@fonderie/auth 7.17.0 → 7.17.1

package/dist/index.js

@@ -312,8 +312,8 @@ function issueMfaPendingToken(userId, config, loginMethod) {
   );
 }
 function issueTokenPair(userId, config, options) {
-  const duration = config.sessionDuration ?? DEFAULT_SESSION_DURATION;
-  const accessDuration = config.accessTokenDuration ?? DEFAULT_ACCESS_TOKEN_DURATION;
+  const duration = validDuration(config.sessionDuration, DEFAULT_SESSION_DURATION, "sessionDuration");
+  const accessDuration = validDuration(config.accessTokenDuration, DEFAULT_ACCESS_TOKEN_DURATION, "accessTokenDuration");
   const authTime = options.authTime ?? Math.floor(Date.now() / 1e3);
   const loginMethod = options.loginMethod;
   const phoneVerified = options.phoneVerified ?? false;
@@ -356,6 +356,17 @@ function durationMs(value) {
   const scale = { ms: 1, s: 1e3, m: 6e4, h: 36e5, d: 864e5, w: 6048e5, y: 315576e5 };
   return Number(m[1]) * (scale[unit] ?? 1e3);
 }
+var warnedDurations = /* @__PURE__ */ new Set();
+function validDuration(value, fallback, name) {
+  if (value === void 0 || value === null || value === "") return fallback;
+  if (durationMs(String(value)) !== null) return String(value);
+  const key = `${name}=${String(value)}`;
+  if (!warnedDurations.has(key)) {
+    warnedDurations.add(key);
+    console.warn(`[auth] ${name} ${JSON.stringify(value)} is not a duration (e.g. '90d', '1h') \u2014 using ${fallback}`);
+  }
+  return fallback;
+}
 
 // src/services/mfa.ts
 import { createHmac, randomBytes } from "crypto";
@@ -1970,7 +1981,7 @@ function authController(store, config, bus, locales = defineLocales()) {
         return setApiResponse3(HTTP3.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Invalid refresh token");
       }
       const resolvedRefresh = { ...config, ...config.resolve?.(ctx) };
-      const maxAgeMs = durationMs(resolvedRefresh.sessionMaxAge);
+      const maxAgeMs = resolvedRefresh.sessionMaxAge ? durationMs(String(resolvedRefresh.sessionMaxAge)) : null;
       let issued = null;
       for (let attempt = 0; attempt < 3 && !issued; attempt++) {
         const found = await sessions.match(token);
@@ -3629,7 +3640,7 @@ var AuthModule = class {
   name = "@fonderie/auth";
   // Baked in at build time by tsup.base, so the operator's Modules page can
   // say what is actually deployed rather than 'not reported'.
-  version = "7.17.0";
+  version = "7.17.1";
   // Users, sessions, login history, suspend — only through @fonderie/admin.
   describeAdmin() {
     return { routes: describeAuthAdminRoutes(this.store) };