@fonderie/auth 7.3.6 → 7.5.0

package/dist/index.d.cts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.cjs';
 import { IFonderieModule, IReadinessProblem, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-Dc5-JNoW.cjs';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-Dc5-JNoW.cjs';
+import { I as IAuthConfig } from './session-Dwlcgxww.cjs';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-Dwlcgxww.cjs';
 export { IUserDTO, toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';
@@ -63,6 +63,21 @@ declare const DEFAULT_TEMPLATES: {
         html: string;
         text: string;
     };
+    "oauth-registration": {
+        subject: string;
+        html: string;
+        text: string;
+    };
+    "oauth-linked": {
+        subject: string;
+        html: string;
+        text: string;
+    };
+    "oauth-unlinked": {
+        subject: string;
+        html: string;
+        text: string;
+    };
 };
 
 interface ILoginEventDTO {

package/dist/index.d.ts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.js';
 import { IFonderieModule, IReadinessProblem, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-Dc5-JNoW.js';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-Dc5-JNoW.js';
+import { I as IAuthConfig } from './session-Dwlcgxww.js';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-Dwlcgxww.js';
 export { IUserDTO, toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';
@@ -63,6 +63,21 @@ declare const DEFAULT_TEMPLATES: {
         html: string;
         text: string;
     };
+    "oauth-registration": {
+        subject: string;
+        html: string;
+        text: string;
+    };
+    "oauth-linked": {
+        subject: string;
+        html: string;
+        text: string;
+    };
+    "oauth-unlinked": {
+        subject: string;
+        html: string;
+        text: string;
+    };
 };
 
 interface ILoginEventDTO {

package/dist/index.js

@@ -44,6 +44,7 @@ var init_password = __esm({
 });
 
 // src/routes.ts
+import { setApiResponse as setApiResponse6, HTTP as HTTP6 } from "@fonderie/core";
 import { requireAuth, requireAnyAuth, requireVerified } from "@fonderie/core/middlewares";
 
 // src/middlewares/require-email-login.ts
@@ -255,7 +256,16 @@ var MESSAGE_KEYS = {
   mfaDisabled: "mfa-disabled",
   mfaBackupCodesRegenerated: "mfa-backup-codes-regenerated",
   emailChanged: "email-changed",
-  phoneChanged: "phone-changed"
+  phoneChanged: "phone-changed",
+  // Changing HOW an account can be signed into is a security event for the
+  // account's owner, who may not be the person doing it. Both directions are
+  // notified for the same reason password changes are.
+  // Welcome for an account CREATED by an OAuth sign-in. Distinct from
+  // emailRegistration, which carries a verification PIN — an OAuth signup
+  // arrives already verified by the provider and has nothing to confirm.
+  oauthRegistration: "oauth-registration",
+  oauthLinked: "oauth-linked",
+  oauthUnlinked: "oauth-unlinked"
 };
 var EVENT_KEYS = {
   userRegistered: "fonderie.user.registered",
@@ -487,6 +497,8 @@ function toUserDTO(user, phoneVerified = false) {
     isEmailVerified: user.emailVerifiedAt !== null,
     isPhoneVerified: phoneVerified,
     mfaEnabled: booleanOrFalse(user.mfaEnabled),
+    provider: stringOrEmpty(user.provider),
+    hasPassword: user.passwordHash !== null && user.passwordHash !== void 0,
     suspended: booleanOrFalse(user.suspended),
     whitelist: booleanOrFalse(user.whitelist),
     ipWhitelist: Array.isArray(user.ipWhitelist) ? user.ipWhitelist : [],
@@ -514,6 +526,7 @@ var USER_COLUMNS = `
 	ip_whitelist       AS "ipWhitelist",
 	mfa_enabled        AS "mfaEnabled",
 	email_verified_at  AS "emailVerifiedAt",
+	provider,
 	deleted_at         AS "deletedAt",
 	created_at         AS "createdAt",
 	updated_at         AS "updatedAt"
@@ -591,6 +604,31 @@ var UserModel = class {
     );
     return row ?? null;
   }
+  /**
+   * Clear the OAuth provider, but ONLY when the account can still be signed
+   * into afterwards.
+   *
+   * An account created through Google has no password. Unlinking it without
+   * checking would not be "removing a sign-in method" — it would be locking
+   * the owner out permanently, which is account deletion wearing a friendlier
+   * label. The guard lives in the WHERE clause so the check and the write are
+   * one atomic statement: a password cannot be removed between them.
+   *
+   * Returns false when the account has no password (nothing was changed) so
+   * the caller can say why rather than reporting a silent success.
+   */
+  async clearProvider(id) {
+    const rows = await this.store.query(
+      `UPDATE fonderie_users
+			    SET provider = NULL, provider_id = NULL
+			  WHERE id = $1
+			    AND password_hash IS NOT NULL
+			    AND provider IS NOT NULL
+			 RETURNING id`,
+      [id]
+    );
+    return rows.length > 0;
+  }
   async updatePassword(id, passwordHash) {
     await this.store.query(`UPDATE fonderie_users SET password_hash = $1 WHERE id = $2`, [
       passwordHash,
@@ -691,14 +729,44 @@ var UserModel = class {
     );
     return row?.mfa_secret ?? null;
   }
+  /**
+   * Link an OAuth identity to the account owning `email`, creating it if there
+   * is none.
+   *
+   * Returns what HAPPENED, not just who it happened to. Three outcomes hide
+   * behind one upsert, and callers must tell them apart:
+   *
+   *   • `inserted` — a brand-new account. Whoever provisions on signup (the
+   *     personal workspace, a wallet, a welcome email) must run, exactly as
+   *     it does for a password registration. This is the case that was
+   *     previously invisible: the upsert returned an id and looked identical
+   *     to a returning user signing in, so OAuth signups silently skipped
+   *     every signup side effect.
+   *   • `previousProvider` differs — an existing account gained, or switched,
+   *     a way to sign in. A security event for the owner.
+   *   • `previousProvider` is the same — an ordinary login. Nothing to do, and
+   *     notifying here would email the user on every single sign-in.
+   *
+   * The prior state is read in a CTE of the SAME statement, so it sees the
+   * snapshot from before the insert. Reading it in a separate query would
+   * race two concurrent logins into both seeing "new".
+   */
   async upsertByProvider(email2, provider, providerId) {
     const [row] = await this.store.query(
-      `INSERT INTO fonderie_users (email, email_verified_at, provider, provider_id)
-			VALUES ($1, now(), $2, $3)
-			ON CONFLICT (email) DO UPDATE
-			SET provider = $2, provider_id = $3,
-			    email_verified_at = COALESCE(fonderie_users.email_verified_at, now())
-			RETURNING id`,
+      `WITH prior AS (
+				SELECT provider FROM fonderie_users WHERE email = $1
+			), upserted AS (
+				INSERT INTO fonderie_users (email, email_verified_at, provider, provider_id)
+				VALUES ($1, now(), $2, $3)
+				ON CONFLICT (email) DO UPDATE
+				SET provider = $2, provider_id = $3,
+				    email_verified_at = COALESCE(fonderie_users.email_verified_at, now())
+				RETURNING id
+			)
+			SELECT upserted.id,
+			       NOT EXISTS (SELECT 1 FROM prior)   AS inserted,
+			       (SELECT provider FROM prior)       AS "previousProvider"
+			FROM upserted`,
       [email2, provider, providerId]
     );
     return row ?? null;
@@ -2191,6 +2259,50 @@ function userController(store, config, bus) {
       await sessions.deleteByUser(ctx.user.id);
       return setApiResponse4(HTTP4.OK, "PASSWORD_CHANGED", "Password updated successfully.");
     },
+    /**
+     * Remove an OAuth provider from the account.
+     *
+     * Refuses when the account has no password, because unlinking would
+     * then leave NO way to sign in — that is account deletion, not a
+     * settings toggle, and a user clicking "disconnect Google" is not
+     * asking for it. The check is inside the UPDATE's WHERE clause, so a
+     * password cannot disappear between the check and the write.
+     *
+     * Notifies the account's email either way: changing how an account can
+     * be signed into is a security event for its owner, who is not
+     * necessarily the person doing it.
+     */
+    unlinkOauth: async (ctx) => {
+      const provider = String(ctx.meta["params"]?.["provider"] ?? "");
+      const current = await users.findById(ctx.user.id);
+      if (!current?.provider) {
+        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_LINKED", "No sign-in provider is linked.");
+      }
+      if (provider && provider.toLowerCase() !== current.provider.toLowerCase()) {
+        return setApiResponse4(
+          HTTP4.NOT_FOUND,
+          "NOT_LINKED",
+          `This account is not linked to ${provider}.`
+        );
+      }
+      const removed = await users.clearProvider(ctx.user.id);
+      if (!removed) {
+        return setApiResponse4(
+          HTTP4.CONFLICT,
+          "PASSWORD_REQUIRED",
+          "Set a password before disconnecting this provider \u2014 it is currently the only way to sign in."
+        );
+      }
+      if (ctx.user.email) {
+        await background4(bus?.emit(NOTIFICATION_EVENT3, {
+          type: MESSAGE_KEYS.oauthUnlinked,
+          locale: ctx.user.locale,
+          data: { provider: current.provider },
+          recipient: { email: ctx.user.email, phone: null, deviceToken: null }
+        }));
+      }
+      return setApiResponse4(HTTP4.OK, "OAUTH_UNLINKED", "Sign-in provider removed.");
+    },
     deleteMe: async (ctx) => {
       const userId = ctx.user.id;
       await users.softDelete(userId);
@@ -2250,7 +2362,8 @@ function userController(store, config, bus) {
 // src/controllers/oauth.controller.ts
 import { randomBytes as randomBytes4, createPublicKey, createHash as createHash2 } from "crypto";
 import jwt2 from "jsonwebtoken";
-import { setApiResponse as setApiResponse5, HTTP as HTTP5, constantTimeEqual as constantTimeEqual2 } from "@fonderie/core";
+import { setApiResponse as setApiResponse5, HTTP as HTTP5, constantTimeEqual as constantTimeEqual2, background as background5 } from "@fonderie/core";
+import { NOTIFICATION_EVENT as NOTIFICATION_EVENT4 } from "@fonderie/events";
 
 // src/models/consumed-token.model.ts
 var ConsumedTokenModel = class {
@@ -2351,11 +2464,56 @@ async function verifyAppleIdToken(idToken, opts) {
   }
 }
 var appleEmailVerified = (c) => c.email_verified === true || c.email_verified === "true";
-function oauthController(store, config) {
+function oauthController(store, config, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
   const loginEvents = new LoginEventModel(store);
   const consumedTokens = new ConsumedTokenModel(store);
+  const announceOAuthUpsert = async (ctx, upserted, provider, user) => {
+    if (!bus) return;
+    const reqId = ctx.meta["requestId"];
+    const reqOpts = reqId !== void 0 ? { requestId: reqId } : void 0;
+    const label = provider.charAt(0).toUpperCase() + provider.slice(1);
+    const recipient = { email: user.email, phone: null, deviceToken: null };
+    if (upserted.inserted) {
+      await background5(bus.emit(
+        EVENT_KEYS.userRegistered,
+        {
+          userId: upserted.id,
+          email: user.email,
+          firstName: user.firstName,
+          lastName: user.lastName,
+          loginMethod: provider
+        },
+        reqOpts
+      ));
+      if (user.email) {
+        await background5(bus.emit(
+          NOTIFICATION_EVENT4,
+          {
+            type: MESSAGE_KEYS.oauthRegistration,
+            locale: user.locale,
+            data: { provider: label, appName: config.appName ?? "Fonderie" },
+            recipient
+          },
+          reqOpts
+        ));
+      }
+      return;
+    }
+    if (upserted.previousProvider !== provider && user.email) {
+      await background5(bus.emit(
+        NOTIFICATION_EVENT4,
+        {
+          type: MESSAGE_KEYS.oauthLinked,
+          locale: user.locale,
+          data: { provider: label },
+          recipient
+        },
+        reqOpts
+      ));
+    }
+  };
   const completeAppleLogin = async (ctx, claims) => {
     const meta = requestMeta(ctx);
     if (!claims.email) {
@@ -2384,6 +2542,7 @@ function oauthController(store, config) {
     if (!fullUser) {
       return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", "Apple login failed");
     }
+    await announceOAuthUpsert(ctx, upserted, "apple", fullUser);
     const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, { loginMethod: "apple" });
     await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
     await loginEvents.recordSafe({
@@ -2534,6 +2693,7 @@ function oauthController(store, config) {
       if (!fullUser) {
         return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
       }
+      await announceOAuthUpsert(ctx, upserted, "google", fullUser);
       const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, {
         loginMethod: "google"
       });
@@ -2698,7 +2858,7 @@ function oauthController(store, config) {
 function buildAuthRoutes(store, config, bus) {
   const user = userController(store, config, bus);
   const auth = authController(store, config, bus);
-  const oauth = oauthController(store, config);
+  const oauth = oauthController(store, config, bus);
   const mfa = mfaController(store, config, config.appName ?? "Fonderie", bus);
   const verifyGate = config.requireVerification ? requireVerified : (_ctx, next) => next();
   const passthrough = (_ctx, next) => next();
@@ -2711,6 +2871,27 @@ function buildAuthRoutes(store, config, bus) {
     return [o.method ?? method, o.path ?? path, ...handlers];
   };
   const routes = [
+    // Which sign-in methods this deployment can actually honour (Public).
+    //
+    // A frontend has to decide which buttons to draw, and the only honest
+    // source is the side holding the credentials. The alternative — a
+    // build-time flag in the app — stores the same fact twice and lets the
+    // two disagree; the symptom is a user clicking a provider the server
+    // cannot complete and landing on the provider's error page, which the
+    // app cannot explain.
+    //
+    // Public and unauthenticated on purpose: the login screen needs it
+    // before anyone has signed in. It discloses nothing a visitor could not
+    // learn by looking at the buttons, and deliberately nothing else — no
+    // client ids, no redirect URIs, no module inventory.
+    R(
+      "providers",
+      "GET",
+      "/auth/providers",
+      async () => setApiResponse6(HTTP6.OK, "AUTH_PROVIDERS", "Sign-in methods available here", {
+        providers: [...config.providers]
+      })
+    ),
     // Registration & Login (Public)
     R("register", "POST", "/auth/register", ipLimit("register"), validate(registerSchema), auth.register),
     R("login", "POST", "/auth/login", ipLimit("login"), validate(loginSchema), acctLimit("login"), auth.login),
@@ -2735,6 +2916,9 @@ function buildAuthRoutes(store, config, bus) {
     R("updateEmail", "PUT", "/users/email", requireAuth, verifyGate, validate(updateEmailSchema), user.updateEmail),
     R("updatePhone", "PUT", "/users/phone", requireAuth, verifyGate, validate(updatePhoneSchema), user.updatePhone),
     R("changePassword", "PUT", "/users/password", requireAuth, validate(changePasswordSchema), user.changePassword),
+    // Disconnect an OAuth provider. requireAuth only — the controller
+    // refuses when it would leave the account with no way to sign in.
+    R("unlinkOauth", "DELETE", "/auth/oauth/:provider", requireAuth, user.unlinkOauth),
     R("deleteMe", "DELETE", "/users", requireAuth, verifyGate, user.deleteMe),
     R("exportMe", "GET", "/users/export", requireAuth, user.exportMe),
     // Security surfaces (Protected; the caller's own login history + sessions).
@@ -3047,9 +3231,47 @@ If you made this change, you're all set. If not, contact support right away \u20
 The phone number on your account was just updated.
 
 If you made this change, you're all set. If not, contact support right away \u2014 someone may have access to your account.`
+  },
+  [MESSAGE_KEYS.oauthRegistration]: {
+    subject: "Welcome to {{appName}}",
+    html: `<h1>Welcome to {{appName}}</h1>
+<p>Your account was created using <strong>{{provider}}</strong>. Sign in any time with the same {{provider}} account &mdash; there is no password to remember.</p>
+<p class="muted">If you did not create this account, contact support.</p>`,
+    text: `Welcome
+
+Your account was created using {{provider}}. Sign in any time with the same
+{{provider}} account \u2014 there is no password to remember.
+
+If you did not create this account, contact support.`
+  },
+  [MESSAGE_KEYS.oauthLinked]: {
+    subject: "A new sign-in method was added to your account",
+    html: `<h1>{{provider}} sign-in was added</h1>
+<p>Your account can now also be signed into with <strong>{{provider}}</strong>.</p>
+<p class="muted">If you did this, nothing more is needed. If not, contact support right away and change your password &mdash; someone else may be able to sign in as you.</p>`,
+    text: `{{provider}} sign-in was added
+
+Your account can now also be signed into with {{provider}}.
+
+If you did this, nothing more is needed. If not, contact support right away and
+change your password \u2014 someone else may be able to sign in as you.`
+  },
+  [MESSAGE_KEYS.oauthUnlinked]: {
+    subject: "A sign-in method was removed from your account",
+    html: `<h1>{{provider}} sign-in was removed</h1>
+<p><strong>{{provider}}</strong> can no longer be used to sign in. Your email and password still work.</p>
+<p class="muted">If you did this, you&rsquo;re all set. If not, contact support right away.</p>`,
+    text: `{{provider}} sign-in was removed
+
+{{provider}} can no longer be used to sign in. Your email and password still work.
+
+If you did this, you're all set. If not, contact support right away.`
   }
 };
 var SAMPLE_PAYLOADS = {
+  [MESSAGE_KEYS.oauthRegistration]: { provider: "Google", appName: "Fonderie" },
+  [MESSAGE_KEYS.oauthLinked]: { provider: "Google" },
+  [MESSAGE_KEYS.oauthUnlinked]: { provider: "Google" },
   [MESSAGE_KEYS.emailRegistration]: { firstName: "", pin: "123456" },
   [MESSAGE_KEYS.emailVerification]: { firstName: "Ada", pin: "123456" },
   [MESSAGE_KEYS.passwordReset]: {