@fonderie/auth 7.2.0 → 7.3.0

package/brain/outcomes.md

@@ -9,6 +9,13 @@ downloading tarballs.
 
 ## Database tables (after all migrations)
 
+### `fonderie_consumed_tokens`
+
+```sql
+token_hash               TEXT PRIMARY KEY
+expires_at               TIMESTAMPTZ NOT NULL
+```
+
 ### `fonderie_email_verifications`
 
 ```sql
@@ -130,12 +137,12 @@ Raw SQL ships in `node_modules/@fonderie/auth/dist/migrations/sql/` — read it
 | Method | Path | Middleware chain (auth / validation / handler) |
 |---|---|---|
 | GET | `/auth/apple` | `oauth.appleInit` |
-| POST | `/auth/apple/callback` | `oauth.appleCallback` |
+| POST | `/auth/apple/callback` | `ipLimit('login') → oauth.appleCallback` |
 | POST | `/auth/apple/native` | `ipLimit('login') → validate(appleNativeSchema) → oauth.appleNative` |
 | POST | `/auth/email/forgot` | `ipLimit('forgot') → validate(forgotPasswordSchema) → acctLimit('forgot') → auth.forgotPassword` |
 | POST | `/auth/email/reset` | `ipLimit('reset') → validate(resetPasswordSchema) → auth.resetPassword` |
 | GET | `/auth/google` | `oauth.googleInit` |
-| GET | `/auth/google/callback` | `oauth.googleCallback` |
+| GET | `/auth/google/callback` | `ipLimit('login') → oauth.googleCallback` |
 | POST | `/auth/login` | `ipLimit('login') → validate(loginSchema) → acctLimit('login') → auth.login` |
 | GET | `/auth/login-history` | `requireAuth → user.loginHistory` |
 | POST | `/auth/logout` | `requireAuth → validate(refreshSchema) → auth.logout` |

package/dist/index.cjs

@@ -736,7 +736,8 @@ var UserModel = class {
       `INSERT INTO fonderie_users (email, email_verified_at, provider, provider_id)
 			VALUES ($1, now(), $2, $3)
 			ON CONFLICT (email) DO UPDATE
-			SET provider = $2, provider_id = $3
+			SET provider = $2, provider_id = $3,
+			    email_verified_at = COALESCE(fonderie_users.email_verified_at, now())
 			RETURNING id`,
       [email2, provider, providerId]
     );
@@ -2304,6 +2305,34 @@ function userController(store, config, bus) {
 var import_node_crypto7 = require("crypto");
 var import_jsonwebtoken2 = __toESM(require("jsonwebtoken"), 1);
 var import_core8 = require("@fonderie/core");
+
+// src/models/consumed-token.model.ts
+var ConsumedTokenModel = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  // True if the token had not been consumed before (caller may proceed); false
+  // if this is a replay. `expiresAt` is the token's own exp — its TTL here.
+  async consumeOnce(tokenHash, expiresAt) {
+    const rows = await this.store.query(
+      `INSERT INTO fonderie_consumed_tokens (token_hash, expires_at)
+			 VALUES ($1, $2)
+			 ON CONFLICT (token_hash) DO NOTHING
+			 RETURNING token_hash`,
+      [tokenHash, expiresAt]
+    );
+    return rows.length > 0;
+  }
+  // Opportunistic, fire-and-forget cleanup of expired rows (index-backed).
+  // Recording history must never block or fail a login.
+  sweepExpiredSafe() {
+    void this.store.query(`DELETE FROM fonderie_consumed_tokens WHERE expires_at < now()`).catch(() => {
+    });
+  }
+};
+
+// src/controllers/oauth.controller.ts
 var APPLE_AUTH_URL = "https://appleid.apple.com/auth/authorize";
 var APPLE_TOKEN_URL = "https://appleid.apple.com/auth/token";
 var APPLE_KEYS_URL = "https://appleid.apple.com/auth/keys";
@@ -2317,18 +2346,34 @@ function mintAppleClientSecret(apple) {
   );
 }
 var appleKeyCache = null;
+var appleKeyInflight = null;
+var appleKeyLastAttempt = 0;
 var APPLE_KEYS_TTL_MS = 60 * 60 * 1e3;
-async function getApplePublicKey(kid) {
-  const fresh = appleKeyCache && Date.now() - appleKeyCache.fetchedAt < APPLE_KEYS_TTL_MS;
-  if (!fresh || !appleKeyCache.keys.some((k) => k.kid === kid)) {
+var APPLE_KEYS_MIN_REFETCH_MS = 60 * 1e3;
+var APPLE_KEYS_FETCH_TIMEOUT_MS = 5e3;
+function refreshAppleKeys() {
+  if (appleKeyInflight) return appleKeyInflight;
+  appleKeyLastAttempt = Date.now();
+  appleKeyInflight = (async () => {
     try {
-      const res = await fetch(APPLE_KEYS_URL);
+      const res = await fetch(APPLE_KEYS_URL, { signal: AbortSignal.timeout(APPLE_KEYS_FETCH_TIMEOUT_MS) });
       const data = await res.json();
       if (Array.isArray(data.keys)) appleKeyCache = { keys: data.keys, fetchedAt: Date.now() };
     } catch {
+    } finally {
+      appleKeyInflight = null;
     }
+  })();
+  return appleKeyInflight;
+}
+async function getApplePublicKey(kid) {
+  const find = () => appleKeyCache?.keys.find((k) => k.kid === kid) ?? null;
+  const cacheFresh = () => !!appleKeyCache && Date.now() - appleKeyCache.fetchedAt < APPLE_KEYS_TTL_MS;
+  let jwk = find();
+  if ((!jwk || !cacheFresh()) && Date.now() - appleKeyLastAttempt >= APPLE_KEYS_MIN_REFETCH_MS) {
+    await refreshAppleKeys();
+    jwk = find();
   }
-  const jwk = appleKeyCache?.keys.find((k) => k.kid === kid);
   if (!jwk) return null;
   try {
     return (0, import_node_crypto7.createPublicKey)({ key: jwk, format: "jwk" });
@@ -2364,6 +2409,7 @@ function oauthController(store, config) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
   const loginEvents = new LoginEventModel(store);
+  const consumedTokens = new ConsumedTokenModel(store);
   const completeAppleLogin = async (ctx, claims) => {
     const meta = requestMeta(ctx);
     if (!claims.email) {
@@ -2673,6 +2719,26 @@ function oauthController(store, config) {
         });
         return (0, import_core8.setApiResponse)(import_core8.HTTP.UNAUTHORIZED, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
       }
+      const tokenHash = (0, import_node_crypto7.createHash)("sha256").update(identityToken).digest("hex");
+      const expMs = typeof claims.exp === "number" ? claims.exp * 1e3 : Date.now() + 5 * 60 * 1e3;
+      const firstUse = await consumedTokens.consumeOnce(tokenHash, new Date(expMs));
+      if (!firstUse) {
+        const meta = requestMeta(ctx);
+        loginEvents.recordSafe({
+          userId: null,
+          emailAttempted: claims.email ?? null,
+          method: "oauth-apple",
+          outcome: "failed",
+          failureReason: "token_replayed",
+          ...meta
+        });
+        return (0, import_core8.setApiResponse)(
+          import_core8.HTTP.UNAUTHORIZED,
+          "APPLE_AUTH_FAILED",
+          "This Apple identity token has already been used"
+        );
+      }
+      consumedTokens.sweepExpiredSafe();
       return completeAppleLogin(ctx, {
         email: claims.email,
         sub: claims.sub,
@@ -2744,15 +2810,18 @@ function buildAuthRoutes(store, config, bus) {
   if (config.providers.includes("google")) {
     routes.push(
       ["GET", "/auth/google", oauth.googleInit],
-      ["GET", "/auth/google/callback", oauth.googleCallback]
+      // ipLimit: an unauthenticated caller can otherwise force one outbound
+      // token-exchange to Google per request (the state check doesn't gate it).
+      ["GET", "/auth/google/callback", ipLimit("login"), oauth.googleCallback]
     );
   }
   if (config.providers.includes("apple")) {
     routes.push(
       // Web redirect flow. The callback is a POST (response_mode=form_post);
-      // its urlencoded body is parsed inside the controller.
+      // its urlencoded body is parsed inside the controller. ipLimit for the
+      // same reason as Google's callback (bounds outbound token exchanges).
       ["GET", "/auth/apple", oauth.appleInit],
-      ["POST", "/auth/apple/callback", oauth.appleCallback],
+      ["POST", "/auth/apple/callback", ipLimit("login"), oauth.appleCallback],
       // Native (iOS) flow: the app posts the identityToken from the Apple
       // sheet. ipLimit guards token brute-forcing; validate bounds the body.
       ["POST", "/auth/apple/native", ipLimit("login"), (0, import_middlewares.validate)(appleNativeSchema), oauth.appleNative]
@@ -2819,6 +2888,13 @@ function collectAuthConfigProblems(config) {
         message: "apple.privateKey does not look like a PEM .p8 key (expected `-----BEGIN PRIVATE KEY-----`)"
       });
     }
+    if (a.nativeClientIds?.some((id) => !id || id.trim() === "" || id.includes("*"))) {
+      problems.push({
+        module: MODULE,
+        severity: "error",
+        message: "apple.nativeClientIds must be exact bundle ids \u2014 empty or wildcard entries would accept identity tokens minted for other apps"
+      });
+    }
   }
   if (config.mfa && !config.mfaSecretKey) {
     problems.push({