@fonderie/auth 7.2.0 → 7.3.0

package/dist/index.js

@@ -696,7 +696,8 @@ var UserModel = class {
       `INSERT INTO fonderie_users (email, email_verified_at, provider, provider_id)
 			VALUES ($1, now(), $2, $3)
 			ON CONFLICT (email) DO UPDATE
-			SET provider = $2, provider_id = $3
+			SET provider = $2, provider_id = $3,
+			    email_verified_at = COALESCE(fonderie_users.email_verified_at, now())
 			RETURNING id`,
       [email2, provider, providerId]
     );
@@ -2261,9 +2262,37 @@ function userController(store, config, bus) {
 }
 
 // src/controllers/oauth.controller.ts
-import { randomBytes as randomBytes4, createPublicKey } from "crypto";
+import { randomBytes as randomBytes4, createPublicKey, createHash as createHash2 } from "crypto";
 import jwt2 from "jsonwebtoken";
 import { setApiResponse as setApiResponse5, HTTP as HTTP5, constantTimeEqual as constantTimeEqual2 } from "@fonderie/core";
+
+// src/models/consumed-token.model.ts
+var ConsumedTokenModel = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  // True if the token had not been consumed before (caller may proceed); false
+  // if this is a replay. `expiresAt` is the token's own exp — its TTL here.
+  async consumeOnce(tokenHash, expiresAt) {
+    const rows = await this.store.query(
+      `INSERT INTO fonderie_consumed_tokens (token_hash, expires_at)
+			 VALUES ($1, $2)
+			 ON CONFLICT (token_hash) DO NOTHING
+			 RETURNING token_hash`,
+      [tokenHash, expiresAt]
+    );
+    return rows.length > 0;
+  }
+  // Opportunistic, fire-and-forget cleanup of expired rows (index-backed).
+  // Recording history must never block or fail a login.
+  sweepExpiredSafe() {
+    void this.store.query(`DELETE FROM fonderie_consumed_tokens WHERE expires_at < now()`).catch(() => {
+    });
+  }
+};
+
+// src/controllers/oauth.controller.ts
 var APPLE_AUTH_URL = "https://appleid.apple.com/auth/authorize";
 var APPLE_TOKEN_URL = "https://appleid.apple.com/auth/token";
 var APPLE_KEYS_URL = "https://appleid.apple.com/auth/keys";
@@ -2277,18 +2306,34 @@ function mintAppleClientSecret(apple) {
   );
 }
 var appleKeyCache = null;
+var appleKeyInflight = null;
+var appleKeyLastAttempt = 0;
 var APPLE_KEYS_TTL_MS = 60 * 60 * 1e3;
-async function getApplePublicKey(kid) {
-  const fresh = appleKeyCache && Date.now() - appleKeyCache.fetchedAt < APPLE_KEYS_TTL_MS;
-  if (!fresh || !appleKeyCache.keys.some((k) => k.kid === kid)) {
+var APPLE_KEYS_MIN_REFETCH_MS = 60 * 1e3;
+var APPLE_KEYS_FETCH_TIMEOUT_MS = 5e3;
+function refreshAppleKeys() {
+  if (appleKeyInflight) return appleKeyInflight;
+  appleKeyLastAttempt = Date.now();
+  appleKeyInflight = (async () => {
     try {
-      const res = await fetch(APPLE_KEYS_URL);
+      const res = await fetch(APPLE_KEYS_URL, { signal: AbortSignal.timeout(APPLE_KEYS_FETCH_TIMEOUT_MS) });
       const data = await res.json();
       if (Array.isArray(data.keys)) appleKeyCache = { keys: data.keys, fetchedAt: Date.now() };
     } catch {
+    } finally {
+      appleKeyInflight = null;
     }
+  })();
+  return appleKeyInflight;
+}
+async function getApplePublicKey(kid) {
+  const find = () => appleKeyCache?.keys.find((k) => k.kid === kid) ?? null;
+  const cacheFresh = () => !!appleKeyCache && Date.now() - appleKeyCache.fetchedAt < APPLE_KEYS_TTL_MS;
+  let jwk = find();
+  if ((!jwk || !cacheFresh()) && Date.now() - appleKeyLastAttempt >= APPLE_KEYS_MIN_REFETCH_MS) {
+    await refreshAppleKeys();
+    jwk = find();
   }
-  const jwk = appleKeyCache?.keys.find((k) => k.kid === kid);
   if (!jwk) return null;
   try {
     return createPublicKey({ key: jwk, format: "jwk" });
@@ -2324,6 +2369,7 @@ function oauthController(store, config) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
   const loginEvents = new LoginEventModel(store);
+  const consumedTokens = new ConsumedTokenModel(store);
   const completeAppleLogin = async (ctx, claims) => {
     const meta = requestMeta(ctx);
     if (!claims.email) {
@@ -2633,6 +2679,26 @@ function oauthController(store, config) {
         });
         return setApiResponse5(HTTP5.UNAUTHORIZED, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
       }
+      const tokenHash = createHash2("sha256").update(identityToken).digest("hex");
+      const expMs = typeof claims.exp === "number" ? claims.exp * 1e3 : Date.now() + 5 * 60 * 1e3;
+      const firstUse = await consumedTokens.consumeOnce(tokenHash, new Date(expMs));
+      if (!firstUse) {
+        const meta = requestMeta(ctx);
+        loginEvents.recordSafe({
+          userId: null,
+          emailAttempted: claims.email ?? null,
+          method: "oauth-apple",
+          outcome: "failed",
+          failureReason: "token_replayed",
+          ...meta
+        });
+        return setApiResponse5(
+          HTTP5.UNAUTHORIZED,
+          "APPLE_AUTH_FAILED",
+          "This Apple identity token has already been used"
+        );
+      }
+      consumedTokens.sweepExpiredSafe();
       return completeAppleLogin(ctx, {
         email: claims.email,
         sub: claims.sub,
@@ -2704,15 +2770,18 @@ function buildAuthRoutes(store, config, bus) {
   if (config.providers.includes("google")) {
     routes.push(
       ["GET", "/auth/google", oauth.googleInit],
-      ["GET", "/auth/google/callback", oauth.googleCallback]
+      // ipLimit: an unauthenticated caller can otherwise force one outbound
+      // token-exchange to Google per request (the state check doesn't gate it).
+      ["GET", "/auth/google/callback", ipLimit("login"), oauth.googleCallback]
     );
   }
   if (config.providers.includes("apple")) {
     routes.push(
       // Web redirect flow. The callback is a POST (response_mode=form_post);
-      // its urlencoded body is parsed inside the controller.
+      // its urlencoded body is parsed inside the controller. ipLimit for the
+      // same reason as Google's callback (bounds outbound token exchanges).
       ["GET", "/auth/apple", oauth.appleInit],
-      ["POST", "/auth/apple/callback", oauth.appleCallback],
+      ["POST", "/auth/apple/callback", ipLimit("login"), oauth.appleCallback],
       // Native (iOS) flow: the app posts the identityToken from the Apple
       // sheet. ipLimit guards token brute-forcing; validate bounds the body.
       ["POST", "/auth/apple/native", ipLimit("login"), validate(appleNativeSchema), oauth.appleNative]
@@ -2779,6 +2848,13 @@ function collectAuthConfigProblems(config) {
         message: "apple.privateKey does not look like a PEM .p8 key (expected `-----BEGIN PRIVATE KEY-----`)"
       });
     }
+    if (a.nativeClientIds?.some((id) => !id || id.trim() === "" || id.includes("*"))) {
+      problems.push({
+        module: MODULE,
+        severity: "error",
+        message: "apple.nativeClientIds must be exact bundle ids \u2014 empty or wildcard entries would accept identity tokens minted for other apps"
+      });
+    }
   }
   if (config.mfa && !config.mfaSecretKey) {
     problems.push({