@fonderie/auth 7.14.4 → 7.15.0

package/dist/index.d.cts

@@ -3,8 +3,8 @@ export { IMfaChallenge, ISession } from './types.cjs';
 import { IFonderieModule, IAdminDescription, IReadinessProblem, IFonderieApp, IDefaultTemplate, IAdminRoute } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig, a as IRequestLocation } from './session-BBF5t-3Y.cjs';
-export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, d as IAuthRateLimitConfig, e as IAuthRuntimeConfig, f as IAuthSecrets, g as IDataExportContributor, h as ILocationRequest, L as LocationResolver, M as MESSAGE_KEYS, i as buildAuthAccountLimiter, j as buildAuthIpLimiter, r as resolveLocation, s as sanitizeLocation, w as withSession } from './session-BBF5t-3Y.cjs';
+import { I as IAuthConfig, a as IRequestLocation } from './session-auNb2L8m.cjs';
+export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, d as IAuthRateLimitConfig, e as IAuthRuntimeConfig, f as IAuthSecrets, g as IDataExportContributor, h as ILocationRequest, L as LocationResolver, M as MESSAGE_KEYS, i as buildAuthAccountLimiter, j as buildAuthIpLimiter, r as resolveLocation, s as sanitizeLocation, w as withSession } from './session-auNb2L8m.cjs';
 import { IUserDTO } from './dtos/user.cjs';
 export { toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';

package/dist/index.d.ts

@@ -3,8 +3,8 @@ export { IMfaChallenge, ISession } from './types.js';
 import { IFonderieModule, IAdminDescription, IReadinessProblem, IFonderieApp, IDefaultTemplate, IAdminRoute } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig, a as IRequestLocation } from './session-BBF5t-3Y.js';
-export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, d as IAuthRateLimitConfig, e as IAuthRuntimeConfig, f as IAuthSecrets, g as IDataExportContributor, h as ILocationRequest, L as LocationResolver, M as MESSAGE_KEYS, i as buildAuthAccountLimiter, j as buildAuthIpLimiter, r as resolveLocation, s as sanitizeLocation, w as withSession } from './session-BBF5t-3Y.js';
+import { I as IAuthConfig, a as IRequestLocation } from './session-auNb2L8m.js';
+export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, d as IAuthRateLimitConfig, e as IAuthRuntimeConfig, f as IAuthSecrets, g as IDataExportContributor, h as ILocationRequest, L as LocationResolver, M as MESSAGE_KEYS, i as buildAuthAccountLimiter, j as buildAuthIpLimiter, r as resolveLocation, s as sanitizeLocation, w as withSession } from './session-auNb2L8m.js';
 import { IUserDTO } from './dtos/user.js';
 export { toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';

package/dist/index.js

@@ -284,8 +284,14 @@ var EVENT_KEYS = {
 };
 
 // src/services/jwt.ts
-import { randomUUID } from "crypto";
+import { createHash, randomUUID } from "crypto";
 import jwt from "jsonwebtoken";
+function keyIdOf(secret) {
+  return createHash("sha256").update(secret).digest("hex").slice(0, 16);
+}
+function keyRing(config) {
+  return [config.jwtSecret, ...config.jwtPreviousSecrets ?? []].filter((s) => typeof s === "string" && s.length > 0);
+}
 function issueMfaPendingToken(userId, config, loginMethod) {
   return jwt.sign(
     {
@@ -296,7 +302,7 @@ function issueMfaPendingToken(userId, config, loginMethod) {
       mfaPending: true
     },
     config.jwtSecret,
-    { expiresIn: "5m" }
+    { expiresIn: "5m", keyid: keyIdOf(config.jwtSecret) }
   );
 }
 function issueTokenPair(userId, config, options) {
@@ -308,12 +314,12 @@ function issueTokenPair(userId, config, options) {
   const accessToken = jwt.sign(
     { sub: userId, type: "access", loginMethod, phoneVerified, sid },
     config.jwtSecret,
-    { expiresIn: accessDuration }
+    { expiresIn: accessDuration, keyid: keyIdOf(config.jwtSecret) }
   );
   const refreshToken = jwt.sign(
     { sub: userId, type: "refresh", loginMethod, phoneVerified, sid },
     config.jwtSecret,
-    { expiresIn: duration }
+    { expiresIn: duration, keyid: keyIdOf(config.jwtSecret) }
   );
   return { accessToken, refreshToken, sid };
 }
@@ -322,11 +328,16 @@ function refreshTokenExpiry(token) {
   return decoded?.exp ? new Date(decoded.exp * 1e3) : new Date(Date.now() + 7 * 24 * 60 * 60 * 1e3);
 }
 function verifyToken(token, config) {
-  try {
-    return jwt.verify(token, config.jwtSecret);
-  } catch {
-    return null;
+  const ring = keyRing(config);
+  const kid = jwt.decode(token, { complete: true })?.header?.kid;
+  const candidates = typeof kid === "string" ? ring.filter((s) => keyIdOf(s) === kid) : ring;
+  for (const secret of candidates) {
+    try {
+      return jwt.verify(token, secret);
+    } catch {
+    }
   }
+  return null;
 }
 
 // src/services/mfa.ts
@@ -1421,8 +1432,8 @@ function normalizeEmailSafe(email2) {
 }
 
 // src/models/password-reset.model.ts
-import { createHash } from "crypto";
-var hashSecret = (value) => createHash("sha256").update(value).digest("hex");
+import { createHash as createHash2 } from "crypto";
+var hashSecret = (value) => createHash2("sha256").update(value).digest("hex");
 var PasswordResetModel = class {
   constructor(store) {
     this.store = store;
@@ -2589,7 +2600,7 @@ function userController(store, config, bus) {
 }
 
 // src/controllers/oauth.controller.ts
-import { randomBytes as randomBytes4, createPublicKey, createHash as createHash2 } from "crypto";
+import { randomBytes as randomBytes4, createPublicKey, createHash as createHash3 } from "crypto";
 import jwt2 from "jsonwebtoken";
 import { setApiResponse as setApiResponse5, HTTP as HTTP5, constantTimeEqual as constantTimeEqual2, background as background5 } from "@fonderie/core";
 import { NOTIFICATION_EVENT as NOTIFICATION_EVENT4 } from "@fonderie/events";
@@ -3066,7 +3077,7 @@ function oauthController(store, config, bus) {
         });
         return setApiResponse5(HTTP5.UNAUTHORIZED, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
       }
-      const tokenHash = createHash2("sha256").update(identityToken).digest("hex");
+      const tokenHash = createHash3("sha256").update(identityToken).digest("hex");
       const expMs = typeof claims.exp === "number" ? claims.exp * 1e3 : Date.now() + 5 * 60 * 1e3;
       const firstUse = await consumedTokens.consumeOnce(tokenHash, new Date(expMs));
       if (!firstUse) {
@@ -3226,6 +3237,18 @@ function collectAuthConfigProblems(config) {
       reason: "JWT_SECRET_PLACEHOLDER"
     });
   }
+  (config.jwtPreviousSecrets ?? []).forEach((previous, index) => {
+    if (secretStrengthProblem(previous ?? "")) {
+      problems.push({
+        module: MODULE,
+        severity: "error",
+        message: `jwtPreviousSecrets[${index}] is too short or a placeholder \u2014 it still verifies tokens`,
+        domain: "auth",
+        reason: "JWT_PREVIOUS_SECRET_WEAK",
+        metadata: { index }
+      });
+    }
+  });
   if (config.secureCookies === false) {
     problems.push({
       module: MODULE,
@@ -3511,7 +3534,7 @@ var AuthModule = class {
   name = "@fonderie/auth";
   // Baked in at build time by tsup.base, so the operator's Modules page can
   // say what is actually deployed rather than 'not reported'.
-  version = "7.14.4";
+  version = "7.15.0";
   // Users, sessions, login history, suspend — only through @fonderie/admin.
   describeAdmin() {
     return { routes: describeAuthAdminRoutes(this.store) };