@fonderie/auth 7.16.0 → 7.17.1

package/dist/index.d.cts

@@ -3,8 +3,8 @@ export { IMfaChallenge, ISession } from './types.cjs';
 import { IFonderieModule, IAdminDescription, IReadinessProblem, IFonderieApp, IDefaultTemplate, IAdminRoute } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig, a as IRequestLocation } from './session-auNb2L8m.cjs';
-export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, d as IAuthRateLimitConfig, e as IAuthRuntimeConfig, f as IAuthSecrets, g as IDataExportContributor, h as ILocationRequest, L as LocationResolver, M as MESSAGE_KEYS, i as buildAuthAccountLimiter, j as buildAuthIpLimiter, r as resolveLocation, s as sanitizeLocation, w as withSession } from './session-auNb2L8m.cjs';
+import { I as IAuthConfig, a as IRequestLocation } from './session-C-ptRylj.cjs';
+export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, d as IAuthRateLimitConfig, e as IAuthRuntimeConfig, f as IAuthSecrets, g as IDataExportContributor, h as ILocationRequest, L as LocationResolver, M as MESSAGE_KEYS, i as buildAuthAccountLimiter, j as buildAuthIpLimiter, r as resolveLocation, s as sanitizeLocation, w as withSession } from './session-C-ptRylj.cjs';
 import { IUserDTO } from './dtos/user.cjs';
 export { toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';

package/dist/index.d.ts

@@ -3,8 +3,8 @@ export { IMfaChallenge, ISession } from './types.js';
 import { IFonderieModule, IAdminDescription, IReadinessProblem, IFonderieApp, IDefaultTemplate, IAdminRoute } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig, a as IRequestLocation } from './session-auNb2L8m.js';
-export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, d as IAuthRateLimitConfig, e as IAuthRuntimeConfig, f as IAuthSecrets, g as IDataExportContributor, h as ILocationRequest, L as LocationResolver, M as MESSAGE_KEYS, i as buildAuthAccountLimiter, j as buildAuthIpLimiter, r as resolveLocation, s as sanitizeLocation, w as withSession } from './session-auNb2L8m.js';
+import { I as IAuthConfig, a as IRequestLocation } from './session-C-ptRylj.js';
+export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, d as IAuthRateLimitConfig, e as IAuthRuntimeConfig, f as IAuthSecrets, g as IDataExportContributor, h as ILocationRequest, L as LocationResolver, M as MESSAGE_KEYS, i as buildAuthAccountLimiter, j as buildAuthIpLimiter, r as resolveLocation, s as sanitizeLocation, w as withSession } from './session-C-ptRylj.js';
 import { IUserDTO } from './dtos/user.js';
 export { toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';

package/dist/index.js

@@ -243,8 +243,11 @@ import { NOTIFICATION_EVENT } from "@fonderie/events";
 
 // src/config.ts
 var DEFAULT_VERIFICATION_COOLDOWN = 5 * 60 * 1e3;
+var DEFAULT_SESSION_DURATION = "90d";
+var DEFAULT_ACCESS_TOKEN_DURATION = "1h";
 var AUTH_CONFIG_KEYS = {
   sessionDuration: "auth.session.duration",
+  sessionMaxAge: "auth.session.max_age",
   verificationCooldown: "auth.verification.cooldown",
   mfa: "auth.mfa.enabled",
   requireVerification: "auth.verification.required"
@@ -309,13 +312,14 @@ function issueMfaPendingToken(userId, config, loginMethod) {
   );
 }
 function issueTokenPair(userId, config, options) {
-  const duration = config.sessionDuration ?? "7d";
-  const accessDuration = config.accessTokenDuration ?? "24h";
+  const duration = validDuration(config.sessionDuration, DEFAULT_SESSION_DURATION, "sessionDuration");
+  const accessDuration = validDuration(config.accessTokenDuration, DEFAULT_ACCESS_TOKEN_DURATION, "accessTokenDuration");
+  const authTime = options.authTime ?? Math.floor(Date.now() / 1e3);
   const loginMethod = options.loginMethod;
   const phoneVerified = options.phoneVerified ?? false;
   const sid = options.sid ?? randomUUID();
   const accessToken = jwt.sign(
-    { sub: userId, type: "access", loginMethod, phoneVerified, sid },
+    { sub: userId, type: "access", loginMethod, phoneVerified, sid, auth_time: authTime },
     config.jwtSecret,
     // jwtid: every token is unique. With the session id kept across rotations,
     // two tokens issued in the same second would otherwise be byte-identical —
@@ -323,7 +327,7 @@ function issueTokenPair(userId, config, options) {
     { expiresIn: accessDuration, keyid: keyIdOf(config.jwtSecret), jwtid: randomUUID() }
   );
   const refreshToken = jwt.sign(
-    { sub: userId, type: "refresh", loginMethod, phoneVerified, sid },
+    { sub: userId, type: "refresh", loginMethod, phoneVerified, sid, auth_time: authTime },
     config.jwtSecret,
     { expiresIn: duration, keyid: keyIdOf(config.jwtSecret), jwtid: randomUUID() }
   );
@@ -345,6 +349,24 @@ function verifyToken(token, config) {
   }
   return null;
 }
+function durationMs(value) {
+  const m = /^\s*(\d+)\s*(ms|s|m|h|d|w|y)?\s*$/i.exec(value ?? "");
+  if (!m) return null;
+  const unit = (m[2] ?? "s").toLowerCase();
+  const scale = { ms: 1, s: 1e3, m: 6e4, h: 36e5, d: 864e5, w: 6048e5, y: 315576e5 };
+  return Number(m[1]) * (scale[unit] ?? 1e3);
+}
+var warnedDurations = /* @__PURE__ */ new Set();
+function validDuration(value, fallback, name) {
+  if (value === void 0 || value === null || value === "") return fallback;
+  if (durationMs(String(value)) !== null) return String(value);
+  const key = `${name}=${String(value)}`;
+  if (!warnedDurations.has(key)) {
+    warnedDurations.add(key);
+    console.warn(`[auth] ${name} ${JSON.stringify(value)} is not a duration (e.g. '90d', '1h') \u2014 using ${fallback}`);
+  }
+  return fallback;
+}
 
 // src/services/mfa.ts
 import { createHmac, randomBytes } from "crypto";
@@ -994,12 +1016,12 @@ var SessionModel = class {
   async match(token) {
     const hash = hashRefreshToken(token);
     const [current] = await this.store.query(
-      `SELECT id, user_id, sid, token FROM fonderie_sessions WHERE token IN ($1, $2) AND expires_at > now() LIMIT 1`,
+      `SELECT id, user_id, sid, token, created_at FROM fonderie_sessions WHERE token IN ($1, $2) AND expires_at > now() LIMIT 1`,
       [hash, token]
     );
     if (current) return { kind: "current", row: toRow(current) };
     const [previous] = await this.store.query(
-      `SELECT id, user_id, sid, token, (previous_valid_until > now()) AS in_grace
+      `SELECT id, user_id, sid, token, created_at, (previous_valid_until > now()) AS in_grace
 			   FROM fonderie_sessions WHERE previous_token_hash = $1 AND expires_at > now() LIMIT 1`,
       [hash]
     );
@@ -1114,7 +1136,7 @@ var SessionModel = class {
   }
 };
 function toRow(r) {
-  return { id: r.id, userId: r.user_id, sid: r.sid, stored: r.token };
+  return { id: r.id, userId: r.user_id, sid: r.sid, stored: r.token, createdAt: r.created_at ? new Date(r.created_at) : /* @__PURE__ */ new Date() };
 }
 
 // src/models/backup-code.model.ts
@@ -1958,6 +1980,8 @@ function authController(store, config, bus, locales = defineLocales()) {
       if (!payload || payload.type !== "refresh") {
         return setApiResponse3(HTTP3.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Invalid refresh token");
       }
+      const resolvedRefresh = { ...config, ...config.resolve?.(ctx) };
+      const maxAgeMs = resolvedRefresh.sessionMaxAge ? durationMs(String(resolvedRefresh.sessionMaxAge)) : null;
       let issued = null;
       for (let attempt = 0; attempt < 3 && !issued; attempt++) {
         const found = await sessions.match(token);
@@ -1971,14 +1995,20 @@ function authController(store, config, bus, locales = defineLocales()) {
           );
           return setApiResponse3(HTTP3.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
         }
+        if (maxAgeMs !== null && Date.now() - found.row.createdAt.getTime() > maxAgeMs) {
+          await sessions.revokeById(found.row.id);
+          return setApiResponse3(HTTP3.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session reached its maximum age \u2014 sign in again");
+        }
         const user = await users.findById(found.row.userId);
         if (!user || user.suspended || user.deletedAt || user.id !== payload.sub) {
           return setApiResponse3(HTTP3.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
         }
-        const pair = issueTokenPair(user.id, config, {
+        const pair = issueTokenPair(user.id, resolvedRefresh, {
           loginMethod: payload.loginMethod ?? "email",
           phoneVerified: payload.phoneVerified ?? false,
-          ...found.row.sid ? { sid: found.row.sid } : {}
+          ...found.row.sid ? { sid: found.row.sid } : {},
+          // A refresh is not a sign-in: keep when the user last signed in.
+          ...typeof payload.auth_time === "number" ? { authTime: payload.auth_time } : {}
         });
         const next = { token: pair.refreshToken, expiresAt: refreshTokenExpiry(pair.refreshToken) };
         if (await sessions.rotate(found.row, token, next, found.kind)) issued = pair;
@@ -3610,7 +3640,7 @@ var AuthModule = class {
   name = "@fonderie/auth";
   // Baked in at build time by tsup.base, so the operator's Modules page can
   // say what is actually deployed rather than 'not reported'.
-  version = "7.16.0";
+  version = "7.17.1";
   // Users, sessions, login history, suspend — only through @fonderie/admin.
   describeAdmin() {
     return { routes: describeAuthAdminRoutes(this.store) };