@fonderie/auth 7.22.0 → 7.22.1

package/brain/outcomes.md

@@ -142,7 +142,7 @@ Raw SQL ships in `node_modules/@fonderie/auth/dist/migrations/sql/` — read it
 
 | Method | Path | Middleware chain (auth / validation / handler) |
 |---|---|---|
-| GET | `/_admin/users` | `async (ctx) => { const params = new URL(ctx.request.url).searchParams; const email = params.get('email')?.trim().toLowerCase(); if (email) { const user = await users.findByEmail(email); return user ? setApiResponse(HTTP.OK, 'USER', 'User', toAdminUserDTO(user)) : NOT_FOUND(); } const rawLimit = Number(params.get('limit') ?? 50); const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.trunc(rawLimit), 1), 200) : 50; const cursorParam = params.get('cursor'); const cursor = cursorParam ? decodeLoginCursor(cursorParam) : null; if (cursorParam && !cursor) return setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'Invalid cursor'); const deleted = params.get('deleted') === '1' || params.get('deleted') === 'true'; const page = await users.list({ limit, ...(cursor ? { cursor } : {}), ...(deleted ? { deleted } : {}), }); return setApiResponse(HTTP.OK, 'USERS', 'Users', toAdminUserPageDTO(page)); }` |
+| GET | `/_admin/users` | `async (ctx) => { const params = new URL(ctx.request.url).searchParams; // Accounts are stored under normalizeEmail: a search for the address a // user typed ('Jane+work@x.com') finds the account ('jane@x.com'). const raw = params.get('email')?.trim(); const email = raw ? normalizeEmailSafe(raw) ?? raw.toLowerCase() : undefined; if (email) { const user = await users.findByEmail(email); return user ? setApiResponse(HTTP.OK, 'USER', 'User', toAdminUserDTO(user)) : NOT_FOUND(); } const rawLimit = Number(params.get('limit') ?? 50); const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.trunc(rawLimit), 1), 200) : 50; const cursorParam = params.get('cursor'); const cursor = cursorParam ? decodeLoginCursor(cursorParam) : null; if (cursorParam && !cursor) return setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'Invalid cursor'); const deleted = params.get('deleted') === '1' || params.get('deleted') === 'true'; const page = await users.list({ limit, ...(cursor ? { cursor } : {}), ...(deleted ? { deleted } : {}), }); return setApiResponse(HTTP.OK, 'USERS', 'Users', toAdminUserPageDTO(page)); }` |
 | GET | `/_admin/users/:id` | `async (ctx) => { // Read-only view: a soft-deleted account resolves (deletedAt set), so // an operator arriving from billing sees what happened to it. const user = await users.findByIdIncludingDeleted(idOf(ctx)); return user ? setApiResponse(HTTP.OK, 'USER', 'User', toAdminUserDTO(user)) : NOT_FOUND(); }` |
 | GET | `/_admin/users/:id/login-history` | `async (ctx) => { if (!(await users.findById(idOf(ctx)))) return NOT_FOUND(); const params = new URL(ctx.request.url).searchParams; const rawLimit = Number(params.get('limit') ?? 50); const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.trunc(rawLimit), 1), 200) : 50; const cursorParam = params.get('cursor'); const cursor = cursorParam ? decodeLoginCursor(cursorParam) : null; if (cursorParam && !cursor) return setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'Invalid cursor'); const page = await events.listByUser({ userId: idOf(ctx), limit, ...(cursor ? { cursor } : {}), }); return setApiResponse( HTTP.OK, 'LOGIN_HISTORY', 'Login history', toLoginHistoryPageDTO(page), ); }` |
 | DELETE | `/_admin/users/:id/sessions` | `async (ctx) => { if (!(await users.findById(idOf(ctx)))) return NOT_FOUND(); await sessions.deleteByUser(idOf(ctx)); await background(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: idOf(ctx), sids: null, reason: 'admin' } satisfies ISessionRevokedEvent)); return setApiResponse(HTTP.OK, 'SESSIONS_REVOKED', 'All sessions revoked'); }` |

package/dist/index.cjs

@@ -125,6 +125,41 @@ var import_middlewares = require("@fonderie/core/middlewares");
 
 // src/services/rate-limit.ts
 var import_rate_limit = require("@fonderie/rate-limit");
+
+// src/services/email.ts
+function normalizeEmail(email2) {
+  if (typeof email2 !== "string" || email2.length === 0) {
+    throw new Error("Invalid email");
+  }
+  const lower = email2.trim().toLowerCase();
+  if (lower.length === 0) {
+    throw new Error("Email cannot be empty");
+  }
+  const atIndex = lower.indexOf("@");
+  if (atIndex === -1 || lower.lastIndexOf("@") !== atIndex) {
+    throw new Error("Invalid email format");
+  }
+  const local = lower.substring(0, atIndex);
+  const domain = lower.substring(atIndex + 1);
+  if (!local || !domain) {
+    throw new Error("Invalid email format");
+  }
+  const plusIndex = local.indexOf("+");
+  const normalizedLocal = plusIndex === -1 ? local : local.substring(0, plusIndex);
+  if (!normalizedLocal) {
+    throw new Error("Invalid email format");
+  }
+  return `${normalizedLocal}@${domain}`;
+}
+function normalizeEmailSafe(email2) {
+  try {
+    return normalizeEmail(email2);
+  } catch {
+    return null;
+  }
+}
+
+// src/services/rate-limit.ts
 var min = (n) => n * 60;
 var DEFAULTS = {
   // login: 10/15min per IP AND 5/15min per account (credential stuffing
@@ -177,7 +212,9 @@ function buildAuthAccountLimiter(route, store, config) {
   return (0, import_rate_limit.rateLimit)({
     store: r.store,
     rule: r.account.rule,
-    key: (0, import_rate_limit.byBodyField)(`auth:${route}`, r.account.field)
+    // The account bucket is keyed the way accounts are stored, so a rotating
+    // '+tag' on the same address does not buy fresh attempts.
+    key: (0, import_rate_limit.byBodyField)(`auth:${route}`, r.account.field, r.account.field === "email" ? normalizeEmailSafe : void 0)
   });
 }
 
@@ -1633,39 +1670,6 @@ function checkCooldown(lastSentAt, cooldownMs) {
 // src/controllers/auth.controller.ts
 init_password();
 
-// src/services/email.ts
-function normalizeEmail(email2) {
-  if (typeof email2 !== "string" || email2.length === 0) {
-    throw new Error("Invalid email");
-  }
-  const lower = email2.trim().toLowerCase();
-  if (lower.length === 0) {
-    throw new Error("Email cannot be empty");
-  }
-  const atIndex = lower.indexOf("@");
-  if (atIndex === -1 || lower.lastIndexOf("@") !== atIndex) {
-    throw new Error("Invalid email format");
-  }
-  const local = lower.substring(0, atIndex);
-  const domain = lower.substring(atIndex + 1);
-  if (!local || !domain) {
-    throw new Error("Invalid email format");
-  }
-  const plusIndex = local.indexOf("+");
-  const normalizedLocal = plusIndex === -1 ? local : local.substring(0, plusIndex);
-  if (!normalizedLocal) {
-    throw new Error("Invalid email format");
-  }
-  return `${normalizedLocal}@${domain}`;
-}
-function normalizeEmailSafe(email2) {
-  try {
-    return normalizeEmail(email2);
-  } catch {
-    return null;
-  }
-}
-
 // src/models/password-reset.model.ts
 var import_node_crypto5 = require("crypto");
 var hashSecret = (value) => (0, import_node_crypto5.createHash)("sha256").update(value).digest("hex");
@@ -3355,7 +3359,7 @@ function oauthController(store, config, bus) {
         const meta = requestMeta(ctx);
         await loginEvents.recordSafe({
           userId: null,
-          emailAttempted: claims.email ?? null,
+          emailAttempted: claims.email ? normalizeEmailSafe(claims.email) ?? claims.email : null,
           method: "oauth-apple",
           outcome: "failed",
           failureReason: "token_replayed",
@@ -3403,7 +3407,7 @@ function oauthController(store, config, bus) {
       if (!await consumedTokens.consumeOnce(tokenHash, new Date(expMs))) {
         await loginEvents.recordSafe({
           userId: null,
-          emailAttempted: claims.email ?? null,
+          emailAttempted: claims.email ? normalizeEmailSafe(claims.email) ?? claims.email : null,
           method: "oauth-google",
           outcome: "failed",
           failureReason: "token_replayed",
@@ -3761,7 +3765,8 @@ function adminRouteTable(store, bus) {
       // see anything cannot discover who signed up this morning.
       async (ctx) => {
         const params = new URL(ctx.request.url).searchParams;
-        const email2 = params.get("email")?.trim().toLowerCase();
+        const raw = params.get("email")?.trim();
+        const email2 = raw ? normalizeEmailSafe(raw) ?? raw.toLowerCase() : void 0;
         if (email2) {
           const user = await users.findByEmail(email2);
           return user ? (0, import_core12.setApiResponse)(import_core12.HTTP.OK, "USER", "User", toAdminUserDTO(user)) : NOT_FOUND();
@@ -3865,7 +3870,7 @@ var AuthModule = class {
   name = "@fonderie/auth";
   // Baked in at build time by tsup.base, so the operator's Modules page can
   // say what is actually deployed rather than 'not reported'.
-  version = "7.22.0";
+  version = "7.22.1";
   // Users, sessions, login history, suspend — only through @fonderie/admin.
   describeAdmin() {
     return { routes: describeAuthAdminRoutes(this.store, this.bus) };
@@ -4721,7 +4726,9 @@ async function importUser(store, user) {
     placeholders.push(`$${vals.length}`);
   };
   if (user.id !== void 0) add("id", user.id);
-  add("email", user.email.toLowerCase().trim());
+  const email2 = normalizeEmailSafe(user.email);
+  if (!email2) throw new Error(`[auth] importUser: '${user.email}' is not an email address`);
+  add("email", email2);
   if (user.passwordHash !== void 0) add("password_hash", user.passwordHash);
   if (user.firstName !== void 0) add("first_name", user.firstName);
   if (user.lastName !== void 0) add("last_name", user.lastName);