@fonderie/auth 7.6.1 → 7.7.0

package/dist/index.js

@@ -1008,13 +1008,23 @@ var MAX_HISTORY_LIMIT = 200;
 
 // src/services/request-meta.ts
 var UA_MAX = 512;
+var warnedAboutMissingIdentity = false;
+function warnIfIdentityless(ctx) {
+  if (warnedAboutMissingIdentity) return;
+  warnedAboutMissingIdentity = true;
+  console.warn(
+    `[auth] recording a security event with no client IP and no user-agent for ${ctx.request.method} ${new URL(ctx.request.url).pathname}. Login history and session rows will show "Unknown device" with no IP for these. This is what a hand-built request looks like: if you call fonderie.handle() directly, forward the caller's user-agent header and pass the resolved IP as \`handle(req, { meta: { clientIp } })\` \u2014 resolve it with resolveClientIp from @fonderie/core/middlewares rather than reading the socket, or a proxied deployment records the proxy. Reported once per process.`
+  );
+}
 function requestMeta(ctx) {
   const ip = ctx.meta["clientIp"];
   const ua = ctx.request.headers.get("user-agent");
-  return {
+  const meta = {
     ipAddress: typeof ip === "string" && ip.length > 0 ? ip : null,
     userAgent: ua && ua.length > 0 ? ua.slice(0, UA_MAX) : null
   };
+  if (meta.ipAddress === null && meta.userAgent === null) warnIfIdentityless(ctx);
+  return meta;
 }
 
 // src/controllers/mfa.controller.ts
@@ -1860,12 +1870,29 @@ function authController(store, config, bus) {
       }
       const pin = raw.trim();
       if (ctx.user.loginMethod === "phone") {
+        const phoneMeta = requestMeta(ctx);
         const record = await phoneVerif.findByUser(ctx.user.id, pin);
         if (!record) {
+          await loginEvents.recordSafe({
+            userId: ctx.user.id,
+            emailAttempted: null,
+            method: "phone",
+            outcome: "failed",
+            failureReason: "invalid_pin",
+            ...phoneMeta
+          });
           return setApiResponse3(HTTP3.BAD_REQUEST, "VERIFICATION_FAILED", "Invalid or expired pin");
         }
         if (/* @__PURE__ */ new Date() > record.expiresAt) {
           await phoneVerif.deleteByUser(ctx.user.id);
+          await loginEvents.recordSafe({
+            userId: ctx.user.id,
+            emailAttempted: null,
+            method: "phone",
+            outcome: "failed",
+            failureReason: "expired_pin",
+            ...phoneMeta
+          });
           return setApiResponse3(
             HTTP3.BAD_REQUEST,
             "VERIFICATION_FAILED",
@@ -1877,7 +1904,14 @@ function authController(store, config, bus) {
           loginMethod: "phone",
           phoneVerified: true
         });
-        await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, requestMeta(ctx));
+        await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, phoneMeta);
+        await loginEvents.recordSafe({
+          userId: ctx.user.id,
+          emailAttempted: null,
+          method: "phone",
+          outcome: "success",
+          ...phoneMeta
+        });
         const verifiedUser = await users.findById(ctx.user.id);
         if (!verifiedUser) {
           return setApiResponse3(HTTP3.NOT_FOUND, "NOT_FOUND", "User not found");