@fonderie/auth 7.3.4 → 7.3.5

package/dist/index.js

@@ -235,7 +235,7 @@ function cookieHeaders(cookies) {
 
 // src/controllers/mfa.controller.ts
 import QRCode from "qrcode";
-import { setApiResponse as setApiResponse2, HTTP as HTTP2, background } from "@fonderie/core";
+import { setApiResponse as setApiResponse2, HTTP as HTTP2, background as background2 } from "@fonderie/core";
 import { NOTIFICATION_EVENT } from "@fonderie/events";
 
 // src/config.ts
@@ -836,6 +836,7 @@ var BackupCodeModel = class {
 };
 
 // src/models/login-event.model.ts
+import { background } from "@fonderie/core";
 var LoginEventModel = class {
   constructor(store) {
     this.store = store;
@@ -857,12 +858,13 @@ var LoginEventModel = class {
       ]
     );
   }
-  // Fire-and-forget variant for the login paths: recording history must never
-  // block or fail a login (same posture as the bus.emit(...).catch(() => {})
-  // notification sends).
-  recordSafe(e) {
-    void this.record(e).catch(() => {
-    });
+  // Never throws — recording history must not fail a login. It IS awaited,
+  // though: this is a security audit trail (who signed in, from where), and a
+  // detached write is abandoned when a serverless instance freezes after the
+  // response, losing the row entirely. background() decides whether waiting is
+  // actually necessary for the current runtime.
+  async recordSafe(e) {
+    await background(this.record(e));
   }
   // One page of a user's own login history, newest first. Keyset-paginated on
   // (created_at, id) — mirrors audit's event list so the two log UIs share a
@@ -952,7 +954,7 @@ function mfaController(store, config, issuer, bus) {
       const token = body?.["token"];
       const isLoginCompletion = ctx.user.mfaPending === true;
       const meta = requestMeta(ctx);
-      const failedMfa = () => loginEvents.recordSafe({
+      const failedMfa = async () => await loginEvents.recordSafe({
         userId: ctx.user.id,
         emailAttempted: ctx.user.email,
         method: "mfa",
@@ -970,7 +972,7 @@ function mfaController(store, config, issuer, bus) {
           return setApiResponse2(HTTP2.UNAUTHORIZED, "INVALID_CODE", "Invalid MFA token");
         }
         await users.confirmMfaSecret(ctx.user.id);
-        await background(bus?.emit(NOTIFICATION_EVENT, {
+        await background2(bus?.emit(NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.mfaEnabled,
           locale: ctx.user.locale,
           data: {},
@@ -999,7 +1001,7 @@ function mfaController(store, config, issuer, bus) {
         );
         const matched = checks.find((r) => r.match);
         if (!matched) {
-          if (isLoginCompletion) failedMfa();
+          if (isLoginCompletion) await failedMfa();
           return setApiResponse2(HTTP2.UNAUTHORIZED, "INVALID_CODE", "Invalid backup code");
         }
         await backupCodes.consume(matched.id);
@@ -1017,7 +1019,7 @@ function mfaController(store, config, issuer, bus) {
         }
         const secret = mfaCipher.decrypt(storedSecret);
         if (!verifyTotpToken(token, secret)) {
-          if (isLoginCompletion) failedMfa();
+          if (isLoginCompletion) await failedMfa();
           return setApiResponse2(HTTP2.UNAUTHORIZED, "INVALID_CODE", "Invalid MFA token");
         }
         if (!ctx.user.mfaEnabled) {
@@ -1030,7 +1032,7 @@ function mfaController(store, config, issuer, bus) {
       });
       await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
       if (isLoginCompletion) {
-        loginEvents.recordSafe({
+        await loginEvents.recordSafe({
           userId: ctx.user.id,
           emailAttempted: ctx.user.email,
           method: "mfa",
@@ -1075,7 +1077,7 @@ function mfaController(store, config, issuer, bus) {
       const plainCodes = generateBackupCodes();
       const codeHashes = await Promise.all(plainCodes.map((c) => hashPassword(c)));
       await backupCodes.replace(ctx.user.id, codeHashes);
-      await background(bus?.emit(NOTIFICATION_EVENT, {
+      await background2(bus?.emit(NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.mfaBackupCodesRegenerated,
         locale: ctx.user.locale,
         data: {},
@@ -1102,7 +1104,7 @@ function mfaController(store, config, issuer, bus) {
         return setApiResponse2(HTTP2.UNAUTHORIZED, "INVALID_CODE", "Invalid TOTP code");
       }
       await Promise.all([users.disableMfa(ctx.user.id), backupCodes.deleteByUser(ctx.user.id)]);
-      await background(bus?.emit(NOTIFICATION_EVENT, {
+      await background2(bus?.emit(NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.mfaDisabled,
         locale: user.locale,
         data: {},
@@ -1116,7 +1118,7 @@ function mfaController(store, config, issuer, bus) {
 // src/controllers/auth.controller.ts
 import { randomBytes as randomBytes3, randomInt } from "crypto";
 import { NOTIFICATION_EVENT as NOTIFICATION_EVENT2 } from "@fonderie/events";
-import { setApiResponse as setApiResponse3, HTTP as HTTP3, background as background2 } from "@fonderie/core";
+import { setApiResponse as setApiResponse3, HTTP as HTTP3, background as background3 } from "@fonderie/core";
 
 // src/services/cooldown.ts
 function checkCooldown(lastSentAt, cooldownMs) {
@@ -1363,7 +1365,7 @@ function authController(store, config, bus) {
         }
         const reqId = ctx.meta["requestId"];
         const reqOpts = reqId !== void 0 ? { requestId: reqId } : void 0;
-        await background2(bus?.emit(
+        await background3(bus?.emit(
           NOTIFICATION_EVENT2,
           {
             type: MESSAGE_KEYS.emailRegistration,
@@ -1373,7 +1375,7 @@ function authController(store, config, bus) {
           },
           reqOpts
         ));
-        await background2(bus?.emit(
+        await background3(bus?.emit(
           EVENT_KEYS.userRegistered,
           {
             userId: user.id,
@@ -1425,7 +1427,7 @@ function authController(store, config, bus) {
         }
         const reqId2 = ctx.meta["requestId"];
         const reqOpts2 = reqId2 !== void 0 ? { requestId: reqId2 } : void 0;
-        await background2(bus?.emit(
+        await background3(bus?.emit(
           NOTIFICATION_EVENT2,
           {
             type: MESSAGE_KEYS.phoneOtp,
@@ -1435,7 +1437,7 @@ function authController(store, config, bus) {
           },
           reqOpts2
         ));
-        await background2(bus?.emit(
+        await background3(bus?.emit(
           EVENT_KEYS.userRegistered,
           {
             userId: user.id,
@@ -1476,7 +1478,7 @@ function authController(store, config, bus) {
         }
         const user = await users.findByEmail(email2);
         if (!user || !user.passwordHash) {
-          loginEvents.recordSafe({
+          await loginEvents.recordSafe({
             userId: null,
             emailAttempted: email2,
             method: "password",
@@ -1492,7 +1494,7 @@ function authController(store, config, bus) {
           config.legacyVerify
         );
         if (!valid) {
-          loginEvents.recordSafe({
+          await loginEvents.recordSafe({
             userId: user.id,
             emailAttempted: email2,
             method: "password",
@@ -1522,7 +1524,7 @@ function authController(store, config, bus) {
           loginMethod: "email"
         });
         await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
-        loginEvents.recordSafe({
+        await loginEvents.recordSafe({
           userId: user.id,
           emailAttempted: email2,
           method: "password",
@@ -1563,7 +1565,7 @@ function authController(store, config, bus) {
         const otp = randomInt(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(user.id, normalizePhone(phone2), otp, expiresAt);
-        await background2(bus?.emit(NOTIFICATION_EVENT2, {
+        await background3(bus?.emit(NOTIFICATION_EVENT2, {
           type: MESSAGE_KEYS.phoneOtp,
           locale: user.locale,
           data: { otp },
@@ -1675,7 +1677,7 @@ function authController(store, config, bus) {
       await passwordReset.create(user.id, pin, token, expiresAt);
       const base = resolved.passwordResetUrl;
       const resetUrl = base ? `${base}${base.includes("?") ? "&" : "?"}token=${token}` : "";
-      await background2(bus?.emit(NOTIFICATION_EVENT2, {
+      await background3(bus?.emit(NOTIFICATION_EVENT2, {
         type: MESSAGE_KEYS.passwordReset,
         locale: user.locale,
         recipient: { email: email2, phone: null, deviceToken: null },
@@ -1855,7 +1857,7 @@ function authController(store, config, bus) {
         const otp = randomInt(1e5, 1e6).toString();
         const expiresAt2 = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(ctx.user.id, phone2, otp, expiresAt2);
-        await background2(bus?.emit(NOTIFICATION_EVENT2, {
+        await background3(bus?.emit(NOTIFICATION_EVENT2, {
           type: MESSAGE_KEYS.phoneOtp,
           locale: ctx.user.locale,
           data: { otp },
@@ -1894,7 +1896,7 @@ function authController(store, config, bus) {
       const pin = randomInt(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
-      await background2(bus?.emit(NOTIFICATION_EVENT2, {
+      await background3(bus?.emit(NOTIFICATION_EVENT2, {
         type: MESSAGE_KEYS.emailVerification,
         locale: ctx.user.locale,
         recipient: { email: ctx.user.email, phone: null, deviceToken: null },
@@ -1909,7 +1911,7 @@ function authController(store, config, bus) {
 
 // src/controllers/user.controller.ts
 import { randomInt as randomInt2 } from "crypto";
-import { setApiResponse as setApiResponse4, HTTP as HTTP4, dateOrEmpty as dateOrEmpty2, background as background3 } from "@fonderie/core";
+import { setApiResponse as setApiResponse4, HTTP as HTTP4, dateOrEmpty as dateOrEmpty2, background as background4 } from "@fonderie/core";
 import { NOTIFICATION_EVENT as NOTIFICATION_EVENT3 } from "@fonderie/events";
 
 // src/dtos/login-activity.ts
@@ -2102,14 +2104,14 @@ function userController(store, config, bus) {
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       await users.updateEmail(ctx.user.id, normalised);
-      await background3(bus?.emit(NOTIFICATION_EVENT3, {
+      await background4(bus?.emit(NOTIFICATION_EVENT3, {
         type: MESSAGE_KEYS.emailVerification,
         locale: ctx.user.locale,
         data: { pin },
         recipient: { email: normalised, phone: null, deviceToken: null }
       }));
       if (oldEmail) {
-        await background3(bus?.emit(NOTIFICATION_EVENT3, {
+        await background4(bus?.emit(NOTIFICATION_EVENT3, {
           type: MESSAGE_KEYS.emailChanged,
           locale: ctx.user.locale,
           data: { newEmail: normalised },
@@ -2144,14 +2146,14 @@ function userController(store, config, bus) {
       const expiresAt = new Date(Date.now() + 10 * 60 * 1e3);
       await phoneVerif.upsert(ctx.user.id, normalised, otp, expiresAt);
       await users.updatePhone(ctx.user.id, normalised);
-      await background3(bus?.emit(NOTIFICATION_EVENT3, {
+      await background4(bus?.emit(NOTIFICATION_EVENT3, {
         type: MESSAGE_KEYS.phoneOtp,
         locale: ctx.user.locale,
         data: { otp },
         recipient: { email: null, phone: normalised, deviceToken: null }
       }));
       if (ctx.user.email) {
-        await background3(bus?.emit(NOTIFICATION_EVENT3, {
+        await background4(bus?.emit(NOTIFICATION_EVENT3, {
           type: MESSAGE_KEYS.phoneChanged,
           locale: ctx.user.locale,
           data: {},
@@ -2193,7 +2195,7 @@ function userController(store, config, bus) {
       const userId = ctx.user.id;
       await users.softDelete(userId);
       const reqId = ctx.meta["requestId"];
-      await background3(bus?.emit(
+      await background4(bus?.emit(
         EVENT_KEYS.userDeleted,
         { userId },
         reqId !== void 0 ? { requestId: reqId } : void 0
@@ -2368,7 +2370,7 @@ function oauthController(store, config) {
     }
     const upserted = await users.upsertByProvider(normalizedEmail, "apple", claims.sub ?? "");
     if (!upserted) {
-      loginEvents.recordSafe({
+      await loginEvents.recordSafe({
         userId: null,
         emailAttempted: normalizedEmail,
         method: "oauth-apple",
@@ -2384,7 +2386,7 @@ function oauthController(store, config) {
     }
     const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, { loginMethod: "apple" });
     await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
-    loginEvents.recordSafe({
+    await loginEvents.recordSafe({
       userId: upserted.id,
       emailAttempted: normalizedEmail,
       method: "oauth-apple",
@@ -2518,7 +2520,7 @@ function oauthController(store, config) {
       const meta = requestMeta(ctx);
       const upserted = await users.upsertByProvider(normalizedEmail, "google", payload.sub ?? "");
       if (!upserted) {
-        loginEvents.recordSafe({
+        await loginEvents.recordSafe({
           userId: null,
           emailAttempted: normalizedEmail,
           method: "oauth-google",
@@ -2536,7 +2538,7 @@ function oauthController(store, config) {
         loginMethod: "google"
       });
       await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
-      loginEvents.recordSafe({
+      await loginEvents.recordSafe({
         userId: upserted.id,
         emailAttempted: normalizedEmail,
         method: "oauth-google",
@@ -2653,7 +2655,7 @@ function oauthController(store, config) {
       const claims = await verifyAppleIdToken(identityToken, { audiences, nonce: body?.nonce });
       if (!claims) {
         const meta = requestMeta(ctx);
-        loginEvents.recordSafe({
+        await loginEvents.recordSafe({
           userId: null,
           emailAttempted: null,
           method: "oauth-apple",
@@ -2668,7 +2670,7 @@ function oauthController(store, config) {
       const firstUse = await consumedTokens.consumeOnce(tokenHash, new Date(expMs));
       if (!firstUse) {
         const meta = requestMeta(ctx);
-        loginEvents.recordSafe({
+        await loginEvents.recordSafe({
           userId: null,
           emailAttempted: claims.email ?? null,
           method: "oauth-apple",