@fonderie/auth 7.4.0 → 7.6.0

package/dist/index.d.cts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.cjs';
 import { IFonderieModule, IReadinessProblem, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-CvNqy0Kd.cjs';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-CvNqy0Kd.cjs';
+import { I as IAuthConfig } from './session-Bv4qu9xV.cjs';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-Bv4qu9xV.cjs';
 export { IUserDTO, toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';
@@ -63,6 +63,26 @@ declare const DEFAULT_TEMPLATES: {
         html: string;
         text: string;
     };
+    "password-revoked": {
+        subject: string;
+        html: string;
+        text: string;
+    };
+    "oauth-registration": {
+        subject: string;
+        html: string;
+        text: string;
+    };
+    "oauth-linked": {
+        subject: string;
+        html: string;
+        text: string;
+    };
+    "oauth-unlinked": {
+        subject: string;
+        html: string;
+        text: string;
+    };
 };
 
 interface ILoginEventDTO {

package/dist/index.d.ts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.js';
 import { IFonderieModule, IReadinessProblem, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-CvNqy0Kd.js';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-CvNqy0Kd.js';
+import { I as IAuthConfig } from './session-Bv4qu9xV.js';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-Bv4qu9xV.js';
 export { IUserDTO, toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';
@@ -63,6 +63,26 @@ declare const DEFAULT_TEMPLATES: {
         html: string;
         text: string;
     };
+    "password-revoked": {
+        subject: string;
+        html: string;
+        text: string;
+    };
+    "oauth-registration": {
+        subject: string;
+        html: string;
+        text: string;
+    };
+    "oauth-linked": {
+        subject: string;
+        html: string;
+        text: string;
+    };
+    "oauth-unlinked": {
+        subject: string;
+        html: string;
+        text: string;
+    };
 };
 
 interface ILoginEventDTO {

package/dist/index.js

@@ -256,7 +256,21 @@ var MESSAGE_KEYS = {
   mfaDisabled: "mfa-disabled",
   mfaBackupCodesRegenerated: "mfa-backup-codes-regenerated",
   emailChanged: "email-changed",
-  phoneChanged: "phone-changed"
+  phoneChanged: "phone-changed",
+  // Changing HOW an account can be signed into is a security event for the
+  // account's owner, who may not be the person doing it. Both directions are
+  // notified for the same reason password changes are.
+  // A password was REVOKED because the account it sat on had never been
+  // verified and an OAuth identity proved ownership of the mailbox. The
+  // recipient is now known to own that address, so this reaches the right
+  // person — and it is the only way they learn a password stopped working.
+  passwordRevoked: "password-revoked",
+  // Welcome for an account CREATED by an OAuth sign-in. Distinct from
+  // emailRegistration, which carries a verification PIN — an OAuth signup
+  // arrives already verified by the provider and has nothing to confirm.
+  oauthRegistration: "oauth-registration",
+  oauthLinked: "oauth-linked",
+  oauthUnlinked: "oauth-unlinked"
 };
 var EVENT_KEYS = {
   userRegistered: "fonderie.user.registered",
@@ -488,6 +502,8 @@ function toUserDTO(user, phoneVerified = false) {
     isEmailVerified: user.emailVerifiedAt !== null,
     isPhoneVerified: phoneVerified,
     mfaEnabled: booleanOrFalse(user.mfaEnabled),
+    provider: stringOrEmpty(user.provider),
+    hasPassword: user.passwordHash !== null && user.passwordHash !== void 0,
     suspended: booleanOrFalse(user.suspended),
     whitelist: booleanOrFalse(user.whitelist),
     ipWhitelist: Array.isArray(user.ipWhitelist) ? user.ipWhitelist : [],
@@ -515,6 +531,7 @@ var USER_COLUMNS = `
 	ip_whitelist       AS "ipWhitelist",
 	mfa_enabled        AS "mfaEnabled",
 	email_verified_at  AS "emailVerifiedAt",
+	provider,
 	deleted_at         AS "deletedAt",
 	created_at         AS "createdAt",
 	updated_at         AS "updatedAt"
@@ -592,6 +609,31 @@ var UserModel = class {
     );
     return row ?? null;
   }
+  /**
+   * Clear the OAuth provider, but ONLY when the account can still be signed
+   * into afterwards.
+   *
+   * An account created through Google has no password. Unlinking it without
+   * checking would not be "removing a sign-in method" — it would be locking
+   * the owner out permanently, which is account deletion wearing a friendlier
+   * label. The guard lives in the WHERE clause so the check and the write are
+   * one atomic statement: a password cannot be removed between them.
+   *
+   * Returns false when the account has no password (nothing was changed) so
+   * the caller can say why rather than reporting a silent success.
+   */
+  async clearProvider(id) {
+    const rows = await this.store.query(
+      `UPDATE fonderie_users
+			    SET provider = NULL, provider_id = NULL
+			  WHERE id = $1
+			    AND password_hash IS NOT NULL
+			    AND provider IS NOT NULL
+			 RETURNING id`,
+      [id]
+    );
+    return rows.length > 0;
+  }
   async updatePassword(id, passwordHash) {
     await this.store.query(`UPDATE fonderie_users SET password_hash = $1 WHERE id = $2`, [
       passwordHash,
@@ -692,14 +734,71 @@ var UserModel = class {
     );
     return row?.mfa_secret ?? null;
   }
+  /**
+   * Link an OAuth identity to the account owning `email`, creating it if there
+   * is none.
+   *
+   * Returns what HAPPENED, not just who it happened to. Three outcomes hide
+   * behind one upsert, and callers must tell them apart:
+   *
+   *   • `inserted` — a brand-new account. Whoever provisions on signup (the
+   *     personal workspace, a wallet, a welcome email) must run, exactly as
+   *     it does for a password registration. This is the case that was
+   *     previously invisible: the upsert returned an id and looked identical
+   *     to a returning user signing in, so OAuth signups silently skipped
+   *     every signup side effect.
+   *   • `previousProvider` differs — an existing account gained, or switched,
+   *     a way to sign in. A security event for the owner.
+   *   • `previousProvider` is the same — an ordinary login. Nothing to do, and
+   *     notifying here would email the user on every single sign-in.
+   *
+   * The prior state is read in a CTE of the SAME statement, so it sees the
+   * snapshot from before the insert. Reading it in a separate query would
+   * race two concurrent logins into both seeing "new".
+   *
+   * SECURITY — linking is BY EMAIL, so this merges into whatever row already
+   * holds the address. If that row was never verified, its password was never
+   * proven to belong to the mailbox; anyone can register an address they do
+   * not own. The provider HAS proven ownership. So an unverified password is
+   * revoked at the moment of linking: without that, linking sets
+   * email_verified_at and the earlier registrant is left holding a working
+   * password on an account now treated as verified.
+   *
+   * The legitimate user loses nothing but a password reset — they own the
+   * mailbox. Someone who does not own it cannot receive that mail.
+   */
   async upsertByProvider(email2, provider, providerId) {
     const [row] = await this.store.query(
-      `INSERT INTO fonderie_users (email, email_verified_at, provider, provider_id)
-			VALUES ($1, now(), $2, $3)
-			ON CONFLICT (email) DO UPDATE
-			SET provider = $2, provider_id = $3,
-			    email_verified_at = COALESCE(fonderie_users.email_verified_at, now())
-			RETURNING id`,
+      `WITH prior AS (
+				SELECT provider, email_verified_at, password_hash IS NOT NULL AS had_password
+				  FROM fonderie_users WHERE email = $1
+			), upserted AS (
+				INSERT INTO fonderie_users (email, email_verified_at, provider, provider_id)
+				VALUES ($1, now(), $2, $3)
+				ON CONFLICT (email) DO UPDATE
+				SET provider = $2, provider_id = $3,
+				    email_verified_at = COALESCE(fonderie_users.email_verified_at, now()),
+				    -- A password on an UNVERIFIED account is a claim, not a
+				    -- credential: nobody ever proved that mailbox belongs to
+				    -- whoever set it. The provider has now proven it belongs to
+				    -- the person signing in. Drop the unproven claim rather than
+				    -- promote it \u2014 otherwise linking marks the account verified
+				    -- and silently hands the earlier registrant a working
+				    -- password on a now-trusted account.
+				    password_hash = CASE
+				      WHEN fonderie_users.email_verified_at IS NULL THEN NULL
+				      ELSE fonderie_users.password_hash
+				    END
+				RETURNING id
+			)
+			SELECT upserted.id,
+			       NOT EXISTS (SELECT 1 FROM prior)   AS inserted,
+			       (SELECT provider FROM prior)       AS "previousProvider",
+			       -- True only when a password was actually revoked, so the
+			       -- caller can tell the owner their sign-in method changed.
+			       COALESCE((SELECT had_password AND email_verified_at IS NULL FROM prior), false)
+			         AS "clearedUnverifiedPassword"
+			FROM upserted`,
       [email2, provider, providerId]
     );
     return row ?? null;
@@ -2192,6 +2291,50 @@ function userController(store, config, bus) {
       await sessions.deleteByUser(ctx.user.id);
       return setApiResponse4(HTTP4.OK, "PASSWORD_CHANGED", "Password updated successfully.");
     },
+    /**
+     * Remove an OAuth provider from the account.
+     *
+     * Refuses when the account has no password, because unlinking would
+     * then leave NO way to sign in — that is account deletion, not a
+     * settings toggle, and a user clicking "disconnect Google" is not
+     * asking for it. The check is inside the UPDATE's WHERE clause, so a
+     * password cannot disappear between the check and the write.
+     *
+     * Notifies the account's email either way: changing how an account can
+     * be signed into is a security event for its owner, who is not
+     * necessarily the person doing it.
+     */
+    unlinkOauth: async (ctx) => {
+      const provider = String(ctx.meta["params"]?.["provider"] ?? "");
+      const current = await users.findById(ctx.user.id);
+      if (!current?.provider) {
+        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_LINKED", "No sign-in provider is linked.");
+      }
+      if (provider && provider.toLowerCase() !== current.provider.toLowerCase()) {
+        return setApiResponse4(
+          HTTP4.NOT_FOUND,
+          "NOT_LINKED",
+          `This account is not linked to ${provider}.`
+        );
+      }
+      const removed = await users.clearProvider(ctx.user.id);
+      if (!removed) {
+        return setApiResponse4(
+          HTTP4.CONFLICT,
+          "PASSWORD_REQUIRED",
+          "Set a password before disconnecting this provider \u2014 it is currently the only way to sign in."
+        );
+      }
+      if (ctx.user.email) {
+        await background4(bus?.emit(NOTIFICATION_EVENT3, {
+          type: MESSAGE_KEYS.oauthUnlinked,
+          locale: ctx.user.locale,
+          data: { provider: current.provider },
+          recipient: { email: ctx.user.email, phone: null, deviceToken: null }
+        }));
+      }
+      return setApiResponse4(HTTP4.OK, "OAUTH_UNLINKED", "Sign-in provider removed.");
+    },
     deleteMe: async (ctx) => {
       const userId = ctx.user.id;
       await users.softDelete(userId);
@@ -2251,7 +2394,8 @@ function userController(store, config, bus) {
 // src/controllers/oauth.controller.ts
 import { randomBytes as randomBytes4, createPublicKey, createHash as createHash2 } from "crypto";
 import jwt2 from "jsonwebtoken";
-import { setApiResponse as setApiResponse5, HTTP as HTTP5, constantTimeEqual as constantTimeEqual2 } from "@fonderie/core";
+import { setApiResponse as setApiResponse5, HTTP as HTTP5, constantTimeEqual as constantTimeEqual2, background as background5 } from "@fonderie/core";
+import { NOTIFICATION_EVENT as NOTIFICATION_EVENT4 } from "@fonderie/events";
 
 // src/models/consumed-token.model.ts
 var ConsumedTokenModel = class {
@@ -2352,11 +2496,68 @@ async function verifyAppleIdToken(idToken, opts) {
   }
 }
 var appleEmailVerified = (c) => c.email_verified === true || c.email_verified === "true";
-function oauthController(store, config) {
+function oauthController(store, config, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
   const loginEvents = new LoginEventModel(store);
   const consumedTokens = new ConsumedTokenModel(store);
+  const announceOAuthUpsert = async (ctx, upserted, provider, user) => {
+    if (!bus) return;
+    const reqId = ctx.meta["requestId"];
+    const reqOpts = reqId !== void 0 ? { requestId: reqId } : void 0;
+    const label = provider.charAt(0).toUpperCase() + provider.slice(1);
+    const recipient = { email: user.email, phone: null, deviceToken: null };
+    if (upserted.clearedUnverifiedPassword && user.email) {
+      await background5(bus.emit(
+        NOTIFICATION_EVENT4,
+        {
+          type: MESSAGE_KEYS.passwordRevoked,
+          locale: user.locale,
+          data: { provider: label },
+          recipient
+        },
+        reqOpts
+      ));
+    }
+    if (upserted.inserted) {
+      await background5(bus.emit(
+        EVENT_KEYS.userRegistered,
+        {
+          userId: upserted.id,
+          email: user.email,
+          firstName: user.firstName,
+          lastName: user.lastName,
+          loginMethod: provider
+        },
+        reqOpts
+      ));
+      if (user.email) {
+        await background5(bus.emit(
+          NOTIFICATION_EVENT4,
+          {
+            type: MESSAGE_KEYS.oauthRegistration,
+            locale: user.locale,
+            data: { provider: label, appName: config.appName ?? "Fonderie" },
+            recipient
+          },
+          reqOpts
+        ));
+      }
+      return;
+    }
+    if (upserted.previousProvider !== provider && user.email) {
+      await background5(bus.emit(
+        NOTIFICATION_EVENT4,
+        {
+          type: MESSAGE_KEYS.oauthLinked,
+          locale: user.locale,
+          data: { provider: label },
+          recipient
+        },
+        reqOpts
+      ));
+    }
+  };
   const completeAppleLogin = async (ctx, claims) => {
     const meta = requestMeta(ctx);
     if (!claims.email) {
@@ -2385,6 +2586,7 @@ function oauthController(store, config) {
     if (!fullUser) {
       return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", "Apple login failed");
     }
+    await announceOAuthUpsert(ctx, upserted, "apple", fullUser);
     const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, { loginMethod: "apple" });
     await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
     await loginEvents.recordSafe({
@@ -2535,6 +2737,7 @@ function oauthController(store, config) {
       if (!fullUser) {
         return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
       }
+      await announceOAuthUpsert(ctx, upserted, "google", fullUser);
       const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, {
         loginMethod: "google"
       });
@@ -2699,7 +2902,7 @@ function oauthController(store, config) {
 function buildAuthRoutes(store, config, bus) {
   const user = userController(store, config, bus);
   const auth = authController(store, config, bus);
-  const oauth = oauthController(store, config);
+  const oauth = oauthController(store, config, bus);
   const mfa = mfaController(store, config, config.appName ?? "Fonderie", bus);
   const verifyGate = config.requireVerification ? requireVerified : (_ctx, next) => next();
   const passthrough = (_ctx, next) => next();
@@ -2757,6 +2960,9 @@ function buildAuthRoutes(store, config, bus) {
     R("updateEmail", "PUT", "/users/email", requireAuth, verifyGate, validate(updateEmailSchema), user.updateEmail),
     R("updatePhone", "PUT", "/users/phone", requireAuth, verifyGate, validate(updatePhoneSchema), user.updatePhone),
     R("changePassword", "PUT", "/users/password", requireAuth, validate(changePasswordSchema), user.changePassword),
+    // Disconnect an OAuth provider. requireAuth only — the controller
+    // refuses when it would leave the account with no way to sign in.
+    R("unlinkOauth", "DELETE", "/auth/oauth/:provider", requireAuth, user.unlinkOauth),
     R("deleteMe", "DELETE", "/users", requireAuth, verifyGate, user.deleteMe),
     R("exportMe", "GET", "/users/export", requireAuth, user.exportMe),
     // Security surfaces (Protected; the caller's own login history + sessions).
@@ -3069,9 +3275,66 @@ If you made this change, you're all set. If not, contact support right away \u20
 The phone number on your account was just updated.
 
 If you made this change, you're all set. If not, contact support right away \u2014 someone may have access to your account.`
+  },
+  [MESSAGE_KEYS.passwordRevoked]: {
+    subject: "The password on your account was removed",
+    html: `<h1>Your password was removed</h1>
+<p>You just signed in with <strong>{{provider}}</strong>. A password had been set on this account, but this email address had never been confirmed &mdash; so we could not tell who set it, and it has been removed.</p>
+<p>Signing in with {{provider}} works as before. If you want a password as well, set one from your account settings.</p>
+<p class="muted">If you never set a password here, someone else may have tried to register with your address. Nothing further is needed &mdash; the account is yours.</p>`,
+    text: `Your password was removed
+
+You just signed in with {{provider}}. A password had been set on this account,
+but this email address had never been confirmed \u2014 so we could not tell who set
+it, and it has been removed.
+
+Signing in with {{provider}} works as before. If you want a password as well,
+set one from your account settings.
+
+If you never set a password here, someone else may have tried to register with
+your address. Nothing further is needed \u2014 the account is yours.`
+  },
+  [MESSAGE_KEYS.oauthRegistration]: {
+    subject: "Welcome to {{appName}}",
+    html: `<h1>Welcome to {{appName}}</h1>
+<p>Your account was created using <strong>{{provider}}</strong>. Sign in any time with the same {{provider}} account &mdash; there is no password to remember.</p>
+<p class="muted">If you did not create this account, contact support.</p>`,
+    text: `Welcome
+
+Your account was created using {{provider}}. Sign in any time with the same
+{{provider}} account \u2014 there is no password to remember.
+
+If you did not create this account, contact support.`
+  },
+  [MESSAGE_KEYS.oauthLinked]: {
+    subject: "A new sign-in method was added to your account",
+    html: `<h1>{{provider}} sign-in was added</h1>
+<p>Your account can now also be signed into with <strong>{{provider}}</strong>.</p>
+<p class="muted">If you did this, nothing more is needed. If not, contact support right away and change your password &mdash; someone else may be able to sign in as you.</p>`,
+    text: `{{provider}} sign-in was added
+
+Your account can now also be signed into with {{provider}}.
+
+If you did this, nothing more is needed. If not, contact support right away and
+change your password \u2014 someone else may be able to sign in as you.`
+  },
+  [MESSAGE_KEYS.oauthUnlinked]: {
+    subject: "A sign-in method was removed from your account",
+    html: `<h1>{{provider}} sign-in was removed</h1>
+<p><strong>{{provider}}</strong> can no longer be used to sign in. Your email and password still work.</p>
+<p class="muted">If you did this, you&rsquo;re all set. If not, contact support right away.</p>`,
+    text: `{{provider}} sign-in was removed
+
+{{provider}} can no longer be used to sign in. Your email and password still work.
+
+If you did this, you're all set. If not, contact support right away.`
   }
 };
 var SAMPLE_PAYLOADS = {
+  [MESSAGE_KEYS.passwordRevoked]: { provider: "Google" },
+  [MESSAGE_KEYS.oauthRegistration]: { provider: "Google", appName: "Fonderie" },
+  [MESSAGE_KEYS.oauthLinked]: { provider: "Google" },
+  [MESSAGE_KEYS.oauthUnlinked]: { provider: "Google" },
   [MESSAGE_KEYS.emailRegistration]: { firstName: "", pin: "123456" },
   [MESSAGE_KEYS.emailVerification]: { firstName: "Ada", pin: "123456" },
   [MESSAGE_KEYS.passwordReset]: {