@fonderie/auth 7.9.4 → 7.11.0

package/dist/index.d.cts

@@ -3,8 +3,8 @@ export { IMfaChallenge, ISession } from './types.cjs';
 import { IFonderieModule, IAdminDescription, IReadinessProblem, IFonderieApp, IAdminRoute } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-Bv4qu9xV.cjs';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-Bv4qu9xV.cjs';
+import { I as IAuthConfig, a as IRequestLocation } from './session-BBF5t-3Y.cjs';
+export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, d as IAuthRateLimitConfig, e as IAuthRuntimeConfig, f as IAuthSecrets, g as IDataExportContributor, h as ILocationRequest, L as LocationResolver, M as MESSAGE_KEYS, i as buildAuthAccountLimiter, j as buildAuthIpLimiter, r as resolveLocation, s as sanitizeLocation, w as withSession } from './session-BBF5t-3Y.cjs';
 import { IUserDTO } from './dtos/user.cjs';
 export { toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
@@ -96,6 +96,9 @@ interface ILoginEventDTO {
     failureReason: string | null;
     ipAddress: string | null;
     userAgent: string | null;
+    /** Where the attempt came from — present only when the app configures
+     * `location`. Country is reliable; region/city are approximate. */
+    location: IRequestLocation | null;
     createdAt: string;
 }
 interface ILoginHistoryPageDTO {
@@ -107,6 +110,8 @@ interface ISessionDTO {
     current: boolean;
     ipAddress: string | null;
     userAgent: string | null;
+    /** Where the session was opened from, when `location` is configured. */
+    location: IRequestLocation | null;
     createdAt: string;
     expiresAt: string;
 }
@@ -257,4 +262,4 @@ interface IAdminUserPageDTO {
 declare function toAdminUserPageDTO(page: IUserPage): IAdminUserPageDTO;
 declare function describeAuthAdminRoutes(store: IStoreAdapter): IAdminRoute[];
 
-export { AuthModule, type ChangePasswordInput, DEFAULT_TEMPLATES, type IAdminUserDTO, IAuthConfig, type IImportUser, type ILoginEventDTO, type ILoginHistoryPageDTO, type IPurgeOptions, type ISessionDTO, IUser, IUserDTO, type IUserRetentionScheduleOptions, type LoginInput, type RegisterInput, type ResetPasswordInput, describeAuthAdminRoutes, importUser, normalizeEmail, normalizeEmailSafe, purgeSoftDeletedUsers, schemas, startUserRetention, toAdminUserDTO, toAdminUserPageDTO, validateAuthConfig };
+export { AuthModule, type ChangePasswordInput, DEFAULT_TEMPLATES, type IAdminUserDTO, IAuthConfig, type IImportUser, type ILoginEventDTO, type ILoginHistoryPageDTO, type IPurgeOptions, IRequestLocation, type ISessionDTO, IUser, IUserDTO, type IUserRetentionScheduleOptions, type LoginInput, type RegisterInput, type ResetPasswordInput, describeAuthAdminRoutes, importUser, normalizeEmail, normalizeEmailSafe, purgeSoftDeletedUsers, schemas, startUserRetention, toAdminUserDTO, toAdminUserPageDTO, validateAuthConfig };

package/dist/index.d.ts

@@ -3,8 +3,8 @@ export { IMfaChallenge, ISession } from './types.js';
 import { IFonderieModule, IAdminDescription, IReadinessProblem, IFonderieApp, IAdminRoute } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-Bv4qu9xV.js';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-Bv4qu9xV.js';
+import { I as IAuthConfig, a as IRequestLocation } from './session-BBF5t-3Y.js';
+export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, d as IAuthRateLimitConfig, e as IAuthRuntimeConfig, f as IAuthSecrets, g as IDataExportContributor, h as ILocationRequest, L as LocationResolver, M as MESSAGE_KEYS, i as buildAuthAccountLimiter, j as buildAuthIpLimiter, r as resolveLocation, s as sanitizeLocation, w as withSession } from './session-BBF5t-3Y.js';
 import { IUserDTO } from './dtos/user.js';
 export { toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
@@ -96,6 +96,9 @@ interface ILoginEventDTO {
     failureReason: string | null;
     ipAddress: string | null;
     userAgent: string | null;
+    /** Where the attempt came from — present only when the app configures
+     * `location`. Country is reliable; region/city are approximate. */
+    location: IRequestLocation | null;
     createdAt: string;
 }
 interface ILoginHistoryPageDTO {
@@ -107,6 +110,8 @@ interface ISessionDTO {
     current: boolean;
     ipAddress: string | null;
     userAgent: string | null;
+    /** Where the session was opened from, when `location` is configured. */
+    location: IRequestLocation | null;
     createdAt: string;
     expiresAt: string;
 }
@@ -257,4 +262,4 @@ interface IAdminUserPageDTO {
 declare function toAdminUserPageDTO(page: IUserPage): IAdminUserPageDTO;
 declare function describeAuthAdminRoutes(store: IStoreAdapter): IAdminRoute[];
 
-export { AuthModule, type ChangePasswordInput, DEFAULT_TEMPLATES, type IAdminUserDTO, IAuthConfig, type IImportUser, type ILoginEventDTO, type ILoginHistoryPageDTO, type IPurgeOptions, type ISessionDTO, IUser, IUserDTO, type IUserRetentionScheduleOptions, type LoginInput, type RegisterInput, type ResetPasswordInput, describeAuthAdminRoutes, importUser, normalizeEmail, normalizeEmailSafe, purgeSoftDeletedUsers, schemas, startUserRetention, toAdminUserDTO, toAdminUserPageDTO, validateAuthConfig };
+export { AuthModule, type ChangePasswordInput, DEFAULT_TEMPLATES, type IAdminUserDTO, IAuthConfig, type IImportUser, type ILoginEventDTO, type ILoginHistoryPageDTO, type IPurgeOptions, IRequestLocation, type ISessionDTO, IUser, IUserDTO, type IUserRetentionScheduleOptions, type LoginInput, type RegisterInput, type ResetPasswordInput, describeAuthAdminRoutes, importUser, normalizeEmail, normalizeEmailSafe, purgeSoftDeletedUsers, schemas, startUserRetention, toAdminUserDTO, toAdminUserPageDTO, validateAuthConfig };

package/dist/index.js

@@ -838,18 +838,111 @@ var UserModel = class {
 };
 var MAX_LIST_LIMIT = 200;
 
+// src/services/request-location.ts
+var LOCATION_TIMEOUT_MS = 500;
+var TEXT_MAX = 128;
+function str(v, re) {
+  if (typeof v !== "string") return null;
+  const t = v.trim();
+  if (t.length === 0 || t.length > TEXT_MAX) return null;
+  return re && !re.test(t) ? null : t;
+}
+function upperCode(v, re) {
+  const t = str(v, re);
+  return t ? t.toUpperCase() : null;
+}
+function bool(v) {
+  return typeof v === "boolean" ? v : null;
+}
+function coord(v, limit) {
+  if (typeof v !== "number" || !Number.isFinite(v) || Math.abs(v) > limit) return null;
+  return Math.round(v * 100) / 100;
+}
+function radius(v) {
+  if (typeof v !== "number" || !Number.isFinite(v) || v <= 0 || v > 2e4) return null;
+  return Math.round(v);
+}
+function placeId(v) {
+  const n = typeof v === "string" && /^\d{1,10}$/.test(v) ? Number(v) : v;
+  return typeof n === "number" && Number.isInteger(n) && n > 0 && n <= 2147483647 ? n : null;
+}
+function sanitizeLocation(input) {
+  if (!input || typeof input !== "object") return null;
+  const i = input;
+  const out = {
+    country: upperCode(i["country"], /^[A-Za-z]{2}$/),
+    countryName: str(i["countryName"]),
+    subdivision: upperCode(i["subdivision"], /^[A-Za-z0-9]{1,3}$/),
+    subdivisionName: str(i["subdivisionName"]),
+    city: str(i["city"]),
+    postalCode: upperCode(i["postalCode"], /^[A-Za-z0-9][A-Za-z0-9 -]{0,11}$/),
+    continent: upperCode(i["continent"], /^[A-Za-z]{2}$/),
+    timeZone: str(i["timeZone"], /^(UTC|[A-Za-z_]+(\/[A-Za-z0-9_+-]+)+)$/),
+    latitude: coord(i["latitude"], 90),
+    longitude: coord(i["longitude"], 180),
+    accuracyRadius: radius(i["accuracyRadius"]),
+    geonameId: placeId(i["geonameId"]),
+    isp: str(i["isp"]),
+    org: str(i["org"]),
+    asn: upperCode(i["asn"], /^AS\d{1,10}$/i),
+    mobile: bool(i["mobile"]),
+    proxy: bool(i["proxy"]),
+    hosting: bool(i["hosting"])
+  };
+  const known = Object.fromEntries(Object.entries(out).filter(([, v]) => v !== null));
+  return Object.keys(known).length > 0 ? known : null;
+}
+var perRequest = /* @__PURE__ */ new WeakMap();
+function resolveLocation(resolver, req, timeoutMs = LOCATION_TIMEOUT_MS) {
+  if (!resolver) return Promise.resolve(null);
+  const cached = perRequest.get(req.headers);
+  if (cached && cached.resolver === resolver) return cached.result;
+  const result = resolveOnce(resolver, req, timeoutMs);
+  perRequest.set(req.headers, { resolver, result });
+  return result;
+}
+async function resolveOnce(resolver, req, timeoutMs) {
+  let timer;
+  try {
+    const result = await Promise.race([
+      Promise.resolve().then(() => resolver(req)),
+      new Promise((resolve2) => {
+        timer = setTimeout(() => resolve2(null), timeoutMs);
+      })
+    ]);
+    return sanitizeLocation(result);
+  } catch (err) {
+    console.warn("[auth] location resolver failed; recording without a location:", err);
+    return null;
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
 // src/models/session.model.ts
 var SessionModel = class {
-  constructor(store) {
+  // `locate` is IAuthConfig.location. Absent ⇒ sessions carry no location.
+  constructor(store, locate) {
     this.store = store;
+    this.locate = locate;
   }
   store;
+  locate;
   async create(userId, token, expiresAt, sid, meta) {
+    const location = this.locate && meta?.headers ? await resolveLocation(this.locate, { ip: meta.ipAddress, headers: meta.headers }) : null;
     await this.store.query(
-      `INSERT INTO fonderie_sessions (user_id, token, expires_at, sid, user_agent, ip_address)
-			VALUES ($1, $2, $3, $4, $5, $6)
+      `INSERT INTO fonderie_sessions (user_id, token, expires_at, sid, user_agent, ip_address, location)
+			VALUES ($1, $2, $3, $4, $5, $6, $7)
 			ON CONFLICT (token) DO NOTHING`,
-      [userId, token, expiresAt, sid ?? null, meta?.userAgent ?? null, meta?.ipAddress ?? null]
+      [
+        userId,
+        token,
+        expiresAt,
+        sid ?? null,
+        meta?.userAgent ?? null,
+        meta?.ipAddress ?? null,
+        location ? JSON.stringify(location) : null
+      ]
     );
   }
   async delete(token) {
@@ -888,6 +981,7 @@ var SessionModel = class {
       `SELECT id, sid,
 			        user_agent AS "userAgent",
 			        ip_address AS "ipAddress",
+			        location,
 			        created_at AS "createdAt",
 			        expires_at AS "expiresAt"
 			 FROM fonderie_sessions
@@ -971,15 +1065,20 @@ var BackupCodeModel = class {
 // src/models/login-event.model.ts
 import { background } from "@fonderie/core";
 var LoginEventModel = class {
-  constructor(store) {
+  // `locate` is IAuthConfig.location. Absent ⇒ rows carry no location,
+  // exactly as before.
+  constructor(store, locate) {
     this.store = store;
+    this.locate = locate;
   }
   store;
+  locate;
   async record(e) {
+    const location = this.locate ? await resolveLocation(this.locate, { ip: e.ipAddress, headers: e.headers ?? new Headers() }) : null;
     await this.store.query(
       `INSERT INTO fonderie_login_events
-			   (user_id, email_attempted, method, outcome, failure_reason, ip_address, user_agent)
-			 VALUES ($1, $2, $3, $4, $5, $6, $7)`,
+			   (user_id, email_attempted, method, outcome, failure_reason, ip_address, user_agent, location)
+			 VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`,
       [
         e.userId,
         e.emailAttempted ?? null,
@@ -987,7 +1086,8 @@ var LoginEventModel = class {
         e.outcome,
         e.failureReason ?? null,
         e.ipAddress,
-        e.userAgent
+        e.userAgent,
+        location ? JSON.stringify(location) : null
       ]
     );
   }
@@ -1026,7 +1126,7 @@ var LoginEventModel = class {
     params.push(limit + 1);
     const rows = await this.store.query(
       `SELECT id, method, outcome, failure_reason AS "failureReason",
-			        ip_address AS "ipAddress", user_agent AS "userAgent",
+			        ip_address AS "ipAddress", user_agent AS "userAgent", location,
 			        created_at AS "createdAt", created_at::text AS "createdAtRaw"
 			 FROM   fonderie_login_events
 			 WHERE  ${where.join(" AND ")}
@@ -1054,7 +1154,8 @@ function requestMeta(ctx) {
   const ua = ctx.request.headers.get("user-agent");
   const meta = {
     ipAddress: typeof ip === "string" && ip.length > 0 ? ip : null,
-    userAgent: ua && ua.length > 0 ? ua.slice(0, UA_MAX) : null
+    userAgent: ua && ua.length > 0 ? ua.slice(0, UA_MAX) : null,
+    headers: ctx.request.headers
   };
   if (meta.ipAddress === null && meta.userAgent === null) warnIfIdentityless(ctx);
   return meta;
@@ -1063,9 +1164,9 @@ function requestMeta(ctx) {
 // src/controllers/mfa.controller.ts
 function mfaController(store, config, issuer, bus) {
   const users = new UserModel(store);
-  const sessions = new SessionModel(store);
+  const sessions = new SessionModel(store, config.location);
   const backupCodes = new BackupCodeModel(store);
-  const loginEvents = new LoginEventModel(store);
+  const loginEvents = new LoginEventModel(store, config.location);
   const mfaCipher = makeMfaCipher(config.mfaSecretKey);
   return {
     // ── 1. Setup ───────────────────────────────────────────────
@@ -1463,8 +1564,8 @@ function extractRefreshToken(ctx) {
 }
 function authController(store, config, bus) {
   const users = new UserModel(store);
-  const sessions = new SessionModel(store);
-  const loginEvents = new LoginEventModel(store);
+  const sessions = new SessionModel(store, config.location);
+  const loginEvents = new LoginEventModel(store, config.location);
   const passwordReset = new PasswordResetModel(store);
   const emailVerif = new EmailVerificationModel(store);
   const phoneVerif = new PhoneVerificationModel(store);
@@ -1532,7 +1633,15 @@ function authController(store, config, bus) {
         const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
           loginMethod: "email"
         });
-        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, requestMeta(ctx));
+        const registerMeta = requestMeta(ctx);
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, registerMeta);
+        await loginEvents.recordSafe({
+          userId: user.id,
+          emailAttempted: normalizedEmail,
+          method: "registration",
+          outcome: "success",
+          ...registerMeta
+        });
         const resolvedRegister = { ...config, ...config.resolve?.(ctx) };
         const requiresVerification = !!resolvedRegister.requireVerification && !user.emailVerifiedAt;
         return Response.json(
@@ -2091,6 +2200,9 @@ function toLoginEventDTO(row) {
     failureReason: row.failureReason,
     ipAddress: row.ipAddress,
     userAgent: row.userAgent,
+    // Re-sanitized on read: the column is JSONB and could have been written
+    // by anything with database access.
+    location: sanitizeLocation(row.location),
     createdAt: row.createdAt instanceof Date ? row.createdAt.toISOString() : String(row.createdAt)
   };
 }
@@ -2106,6 +2218,7 @@ function toSessionDTO(row, currentSid) {
     current: currentSid !== null && row.sid === currentSid,
     ipAddress: row.ipAddress,
     userAgent: row.userAgent,
+    location: sanitizeLocation(row.location),
     createdAt: row.createdAt instanceof Date ? row.createdAt.toISOString() : String(row.createdAt),
     expiresAt: row.expiresAt instanceof Date ? row.expiresAt.toISOString() : String(row.expiresAt)
   };
@@ -2120,8 +2233,8 @@ function isValidPhone2(phone2) {
 }
 function userController(store, config, bus) {
   const users = new UserModel(store);
-  const sessions = new SessionModel(store);
-  const loginEvents = new LoginEventModel(store);
+  const sessions = new SessionModel(store, config.location);
+  const loginEvents = new LoginEventModel(store, config.location);
   const emailVerif = new EmailVerificationModel(store);
   const phoneVerif = new PhoneVerificationModel(store);
   return {
@@ -2565,8 +2678,8 @@ async function verifyAppleIdToken(idToken, opts) {
 var appleEmailVerified = (c) => c.email_verified === true || c.email_verified === "true";
 function oauthController(store, config, bus) {
   const users = new UserModel(store);
-  const sessions = new SessionModel(store);
-  const loginEvents = new LoginEventModel(store);
+  const sessions = new SessionModel(store, config.location);
+  const loginEvents = new LoginEventModel(store, config.location);
   const consumedTokens = new ConsumedTokenModel(store);
   const announceOAuthUpsert = async (ctx, upserted, provider, user) => {
     if (!bus) return;
@@ -3355,7 +3468,7 @@ var AuthModule = class {
   name = "@fonderie/auth";
   // Baked in at build time by tsup.base, so the operator's Modules page can
   // say what is actually deployed rather than 'not reported'.
-  version = "7.9.4";
+  version = "7.11.0";
   // Users, sessions, login history, suspend — only through @fonderie/admin.
   describeAdmin() {
     return { routes: describeAuthAdminRoutes(this.store) };
@@ -3632,6 +3745,8 @@ export {
   normalizeEmailSafe,
   purgeSoftDeletedUsers,
   requireAuth2 as requireAuth,
+  resolveLocation,
+  sanitizeLocation,
   schemas_exports as schemas,
   startUserRetention,
   toAdminUserDTO,