@fonderie/auth 7.22.0 → 7.22.1

package/dist/index.js

@@ -74,6 +74,41 @@ import {
   rateLimit,
   StoreAdapterStore
 } from "@fonderie/rate-limit";
+
+// src/services/email.ts
+function normalizeEmail(email2) {
+  if (typeof email2 !== "string" || email2.length === 0) {
+    throw new Error("Invalid email");
+  }
+  const lower = email2.trim().toLowerCase();
+  if (lower.length === 0) {
+    throw new Error("Email cannot be empty");
+  }
+  const atIndex = lower.indexOf("@");
+  if (atIndex === -1 || lower.lastIndexOf("@") !== atIndex) {
+    throw new Error("Invalid email format");
+  }
+  const local = lower.substring(0, atIndex);
+  const domain = lower.substring(atIndex + 1);
+  if (!local || !domain) {
+    throw new Error("Invalid email format");
+  }
+  const plusIndex = local.indexOf("+");
+  const normalizedLocal = plusIndex === -1 ? local : local.substring(0, plusIndex);
+  if (!normalizedLocal) {
+    throw new Error("Invalid email format");
+  }
+  return `${normalizedLocal}@${domain}`;
+}
+function normalizeEmailSafe(email2) {
+  try {
+    return normalizeEmail(email2);
+  } catch {
+    return null;
+  }
+}
+
+// src/services/rate-limit.ts
 var min = (n) => n * 60;
 var DEFAULTS = {
   // login: 10/15min per IP AND 5/15min per account (credential stuffing
@@ -126,7 +161,9 @@ function buildAuthAccountLimiter(route, store, config) {
   return rateLimit({
     store: r.store,
     rule: r.account.rule,
-    key: byBodyField(`auth:${route}`, r.account.field)
+    // The account bucket is keyed the way accounts are stored, so a rotating
+    // '+tag' on the same address does not buy fresh attempts.
+    key: byBodyField(`auth:${route}`, r.account.field, r.account.field === "email" ? normalizeEmailSafe : void 0)
   });
 }
 
@@ -1582,39 +1619,6 @@ function checkCooldown(lastSentAt, cooldownMs) {
 // src/controllers/auth.controller.ts
 init_password();
 
-// src/services/email.ts
-function normalizeEmail(email2) {
-  if (typeof email2 !== "string" || email2.length === 0) {
-    throw new Error("Invalid email");
-  }
-  const lower = email2.trim().toLowerCase();
-  if (lower.length === 0) {
-    throw new Error("Email cannot be empty");
-  }
-  const atIndex = lower.indexOf("@");
-  if (atIndex === -1 || lower.lastIndexOf("@") !== atIndex) {
-    throw new Error("Invalid email format");
-  }
-  const local = lower.substring(0, atIndex);
-  const domain = lower.substring(atIndex + 1);
-  if (!local || !domain) {
-    throw new Error("Invalid email format");
-  }
-  const plusIndex = local.indexOf("+");
-  const normalizedLocal = plusIndex === -1 ? local : local.substring(0, plusIndex);
-  if (!normalizedLocal) {
-    throw new Error("Invalid email format");
-  }
-  return `${normalizedLocal}@${domain}`;
-}
-function normalizeEmailSafe(email2) {
-  try {
-    return normalizeEmail(email2);
-  } catch {
-    return null;
-  }
-}
-
 // src/models/password-reset.model.ts
 import { createHash as createHash3 } from "crypto";
 var hashSecret = (value) => createHash3("sha256").update(value).digest("hex");
@@ -3304,7 +3308,7 @@ function oauthController(store, config, bus) {
         const meta = requestMeta(ctx);
         await loginEvents.recordSafe({
           userId: null,
-          emailAttempted: claims.email ?? null,
+          emailAttempted: claims.email ? normalizeEmailSafe(claims.email) ?? claims.email : null,
           method: "oauth-apple",
           outcome: "failed",
           failureReason: "token_replayed",
@@ -3352,7 +3356,7 @@ function oauthController(store, config, bus) {
       if (!await consumedTokens.consumeOnce(tokenHash, new Date(expMs))) {
         await loginEvents.recordSafe({
           userId: null,
-          emailAttempted: claims.email ?? null,
+          emailAttempted: claims.email ? normalizeEmailSafe(claims.email) ?? claims.email : null,
           method: "oauth-google",
           outcome: "failed",
           failureReason: "token_replayed",
@@ -3710,7 +3714,8 @@ function adminRouteTable(store, bus) {
       // see anything cannot discover who signed up this morning.
       async (ctx) => {
         const params = new URL(ctx.request.url).searchParams;
-        const email2 = params.get("email")?.trim().toLowerCase();
+        const raw = params.get("email")?.trim();
+        const email2 = raw ? normalizeEmailSafe(raw) ?? raw.toLowerCase() : void 0;
         if (email2) {
           const user = await users.findByEmail(email2);
           return user ? setApiResponse7(HTTP7.OK, "USER", "User", toAdminUserDTO(user)) : NOT_FOUND();
@@ -3814,7 +3819,7 @@ var AuthModule = class {
   name = "@fonderie/auth";
   // Baked in at build time by tsup.base, so the operator's Modules page can
   // say what is actually deployed rather than 'not reported'.
-  version = "7.22.0";
+  version = "7.22.1";
   // Users, sessions, login history, suspend — only through @fonderie/admin.
   describeAdmin() {
     return { routes: describeAuthAdminRoutes(this.store, this.bus) };
@@ -4670,7 +4675,9 @@ async function importUser(store, user) {
     placeholders.push(`$${vals.length}`);
   };
   if (user.id !== void 0) add("id", user.id);
-  add("email", user.email.toLowerCase().trim());
+  const email2 = normalizeEmailSafe(user.email);
+  if (!email2) throw new Error(`[auth] importUser: '${user.email}' is not an email address`);
+  add("email", email2);
   if (user.passwordHash !== void 0) add("password_hash", user.passwordHash);
   if (user.firstName !== void 0) add("first_name", user.firstName);
   if (user.lastName !== void 0) add("last_name", user.lastName);