@fonderie/auth 7.13.0 → 7.14.0

package/dist/index.js

@@ -3212,20 +3212,27 @@ function collectAuthConfigProblems(config) {
     problems.push({
       module: MODULE,
       severity: "error",
-      message: `jwtSecret must be at least ${MIN_SECRET_LENGTH} characters (got ${secret.length})`
+      message: `jwtSecret must be at least ${MIN_SECRET_LENGTH} characters (got ${secret.length})`,
+      domain: "auth",
+      reason: "JWT_SECRET_TOO_SHORT",
+      metadata: { min: MIN_SECRET_LENGTH, got: secret.length }
     });
   } else if (secretProblem === "placeholder") {
     problems.push({
       module: MODULE,
       severity: "error",
-      message: "jwtSecret looks like a placeholder or dev-default value"
+      message: "jwtSecret looks like a placeholder or dev-default value",
+      domain: "auth",
+      reason: "JWT_SECRET_PLACEHOLDER"
     });
   }
   if (config.secureCookies === false) {
     problems.push({
       module: MODULE,
       severity: process.env["NODE_ENV"] === "production" ? "error" : "warning",
-      message: "secureCookies is false \u2014 auth cookies may be sent over non-HTTPS connections in production"
+      message: "secureCookies is false \u2014 auth cookies may be sent over non-HTTPS connections in production",
+      domain: "auth",
+      reason: "INSECURE_COOKIES"
     });
   }
   if (config.google) {
@@ -3234,13 +3241,17 @@ function collectAuthConfigProblems(config) {
       problems.push({
         module: MODULE,
         severity: "error",
-        message: "google OAuth is configured but clientId, clientSecret, or redirectUri is missing"
+        message: "google OAuth is configured but clientId, clientSecret, or redirectUri is missing",
+        domain: "auth",
+        reason: "GOOGLE_INCOMPLETE"
       });
     } else if (PLACEHOLDER_SECRET.test(clientSecret)) {
       problems.push({
         module: MODULE,
         severity: "error",
-        message: "google.clientSecret looks like a placeholder or dev-default value"
+        message: "google.clientSecret looks like a placeholder or dev-default value",
+        domain: "auth",
+        reason: "GOOGLE_SECRET_PLACEHOLDER"
       });
     }
   }
@@ -3250,20 +3261,26 @@ function collectAuthConfigProblems(config) {
       problems.push({
         module: MODULE,
         severity: "error",
-        message: "apple OAuth is configured but clientId, teamId, keyId, privateKey, or redirectUri is missing"
+        message: "apple OAuth is configured but clientId, teamId, keyId, privateKey, or redirectUri is missing",
+        domain: "auth",
+        reason: "APPLE_INCOMPLETE"
       });
     } else if (!/-----BEGIN [A-Z ]*PRIVATE KEY-----/.test(a.privateKey)) {
       problems.push({
         module: MODULE,
         severity: "error",
-        message: "apple.privateKey does not look like a PEM .p8 key (expected `-----BEGIN PRIVATE KEY-----`)"
+        message: "apple.privateKey does not look like a PEM .p8 key (expected `-----BEGIN PRIVATE KEY-----`)",
+        domain: "auth",
+        reason: "APPLE_KEY_NOT_PEM"
       });
     }
     if (a.nativeClientIds?.some((id) => !id || id.trim() === "" || id.includes("*"))) {
       problems.push({
         module: MODULE,
         severity: "error",
-        message: "apple.nativeClientIds must be exact bundle ids \u2014 empty or wildcard entries would accept identity tokens minted for other apps"
+        message: "apple.nativeClientIds must be exact bundle ids \u2014 empty or wildcard entries would accept identity tokens minted for other apps",
+        domain: "auth",
+        reason: "APPLE_NATIVE_IDS_INVALID"
       });
     }
   }
@@ -3271,14 +3288,18 @@ function collectAuthConfigProblems(config) {
     problems.push({
       module: MODULE,
       severity: process.env["NODE_ENV"] === "production" ? "error" : "warning",
-      message: "mfa is enabled without mfaSecretKey \u2014 TOTP secrets are stored plaintext at rest; set a 32-byte key (openssl rand -hex 32)"
+      message: "mfa is enabled without mfaSecretKey \u2014 TOTP secrets are stored plaintext at rest; set a 32-byte key (openssl rand -hex 32)",
+      domain: "auth",
+      reason: "MFA_KEY_MISSING"
     });
   }
   if (config.mfaSecretKey && !/^[0-9a-fA-F]{64}$/.test(config.mfaSecretKey)) {
     problems.push({
       module: MODULE,
       severity: "error",
-      message: "mfaSecretKey must be 64 hex characters (32 bytes, e.g. `openssl rand -hex 32`)"
+      message: "mfaSecretKey must be 64 hex characters (32 bytes, e.g. `openssl rand -hex 32`)",
+      domain: "auth",
+      reason: "MFA_KEY_INVALID"
     });
   }
   return problems;
@@ -3490,7 +3511,7 @@ var AuthModule = class {
   name = "@fonderie/auth";
   // Baked in at build time by tsup.base, so the operator's Modules page can
   // say what is actually deployed rather than 'not reported'.
-  version = "7.13.0";
+  version = "7.14.0";
   // Users, sessions, login history, suspend — only through @fonderie/admin.
   describeAdmin() {
     return { routes: describeAuthAdminRoutes(this.store) };