@fonderie/auth 7.3.3 → 7.3.5

package/dist/index.js

@@ -235,7 +235,7 @@ function cookieHeaders(cookies) {
 
 // src/controllers/mfa.controller.ts
 import QRCode from "qrcode";
-import { setApiResponse as setApiResponse2, HTTP as HTTP2 } from "@fonderie/core";
+import { setApiResponse as setApiResponse2, HTTP as HTTP2, background as background2 } from "@fonderie/core";
 import { NOTIFICATION_EVENT } from "@fonderie/events";
 
 // src/config.ts
@@ -836,6 +836,7 @@ var BackupCodeModel = class {
 };
 
 // src/models/login-event.model.ts
+import { background } from "@fonderie/core";
 var LoginEventModel = class {
   constructor(store) {
     this.store = store;
@@ -857,12 +858,13 @@ var LoginEventModel = class {
       ]
     );
   }
-  // Fire-and-forget variant for the login paths: recording history must never
-  // block or fail a login (same posture as the bus.emit(...).catch(() => {})
-  // notification sends).
-  recordSafe(e) {
-    void this.record(e).catch(() => {
-    });
+  // Never throws — recording history must not fail a login. It IS awaited,
+  // though: this is a security audit trail (who signed in, from where), and a
+  // detached write is abandoned when a serverless instance freezes after the
+  // response, losing the row entirely. background() decides whether waiting is
+  // actually necessary for the current runtime.
+  async recordSafe(e) {
+    await background(this.record(e));
   }
   // One page of a user's own login history, newest first. Keyset-paginated on
   // (created_at, id) — mirrors audit's event list so the two log UIs share a
@@ -952,7 +954,7 @@ function mfaController(store, config, issuer, bus) {
       const token = body?.["token"];
       const isLoginCompletion = ctx.user.mfaPending === true;
       const meta = requestMeta(ctx);
-      const failedMfa = () => loginEvents.recordSafe({
+      const failedMfa = async () => await loginEvents.recordSafe({
         userId: ctx.user.id,
         emailAttempted: ctx.user.email,
         method: "mfa",
@@ -970,13 +972,12 @@ function mfaController(store, config, issuer, bus) {
           return setApiResponse2(HTTP2.UNAUTHORIZED, "INVALID_CODE", "Invalid MFA token");
         }
         await users.confirmMfaSecret(ctx.user.id);
-        bus?.emit(NOTIFICATION_EVENT, {
+        await background2(bus?.emit(NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.mfaEnabled,
           locale: ctx.user.locale,
           data: {},
           recipient: { email: ctx.user.email, phone: null, deviceToken: null }
-        }).catch(() => {
-        });
+        }));
         return setApiResponse2(HTTP2.OK, "MFA_VERIFIED", "MFA verified successfully.", {
           mfaEnabled: true
         });
@@ -1000,7 +1001,7 @@ function mfaController(store, config, issuer, bus) {
         );
         const matched = checks.find((r) => r.match);
         if (!matched) {
-          if (isLoginCompletion) failedMfa();
+          if (isLoginCompletion) await failedMfa();
           return setApiResponse2(HTTP2.UNAUTHORIZED, "INVALID_CODE", "Invalid backup code");
         }
         await backupCodes.consume(matched.id);
@@ -1018,7 +1019,7 @@ function mfaController(store, config, issuer, bus) {
         }
         const secret = mfaCipher.decrypt(storedSecret);
         if (!verifyTotpToken(token, secret)) {
-          if (isLoginCompletion) failedMfa();
+          if (isLoginCompletion) await failedMfa();
           return setApiResponse2(HTTP2.UNAUTHORIZED, "INVALID_CODE", "Invalid MFA token");
         }
         if (!ctx.user.mfaEnabled) {
@@ -1031,7 +1032,7 @@ function mfaController(store, config, issuer, bus) {
       });
       await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
       if (isLoginCompletion) {
-        loginEvents.recordSafe({
+        await loginEvents.recordSafe({
           userId: ctx.user.id,
           emailAttempted: ctx.user.email,
           method: "mfa",
@@ -1076,13 +1077,12 @@ function mfaController(store, config, issuer, bus) {
       const plainCodes = generateBackupCodes();
       const codeHashes = await Promise.all(plainCodes.map((c) => hashPassword(c)));
       await backupCodes.replace(ctx.user.id, codeHashes);
-      bus?.emit(NOTIFICATION_EVENT, {
+      await background2(bus?.emit(NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.mfaBackupCodesRegenerated,
         locale: ctx.user.locale,
         data: {},
         recipient: { email: ctx.user.email, phone: null, deviceToken: null }
-      }).catch(() => {
-      });
+      }));
       return setApiResponse2(HTTP2.OK, "BACKUP_CODES_REGENERATED", "Backup codes regenerated.", {
         backupCodes: plainCodes
       });
@@ -1104,13 +1104,12 @@ function mfaController(store, config, issuer, bus) {
         return setApiResponse2(HTTP2.UNAUTHORIZED, "INVALID_CODE", "Invalid TOTP code");
       }
       await Promise.all([users.disableMfa(ctx.user.id), backupCodes.deleteByUser(ctx.user.id)]);
-      bus?.emit(NOTIFICATION_EVENT, {
+      await background2(bus?.emit(NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.mfaDisabled,
         locale: user.locale,
         data: {},
         recipient: { email: user.email, phone: null, deviceToken: null }
-      }).catch(() => {
-      });
+      }));
       return setApiResponse2(HTTP2.OK, "MFA_DISABLED", "MFA disabled successfully.");
     }
   };
@@ -1119,7 +1118,7 @@ function mfaController(store, config, issuer, bus) {
 // src/controllers/auth.controller.ts
 import { randomBytes as randomBytes3, randomInt } from "crypto";
 import { NOTIFICATION_EVENT as NOTIFICATION_EVENT2 } from "@fonderie/events";
-import { setApiResponse as setApiResponse3, HTTP as HTTP3 } from "@fonderie/core";
+import { setApiResponse as setApiResponse3, HTTP as HTTP3, background as background3 } from "@fonderie/core";
 
 // src/services/cooldown.ts
 function checkCooldown(lastSentAt, cooldownMs) {
@@ -1366,7 +1365,7 @@ function authController(store, config, bus) {
         }
         const reqId = ctx.meta["requestId"];
         const reqOpts = reqId !== void 0 ? { requestId: reqId } : void 0;
-        bus?.emit(
+        await background3(bus?.emit(
           NOTIFICATION_EVENT2,
           {
             type: MESSAGE_KEYS.emailRegistration,
@@ -1375,9 +1374,8 @@ function authController(store, config, bus) {
             recipient: { email: normalizedEmail, phone: null, deviceToken: null }
           },
           reqOpts
-        ).catch(() => {
-        });
-        bus?.emit(
+        ));
+        await background3(bus?.emit(
           EVENT_KEYS.userRegistered,
           {
             userId: user.id,
@@ -1387,8 +1385,7 @@ function authController(store, config, bus) {
             loginMethod: "email"
           },
           reqOpts
-        ).catch(() => {
-        });
+        ));
         const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "email"
         });
@@ -1430,7 +1427,7 @@ function authController(store, config, bus) {
         }
         const reqId2 = ctx.meta["requestId"];
         const reqOpts2 = reqId2 !== void 0 ? { requestId: reqId2 } : void 0;
-        bus?.emit(
+        await background3(bus?.emit(
           NOTIFICATION_EVENT2,
           {
             type: MESSAGE_KEYS.phoneOtp,
@@ -1439,9 +1436,8 @@ function authController(store, config, bus) {
             recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
           },
           reqOpts2
-        ).catch(() => {
-        });
-        bus?.emit(
+        ));
+        await background3(bus?.emit(
           EVENT_KEYS.userRegistered,
           {
             userId: user.id,
@@ -1451,8 +1447,7 @@ function authController(store, config, bus) {
             loginMethod: "phone"
           },
           reqOpts2
-        ).catch(() => {
-        });
+        ));
         const otpToken = issueMfaPendingToken(user.id, config, "phone");
         return Response.json(
           {
@@ -1483,7 +1478,7 @@ function authController(store, config, bus) {
         }
         const user = await users.findByEmail(email2);
         if (!user || !user.passwordHash) {
-          loginEvents.recordSafe({
+          await loginEvents.recordSafe({
             userId: null,
             emailAttempted: email2,
             method: "password",
@@ -1499,7 +1494,7 @@ function authController(store, config, bus) {
           config.legacyVerify
         );
         if (!valid) {
-          loginEvents.recordSafe({
+          await loginEvents.recordSafe({
             userId: user.id,
             emailAttempted: email2,
             method: "password",
@@ -1529,7 +1524,7 @@ function authController(store, config, bus) {
           loginMethod: "email"
         });
         await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
-        loginEvents.recordSafe({
+        await loginEvents.recordSafe({
           userId: user.id,
           emailAttempted: email2,
           method: "password",
@@ -1570,13 +1565,12 @@ function authController(store, config, bus) {
         const otp = randomInt(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(user.id, normalizePhone(phone2), otp, expiresAt);
-        bus?.emit(NOTIFICATION_EVENT2, {
+        await background3(bus?.emit(NOTIFICATION_EVENT2, {
           type: MESSAGE_KEYS.phoneOtp,
           locale: user.locale,
           data: { otp },
           recipient: { email: null, phone: normalizePhone(phone2), deviceToken: null }
-        }).catch(() => {
-        });
+        }));
         const otpToken = issueMfaPendingToken(user.id, config, "phone");
         return Response.json(
           {
@@ -1683,13 +1677,12 @@ function authController(store, config, bus) {
       await passwordReset.create(user.id, pin, token, expiresAt);
       const base = resolved.passwordResetUrl;
       const resetUrl = base ? `${base}${base.includes("?") ? "&" : "?"}token=${token}` : "";
-      bus?.emit(NOTIFICATION_EVENT2, {
+      await background3(bus?.emit(NOTIFICATION_EVENT2, {
         type: MESSAGE_KEYS.passwordReset,
         locale: user.locale,
         recipient: { email: email2, phone: null, deviceToken: null },
         data: { pin, token, resetUrl }
-      }).catch(() => {
-      });
+      }));
       return setApiResponse3(
         HTTP3.OK,
         "PASSWORD_RESET_EMAIL_SENT",
@@ -1864,13 +1857,12 @@ function authController(store, config, bus) {
         const otp = randomInt(1e5, 1e6).toString();
         const expiresAt2 = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(ctx.user.id, phone2, otp, expiresAt2);
-        bus?.emit(NOTIFICATION_EVENT2, {
+        await background3(bus?.emit(NOTIFICATION_EVENT2, {
           type: MESSAGE_KEYS.phoneOtp,
           locale: ctx.user.locale,
           data: { otp },
           recipient: { email: null, phone: phone2, deviceToken: null }
-        }).catch(() => {
-        });
+        }));
         return setApiResponse3(
           HTTP3.OK,
           "VERIFICATION_SENT",
@@ -1904,13 +1896,12 @@ function authController(store, config, bus) {
       const pin = randomInt(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
-      bus?.emit(NOTIFICATION_EVENT2, {
+      await background3(bus?.emit(NOTIFICATION_EVENT2, {
         type: MESSAGE_KEYS.emailVerification,
         locale: ctx.user.locale,
         recipient: { email: ctx.user.email, phone: null, deviceToken: null },
         data: { pin }
-      }).catch(() => {
-      });
+      }));
       return setApiResponse3(HTTP3.OK, "VERIFICATION_SENT", "Verification email sent.", {
         email: ctx.user.email
       });
@@ -1920,7 +1911,7 @@ function authController(store, config, bus) {
 
 // src/controllers/user.controller.ts
 import { randomInt as randomInt2 } from "crypto";
-import { setApiResponse as setApiResponse4, HTTP as HTTP4, dateOrEmpty as dateOrEmpty2 } from "@fonderie/core";
+import { setApiResponse as setApiResponse4, HTTP as HTTP4, dateOrEmpty as dateOrEmpty2, background as background4 } from "@fonderie/core";
 import { NOTIFICATION_EVENT as NOTIFICATION_EVENT3 } from "@fonderie/events";
 
 // src/dtos/login-activity.ts
@@ -2113,21 +2104,19 @@ function userController(store, config, bus) {
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       await users.updateEmail(ctx.user.id, normalised);
-      bus?.emit(NOTIFICATION_EVENT3, {
+      await background4(bus?.emit(NOTIFICATION_EVENT3, {
         type: MESSAGE_KEYS.emailVerification,
         locale: ctx.user.locale,
         data: { pin },
         recipient: { email: normalised, phone: null, deviceToken: null }
-      }).catch(() => {
-      });
+      }));
       if (oldEmail) {
-        bus?.emit(NOTIFICATION_EVENT3, {
+        await background4(bus?.emit(NOTIFICATION_EVENT3, {
           type: MESSAGE_KEYS.emailChanged,
           locale: ctx.user.locale,
           data: { newEmail: normalised },
           recipient: { email: oldEmail, phone: null, deviceToken: null }
-        }).catch(() => {
-        });
+        }));
       }
       return setApiResponse4(
         HTTP4.OK,
@@ -2157,21 +2146,19 @@ function userController(store, config, bus) {
       const expiresAt = new Date(Date.now() + 10 * 60 * 1e3);
       await phoneVerif.upsert(ctx.user.id, normalised, otp, expiresAt);
       await users.updatePhone(ctx.user.id, normalised);
-      bus?.emit(NOTIFICATION_EVENT3, {
+      await background4(bus?.emit(NOTIFICATION_EVENT3, {
         type: MESSAGE_KEYS.phoneOtp,
         locale: ctx.user.locale,
         data: { otp },
         recipient: { email: null, phone: normalised, deviceToken: null }
-      }).catch(() => {
-      });
+      }));
       if (ctx.user.email) {
-        bus?.emit(NOTIFICATION_EVENT3, {
+        await background4(bus?.emit(NOTIFICATION_EVENT3, {
           type: MESSAGE_KEYS.phoneChanged,
           locale: ctx.user.locale,
           data: {},
           recipient: { email: ctx.user.email, phone: null, deviceToken: null }
-        }).catch(() => {
-        });
+        }));
       }
       return setApiResponse4(
         HTTP4.OK,
@@ -2208,12 +2195,11 @@ function userController(store, config, bus) {
       const userId = ctx.user.id;
       await users.softDelete(userId);
       const reqId = ctx.meta["requestId"];
-      bus?.emit(
+      await background4(bus?.emit(
         EVENT_KEYS.userDeleted,
         { userId },
         reqId !== void 0 ? { requestId: reqId } : void 0
-      ).catch(() => {
-      });
+      ));
       return Response.json(
         { reason: "ACCOUNT_DELETED", explanation: "Account successfully deleted." },
         {
@@ -2384,7 +2370,7 @@ function oauthController(store, config) {
     }
     const upserted = await users.upsertByProvider(normalizedEmail, "apple", claims.sub ?? "");
     if (!upserted) {
-      loginEvents.recordSafe({
+      await loginEvents.recordSafe({
         userId: null,
         emailAttempted: normalizedEmail,
         method: "oauth-apple",
@@ -2400,7 +2386,7 @@ function oauthController(store, config) {
     }
     const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, { loginMethod: "apple" });
     await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
-    loginEvents.recordSafe({
+    await loginEvents.recordSafe({
       userId: upserted.id,
       emailAttempted: normalizedEmail,
       method: "oauth-apple",
@@ -2534,7 +2520,7 @@ function oauthController(store, config) {
       const meta = requestMeta(ctx);
       const upserted = await users.upsertByProvider(normalizedEmail, "google", payload.sub ?? "");
       if (!upserted) {
-        loginEvents.recordSafe({
+        await loginEvents.recordSafe({
           userId: null,
           emailAttempted: normalizedEmail,
           method: "oauth-google",
@@ -2552,7 +2538,7 @@ function oauthController(store, config) {
         loginMethod: "google"
       });
       await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
-      loginEvents.recordSafe({
+      await loginEvents.recordSafe({
         userId: upserted.id,
         emailAttempted: normalizedEmail,
         method: "oauth-google",
@@ -2669,7 +2655,7 @@ function oauthController(store, config) {
       const claims = await verifyAppleIdToken(identityToken, { audiences, nonce: body?.nonce });
       if (!claims) {
         const meta = requestMeta(ctx);
-        loginEvents.recordSafe({
+        await loginEvents.recordSafe({
           userId: null,
           emailAttempted: null,
           method: "oauth-apple",
@@ -2684,7 +2670,7 @@ function oauthController(store, config) {
       const firstUse = await consumedTokens.consumeOnce(tokenHash, new Date(expMs));
       if (!firstUse) {
         const meta = requestMeta(ctx);
-        loginEvents.recordSafe({
+        await loginEvents.recordSafe({
           userId: null,
           emailAttempted: claims.email ?? null,
           method: "oauth-apple",