@fonderie/auth 7.5.0 → 7.6.0

package/brain/signatures.md

@@ -100,11 +100,11 @@ interface IDataExportContributor {
 
 const AUTH_CONFIG_KEYS: { sessionDuration: string; verificationCooldown: string; mfa: string; requireVerification: string; }
 
-const MESSAGE_KEYS: { readonly emailRegistration: "email-registration"; readonly emailVerification: "email-verification"; readonly passwordReset: "password-reset"; readonly phoneOtp: "phone-otp"; readonly mfaEnabled: "mfa-enabled"; readonly mfaDisabled: "mfa-disabled"; readonly mfaBackupCodesRegenerated: "mfa-backup-codes-regenerated"; readonly emailChanged: "email-changed"; readonly phoneChanged: "phone-changed"; readonly oauthRegistration: "oauth-registration"; readonly oauthLinked: "oauth-linked"; readonly oauthUnlinked: "oauth-unlinked"; }
+const MESSAGE_KEYS: { readonly emailRegistration: "email-registration"; readonly emailVerification: "email-verification"; readonly passwordReset: "password-reset"; readonly phoneOtp: "phone-otp"; readonly mfaEnabled: "mfa-enabled"; readonly mfaDisabled: "mfa-disabled"; readonly mfaBackupCodesRegenerated: "mfa-backup-codes-regenerated"; readonly emailChanged: "email-changed"; readonly phoneChanged: "phone-changed"; readonly passwordRevoked: "password-revoked"; readonly oauthRegistration: "oauth-registration"; readonly oauthLinked: "oauth-linked"; readonly oauthUnlinked: "oauth-unlinked"; }
 
 type AuthMessageKey = (typeof MESSAGE_KEYS)[keyof typeof MESSAGE_KEYS];
 
-const DEFAULT_TEMPLATES: { "email-registration": { subject: string; html: string; text: string; }; "email-verification": { subject: string; html: string; text: string; }; "password-reset": { subject: string; html: string; text: string; }; "phone-otp": { text: string; }; "mfa-enabled": { subject: string; html: string; text: string; }; "mfa-disabled": { subject: string; html: string; text: string; }; "mfa-backup-codes-regenerated": { subject: string; html: string; text: string; }; "email-changed": { subject: string; html: string; text: string; }; "phone-changed": { subject: string; html: string; text: string; }; "oauth-registration": { subject: string; html: string; text: string; }; "oauth-linked": { subject: string; html: string; text: string; }; "oauth-unlinked": { subject: string; html: string; text: string; }; }
+const DEFAULT_TEMPLATES: { "email-registration": { subject: string; html: string; text: string; }; "email-verification": { subject: string; html: string; text: string; }; "password-reset": { subject: string; html: string; text: string; }; "phone-otp": { text: string; }; "mfa-enabled": { subject: string; html: string; text: string; }; "mfa-disabled": { subject: string; html: string; text: string; }; "mfa-backup-codes-regenerated": { subject: string; html: string; text: string; }; "email-changed": { subject: string; html: string; text: string; }; "phone-changed": { subject: string; html: string; text: string; }; "password-revoked": { subject: string; html: string; text: string; }; "oauth-registration": { subject: string; html: string; text: string; }; "oauth-linked": { subject: string; html: string; text: string; }; "oauth-unlinked": { subject: string; html: string; text: string; }; }
 
 interface IUserDTO {
     id: string;

package/dist/index.cjs

@@ -300,6 +300,11 @@ var MESSAGE_KEYS = {
   // Changing HOW an account can be signed into is a security event for the
   // account's owner, who may not be the person doing it. Both directions are
   // notified for the same reason password changes are.
+  // A password was REVOKED because the account it sat on had never been
+  // verified and an OAuth identity proved ownership of the mailbox. The
+  // recipient is now known to own that address, so this reaches the right
+  // person — and it is the only way they learn a password stopped working.
+  passwordRevoked: "password-revoked",
   // Welcome for an account CREATED by an OAuth sign-in. Distinct from
   // emailRegistration, which carries a verification PIN — an OAuth signup
   // arrives already verified by the provider and has nothing to confirm.
@@ -790,22 +795,49 @@ var UserModel = class {
    * The prior state is read in a CTE of the SAME statement, so it sees the
    * snapshot from before the insert. Reading it in a separate query would
    * race two concurrent logins into both seeing "new".
+   *
+   * SECURITY — linking is BY EMAIL, so this merges into whatever row already
+   * holds the address. If that row was never verified, its password was never
+   * proven to belong to the mailbox; anyone can register an address they do
+   * not own. The provider HAS proven ownership. So an unverified password is
+   * revoked at the moment of linking: without that, linking sets
+   * email_verified_at and the earlier registrant is left holding a working
+   * password on an account now treated as verified.
+   *
+   * The legitimate user loses nothing but a password reset — they own the
+   * mailbox. Someone who does not own it cannot receive that mail.
    */
   async upsertByProvider(email2, provider, providerId) {
     const [row] = await this.store.query(
       `WITH prior AS (
-				SELECT provider FROM fonderie_users WHERE email = $1
+				SELECT provider, email_verified_at, password_hash IS NOT NULL AS had_password
+				  FROM fonderie_users WHERE email = $1
 			), upserted AS (
 				INSERT INTO fonderie_users (email, email_verified_at, provider, provider_id)
 				VALUES ($1, now(), $2, $3)
 				ON CONFLICT (email) DO UPDATE
 				SET provider = $2, provider_id = $3,
-				    email_verified_at = COALESCE(fonderie_users.email_verified_at, now())
+				    email_verified_at = COALESCE(fonderie_users.email_verified_at, now()),
+				    -- A password on an UNVERIFIED account is a claim, not a
+				    -- credential: nobody ever proved that mailbox belongs to
+				    -- whoever set it. The provider has now proven it belongs to
+				    -- the person signing in. Drop the unproven claim rather than
+				    -- promote it \u2014 otherwise linking marks the account verified
+				    -- and silently hands the earlier registrant a working
+				    -- password on a now-trusted account.
+				    password_hash = CASE
+				      WHEN fonderie_users.email_verified_at IS NULL THEN NULL
+				      ELSE fonderie_users.password_hash
+				    END
 				RETURNING id
 			)
 			SELECT upserted.id,
 			       NOT EXISTS (SELECT 1 FROM prior)   AS inserted,
-			       (SELECT provider FROM prior)       AS "previousProvider"
+			       (SELECT provider FROM prior)       AS "previousProvider",
+			       -- True only when a password was actually revoked, so the
+			       -- caller can tell the owner their sign-in method changed.
+			       COALESCE((SELECT had_password AND email_verified_at IS NULL FROM prior), false)
+			         AS "clearedUnverifiedPassword"
 			FROM upserted`,
       [email2, provider, providerId]
     );
@@ -2515,6 +2547,18 @@ function oauthController(store, config, bus) {
     const reqOpts = reqId !== void 0 ? { requestId: reqId } : void 0;
     const label = provider.charAt(0).toUpperCase() + provider.slice(1);
     const recipient = { email: user.email, phone: null, deviceToken: null };
+    if (upserted.clearedUnverifiedPassword && user.email) {
+      await (0, import_core9.background)(bus.emit(
+        import_events4.NOTIFICATION_EVENT,
+        {
+          type: MESSAGE_KEYS.passwordRevoked,
+          locale: user.locale,
+          data: { provider: label },
+          recipient
+        },
+        reqOpts
+      ));
+    }
     if (upserted.inserted) {
       await (0, import_core9.background)(bus.emit(
         EVENT_KEYS.userRegistered,
@@ -3271,6 +3315,24 @@ If you made this change, you're all set. If not, contact support right away \u20
 The phone number on your account was just updated.
 
 If you made this change, you're all set. If not, contact support right away \u2014 someone may have access to your account.`
+  },
+  [MESSAGE_KEYS.passwordRevoked]: {
+    subject: "The password on your account was removed",
+    html: `<h1>Your password was removed</h1>
+<p>You just signed in with <strong>{{provider}}</strong>. A password had been set on this account, but this email address had never been confirmed &mdash; so we could not tell who set it, and it has been removed.</p>
+<p>Signing in with {{provider}} works as before. If you want a password as well, set one from your account settings.</p>
+<p class="muted">If you never set a password here, someone else may have tried to register with your address. Nothing further is needed &mdash; the account is yours.</p>`,
+    text: `Your password was removed
+
+You just signed in with {{provider}}. A password had been set on this account,
+but this email address had never been confirmed \u2014 so we could not tell who set
+it, and it has been removed.
+
+Signing in with {{provider}} works as before. If you want a password as well,
+set one from your account settings.
+
+If you never set a password here, someone else may have tried to register with
+your address. Nothing further is needed \u2014 the account is yours.`
   },
   [MESSAGE_KEYS.oauthRegistration]: {
     subject: "Welcome to {{appName}}",
@@ -3309,6 +3371,7 @@ If you did this, you're all set. If not, contact support right away.`
   }
 };
 var SAMPLE_PAYLOADS = {
+  [MESSAGE_KEYS.passwordRevoked]: { provider: "Google" },
   [MESSAGE_KEYS.oauthRegistration]: { provider: "Google", appName: "Fonderie" },
   [MESSAGE_KEYS.oauthLinked]: { provider: "Google" },
   [MESSAGE_KEYS.oauthUnlinked]: { provider: "Google" },