@fonderie/auth 7.19.2 → 7.21.0

package/brain/outcomes.md

@@ -156,13 +156,14 @@ Raw SQL ships in `node_modules/@fonderie/auth/dist/migrations/sql/` — read it
 | POST | `/auth/email/reset` | `ipLimit('reset') → validate(resetPasswordSchema) → auth.resetPassword` |
 | GET | `/auth/google` | `oauth.googleInit` |
 | GET | `/auth/google/callback` | `ipLimit('login') → oauth.googleCallback` |
+| POST | `/auth/google/native` | `ipLimit('login') → validate(googleNativeSchema) → oauth.googleNative` |
 | POST | `/auth/login` | `ipLimit('login') → validate(loginSchema) → acctLimit('login') → auth.login` |
 | GET | `/auth/login-history` | `requireAuth → user.loginHistory` |
 | POST | `/auth/logout` | `requireAuth → validate(refreshSchema) → auth.logout` |
 | POST | `/auth/mfa/backup-codes` | `requireAuth → requireEmailLogin → requireVerified → validate(mfaTokenSchema) → mfa.regenerateBackupCodes` |
 | POST | `/auth/mfa/disable` | `requireAuth → requireEmailLogin → requireVerified → validate(mfaTokenSchema) → mfa.disable` |
 | POST | `/auth/mfa/setup` | `requireAuth → requireEmailLogin → requireVerified → mfa.setup` |
-| POST | `/auth/mfa/verify` | `ipLimit('mfaVerify') → requireAnyAuth → requireEmailLogin → requireVerified → validate(mfaTokenSchema) → mfa.verify` |
+| POST | `/auth/mfa/verify` | `ipLimit('mfaVerify') → requireAnyAuth → requireEmailLoginUnlessSigningIn → requireVerified → validate(mfaTokenSchema) → mfa.verify` |
 | DELETE | `/auth/oauth/:provider` | `requireAuth → user.unlinkOauth` |
 | GET | `/auth/providers` | `async () => setApiResponse(HTTP.OK, 'AUTH_PROVIDERS', 'Sign-in methods available here', { providers: [...config.providers], })` |
 | POST | `/auth/refresh` | `validate(refreshSchema) → auth.refresh` |

package/brain/signatures.md

@@ -78,8 +78,9 @@ interface IAuthSecrets {
     mfaSecretKey?: string;
     google?: {
         clientId: string;
-        clientSecret: string;
-        redirectUri: string;
+        clientSecret?: string;
+        redirectUri?: string;
+        nativeClientIds?: string[];
     };
     apple?: {
         clientId: string;
@@ -198,7 +199,7 @@ type LocationResolver = (req: ILocationRequest) => IRequestLocation | null | und
 
 function validate(schema: IRequestSchema): Middleware
 
-namespace schemas — exports: ChangePasswordInput, LoginInput, RegisterInput, ResetPasswordInput, appleNativeSchema, changePasswordSchema, forgotPasswordSchema, loginSchema, mfaTokenSchema, refreshSchema, registerSchema, resetPasswordSchema, updateEmailSchema, updatePhoneSchema, updatePreferencesSchema, updateProfileSchema, verifySchema
+namespace schemas — exports: ChangePasswordInput, LoginInput, RegisterInput, ResetPasswordInput, appleNativeSchema, changePasswordSchema, forgotPasswordSchema, googleNativeSchema, loginSchema, mfaTokenSchema, refreshSchema, registerSchema, resetPasswordSchema, updateEmailSchema, updatePhoneSchema, updatePreferencesSchema, updateProfileSchema, verifySchema
 
 type RegisterInput = z.infer<typeof registerSchema>;
 

package/dist/index.cjs

@@ -115,6 +115,10 @@ var requireEmailLogin = async (ctx, next) => {
   }
   return next();
 };
+var requireEmailLoginUnlessSigningIn = async (ctx, next) => {
+  if (ctx.user.mfaPending) return next();
+  return requireEmailLogin(ctx, next);
+};
 
 // src/middlewares/validate.ts
 var import_middlewares = require("@fonderie/core/middlewares");
@@ -183,6 +187,7 @@ __export(schemas_exports, {
   appleNativeSchema: () => appleNativeSchema,
   changePasswordSchema: () => changePasswordSchema,
   forgotPasswordSchema: () => forgotPasswordSchema,
+  googleNativeSchema: () => googleNativeSchema,
   loginSchema: () => loginSchema,
   mfaTokenSchema: () => mfaTokenSchema,
   refreshSchema: () => refreshSchema,
@@ -220,6 +225,12 @@ var appleNativeSchema = import_zod.z.object({
   // it against the token's `nonce` claim to defend against replay.
   nonce: import_zod.z.string().max(256).optional()
 });
+var googleNativeSchema = import_zod.z.object({
+  idToken: import_zod.z.string().min(1).max(8192),
+  // Optional nonce the app passed to the Google SDK; checked against the
+  // token's `nonce` claim (binds the token to this request).
+  nonce: import_zod.z.string().max(256).optional()
+});
 var refreshSchema = import_zod.z.object({ refreshToken: import_zod.z.string().min(1).optional() });
 var forgotPasswordSchema = import_zod.z.object({ email });
 var resetPasswordSchema = import_zod.z.union([
@@ -2795,12 +2806,14 @@ function userController(store, config, bus) {
     deleteMe: async (ctx) => {
       const userId = ctx.user.id;
       await users.softDelete(userId);
+      await sessions.deleteByUser(userId);
       const reqId = ctx.meta["requestId"];
       await (0, import_core8.background)(bus?.emit(
         EVENT_KEYS.userDeleted,
         { userId },
         reqId !== void 0 ? { requestId: reqId } : void 0
       ));
+      await (0, import_core8.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId, sids: null, reason: "account-deleted" }));
       return Response.json(
         { reason: "ACCOUNT_DELETED", explanation: "Account successfully deleted." },
         {
@@ -2849,11 +2862,59 @@ function userController(store, config, bus) {
 }
 
 // src/controllers/oauth.controller.ts
-var import_node_crypto8 = require("crypto");
+var import_node_crypto9 = require("crypto");
 var import_jsonwebtoken2 = __toESM(require("jsonwebtoken"), 1);
 var import_core9 = require("@fonderie/core");
 var import_events4 = require("@fonderie/events");
 
+// src/services/jwks.ts
+var import_node_crypto8 = require("crypto");
+var TTL_MS = 60 * 60 * 1e3;
+var MIN_REFETCH_MS = 60 * 1e3;
+var FETCH_TIMEOUT_MS = 5e3;
+function createJwksSource(url) {
+  let cache = null;
+  let inflight = null;
+  let lastAttempt = 0;
+  const refresh = () => {
+    if (inflight) return inflight;
+    lastAttempt = Date.now();
+    inflight = (async () => {
+      try {
+        const res = await fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+        const data = await res.json();
+        if (Array.isArray(data.keys)) cache = { keys: data.keys, fetchedAt: Date.now() };
+      } catch {
+      } finally {
+        inflight = null;
+      }
+    })();
+    return inflight;
+  };
+  return {
+    async getKey(kid) {
+      const find = () => cache?.keys.find((k) => k.kid === kid) ?? null;
+      const fresh = () => !!cache && Date.now() - cache.fetchedAt < TTL_MS;
+      let jwk = find();
+      if ((!jwk || !fresh()) && Date.now() - lastAttempt >= MIN_REFETCH_MS) {
+        await refresh();
+        jwk = find();
+      }
+      if (!jwk) return null;
+      try {
+        return (0, import_node_crypto8.createPublicKey)({ key: jwk, format: "jwk" });
+      } catch {
+        return null;
+      }
+    },
+    reset() {
+      cache = null;
+      inflight = null;
+      lastAttempt = 0;
+    }
+  };
+}
+
 // src/models/consumed-token.model.ts
 var ConsumedTokenModel = class {
   constructor(store) {
@@ -2893,49 +2954,14 @@ function mintAppleClientSecret(apple) {
     { algorithm: "ES256", keyid: apple.keyId }
   );
 }
-var appleKeyCache = null;
-var appleKeyInflight = null;
-var appleKeyLastAttempt = 0;
-var APPLE_KEYS_TTL_MS = 60 * 60 * 1e3;
-var APPLE_KEYS_MIN_REFETCH_MS = 60 * 1e3;
-var APPLE_KEYS_FETCH_TIMEOUT_MS = 5e3;
-function refreshAppleKeys() {
-  if (appleKeyInflight) return appleKeyInflight;
-  appleKeyLastAttempt = Date.now();
-  appleKeyInflight = (async () => {
-    try {
-      const res = await fetch(APPLE_KEYS_URL, { signal: AbortSignal.timeout(APPLE_KEYS_FETCH_TIMEOUT_MS) });
-      const data = await res.json();
-      if (Array.isArray(data.keys)) appleKeyCache = { keys: data.keys, fetchedAt: Date.now() };
-    } catch {
-    } finally {
-      appleKeyInflight = null;
-    }
-  })();
-  return appleKeyInflight;
-}
-async function getApplePublicKey(kid) {
-  const find = () => appleKeyCache?.keys.find((k) => k.kid === kid) ?? null;
-  const cacheFresh = () => !!appleKeyCache && Date.now() - appleKeyCache.fetchedAt < APPLE_KEYS_TTL_MS;
-  let jwk = find();
-  if ((!jwk || !cacheFresh()) && Date.now() - appleKeyLastAttempt >= APPLE_KEYS_MIN_REFETCH_MS) {
-    await refreshAppleKeys();
-    jwk = find();
-  }
-  if (!jwk) return null;
-  try {
-    return (0, import_node_crypto8.createPublicKey)({ key: jwk, format: "jwk" });
-  } catch {
-    return null;
-  }
-}
+var appleKeys = createJwksSource(APPLE_KEYS_URL);
 async function verifyAppleIdToken(idToken, opts) {
   if (opts.audiences.length === 0) return null;
   const decoded = import_jsonwebtoken2.default.decode(idToken, { complete: true });
   if (!decoded || typeof decoded === "string") return null;
   const kid = decoded.header.kid;
   if (!kid) return null;
-  const key = await getApplePublicKey(kid);
+  const key = await appleKeys.getKey(kid);
   if (!key) return null;
   try {
     const payload = import_jsonwebtoken2.default.verify(idToken, key, {
@@ -2953,6 +2979,30 @@ async function verifyAppleIdToken(idToken, opts) {
   }
 }
 var appleEmailVerified = (c) => c.email_verified === true || c.email_verified === "true";
+var GOOGLE_KEYS_URL = "https://www.googleapis.com/oauth2/v3/certs";
+var GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
+var googleKeys = createJwksSource(GOOGLE_KEYS_URL);
+async function verifyGoogleIdToken(idToken, opts) {
+  if (opts.audiences.length === 0) return null;
+  const decoded = import_jsonwebtoken2.default.decode(idToken, { complete: true });
+  if (!decoded || typeof decoded === "string") return null;
+  const kid = decoded.header.kid;
+  if (!kid) return null;
+  const key = await googleKeys.getKey(kid);
+  if (!key) return null;
+  try {
+    const payload = import_jsonwebtoken2.default.verify(idToken, key, {
+      algorithms: ["RS256"],
+      issuer: [...GOOGLE_ISSUERS],
+      audience: opts.audiences
+    });
+    if (opts.nonce !== void 0 && payload.nonce !== opts.nonce) return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+var googleEmailVerified = (c) => c.email_verified === true || c.email_verified === "true";
 function oauthController(store, config, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store, config.location);
@@ -3015,48 +3065,68 @@ function oauthController(store, config, bus) {
       ));
     }
   };
-  const completeAppleLogin = async (ctx, claims) => {
+  const PROVIDER = {
+    apple: { label: "Apple", failed: "APPLE_AUTH_FAILED", success: "APPLE_AUTH_SUCCESS" },
+    google: { label: "Google", failed: "GOOGLE_AUTH_FAILED", success: "GOOGLE_AUTH_SUCCESS" }
+  };
+  const completeOAuthLogin = async (ctx, provider, claims, clearCookies = []) => {
+    const p = PROVIDER[provider];
+    const method = provider === "apple" ? "oauth-apple" : "oauth-google";
     const meta = requestMeta(ctx);
     if (!claims.email) {
-      return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "APPLE_AUTH_FAILED", "No email in Apple identity token");
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, p.failed, `No email in ${p.label} identity token`);
     }
     if (!claims.emailVerified) {
-      return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "APPLE_AUTH_FAILED", "Apple account email is not verified");
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, p.failed, `${p.label} account email is not verified`);
     }
     const normalizedEmail = normalizeEmailSafe(claims.email);
     if (!normalizedEmail) {
-      return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "APPLE_AUTH_FAILED", "Invalid email in Apple identity token");
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, p.failed, `Invalid email in ${p.label} identity token`);
     }
-    const upserted = await users.upsertByProvider(normalizedEmail, "apple", claims.sub ?? "");
+    const upserted = await users.upsertByProvider(normalizedEmail, provider, claims.sub ?? "");
     if (!upserted) {
       await loginEvents.recordSafe({
         userId: null,
         emailAttempted: normalizedEmail,
-        method: "oauth-apple",
+        method,
         outcome: "failed",
         failureReason: "provider_upsert_failed",
         ...meta
       });
-      return (0, import_core9.setApiResponse)(import_core9.HTTP.SERVER_ERROR, "SERVER_ERROR", "Apple login failed");
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.SERVER_ERROR, "SERVER_ERROR", `${p.label} login failed`);
     }
     const fullUser = await users.findById(upserted.id);
     if (!fullUser) {
-      return (0, import_core9.setApiResponse)(import_core9.HTTP.SERVER_ERROR, "SERVER_ERROR", "Apple login failed");
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.SERVER_ERROR, "SERVER_ERROR", `${p.label} login failed`);
+    }
+    await announceOAuthUpsert(ctx, upserted, provider, fullUser);
+    if (fullUser.suspended) {
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.FORBIDDEN, "ACCOUNT_SUSPENDED", "Account suspended. Please contact support.");
+    }
+    if (fullUser.mfaEnabled) {
+      const mfaToken = issueMfaPendingToken(upserted.id, config, provider);
+      return Response.json(
+        {
+          reason: "MFA_REQUIRED",
+          explanation: "Multi-factor authentication required",
+          result: { mfaToken }
+        },
+        { status: 200, headers: cookieHeaders(clearCookies) }
+      );
     }
-    await announceOAuthUpsert(ctx, upserted, "apple", fullUser);
-    const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), { loginMethod: "apple" });
+    const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), { loginMethod: provider });
     await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
     await loginEvents.recordSafe({
       userId: upserted.id,
       emailAttempted: normalizedEmail,
-      method: "oauth-apple",
+      method,
       outcome: "success",
       ...meta
     });
     return Response.json(
       {
-        reason: "APPLE_AUTH_SUCCESS",
-        explanation: "Apple authentication successful.",
+        reason: p.success,
+        explanation: `${p.label} authentication successful.`,
         result: {
           tokens: { access: accessToken, refresh: refreshToken },
           user: toUserDTO(fullUser)
@@ -3064,25 +3134,23 @@ function oauthController(store, config, bus) {
       },
       {
         status: 200,
-        headers: cookieHeaders([
-          ...tokenPairCookies(accessToken, refreshToken, config),
-          // One-time value — clear the (SameSite=None) state cookie.
-          "oauth_state=; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=0"
-        ])
+        headers: cookieHeaders([...tokenPairCookies(accessToken, refreshToken, config), ...clearCookies])
       }
     );
   };
+  const APPLE_STATE_CLEAR = "oauth_state=; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=0";
+  const GOOGLE_STATE_CLEAR = "oauth_state=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0";
   return {
     googleInit: async (_ctx) => {
       const google = config.google;
-      if (!google) {
+      if (!google || !google.clientSecret || !google.redirectUri) {
         return (0, import_core9.setApiResponse)(
           import_core9.HTTP.NOT_IMPLEMENTED,
           "NOT_CONFIGURED",
           "Google OAuth not configured"
         );
       }
-      const state = (0, import_node_crypto8.randomBytes)(16).toString("hex");
+      const state = (0, import_node_crypto9.randomBytes)(16).toString("hex");
       const params = new URLSearchParams({
         client_id: google.clientId,
         redirect_uri: google.redirectUri,
@@ -3110,7 +3178,7 @@ function oauthController(store, config, bus) {
     },
     googleCallback: async (ctx) => {
       const google = config.google;
-      if (!google) {
+      if (!google || !google.clientSecret || !google.redirectUri) {
         return (0, import_core9.setApiResponse)(
           import_core9.HTTP.NOT_IMPLEMENTED,
           "NOT_CONFIGURED",
@@ -3173,64 +3241,18 @@ function oauthController(store, config, bus) {
           "Google account email is not verified"
         );
       }
-      const normalizedEmail = normalizeEmailSafe(payload.email);
-      if (!normalizedEmail) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "Invalid email in OAuth response");
-      }
-      const meta = requestMeta(ctx);
-      const upserted = await users.upsertByProvider(normalizedEmail, "google", payload.sub ?? "");
-      if (!upserted) {
-        await loginEvents.recordSafe({
-          userId: null,
-          emailAttempted: normalizedEmail,
-          method: "oauth-google",
-          outcome: "failed",
-          failureReason: "provider_upsert_failed",
-          ...meta
-        });
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
-      }
-      const fullUser = await users.findById(upserted.id);
-      if (!fullUser) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
-      }
-      await announceOAuthUpsert(ctx, upserted, "google", fullUser);
-      const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
-        loginMethod: "google"
-      });
-      await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
-      await loginEvents.recordSafe({
-        userId: upserted.id,
-        emailAttempted: normalizedEmail,
-        method: "oauth-google",
-        outcome: "success",
-        ...meta
-      });
-      return Response.json(
-        {
-          reason: "GOOGLE_AUTH_SUCCESS",
-          explanation: "Google authentication successful.",
-          result: {
-            tokens: { access: accessToken, refresh: refreshToken },
-            user: toUserDTO(fullUser)
-          }
-        },
-        {
-          status: 200,
-          headers: cookieHeaders([
-            ...tokenPairCookies(accessToken, refreshToken, config),
-            // One-time value — clear it once the flow completes.
-            "oauth_state=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0"
-          ])
-        }
-      );
+      return completeOAuthLogin(ctx, "google", {
+        email: payload.email,
+        sub: payload.sub,
+        emailVerified: payload.email_verified === true
+      }, [GOOGLE_STATE_CLEAR]);
     },
     appleInit: async (_ctx) => {
       const apple = config.apple;
       if (!apple) {
         return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
       }
-      const state = (0, import_node_crypto8.randomBytes)(16).toString("hex");
+      const state = (0, import_node_crypto9.randomBytes)(16).toString("hex");
       const params = new URLSearchParams({
         client_id: apple.clientId,
         redirect_uri: apple.redirectUri,
@@ -3296,11 +3318,11 @@ function oauthController(store, config, bus) {
       if (!claims) {
         return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
       }
-      return completeAppleLogin(ctx, {
+      return completeOAuthLogin(ctx, "apple", {
         email: claims.email,
         sub: claims.sub,
         emailVerified: appleEmailVerified(claims)
-      });
+      }, [APPLE_STATE_CLEAR]);
     },
     appleNative: async (ctx) => {
       const apple = config.apple;
@@ -3326,7 +3348,7 @@ function oauthController(store, config, bus) {
         });
         return (0, import_core9.setApiResponse)(import_core9.HTTP.UNAUTHORIZED, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
       }
-      const tokenHash = (0, import_node_crypto8.createHash)("sha256").update(identityToken).digest("hex");
+      const tokenHash = (0, import_node_crypto9.createHash)("sha256").update(identityToken).digest("hex");
       const expMs = typeof claims.exp === "number" ? claims.exp * 1e3 : Date.now() + 5 * 60 * 1e3;
       const firstUse = await consumedTokens.consumeOnce(tokenHash, new Date(expMs));
       if (!firstUse) {
@@ -3346,10 +3368,54 @@ function oauthController(store, config, bus) {
         );
       }
       consumedTokens.sweepExpiredSafe();
-      return completeAppleLogin(ctx, {
+      return completeOAuthLogin(ctx, "apple", {
         email: claims.email,
         sub: claims.sub,
         emailVerified: appleEmailVerified(claims)
+      }, [APPLE_STATE_CLEAR]);
+    },
+    // Sign in with Google from a native app: the Google SDK's ID token,
+    // verified here (signature, issuer, audience, expiry), redeemed once.
+    googleNative: async (ctx) => {
+      const audiences = config.google?.nativeClientIds ?? [];
+      if (!config.google || audiences.length === 0) {
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Native Google sign-in not configured");
+      }
+      const body = ctx.meta["body"];
+      const idToken = body?.idToken;
+      if (!idToken) {
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing idToken");
+      }
+      const claims = await verifyGoogleIdToken(idToken, { audiences, nonce: body?.nonce });
+      if (!claims) {
+        await loginEvents.recordSafe({
+          userId: null,
+          emailAttempted: null,
+          method: "oauth-google",
+          outcome: "failed",
+          failureReason: "invalid_identity_token",
+          ...requestMeta(ctx)
+        });
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.UNAUTHORIZED, "GOOGLE_AUTH_FAILED", "Invalid Google ID token");
+      }
+      const tokenHash = (0, import_node_crypto9.createHash)("sha256").update(idToken).digest("hex");
+      const expMs = typeof claims.exp === "number" ? claims.exp * 1e3 : Date.now() + 5 * 60 * 1e3;
+      if (!await consumedTokens.consumeOnce(tokenHash, new Date(expMs))) {
+        await loginEvents.recordSafe({
+          userId: null,
+          emailAttempted: claims.email ?? null,
+          method: "oauth-google",
+          outcome: "failed",
+          failureReason: "token_replayed",
+          ...requestMeta(ctx)
+        });
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.UNAUTHORIZED, "GOOGLE_AUTH_FAILED", "This Google ID token has already been used");
+      }
+      consumedTokens.sweepExpiredSafe();
+      return completeOAuthLogin(ctx, "google", {
+        email: claims.email,
+        sub: claims.sub,
+        emailVerified: googleEmailVerified(claims)
       });
     }
   };
@@ -3434,7 +3500,7 @@ function buildAuthRoutes(store, config, bus, locales) {
     R("mfaSetup", "POST", "/auth/mfa/setup", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, mfa.setup),
     // /auth/mfa/verify accepts both mfaPending tokens (TOTP/backup-code login)
     // and full tokens (setup confirmation), so requireAnyAuth is used here.
-    R("mfaVerify", "POST", "/auth/mfa/verify", ipLimit("mfaVerify"), import_middlewares2.requireAnyAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.verify),
+    R("mfaVerify", "POST", "/auth/mfa/verify", ipLimit("mfaVerify"), import_middlewares2.requireAnyAuth, requireEmailLoginUnlessSigningIn, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.verify),
     R("mfaDisable", "POST", "/auth/mfa/disable", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.disable),
     R("mfaBackupCodes", "POST", "/auth/mfa/backup-codes", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, (0, import_middlewares.validate)(mfaTokenSchema), mfa.regenerateBackupCodes)
   ];
@@ -3443,7 +3509,9 @@ function buildAuthRoutes(store, config, bus, locales) {
       ["GET", "/auth/google", oauth.googleInit],
       // ipLimit: an unauthenticated caller can otherwise force one outbound
       // token-exchange to Google per request (the state check doesn't gate it).
-      ["GET", "/auth/google/callback", ipLimit("login"), oauth.googleCallback]
+      ["GET", "/auth/google/callback", ipLimit("login"), oauth.googleCallback],
+      // Native (Android/iOS) flow: the app posts the Google SDK's ID token.
+      ["POST", "/auth/google/native", ipLimit("login"), (0, import_middlewares.validate)(googleNativeSchema), oauth.googleNative]
     );
   }
   if (config.providers.includes("apple")) {
@@ -3509,15 +3577,18 @@ function collectAuthConfigProblems(config) {
   }
   if (config.google) {
     const clientSecret = config.google.clientSecret ?? "";
-    if (!clientSecret || !config.google.clientId || !config.google.redirectUri) {
+    const web = Boolean(clientSecret || config.google.redirectUri);
+    const webComplete = Boolean(clientSecret && config.google.redirectUri);
+    const native = (config.google.nativeClientIds ?? []).filter(Boolean).length > 0;
+    if (!config.google.clientId || web && !webComplete || !webComplete && !native) {
       problems.push({
         module: MODULE,
         severity: "error",
-        message: "google OAuth is configured but clientId, clientSecret, or redirectUri is missing",
+        message: "google OAuth is configured but incomplete: set clientId, and clientSecret + redirectUri (web sign-in) and/or nativeClientIds (app sign-in)",
         domain: "auth",
         reason: "GOOGLE_INCOMPLETE"
       });
-    } else if (import_core11.PLACEHOLDER_SECRET.test(clientSecret)) {
+    } else if (clientSecret && import_core11.PLACEHOLDER_SECRET.test(clientSecret)) {
       problems.push({
         module: MODULE,
         severity: "error",
@@ -3526,6 +3597,15 @@ function collectAuthConfigProblems(config) {
         reason: "GOOGLE_SECRET_PLACEHOLDER"
       });
     }
+    if (config.google.nativeClientIds?.some((id) => !id || id.trim() === "" || id.includes("*"))) {
+      problems.push({
+        module: MODULE,
+        severity: "error",
+        message: "google.nativeClientIds must be exact client ids \u2014 empty or wildcard entries would accept ID tokens minted for other apps",
+        domain: "auth",
+        reason: "GOOGLE_NATIVE_IDS_INVALID"
+      });
+    }
   }
   if (config.apple) {
     const a = config.apple;
@@ -3785,7 +3865,7 @@ var AuthModule = class {
   name = "@fonderie/auth";
   // Baked in at build time by tsup.base, so the operator's Modules page can
   // say what is actually deployed rather than 'not reported'.
-  version = "7.19.2";
+  version = "7.21.0";
   // Users, sessions, login history, suspend — only through @fonderie/admin.
   describeAdmin() {
     return { routes: describeAuthAdminRoutes(this.store, this.bus) };