0, import_core5.setApiResponse)(import_core5.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
         }
-        const pin = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
+        const pin = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
         await emailVerif.create(row.id, pin, expiresAt);
         const user = await users.findById(row.id);
@@ -1451,7 +1460,7 @@ function authController(store, config, bus) {
           firstName ?? null,
           lastName ?? null
         );
-        const otp = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
+        const otp = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(id, normalizePhone(phone2), otp, expiresAt);
         const user = await users.findById(id);
@@ -1597,7 +1606,7 @@ function authController(store, config, bus) {
             "Account suspended. Please contact support."
           );
         }
-        const otp = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
+        const otp = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(user.id, normalizePhone(phone2), otp, expiresAt);
         bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1707,8 +1716,8 @@ function authController(store, config, bus) {
           "Password reset email sent (if account exists)."
         );
       }
-      const pin = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
-      const token = (0, import_node_crypto4.randomBytes)(32).toString("hex");
+      const pin = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
+      const token = (0, import_node_crypto5.randomBytes)(32).toString("hex");
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60);
       await passwordReset.create(user.id, pin, token, expiresAt);
       const base = resolved.passwordResetUrl;
@@ -1891,7 +1900,7 @@ function authController(store, config, bus) {
             }
           );
         }
-        const otp = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
+        const otp = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
         const expiresAt2 = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(ctx.user.id, phone2, otp, expiresAt2);
         bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1931,7 +1940,7 @@ function authController(store, config, bus) {
           }
         );
       }
-      const pin = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
+      const pin = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1949,7 +1958,7 @@ function authController(store, config, bus) {
 }
 
 // src/controllers/user.controller.ts
-var import_node_crypto5 = require("crypto");
+var import_node_crypto6 = require("crypto");
 var import_core7 = require("@fonderie/core");
 var import_events3 = require("@fonderie/events");
 
@@ -2139,7 +2148,7 @@ function userController(store, config, bus) {
       if (existing) {
         return (0, import_core7.setApiResponse)(import_core7.HTTP.CONFLICT, "EMAIL_IN_USE", "Email already in use");
       }
-      const pin = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
+      const pin = (0, import_node_crypto6.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       await users.updateEmail(ctx.user.id, normalised);
@@ -2183,7 +2192,7 @@ function userController(store, config, bus) {
       if (existing) {
         return (0, import_core7.setApiResponse)(import_core7.HTTP.CONFLICT, "PHONE_IN_USE", "Phone number already in use");
       }
-      const otp = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
+      const otp = (0, import_node_crypto6.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 10 * 60 * 1e3);
       await phoneVerif.upsert(ctx.user.id, normalised, otp, expiresAt);
       await users.updatePhone(ctx.user.id, normalised);
@@ -2292,12 +2301,125 @@ function userController(store, config, bus) {
 }
 
 // src/controllers/oauth.controller.ts
-var import_node_crypto6 = require("crypto");
+var import_node_crypto7 = require("crypto");
+var import_jsonwebtoken2 = __toESM(require("jsonwebtoken"), 1);
 var import_core8 = require("@fonderie/core");
+var APPLE_AUTH_URL = "https://appleid.apple.com/auth/authorize";
+var APPLE_TOKEN_URL = "https://appleid.apple.com/auth/token";
+var APPLE_KEYS_URL = "https://appleid.apple.com/auth/keys";
+var APPLE_ISSUER = "https://appleid.apple.com";
+function mintAppleClientSecret(apple) {
+  const now = Math.floor(Date.now() / 1e3);
+  return import_jsonwebtoken2.default.sign(
+    { iss: apple.teamId, iat: now, exp: now + 300, aud: APPLE_ISSUER, sub: apple.clientId },
+    apple.privateKey,
+    { algorithm: "ES256", keyid: apple.keyId }
+  );
+}
+var appleKeyCache = null;
+var APPLE_KEYS_TTL_MS = 60 * 60 * 1e3;
+async function getApplePublicKey(kid) {
+  const fresh = appleKeyCache && Date.now() - appleKeyCache.fetchedAt < APPLE_KEYS_TTL_MS;
+  if (!fresh || !appleKeyCache.keys.some((k) => k.kid === kid)) {
+    try {
+      const res = await fetch(APPLE_KEYS_URL);
+      const data = await res.json();
+      if (Array.isArray(data.keys)) appleKeyCache = { keys: data.keys, fetchedAt: Date.now() };
+    } catch {
+    }
+  }
+  const jwk = appleKeyCache?.keys.find((k) => k.kid === kid);
+  if (!jwk) return null;
+  try {
+    return (0, import_node_crypto7.createPublicKey)({ key: jwk, format: "jwk" });
+  } catch {
+    return null;
+  }
+}
+async function verifyAppleIdToken(idToken, opts) {
+  if (opts.audiences.length === 0) return null;
+  const decoded = import_jsonwebtoken2.default.decode(idToken, { complete: true });
+  if (!decoded || typeof decoded === "string") return null;
+  const kid = decoded.header.kid;
+  if (!kid) return null;
+  const key = await getApplePublicKey(kid);
+  if (!key) return null;
+  try {
+    const payload = import_jsonwebtoken2.default.verify(idToken, key, {
+      algorithms: ["RS256"],
+      issuer: APPLE_ISSUER,
+      // jsonwebtoken types `audience` as a non-empty tuple; runtime accepts a
+      // list and matches the token's aud against ANY entry (guarded non-empty
+      // above).
+      audience: opts.audiences
+    });
+    if (opts.nonce !== void 0 && payload.nonce !== opts.nonce) return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+var appleEmailVerified = (c) => c.email_verified === true || c.email_verified === "true";
 function oauthController(store, config) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
   const loginEvents = new LoginEventModel(store);
+  const completeAppleLogin = async (ctx, claims) => {
+    const meta = requestMeta(ctx);
+    if (!claims.email) {
+      return (0, import_core8.setApiResponse)(import_core8.HTTP.BAD_REQUEST, "APPLE_AUTH_FAILED", "No email in Apple identity token");
+    }
+    if (!claims.emailVerified) {
+      return (0, import_core8.setApiResponse)(import_core8.HTTP.BAD_REQUEST, "APPLE_AUTH_FAILED", "Apple account email is not verified");
+    }
+    const normalizedEmail = normalizeEmailSafe(claims.email);
+    if (!normalizedEmail) {
+      return (0, import_core8.setApiResponse)(import_core8.HTTP.BAD_REQUEST, "APPLE_AUTH_FAILED", "Invalid email in Apple identity token");
+    }
+    const upserted = await users.upsertByProvider(normalizedEmail, "apple", claims.sub ?? "");
+    if (!upserted) {
+      loginEvents.recordSafe({
+        userId: null,
+        emailAttempted: normalizedEmail,
+        method: "oauth-apple",
+        outcome: "failed",
+        failureReason: "provider_upsert_failed",
+        ...meta
+      });
+      return (0, import_core8.setApiResponse)(import_core8.HTTP.SERVER_ERROR, "SERVER_ERROR", "Apple login failed");
+    }
+    const fullUser = await users.findById(upserted.id);
+    if (!fullUser) {
+      return (0, import_core8.setApiResponse)(import_core8.HTTP.SERVER_ERROR, "SERVER_ERROR", "Apple login failed");
+    }
+    const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, { loginMethod: "apple" });
+    await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
+    loginEvents.recordSafe({
+      userId: upserted.id,
+      emailAttempted: normalizedEmail,
+      method: "oauth-apple",
+      outcome: "success",
+      ...meta
+    });
+    return Response.json(
+      {
+        reason: "APPLE_AUTH_SUCCESS",
+        explanation: "Apple authentication successful.",
+        result: {
+          tokens: { access: accessToken, refresh: refreshToken },
+          user: toUserDTO(fullUser)
+        }
+      },
+      {
+        status: 200,
+        headers: cookieHeaders([
+          ...tokenPairCookies(accessToken, refreshToken, config),
+          // One-time value — clear the (SameSite=None) state cookie.
+          "oauth_state=; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=0"
+        ])
+      }
+    );
+  };
   return {
     googleInit: async (_ctx) => {
       const google = config.google;
@@ -2308,7 +2430,7 @@ function oauthController(store, config) {
           "Google OAuth not configured"
         );
       }
-      const state = (0, import_node_crypto6.randomBytes)(16).toString("hex");
+      const state = (0, import_node_crypto7.randomBytes)(16).toString("hex");
       const params = new URLSearchParams({
         client_id: google.clientId,
         redirect_uri: google.redirectUri,
@@ -2449,6 +2571,113 @@ function oauthController(store, config) {
           ])
         }
       );
+    },
+    appleInit: async (_ctx) => {
+      const apple = config.apple;
+      if (!apple) {
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
+      }
+      const state = (0, import_node_crypto7.randomBytes)(16).toString("hex");
+      const params = new URLSearchParams({
+        client_id: apple.clientId,
+        redirect_uri: apple.redirectUri,
+        response_type: "code",
+        // form_post is REQUIRED to receive name/email; Apple then POSTs the
+        // callback cross-site.
+        response_mode: "form_post",
+        scope: "name email",
+        state
+      });
+      const url = `${APPLE_AUTH_URL}?${params}`;
+      return Response.json(
+        {
+          reason: "APPLE_AUTH_URL",
+          explanation: "Redirect the user to the returned URL to begin Apple OAuth.",
+          result: { url }
+        },
+        {
+          status: 200,
+          headers: cookieHeaders([
+            `oauth_state=${state}; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=600`
+          ])
+        }
+      );
+    },
+    appleCallback: async (ctx) => {
+      const apple = config.apple;
+      if (!apple) {
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
+      }
+      const pre = ctx.meta["body"];
+      const form = pre && typeof pre === "object" ? new URLSearchParams(pre) : new URLSearchParams(await ctx.request.text());
+      const code = form.get("code");
+      if (!code) {
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
+      }
+      const returnedState = form.get("state") ?? "";
+      const cookieHeader = ctx.request.headers.get("cookie") ?? "";
+      const expectedState = cookieHeader.match(/(?:^|;\s*)oauth_state=([^;]+)/)?.[1] ?? "";
+      if (!returnedState || !expectedState || !(0, import_core8.constantTimeEqual)(Buffer.from(returnedState), Buffer.from(expectedState))) {
+        return (0, import_core8.setApiResponse)(
+          import_core8.HTTP.BAD_REQUEST,
+          "APPLE_AUTH_FAILED",
+          "OAuth state mismatch \u2014 restart the sign-in flow"
+        );
+      }
+      const tokenRes = await fetch(APPLE_TOKEN_URL, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          code,
+          client_id: apple.clientId,
+          client_secret: mintAppleClientSecret(apple),
+          redirect_uri: apple.redirectUri,
+          grant_type: "authorization_code"
+        })
+      });
+      const tokenData = await tokenRes.json();
+      if (!tokenData.id_token) {
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.BAD_REQUEST, "APPLE_AUTH_FAILED", "OAuth token exchange failed");
+      }
+      const claims = await verifyAppleIdToken(tokenData.id_token, { audiences: [apple.clientId] });
+      if (!claims) {
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.BAD_REQUEST, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
+      }
+      return completeAppleLogin(ctx, {
+        email: claims.email,
+        sub: claims.sub,
+        emailVerified: appleEmailVerified(claims)
+      });
+    },
+    appleNative: async (ctx) => {
+      const apple = config.apple;
+      if (!apple) {
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
+      }
+      const body = ctx.meta["body"];
+      const identityToken = body?.identityToken;
+      if (!identityToken) {
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing identityToken");
+      }
+      const audiences = apple.nativeClientIds && apple.nativeClientIds.length ? apple.nativeClientIds : [apple.clientId];
+      const claims = await verifyAppleIdToken(identityToken, { audiences, nonce: body?.nonce });
+      if (!claims) {
+        const meta = requestMeta(ctx);
+        loginEvents.recordSafe({
+          userId: null,
+          emailAttempted: null,
+          method: "oauth-apple",
+          outcome: "failed",
+          failureReason: "invalid_identity_token",
+          ...meta
+        });
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.UNAUTHORIZED, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
+      }
+      return completeAppleLogin(ctx, {
+        email: claims.email,
+        sub: claims.sub,
+        emailVerified: appleEmailVerified(claims)
+      });
     }
   };
 }
@@ -2518,6 +2747,17 @@ function buildAuthRoutes(store, config, bus) {
       ["GET", "/auth/google/callback", oauth.googleCallback]
     );
   }
+  if (config.providers.includes("apple")) {
+    routes.push(
+      // Web redirect flow. The callback is a POST (response_mode=form_post);
+      // its urlencoded body is parsed inside the controller.
+      ["GET", "/auth/apple", oauth.appleInit],
+      ["POST", "/auth/apple/callback", oauth.appleCallback],
+      // Native (iOS) flow: the app posts the identityToken from the Apple
+      // sheet. ipLimit guards token brute-forcing; validate bounds the body.
+      ["POST", "/auth/apple/native", ipLimit("login"), (0, import_middlewares.validate)(appleNativeSchema), oauth.appleNative]
+    );
+  }
   return routes;
 }
 
@@ -2564,6 +2804,22 @@ function collectAuthConfigProblems(config) {
       });
     }
   }
+  if (config.apple) {
+    const a = config.apple;
+    if (!a.clientId || !a.teamId || !a.keyId || !a.privateKey || !a.redirectUri) {
+      problems.push({
+        module: MODULE,
+        severity: "error",
+        message: "apple OAuth is configured but clientId, teamId, keyId, privateKey, or redirectUri is missing"
+      });
+    } else if (!/-----BEGIN [A-Z ]*PRIVATE KEY-----/.test(a.privateKey)) {
+      problems.push({
+        module: MODULE,
+        severity: "error",
+        message: "apple.privateKey does not look like a PEM .p8 key (expected `-----BEGIN PRIVATE KEY-----`)"
+      });
+    }
+  }
   if (config.mfa && !config.mfaSecretKey) {
     problems.push({
       module: MODULE,