@fonderie/auth 7.20.0 → 7.21.0

package/dist/index.d.cts

@@ -3,8 +3,8 @@ export { IMfaChallenge, ISession } from './types.cjs';
 import { IFonderieModule, IAdminDescription, IEventCatalogEntry, IReadinessProblem, IFonderieApp, IDefaultTemplate, IAdminRoute } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig, a as IRequestLocation } from './session-B-IgXFu8.cjs';
-export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, C as CLIENT_KINDS, d as ClientKind, e as IAuthRateLimitConfig, f as IAuthRuntimeConfig, g as IAuthSecrets, h as IDataExportContributor, i as ILocationRequest, j as ISessionPolicy, L as LocationResolver, M as MESSAGE_KEYS, S as SESSION_POLICY_PRESETS, k as buildAuthAccountLimiter, l as buildAuthIpLimiter, m as clientKindOf, n as configForClient, r as readAuthRuntimeConfig, o as resolveLocation, s as sanitizeLocation, p as sessionPolicyConfigKeys, w as withSession } from './session-B-IgXFu8.cjs';
+import { I as IAuthConfig, a as IRequestLocation } from './session-C1A21bvb.cjs';
+export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, C as CLIENT_KINDS, d as ClientKind, e as IAuthRateLimitConfig, f as IAuthRuntimeConfig, g as IAuthSecrets, h as IDataExportContributor, i as ILocationRequest, j as ISessionPolicy, L as LocationResolver, M as MESSAGE_KEYS, S as SESSION_POLICY_PRESETS, k as buildAuthAccountLimiter, l as buildAuthIpLimiter, m as clientKindOf, n as configForClient, r as readAuthRuntimeConfig, o as resolveLocation, s as sanitizeLocation, p as sessionPolicyConfigKeys, w as withSession } from './session-C1A21bvb.cjs';
 import { IUserDTO } from './dtos/user.cjs';
 export { toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
@@ -75,6 +75,10 @@ declare const appleNativeSchema: z.ZodObject<{
     identityToken: z.ZodString;
     nonce: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+declare const googleNativeSchema: z.ZodObject<{
+    idToken: z.ZodString;
+    nonce: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 declare const refreshSchema: z.ZodObject<{
     refreshToken: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -134,6 +138,7 @@ type schemas_ResetPasswordInput = ResetPasswordInput;
 declare const schemas_appleNativeSchema: typeof appleNativeSchema;
 declare const schemas_changePasswordSchema: typeof changePasswordSchema;
 declare const schemas_forgotPasswordSchema: typeof forgotPasswordSchema;
+declare const schemas_googleNativeSchema: typeof googleNativeSchema;
 declare const schemas_loginSchema: typeof loginSchema;
 declare const schemas_mfaTokenSchema: typeof mfaTokenSchema;
 declare const schemas_refreshSchema: typeof refreshSchema;
@@ -145,7 +150,7 @@ declare const schemas_updatePreferencesSchema: typeof updatePreferencesSchema;
 declare const schemas_updateProfileSchema: typeof updateProfileSchema;
 declare const schemas_verifySchema: typeof verifySchema;
 declare namespace schemas {
-  export { type schemas_ChangePasswordInput as ChangePasswordInput, type schemas_LoginInput as LoginInput, type schemas_RegisterInput as RegisterInput, type schemas_ResetPasswordInput as ResetPasswordInput, schemas_appleNativeSchema as appleNativeSchema, schemas_changePasswordSchema as changePasswordSchema, schemas_forgotPasswordSchema as forgotPasswordSchema, schemas_loginSchema as loginSchema, schemas_mfaTokenSchema as mfaTokenSchema, schemas_refreshSchema as refreshSchema, schemas_registerSchema as registerSchema, schemas_resetPasswordSchema as resetPasswordSchema, schemas_updateEmailSchema as updateEmailSchema, schemas_updatePhoneSchema as updatePhoneSchema, schemas_updatePreferencesSchema as updatePreferencesSchema, schemas_updateProfileSchema as updateProfileSchema, schemas_verifySchema as verifySchema };
+  export { type schemas_ChangePasswordInput as ChangePasswordInput, type schemas_LoginInput as LoginInput, type schemas_RegisterInput as RegisterInput, type schemas_ResetPasswordInput as ResetPasswordInput, schemas_appleNativeSchema as appleNativeSchema, schemas_changePasswordSchema as changePasswordSchema, schemas_forgotPasswordSchema as forgotPasswordSchema, schemas_googleNativeSchema as googleNativeSchema, schemas_loginSchema as loginSchema, schemas_mfaTokenSchema as mfaTokenSchema, schemas_refreshSchema as refreshSchema, schemas_registerSchema as registerSchema, schemas_resetPasswordSchema as resetPasswordSchema, schemas_updateEmailSchema as updateEmailSchema, schemas_updatePhoneSchema as updatePhoneSchema, schemas_updatePreferencesSchema as updatePreferencesSchema, schemas_updateProfileSchema as updateProfileSchema, schemas_verifySchema as verifySchema };
 }
 
 declare function normalizeEmail(email: string): string;

package/dist/index.d.ts

@@ -3,8 +3,8 @@ export { IMfaChallenge, ISession } from './types.js';
 import { IFonderieModule, IAdminDescription, IEventCatalogEntry, IReadinessProblem, IFonderieApp, IDefaultTemplate, IAdminRoute } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig, a as IRequestLocation } from './session-B-IgXFu8.js';
-export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, C as CLIENT_KINDS, d as ClientKind, e as IAuthRateLimitConfig, f as IAuthRuntimeConfig, g as IAuthSecrets, h as IDataExportContributor, i as ILocationRequest, j as ISessionPolicy, L as LocationResolver, M as MESSAGE_KEYS, S as SESSION_POLICY_PRESETS, k as buildAuthAccountLimiter, l as buildAuthIpLimiter, m as clientKindOf, n as configForClient, r as readAuthRuntimeConfig, o as resolveLocation, s as sanitizeLocation, p as sessionPolicyConfigKeys, w as withSession } from './session-B-IgXFu8.js';
+import { I as IAuthConfig, a as IRequestLocation } from './session-C1A21bvb.js';
+export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, C as CLIENT_KINDS, d as ClientKind, e as IAuthRateLimitConfig, f as IAuthRuntimeConfig, g as IAuthSecrets, h as IDataExportContributor, i as ILocationRequest, j as ISessionPolicy, L as LocationResolver, M as MESSAGE_KEYS, S as SESSION_POLICY_PRESETS, k as buildAuthAccountLimiter, l as buildAuthIpLimiter, m as clientKindOf, n as configForClient, r as readAuthRuntimeConfig, o as resolveLocation, s as sanitizeLocation, p as sessionPolicyConfigKeys, w as withSession } from './session-C1A21bvb.js';
 import { IUserDTO } from './dtos/user.js';
 export { toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
@@ -75,6 +75,10 @@ declare const appleNativeSchema: z.ZodObject<{
     identityToken: z.ZodString;
     nonce: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+declare const googleNativeSchema: z.ZodObject<{
+    idToken: z.ZodString;
+    nonce: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 declare const refreshSchema: z.ZodObject<{
     refreshToken: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -134,6 +138,7 @@ type schemas_ResetPasswordInput = ResetPasswordInput;
 declare const schemas_appleNativeSchema: typeof appleNativeSchema;
 declare const schemas_changePasswordSchema: typeof changePasswordSchema;
 declare const schemas_forgotPasswordSchema: typeof forgotPasswordSchema;
+declare const schemas_googleNativeSchema: typeof googleNativeSchema;
 declare const schemas_loginSchema: typeof loginSchema;
 declare const schemas_mfaTokenSchema: typeof mfaTokenSchema;
 declare const schemas_refreshSchema: typeof refreshSchema;
@@ -145,7 +150,7 @@ declare const schemas_updatePreferencesSchema: typeof updatePreferencesSchema;
 declare const schemas_updateProfileSchema: typeof updateProfileSchema;
 declare const schemas_verifySchema: typeof verifySchema;
 declare namespace schemas {
-  export { type schemas_ChangePasswordInput as ChangePasswordInput, type schemas_LoginInput as LoginInput, type schemas_RegisterInput as RegisterInput, type schemas_ResetPasswordInput as ResetPasswordInput, schemas_appleNativeSchema as appleNativeSchema, schemas_changePasswordSchema as changePasswordSchema, schemas_forgotPasswordSchema as forgotPasswordSchema, schemas_loginSchema as loginSchema, schemas_mfaTokenSchema as mfaTokenSchema, schemas_refreshSchema as refreshSchema, schemas_registerSchema as registerSchema, schemas_resetPasswordSchema as resetPasswordSchema, schemas_updateEmailSchema as updateEmailSchema, schemas_updatePhoneSchema as updatePhoneSchema, schemas_updatePreferencesSchema as updatePreferencesSchema, schemas_updateProfileSchema as updateProfileSchema, schemas_verifySchema as verifySchema };
+  export { type schemas_ChangePasswordInput as ChangePasswordInput, type schemas_LoginInput as LoginInput, type schemas_RegisterInput as RegisterInput, type schemas_ResetPasswordInput as ResetPasswordInput, schemas_appleNativeSchema as appleNativeSchema, schemas_changePasswordSchema as changePasswordSchema, schemas_forgotPasswordSchema as forgotPasswordSchema, schemas_googleNativeSchema as googleNativeSchema, schemas_loginSchema as loginSchema, schemas_mfaTokenSchema as mfaTokenSchema, schemas_refreshSchema as refreshSchema, schemas_registerSchema as registerSchema, schemas_resetPasswordSchema as resetPasswordSchema, schemas_updateEmailSchema as updateEmailSchema, schemas_updatePhoneSchema as updatePhoneSchema, schemas_updatePreferencesSchema as updatePreferencesSchema, schemas_updateProfileSchema as updateProfileSchema, schemas_verifySchema as verifySchema };
 }
 
 declare function normalizeEmail(email: string): string;

package/dist/index.js

@@ -59,6 +59,10 @@ var requireEmailLogin = async (ctx, next) => {
   }
   return next();
 };
+var requireEmailLoginUnlessSigningIn = async (ctx, next) => {
+  if (ctx.user.mfaPending) return next();
+  return requireEmailLogin(ctx, next);
+};
 
 // src/middlewares/validate.ts
 import { validate } from "@fonderie/core/middlewares";
@@ -132,6 +136,7 @@ __export(schemas_exports, {
   appleNativeSchema: () => appleNativeSchema,
   changePasswordSchema: () => changePasswordSchema,
   forgotPasswordSchema: () => forgotPasswordSchema,
+  googleNativeSchema: () => googleNativeSchema,
   loginSchema: () => loginSchema,
   mfaTokenSchema: () => mfaTokenSchema,
   refreshSchema: () => refreshSchema,
@@ -169,6 +174,12 @@ var appleNativeSchema = z.object({
   // it against the token's `nonce` claim to defend against replay.
   nonce: z.string().max(256).optional()
 });
+var googleNativeSchema = z.object({
+  idToken: z.string().min(1).max(8192),
+  // Optional nonce the app passed to the Google SDK; checked against the
+  // token's `nonce` claim (binds the token to this request).
+  nonce: z.string().max(256).optional()
+});
 var refreshSchema = z.object({ refreshToken: z.string().min(1).optional() });
 var forgotPasswordSchema = z.object({ email });
 var resetPasswordSchema = z.union([
@@ -2800,11 +2811,59 @@ function userController(store, config, bus) {
 }
 
 // src/controllers/oauth.controller.ts
-import { randomBytes as randomBytes4, createPublicKey, createHash as createHash4 } from "crypto";
+import { randomBytes as randomBytes4, createHash as createHash4 } from "crypto";
 import jwt2 from "jsonwebtoken";
 import { setApiResponse as setApiResponse5, HTTP as HTTP5, constantTimeEqual as constantTimeEqual2, background as background5 } from "@fonderie/core";
 import { NOTIFICATION_EVENT as NOTIFICATION_EVENT4 } from "@fonderie/events";
 
+// src/services/jwks.ts
+import { createPublicKey } from "crypto";
+var TTL_MS = 60 * 60 * 1e3;
+var MIN_REFETCH_MS = 60 * 1e3;
+var FETCH_TIMEOUT_MS = 5e3;
+function createJwksSource(url) {
+  let cache = null;
+  let inflight = null;
+  let lastAttempt = 0;
+  const refresh = () => {
+    if (inflight) return inflight;
+    lastAttempt = Date.now();
+    inflight = (async () => {
+      try {
+        const res = await fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+        const data = await res.json();
+        if (Array.isArray(data.keys)) cache = { keys: data.keys, fetchedAt: Date.now() };
+      } catch {
+      } finally {
+        inflight = null;
+      }
+    })();
+    return inflight;
+  };
+  return {
+    async getKey(kid) {
+      const find = () => cache?.keys.find((k) => k.kid === kid) ?? null;
+      const fresh = () => !!cache && Date.now() - cache.fetchedAt < TTL_MS;
+      let jwk = find();
+      if ((!jwk || !fresh()) && Date.now() - lastAttempt >= MIN_REFETCH_MS) {
+        await refresh();
+        jwk = find();
+      }
+      if (!jwk) return null;
+      try {
+        return createPublicKey({ key: jwk, format: "jwk" });
+      } catch {
+        return null;
+      }
+    },
+    reset() {
+      cache = null;
+      inflight = null;
+      lastAttempt = 0;
+    }
+  };
+}
+
 // src/models/consumed-token.model.ts
 var ConsumedTokenModel = class {
   constructor(store) {
@@ -2844,49 +2903,14 @@ function mintAppleClientSecret(apple) {
     { algorithm: "ES256", keyid: apple.keyId }
   );
 }
-var appleKeyCache = null;
-var appleKeyInflight = null;
-var appleKeyLastAttempt = 0;
-var APPLE_KEYS_TTL_MS = 60 * 60 * 1e3;
-var APPLE_KEYS_MIN_REFETCH_MS = 60 * 1e3;
-var APPLE_KEYS_FETCH_TIMEOUT_MS = 5e3;
-function refreshAppleKeys() {
-  if (appleKeyInflight) return appleKeyInflight;
-  appleKeyLastAttempt = Date.now();
-  appleKeyInflight = (async () => {
-    try {
-      const res = await fetch(APPLE_KEYS_URL, { signal: AbortSignal.timeout(APPLE_KEYS_FETCH_TIMEOUT_MS) });
-      const data = await res.json();
-      if (Array.isArray(data.keys)) appleKeyCache = { keys: data.keys, fetchedAt: Date.now() };
-    } catch {
-    } finally {
-      appleKeyInflight = null;
-    }
-  })();
-  return appleKeyInflight;
-}
-async function getApplePublicKey(kid) {
-  const find = () => appleKeyCache?.keys.find((k) => k.kid === kid) ?? null;
-  const cacheFresh = () => !!appleKeyCache && Date.now() - appleKeyCache.fetchedAt < APPLE_KEYS_TTL_MS;
-  let jwk = find();
-  if ((!jwk || !cacheFresh()) && Date.now() - appleKeyLastAttempt >= APPLE_KEYS_MIN_REFETCH_MS) {
-    await refreshAppleKeys();
-    jwk = find();
-  }
-  if (!jwk) return null;
-  try {
-    return createPublicKey({ key: jwk, format: "jwk" });
-  } catch {
-    return null;
-  }
-}
+var appleKeys = createJwksSource(APPLE_KEYS_URL);
 async function verifyAppleIdToken(idToken, opts) {
   if (opts.audiences.length === 0) return null;
   const decoded = jwt2.decode(idToken, { complete: true });
   if (!decoded || typeof decoded === "string") return null;
   const kid = decoded.header.kid;
   if (!kid) return null;
-  const key = await getApplePublicKey(kid);
+  const key = await appleKeys.getKey(kid);
   if (!key) return null;
   try {
     const payload = jwt2.verify(idToken, key, {
@@ -2904,6 +2928,30 @@ async function verifyAppleIdToken(idToken, opts) {
   }
 }
 var appleEmailVerified = (c) => c.email_verified === true || c.email_verified === "true";
+var GOOGLE_KEYS_URL = "https://www.googleapis.com/oauth2/v3/certs";
+var GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
+var googleKeys = createJwksSource(GOOGLE_KEYS_URL);
+async function verifyGoogleIdToken(idToken, opts) {
+  if (opts.audiences.length === 0) return null;
+  const decoded = jwt2.decode(idToken, { complete: true });
+  if (!decoded || typeof decoded === "string") return null;
+  const kid = decoded.header.kid;
+  if (!kid) return null;
+  const key = await googleKeys.getKey(kid);
+  if (!key) return null;
+  try {
+    const payload = jwt2.verify(idToken, key, {
+      algorithms: ["RS256"],
+      issuer: [...GOOGLE_ISSUERS],
+      audience: opts.audiences
+    });
+    if (opts.nonce !== void 0 && payload.nonce !== opts.nonce) return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+var googleEmailVerified = (c) => c.email_verified === true || c.email_verified === "true";
 function oauthController(store, config, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store, config.location);
@@ -2966,48 +3014,68 @@ function oauthController(store, config, bus) {
       ));
     }
   };
-  const completeAppleLogin = async (ctx, claims) => {
+  const PROVIDER = {
+    apple: { label: "Apple", failed: "APPLE_AUTH_FAILED", success: "APPLE_AUTH_SUCCESS" },
+    google: { label: "Google", failed: "GOOGLE_AUTH_FAILED", success: "GOOGLE_AUTH_SUCCESS" }
+  };
+  const completeOAuthLogin = async (ctx, provider, claims, clearCookies = []) => {
+    const p = PROVIDER[provider];
+    const method = provider === "apple" ? "oauth-apple" : "oauth-google";
     const meta = requestMeta(ctx);
     if (!claims.email) {
-      return setApiResponse5(HTTP5.BAD_REQUEST, "APPLE_AUTH_FAILED", "No email in Apple identity token");
+      return setApiResponse5(HTTP5.BAD_REQUEST, p.failed, `No email in ${p.label} identity token`);
     }
     if (!claims.emailVerified) {
-      return setApiResponse5(HTTP5.BAD_REQUEST, "APPLE_AUTH_FAILED", "Apple account email is not verified");
+      return setApiResponse5(HTTP5.BAD_REQUEST, p.failed, `${p.label} account email is not verified`);
     }
     const normalizedEmail = normalizeEmailSafe(claims.email);
     if (!normalizedEmail) {
-      return setApiResponse5(HTTP5.BAD_REQUEST, "APPLE_AUTH_FAILED", "Invalid email in Apple identity token");
+      return setApiResponse5(HTTP5.BAD_REQUEST, p.failed, `Invalid email in ${p.label} identity token`);
     }
-    const upserted = await users.upsertByProvider(normalizedEmail, "apple", claims.sub ?? "");
+    const upserted = await users.upsertByProvider(normalizedEmail, provider, claims.sub ?? "");
     if (!upserted) {
       await loginEvents.recordSafe({
         userId: null,
         emailAttempted: normalizedEmail,
-        method: "oauth-apple",
+        method,
         outcome: "failed",
         failureReason: "provider_upsert_failed",
         ...meta
       });
-      return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", "Apple login failed");
+      return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", `${p.label} login failed`);
     }
     const fullUser = await users.findById(upserted.id);
     if (!fullUser) {
-      return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", "Apple login failed");
+      return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", `${p.label} login failed`);
     }
-    await announceOAuthUpsert(ctx, upserted, "apple", fullUser);
-    const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), { loginMethod: "apple" });
+    await announceOAuthUpsert(ctx, upserted, provider, fullUser);
+    if (fullUser.suspended) {
+      return setApiResponse5(HTTP5.FORBIDDEN, "ACCOUNT_SUSPENDED", "Account suspended. Please contact support.");
+    }
+    if (fullUser.mfaEnabled) {
+      const mfaToken = issueMfaPendingToken(upserted.id, config, provider);
+      return Response.json(
+        {
+          reason: "MFA_REQUIRED",
+          explanation: "Multi-factor authentication required",
+          result: { mfaToken }
+        },
+        { status: 200, headers: cookieHeaders(clearCookies) }
+      );
+    }
+    const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), { loginMethod: provider });
     await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
     await loginEvents.recordSafe({
       userId: upserted.id,
       emailAttempted: normalizedEmail,
-      method: "oauth-apple",
+      method,
       outcome: "success",
       ...meta
     });
     return Response.json(
       {
-        reason: "APPLE_AUTH_SUCCESS",
-        explanation: "Apple authentication successful.",
+        reason: p.success,
+        explanation: `${p.label} authentication successful.`,
         result: {
           tokens: { access: accessToken, refresh: refreshToken },
           user: toUserDTO(fullUser)
@@ -3015,18 +3083,16 @@ function oauthController(store, config, bus) {
       },
       {
         status: 200,
-        headers: cookieHeaders([
-          ...tokenPairCookies(accessToken, refreshToken, config),
-          // One-time value — clear the (SameSite=None) state cookie.
-          "oauth_state=; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=0"
-        ])
+        headers: cookieHeaders([...tokenPairCookies(accessToken, refreshToken, config), ...clearCookies])
       }
     );
   };
+  const APPLE_STATE_CLEAR = "oauth_state=; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=0";
+  const GOOGLE_STATE_CLEAR = "oauth_state=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0";
   return {
     googleInit: async (_ctx) => {
       const google = config.google;
-      if (!google) {
+      if (!google || !google.clientSecret || !google.redirectUri) {
         return setApiResponse5(
           HTTP5.NOT_IMPLEMENTED,
           "NOT_CONFIGURED",
@@ -3061,7 +3127,7 @@ function oauthController(store, config, bus) {
     },
     googleCallback: async (ctx) => {
       const google = config.google;
-      if (!google) {
+      if (!google || !google.clientSecret || !google.redirectUri) {
         return setApiResponse5(
           HTTP5.NOT_IMPLEMENTED,
           "NOT_CONFIGURED",
@@ -3124,57 +3190,11 @@ function oauthController(store, config, bus) {
           "Google account email is not verified"
         );
       }
-      const normalizedEmail = normalizeEmailSafe(payload.email);
-      if (!normalizedEmail) {
-        return setApiResponse5(HTTP5.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "Invalid email in OAuth response");
-      }
-      const meta = requestMeta(ctx);
-      const upserted = await users.upsertByProvider(normalizedEmail, "google", payload.sub ?? "");
-      if (!upserted) {
-        await loginEvents.recordSafe({
-          userId: null,
-          emailAttempted: normalizedEmail,
-          method: "oauth-google",
-          outcome: "failed",
-          failureReason: "provider_upsert_failed",
-          ...meta
-        });
-        return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
-      }
-      const fullUser = await users.findById(upserted.id);
-      if (!fullUser) {
-        return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
-      }
-      await announceOAuthUpsert(ctx, upserted, "google", fullUser);
-      const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
-        loginMethod: "google"
-      });
-      await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
-      await loginEvents.recordSafe({
-        userId: upserted.id,
-        emailAttempted: normalizedEmail,
-        method: "oauth-google",
-        outcome: "success",
-        ...meta
-      });
-      return Response.json(
-        {
-          reason: "GOOGLE_AUTH_SUCCESS",
-          explanation: "Google authentication successful.",
-          result: {
-            tokens: { access: accessToken, refresh: refreshToken },
-            user: toUserDTO(fullUser)
-          }
-        },
-        {
-          status: 200,
-          headers: cookieHeaders([
-            ...tokenPairCookies(accessToken, refreshToken, config),
-            // One-time value — clear it once the flow completes.
-            "oauth_state=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0"
-          ])
-        }
-      );
+      return completeOAuthLogin(ctx, "google", {
+        email: payload.email,
+        sub: payload.sub,
+        emailVerified: payload.email_verified === true
+      }, [GOOGLE_STATE_CLEAR]);
     },
     appleInit: async (_ctx) => {
       const apple = config.apple;
@@ -3247,11 +3267,11 @@ function oauthController(store, config, bus) {
       if (!claims) {
         return setApiResponse5(HTTP5.BAD_REQUEST, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
       }
-      return completeAppleLogin(ctx, {
+      return completeOAuthLogin(ctx, "apple", {
         email: claims.email,
         sub: claims.sub,
         emailVerified: appleEmailVerified(claims)
-      });
+      }, [APPLE_STATE_CLEAR]);
     },
     appleNative: async (ctx) => {
       const apple = config.apple;
@@ -3297,10 +3317,54 @@ function oauthController(store, config, bus) {
         );
       }
       consumedTokens.sweepExpiredSafe();
-      return completeAppleLogin(ctx, {
+      return completeOAuthLogin(ctx, "apple", {
         email: claims.email,
         sub: claims.sub,
         emailVerified: appleEmailVerified(claims)
+      }, [APPLE_STATE_CLEAR]);
+    },
+    // Sign in with Google from a native app: the Google SDK's ID token,
+    // verified here (signature, issuer, audience, expiry), redeemed once.
+    googleNative: async (ctx) => {
+      const audiences = config.google?.nativeClientIds ?? [];
+      if (!config.google || audiences.length === 0) {
+        return setApiResponse5(HTTP5.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Native Google sign-in not configured");
+      }
+      const body = ctx.meta["body"];
+      const idToken = body?.idToken;
+      if (!idToken) {
+        return setApiResponse5(HTTP5.BAD_REQUEST, "INVALID_PARAMETER", "Missing idToken");
+      }
+      const claims = await verifyGoogleIdToken(idToken, { audiences, nonce: body?.nonce });
+      if (!claims) {
+        await loginEvents.recordSafe({
+          userId: null,
+          emailAttempted: null,
+          method: "oauth-google",
+          outcome: "failed",
+          failureReason: "invalid_identity_token",
+          ...requestMeta(ctx)
+        });
+        return setApiResponse5(HTTP5.UNAUTHORIZED, "GOOGLE_AUTH_FAILED", "Invalid Google ID token");
+      }
+      const tokenHash = createHash4("sha256").update(idToken).digest("hex");
+      const expMs = typeof claims.exp === "number" ? claims.exp * 1e3 : Date.now() + 5 * 60 * 1e3;
+      if (!await consumedTokens.consumeOnce(tokenHash, new Date(expMs))) {
+        await loginEvents.recordSafe({
+          userId: null,
+          emailAttempted: claims.email ?? null,
+          method: "oauth-google",
+          outcome: "failed",
+          failureReason: "token_replayed",
+          ...requestMeta(ctx)
+        });
+        return setApiResponse5(HTTP5.UNAUTHORIZED, "GOOGLE_AUTH_FAILED", "This Google ID token has already been used");
+      }
+      consumedTokens.sweepExpiredSafe();
+      return completeOAuthLogin(ctx, "google", {
+        email: claims.email,
+        sub: claims.sub,
+        emailVerified: googleEmailVerified(claims)
       });
     }
   };
@@ -3385,7 +3449,7 @@ function buildAuthRoutes(store, config, bus, locales) {
     R("mfaSetup", "POST", "/auth/mfa/setup", requireAuth, requireEmailLogin, requireVerified, mfa.setup),
     // /auth/mfa/verify accepts both mfaPending tokens (TOTP/backup-code login)
     // and full tokens (setup confirmation), so requireAnyAuth is used here.
-    R("mfaVerify", "POST", "/auth/mfa/verify", ipLimit("mfaVerify"), requireAnyAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.verify),
+    R("mfaVerify", "POST", "/auth/mfa/verify", ipLimit("mfaVerify"), requireAnyAuth, requireEmailLoginUnlessSigningIn, requireVerified, validate(mfaTokenSchema), mfa.verify),
     R("mfaDisable", "POST", "/auth/mfa/disable", requireAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.disable),
     R("mfaBackupCodes", "POST", "/auth/mfa/backup-codes", requireAuth, requireEmailLogin, requireVerified, validate(mfaTokenSchema), mfa.regenerateBackupCodes)
   ];
@@ -3394,7 +3458,9 @@ function buildAuthRoutes(store, config, bus, locales) {
       ["GET", "/auth/google", oauth.googleInit],
       // ipLimit: an unauthenticated caller can otherwise force one outbound
       // token-exchange to Google per request (the state check doesn't gate it).
-      ["GET", "/auth/google/callback", ipLimit("login"), oauth.googleCallback]
+      ["GET", "/auth/google/callback", ipLimit("login"), oauth.googleCallback],
+      // Native (Android/iOS) flow: the app posts the Google SDK's ID token.
+      ["POST", "/auth/google/native", ipLimit("login"), validate(googleNativeSchema), oauth.googleNative]
     );
   }
   if (config.providers.includes("apple")) {
@@ -3460,15 +3526,18 @@ function collectAuthConfigProblems(config) {
   }
   if (config.google) {
     const clientSecret = config.google.clientSecret ?? "";
-    if (!clientSecret || !config.google.clientId || !config.google.redirectUri) {
+    const web = Boolean(clientSecret || config.google.redirectUri);
+    const webComplete = Boolean(clientSecret && config.google.redirectUri);
+    const native = (config.google.nativeClientIds ?? []).filter(Boolean).length > 0;
+    if (!config.google.clientId || web && !webComplete || !webComplete && !native) {
       problems.push({
         module: MODULE,
         severity: "error",
-        message: "google OAuth is configured but clientId, clientSecret, or redirectUri is missing",
+        message: "google OAuth is configured but incomplete: set clientId, and clientSecret + redirectUri (web sign-in) and/or nativeClientIds (app sign-in)",
         domain: "auth",
         reason: "GOOGLE_INCOMPLETE"
       });
-    } else if (PLACEHOLDER_SECRET.test(clientSecret)) {
+    } else if (clientSecret && PLACEHOLDER_SECRET.test(clientSecret)) {
       problems.push({
         module: MODULE,
         severity: "error",
@@ -3477,6 +3546,15 @@ function collectAuthConfigProblems(config) {
         reason: "GOOGLE_SECRET_PLACEHOLDER"
       });
     }
+    if (config.google.nativeClientIds?.some((id) => !id || id.trim() === "" || id.includes("*"))) {
+      problems.push({
+        module: MODULE,
+        severity: "error",
+        message: "google.nativeClientIds must be exact client ids \u2014 empty or wildcard entries would accept ID tokens minted for other apps",
+        domain: "auth",
+        reason: "GOOGLE_NATIVE_IDS_INVALID"
+      });
+    }
   }
   if (config.apple) {
     const a = config.apple;
@@ -3736,7 +3814,7 @@ var AuthModule = class {
   name = "@fonderie/auth";
   // Baked in at build time by tsup.base, so the operator's Modules page can
   // say what is actually deployed rather than 'not reported'.
-  version = "7.20.0";
+  version = "7.21.0";
   // Users, sessions, login history, suspend — only through @fonderie/admin.
   describeAdmin() {
     return { routes: describeAuthAdminRoutes(this.store, this.bus) };