@fonderie/auth 7.17.0 → 7.18.0

package/dist/index.d.cts

@@ -3,8 +3,8 @@ export { IMfaChallenge, ISession } from './types.cjs';
 import { IFonderieModule, IAdminDescription, IReadinessProblem, IFonderieApp, IDefaultTemplate, IAdminRoute } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig, a as IRequestLocation } from './session-C-ptRylj.cjs';
-export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, d as IAuthRateLimitConfig, e as IAuthRuntimeConfig, f as IAuthSecrets, g as IDataExportContributor, h as ILocationRequest, L as LocationResolver, M as MESSAGE_KEYS, i as buildAuthAccountLimiter, j as buildAuthIpLimiter, r as resolveLocation, s as sanitizeLocation, w as withSession } from './session-C-ptRylj.cjs';
+import { I as IAuthConfig, a as IRequestLocation } from './session-B-IgXFu8.cjs';
+export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, C as CLIENT_KINDS, d as ClientKind, e as IAuthRateLimitConfig, f as IAuthRuntimeConfig, g as IAuthSecrets, h as IDataExportContributor, i as ILocationRequest, j as ISessionPolicy, L as LocationResolver, M as MESSAGE_KEYS, S as SESSION_POLICY_PRESETS, k as buildAuthAccountLimiter, l as buildAuthIpLimiter, m as clientKindOf, n as configForClient, r as readAuthRuntimeConfig, o as resolveLocation, s as sanitizeLocation, p as sessionPolicyConfigKeys, w as withSession } from './session-B-IgXFu8.cjs';
 import { IUserDTO } from './dtos/user.cjs';
 export { toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
@@ -50,6 +50,8 @@ interface ISessionDTO {
     location: IRequestLocation | null;
     createdAt: string;
     expiresAt: string;
+    /** The platform declared at sign-in (mobile | desktop | web), or null. */
+    clientKind: string | null;
 }
 
 declare const registerSchema: z.ZodUnion<readonly [z.ZodObject<{

package/dist/index.d.ts

@@ -3,8 +3,8 @@ export { IMfaChallenge, ISession } from './types.js';
 import { IFonderieModule, IAdminDescription, IReadinessProblem, IFonderieApp, IDefaultTemplate, IAdminRoute } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig, a as IRequestLocation } from './session-C-ptRylj.js';
-export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, d as IAuthRateLimitConfig, e as IAuthRuntimeConfig, f as IAuthSecrets, g as IDataExportContributor, h as ILocationRequest, L as LocationResolver, M as MESSAGE_KEYS, i as buildAuthAccountLimiter, j as buildAuthIpLimiter, r as resolveLocation, s as sanitizeLocation, w as withSession } from './session-C-ptRylj.js';
+import { I as IAuthConfig, a as IRequestLocation } from './session-B-IgXFu8.js';
+export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, C as CLIENT_KINDS, d as ClientKind, e as IAuthRateLimitConfig, f as IAuthRuntimeConfig, g as IAuthSecrets, h as IDataExportContributor, i as ILocationRequest, j as ISessionPolicy, L as LocationResolver, M as MESSAGE_KEYS, S as SESSION_POLICY_PRESETS, k as buildAuthAccountLimiter, l as buildAuthIpLimiter, m as clientKindOf, n as configForClient, r as readAuthRuntimeConfig, o as resolveLocation, s as sanitizeLocation, p as sessionPolicyConfigKeys, w as withSession } from './session-B-IgXFu8.js';
 import { IUserDTO } from './dtos/user.js';
 export { toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
@@ -50,6 +50,8 @@ interface ISessionDTO {
     location: IRequestLocation | null;
     createdAt: string;
     expiresAt: string;
+    /** The platform declared at sign-in (mobile | desktop | web), or null. */
+    clientKind: string | null;
 }
 
 declare const registerSchema: z.ZodUnion<readonly [z.ZodObject<{

package/dist/index.js

@@ -312,8 +312,8 @@ function issueMfaPendingToken(userId, config, loginMethod) {
   );
 }
 function issueTokenPair(userId, config, options) {
-  const duration = config.sessionDuration ?? DEFAULT_SESSION_DURATION;
-  const accessDuration = config.accessTokenDuration ?? DEFAULT_ACCESS_TOKEN_DURATION;
+  const duration = validDuration(config.sessionDuration, DEFAULT_SESSION_DURATION, "sessionDuration");
+  const accessDuration = validDuration(config.accessTokenDuration, DEFAULT_ACCESS_TOKEN_DURATION, "accessTokenDuration");
   const authTime = options.authTime ?? Math.floor(Date.now() / 1e3);
   const loginMethod = options.loginMethod;
   const phoneVerified = options.phoneVerified ?? false;
@@ -356,6 +356,90 @@ function durationMs(value) {
   const scale = { ms: 1, s: 1e3, m: 6e4, h: 36e5, d: 864e5, w: 6048e5, y: 315576e5 };
   return Number(m[1]) * (scale[unit] ?? 1e3);
 }
+var warnedDurations = /* @__PURE__ */ new Set();
+function validDuration(value, fallback, name) {
+  if (value === void 0 || value === null || value === "") return fallback;
+  if (durationMs(String(value)) !== null) return String(value);
+  const key = `${name}=${String(value)}`;
+  if (!warnedDurations.has(key)) {
+    warnedDurations.add(key);
+    console.warn(`[auth] ${name} ${JSON.stringify(value)} is not a duration (e.g. '90d', '1h') \u2014 using ${fallback}`);
+  }
+  return fallback;
+}
+
+// src/services/session-policy.ts
+var CLIENT_KINDS = ["mobile", "desktop", "web"];
+var SESSION_POLICY_PRESETS = {
+  // Personal device; the token lives in the Keychain / Keystore.
+  mobile: { sessionDuration: "90d", sessionMaxAge: "365d" },
+  // Personal, but often a shared workstation.
+  desktop: { sessionDuration: "30d", sessionMaxAge: "180d" },
+  // Shared and public computers; cookies.
+  web: { sessionDuration: "14d", sessionMaxAge: "90d" }
+};
+function clientKindOf(headers) {
+  const v = headers.get("x-client-kind")?.trim().toLowerCase();
+  return CLIENT_KINDS.includes(v ?? "") ? v : null;
+}
+var FIELDS = ["sessionDuration", "sessionMaxAge", "accessTokenDuration"];
+function configForClient(config, runtime, kind) {
+  const rt = runtime ?? {};
+  const code = config;
+  const out = { ...config, ...rt };
+  for (const field of FIELDS) {
+    const value = (kind ? rt.sessionPolicies?.[kind]?.[field] : void 0) ?? rt[field] ?? (kind ? code.sessionPolicies?.[kind]?.[field] : void 0) ?? code[field] ?? (kind ? SESSION_POLICY_PRESETS[kind][field] : void 0);
+    if (value === void 0) delete out[field];
+    else out[field] = value;
+  }
+  return out;
+}
+function sessionPolicyConfigKeys(kind) {
+  return {
+    sessionDuration: `auth.session.duration.${kind}`,
+    sessionMaxAge: `auth.session.max_age.${kind}`,
+    accessTokenDuration: `auth.access.duration.${kind}`
+  };
+}
+function readAuthRuntimeConfig(read) {
+  const text = (key) => {
+    const v = read(key);
+    return typeof v === "string" && v.trim() ? v.trim() : void 0;
+  };
+  const bool2 = (key) => {
+    const v = read(key);
+    if (typeof v === "boolean") return v;
+    if (typeof v === "string" && ["true", "false"].includes(v.trim().toLowerCase())) return v.trim().toLowerCase() === "true";
+    return void 0;
+  };
+  const num = (key) => {
+    const v = read(key);
+    const n = typeof v === "number" ? v : typeof v === "string" && v.trim() ? Number(v) : NaN;
+    return Number.isFinite(n) ? n : void 0;
+  };
+  const out = {};
+  const set = (k, v) => {
+    if (v !== void 0) out[k] = v;
+  };
+  set("sessionDuration", text("auth.session.duration"));
+  set("sessionMaxAge", text("auth.session.max_age"));
+  set("accessTokenDuration", text("auth.access.duration"));
+  set("verificationCooldown", num("auth.verification.cooldown"));
+  set("mfa", bool2("auth.mfa.enabled"));
+  set("requireVerification", bool2("auth.verification.required"));
+  const policies = {};
+  for (const kind of CLIENT_KINDS) {
+    const keys = sessionPolicyConfigKeys(kind);
+    const policy = {};
+    for (const field of FIELDS) {
+      const v = text(keys[field]);
+      if (v !== void 0) policy[field] = v;
+    }
+    if (Object.keys(policy).length) policies[kind] = policy;
+  }
+  if (Object.keys(policies).length) out.sessionPolicies = policies;
+  return out;
+}
 
 // src/services/mfa.ts
 import { createHmac, randomBytes } from "crypto";
@@ -980,8 +1064,8 @@ var SessionModel = class {
   async create(userId, token, expiresAt, sid, meta) {
     const location = this.locate && meta?.headers ? await resolveLocation(this.locate, { ip: meta.ipAddress, headers: meta.headers }) : null;
     await this.store.query(
-      `INSERT INTO fonderie_sessions (user_id, token, expires_at, sid, user_agent, ip_address, location, last_used_at)
-			VALUES ($1, $2, $3, $4, $5, $6, $7, now())
+      `INSERT INTO fonderie_sessions (user_id, token, expires_at, sid, user_agent, ip_address, location, last_used_at, client_kind)
+			VALUES ($1, $2, $3, $4, $5, $6, $7, now(), $8)
 			ON CONFLICT (token) DO NOTHING`,
       [
         userId,
@@ -990,7 +1074,8 @@ var SessionModel = class {
         sid ?? null,
         meta?.userAgent ?? null,
         meta?.ipAddress ?? null,
-        location ? JSON.stringify(location) : null
+        location ? JSON.stringify(location) : null,
+        meta?.clientKind ?? null
       ]
     );
   }
@@ -1005,12 +1090,12 @@ var SessionModel = class {
   async match(token) {
     const hash = hashRefreshToken(token);
     const [current] = await this.store.query(
-      `SELECT id, user_id, sid, token, created_at FROM fonderie_sessions WHERE token IN ($1, $2) AND expires_at > now() LIMIT 1`,
+      `SELECT id, user_id, sid, token, created_at, client_kind FROM fonderie_sessions WHERE token IN ($1, $2) AND expires_at > now() LIMIT 1`,
       [hash, token]
     );
     if (current) return { kind: "current", row: toRow(current) };
     const [previous] = await this.store.query(
-      `SELECT id, user_id, sid, token, created_at, (previous_valid_until > now()) AS in_grace
+      `SELECT id, user_id, sid, token, created_at, client_kind, (previous_valid_until > now()) AS in_grace
 			   FROM fonderie_sessions WHERE previous_token_hash = $1 AND expires_at > now() LIMIT 1`,
       [hash]
     );
@@ -1076,7 +1161,7 @@ var SessionModel = class {
   // No token — that never leaves the server.
   async listLiveByUser(userId) {
     return this.store.query(
-      `SELECT id, sid,
+      `SELECT id, sid, client_kind AS "clientKind",
 			        user_agent AS "userAgent",
 			        ip_address AS "ipAddress",
 			        location,
@@ -1125,7 +1210,8 @@ var SessionModel = class {
   }
 };
 function toRow(r) {
-  return { id: r.id, userId: r.user_id, sid: r.sid, stored: r.token, createdAt: r.created_at ? new Date(r.created_at) : /* @__PURE__ */ new Date() };
+  const kind = CLIENT_KINDS.includes(r.client_kind ?? "") ? r.client_kind : null;
+  return { id: r.id, userId: r.user_id, sid: r.sid, stored: r.token, createdAt: r.created_at ? new Date(r.created_at) : /* @__PURE__ */ new Date(), clientKind: kind };
 }
 
 // src/models/backup-code.model.ts
@@ -1256,7 +1342,8 @@ function requestMeta(ctx) {
   const meta = {
     ipAddress: typeof ip === "string" && ip.length > 0 ? ip : null,
     userAgent: ua && ua.length > 0 ? ua.slice(0, UA_MAX) : null,
-    headers: ctx.request.headers
+    headers: ctx.request.headers,
+    clientKind: clientKindOf(ctx.request.headers)
   };
   if (meta.ipAddress === null && meta.userAgent === null) warnIfIdentityless(ctx);
   return meta;
@@ -1371,7 +1458,7 @@ function mfaController(store, config, issuer, bus) {
           await users.enableMfa(ctx.user.id);
         }
       }
-      const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, config, {
+      const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
         loginMethod: ctx.user.loginMethod,
         phoneVerified: ctx.user.phoneVerified
       });
@@ -1733,7 +1820,7 @@ function authController(store, config, bus, locales = defineLocales()) {
           },
           reqOpts
         ));
-        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
           loginMethod: "email"
         });
         const registerMeta = requestMeta(ctx);
@@ -1876,7 +1963,7 @@ function authController(store, config, bus, locales = defineLocales()) {
             mfaToken
           });
         }
-        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
           loginMethod: "email"
         });
         await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
@@ -1969,8 +2056,7 @@ function authController(store, config, bus, locales = defineLocales()) {
       if (!payload || payload.type !== "refresh") {
         return setApiResponse3(HTTP3.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Invalid refresh token");
       }
-      const resolvedRefresh = { ...config, ...config.resolve?.(ctx) };
-      const maxAgeMs = durationMs(resolvedRefresh.sessionMaxAge);
+      const runtime = config.resolve?.(ctx);
       let issued = null;
       for (let attempt = 0; attempt < 3 && !issued; attempt++) {
         const found = await sessions.match(token);
@@ -1984,6 +2070,8 @@ function authController(store, config, bus, locales = defineLocales()) {
           );
           return setApiResponse3(HTTP3.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
         }
+        const resolvedRefresh = configForClient(config, runtime, found.row.clientKind);
+        const maxAgeMs = resolvedRefresh.sessionMaxAge ? durationMs(String(resolvedRefresh.sessionMaxAge)) : null;
         if (maxAgeMs !== null && Date.now() - found.row.createdAt.getTime() > maxAgeMs) {
           await sessions.revokeById(found.row.id);
           return setApiResponse3(HTTP3.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session reached its maximum age \u2014 sign in again");
@@ -2165,7 +2253,7 @@ function authController(store, config, bus, locales = defineLocales()) {
           );
         }
         await phoneVerif.deleteByUser(ctx.user.id);
-        const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
           loginMethod: "phone",
           phoneVerified: true
         });
@@ -2342,6 +2430,7 @@ function toSessionDTO(row, currentSid) {
     ipAddress: row.ipAddress,
     userAgent: row.userAgent,
     location: sanitizeLocation(row.location),
+    clientKind: row.clientKind ?? null,
     createdAt: row.createdAt instanceof Date ? row.createdAt.toISOString() : String(row.createdAt),
     expiresAt: row.expiresAt instanceof Date ? row.expiresAt.toISOString() : String(row.expiresAt)
   };
@@ -2890,7 +2979,7 @@ function oauthController(store, config, bus) {
       return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", "Apple login failed");
     }
     await announceOAuthUpsert(ctx, upserted, "apple", fullUser);
-    const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, { loginMethod: "apple" });
+    const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), { loginMethod: "apple" });
     await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
     await loginEvents.recordSafe({
       userId: upserted.id,
@@ -3041,7 +3130,7 @@ function oauthController(store, config, bus) {
         return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
       }
       await announceOAuthUpsert(ctx, upserted, "google", fullUser);
-      const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, {
+      const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
         loginMethod: "google"
       });
       await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
@@ -3629,7 +3718,7 @@ var AuthModule = class {
   name = "@fonderie/auth";
   // Baked in at build time by tsup.base, so the operator's Modules page can
   // say what is actually deployed rather than 'not reported'.
-  version = "7.17.0";
+  version = "7.18.0";
   // Users, sessions, login history, suspend — only through @fonderie/admin.
   describeAdmin() {
     return { routes: describeAuthAdminRoutes(this.store) };
@@ -4224,19 +4313,25 @@ function startUserRetention(store, options) {
 export {
   AUTH_CONFIG_KEYS,
   AuthModule,
+  CLIENT_KINDS,
   DEFAULT_TEMPLATES,
   MESSAGE_KEYS,
+  SESSION_POLICY_PRESETS,
   buildAuthAccountLimiter,
   buildAuthIpLimiter,
+  clientKindOf,
+  configForClient,
   describeAuthAdminRoutes,
   importUser,
   normalizeEmail,
   normalizeEmailSafe,
   purgeSoftDeletedUsers,
+  readAuthRuntimeConfig,
   requireAuth2 as requireAuth,
   resolveLocation,
   sanitizeLocation,
   schemas_exports as schemas,
+  sessionPolicyConfigKeys,
   startUserRetention,
   toAdminUserDTO,
   toAdminUserPageDTO,