@fonoster/identity 0.26.0 → 0.30.0

package/dist/utils/createIsValidVerificationCode.d.ts

@@ -1,5 +1,10 @@
 import { Prisma } from "../db";
 import { VerificationType } from "../generated/@prisma/client";
+/**
+ * Checks a code and, when it matches, consumes it: a code works once, only
+ * before it expires, and only until VERIFICATION_CODE_MAX_ATTEMPTS wrong
+ * guesses have been made against it.
+ */
 declare function createIsValidVerificationCode(prisma: Prisma): (params: {
     type: VerificationType;
     value: string;

package/dist/utils/createIsValidVerificationCode.js

@@ -29,24 +29,51 @@ exports.createIsValidVerificationCode = createIsValidVerificationCode;
  * limitations under the License.
  */
 const constants_1 = require("../constants");
+const normalizeContact_1 = require("./normalizeContact");
+const passwords_1 = require("./passwords");
+/**
+ * Checks a code and, when it matches, consumes it: a code works once, only
+ * before it expires, and only until VERIFICATION_CODE_MAX_ATTEMPTS wrong
+ * guesses have been made against it.
+ */
 function createIsValidVerificationCode(prisma) {
     return (params) => __awaiter(this, void 0, void 0, function* () {
-        const { type, value, code } = params;
-        // Delete old verification codes
+        const { type, code } = params;
+        const value = (0, normalizeContact_1.normalizeContact)(type, params.value);
+        const now = new Date();
+        // Housekeeping: drop codes that expired a while ago.
         yield prisma.verificationCode.deleteMany({
             where: {
                 expiresAt: {
-                    lt: new Date(Date.now() - constants_1.VERIFICATION_CODE_EXPIRATION)
+                    lt: new Date(now.getTime() - constants_1.VERIFICATION_CODE_EXPIRATION)
                 }
             }
         });
-        const result = yield prisma.verificationCode.findFirst({
+        const current = yield prisma.verificationCode.findFirst({
             where: {
                 type,
                 value,
-                code
-            }
+                consumedAt: null,
+                expiresAt: { gt: now },
+                attempts: { lt: constants_1.VERIFICATION_CODE_MAX_ATTEMPTS }
+            },
+            orderBy: { createdAt: "desc" }
+        });
+        if (!current) {
+            return false;
+        }
+        if (!code || !(0, passwords_1.equalsInConstantTime)(current.code, code)) {
+            yield prisma.verificationCode.update({
+                where: { ref: current.ref },
+                data: { attempts: { increment: 1 } }
+            });
+            return false;
+        }
+        // Conditional update so two concurrent requests can't both use the code.
+        const { count } = yield prisma.verificationCode.updateMany({
+            where: { ref: current.ref, consumedAt: null },
+            data: { consumedAt: now }
         });
-        return !!result;
+        return count === 1;
     });
 }

package/dist/utils/createSendEmail.d.ts

@@ -1,3 +1,4 @@
 import { IdentityConfig } from "../exchanges/types";
+declare const SMTP_NOT_CONFIGURED = "email can't be sent: smtp is not configured (set smtp in the config file)";
 declare function createSendEmail(identityConfig: IdentityConfig): (params: import("@fonoster/common").EmailParams) => Promise<void>;
-export { createSendEmail };
+export { createSendEmail, SMTP_NOT_CONFIGURED };

package/dist/utils/createSendEmail.js

@@ -1,5 +1,15 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SMTP_NOT_CONFIGURED = void 0;
 exports.createSendEmail = createSendEmail;
 /**
  * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
@@ -20,8 +30,15 @@ exports.createSendEmail = createSendEmail;
  * limitations under the License.
  */
 const common_1 = require("@fonoster/common");
+const SMTP_NOT_CONFIGURED = "email can't be sent: smtp is not configured (set smtp in the config file)";
+exports.SMTP_NOT_CONFIGURED = SMTP_NOT_CONFIGURED;
 function createSendEmail(identityConfig) {
     const { smtpConfig } = identityConfig;
+    if (!smtpConfig) {
+        return () => __awaiter(this, void 0, void 0, function* () {
+            throw new Error(SMTP_NOT_CONFIGURED);
+        });
+    }
     const { host, port, secure, sender, auth } = smtpConfig;
     const { user, pass } = auth;
     return (0, common_1.createSendEmail)({

package/dist/utils/createUpdateMembershipStatus.js

@@ -30,16 +30,23 @@ exports.createUpdateMembershipStatus = createUpdateMembershipStatus;
  */
 const common_1 = require("@fonoster/common");
 const types_1 = require("@fonoster/types");
-const jwt_decode_1 = require("jwt-decode");
 const db_1 = require("../db");
 function createUpdateMembershipStatus(identityConfig) {
     const prisma = (0, db_1.createPrismaClient)(identityConfig.dbUrl, identityConfig.encryptionKey);
     return function pdateMembershipStatus(token) {
         return __awaiter(this, void 0, void 0, function* () {
-            if (!(0, common_1.isValidToken)(token, identityConfig.privateKey)) {
+            const claims = (0, common_1.verifyToken)(token, identityConfig.privateKey, {
+                issuer: identityConfig.issuer,
+                audience: identityConfig.audience
+            });
+            // Invite tokens only (older ones carry no tokenUse); never a session token.
+            if (!claims ||
+                (claims.tokenUse !== undefined &&
+                    claims.tokenUse !== common_1.TokenUseEnum.INVITE) ||
+                typeof claims.memberRef !== "string") {
                 throw new Error("Invalid token");
             }
-            const { memberRef } = (0, jwt_decode_1.jwtDecode)(token);
+            const { memberRef } = claims;
             yield prisma.workspaceMember.update({
                 where: {
                     ref: memberRef

package/dist/utils/generateOneTimePassword.d.ts

@@ -0,0 +1,3 @@
+/** The 10-character password emailed with an invite. */
+declare const generateOneTimePassword: (size?: number) => string;
+export { generateOneTimePassword };

package/dist/utils/generateOneTimePassword.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateOneTimePassword = void 0;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const nanoid_1 = require("nanoid");
+/** The 10-character password emailed with an invite. */
+const generateOneTimePassword = (0, nanoid_1.customAlphabet)("23456789abcdefghjkmnpqrstuvwxyz", 10);
+exports.generateOneTimePassword = generateOneTimePassword;

package/dist/utils/getGitHubUserWithOauth2Code.d.ts

@@ -1,6 +1,24 @@
+type GitHubUser = {
+    name?: string;
+    login?: string;
+    avatar_url?: string;
+    /** The primary verified address, or undefined when there is none. */
+    email?: string;
+    /** Every verified address, primary first; used to find an existing user. */
+    verifiedEmails?: string[];
+};
+/**
+ * Trades an OAuth code for the GitHub user. The email is the account's
+ * primary *verified* address from /user/emails, never the public profile
+ * email, which the user can set to anything.
+ */
 declare function getGitHubUserWithOauth2Code(params: {
     clientId: string;
     clientSecret: string;
     code: string;
-}): Promise<any>;
-export { getGitHubUserWithOauth2Code };
+    /** Defaults to https://github.com; a fake GitHub in tests. */
+    url?: string;
+    /** Defaults to https://api.github.com. */
+    apiUrl?: string;
+}): Promise<GitHubUser>;
+export { getGitHubUserWithOauth2Code, GitHubUser };

package/dist/utils/getGitHubUserWithOauth2Code.js

@@ -28,12 +28,20 @@ exports.getGitHubUserWithOauth2Code = getGitHubUserWithOauth2Code;
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-const GITHUB_API_URL = "https://github.com/login/oauth/access_token";
-const GITHUB_USER_API_URL = "https://api.github.com/user";
+const GITHUB_URL = "https://github.com";
+const GITHUB_API_URL = "https://api.github.com";
+/**
+ * Trades an OAuth code for the GitHub user. The email is the account's
+ * primary *verified* address from /user/emails, never the public profile
+ * email, which the user can set to anything.
+ */
 function getGitHubUserWithOauth2Code(params) {
     return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
         const { clientId, clientSecret, code } = params;
-        const tokenResponse = yield fetch(GITHUB_API_URL, {
+        const url = (_a = params.url) !== null && _a !== void 0 ? _a : GITHUB_URL;
+        const apiUrl = (_b = params.apiUrl) !== null && _b !== void 0 ? _b : GITHUB_API_URL;
+        const tokenResponse = yield fetch(`${url}/login/oauth/access_token`, {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
@@ -47,11 +55,35 @@ function getGitHubUserWithOauth2Code(params) {
         });
         const tokenData = yield tokenResponse.json();
         const accessToken = tokenData === null || tokenData === void 0 ? void 0 : tokenData.access_token;
-        const userResponse = yield fetch(GITHUB_USER_API_URL, {
-            headers: {
-                Authorization: `token ${accessToken}`
-            }
-        });
-        return userResponse.json();
+        if (!accessToken) {
+            return {};
+        }
+        const headers = {
+            Authorization: `token ${accessToken}`,
+            Accept: "application/vnd.github+json"
+        };
+        const [userResponse, emailsResponse] = yield Promise.all([
+            fetch(`${apiUrl}/user`, { headers }),
+            fetch(`${apiUrl}/user/emails`, { headers })
+        ]);
+        const user = yield userResponse.json();
+        const emails = emailsResponse.ok
+            ? yield emailsResponse.json()
+            : [];
+        const primary = Array.isArray(emails)
+            ? emails.find((e) => e.primary && e.verified)
+            : undefined;
+        const verified = Array.isArray(emails)
+            ? emails.filter((e) => e.verified).map((e) => e.email)
+            : [];
+        return {
+            name: (user === null || user === void 0 ? void 0 : user.name) || (user === null || user === void 0 ? void 0 : user.login),
+            login: user === null || user === void 0 ? void 0 : user.login,
+            avatar_url: user === null || user === void 0 ? void 0 : user.avatar_url,
+            email: primary === null || primary === void 0 ? void 0 : primary.email,
+            verifiedEmails: primary
+                ? [primary.email, ...verified.filter((e) => e !== primary.email)]
+                : verified
+        };
     });
 }

package/dist/utils/isWorkspaceAdminCall.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Whether the caller is an owner or admin of the workspace the call names
+ * (its `accesskeyid` metadata). Only the role held in that workspace counts.
+ * The interceptor has already verified the token; this re-checks the role in
+ * the handler and answers false on anything unexpected.
+ */
+declare function isWorkspaceAdminCall(call: unknown): boolean;
+export { isWorkspaceAdminCall };

package/dist/utils/isWorkspaceAdminCall.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isWorkspaceAdminCall = isWorkspaceAdminCall;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const common_1 = require("@fonoster/common");
+const types_1 = require("@fonoster/types");
+const ADMIN_ROLES = [types_1.Role.WORKSPACE_OWNER, types_1.Role.WORKSPACE_ADMIN];
+/**
+ * Whether the caller is an owner or admin of the workspace the call names
+ * (its `accesskeyid` metadata). Only the role held in that workspace counts.
+ * The interceptor has already verified the token; this re-checks the role in
+ * the handler and answers false on anything unexpected.
+ */
+function isWorkspaceAdminCall(call) {
+    try {
+        const typedCall = call;
+        const accessKeyId = (0, common_1.getAccessKeyIdFromCall)(typedCall);
+        const token = (0, common_1.decodeToken)((0, common_1.getTokenFromCall)(typedCall));
+        if (!accessKeyId || (token === null || token === void 0 ? void 0 : token.tokenUse) !== common_1.TokenUseEnum.ACCESS) {
+            return false;
+        }
+        const entry = Array.isArray(token.access)
+            ? token.access.find((a) => (a === null || a === void 0 ? void 0 : a.accessKeyId) === accessKeyId)
+            : undefined;
+        return entry ? ADMIN_ROLES.includes(entry.role) : false;
+    }
+    catch (_a) {
+        return false;
+    }
+}

package/dist/utils/normalizeContact.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { VerificationType } from "../generated/@prisma/client";
+/** Emails are matched case-insensitively; phone numbers as given. */
+declare function normalizeContact(type: VerificationType, value: string): string;
+export { normalizeContact };

package/dist/utils/normalizeContact.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeContact = normalizeContact;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const client_1 = require("../generated/@prisma/client");
+/** Emails are matched case-insensitively; phone numbers as given. */
+function normalizeContact(type, value) {
+    return type === client_1.VerificationType.EMAIL
+        ? (value !== null && value !== void 0 ? value : "").trim().toLowerCase()
+        : value;
+}

package/dist/utils/passwords.d.ts

@@ -0,0 +1,11 @@
+/**
+ * One-way digest for storing a password: `scrypt$N$r$p$salt$hash`
+ * (base64 salt and hash). The parameters travel with the digest so they can
+ * be raised later without invalidating existing ones.
+ */
+declare function hashPassword(password: string): Promise<string>;
+/** Checks a password against a digest from `hashPassword`, in constant time. */
+declare function verifyPasswordDigest(password: string, digest: string): Promise<boolean>;
+/** Constant-time comparison for legacy (decrypted) passwords. */
+declare function equalsInConstantTime(a: string, b: string): boolean;
+export { equalsInConstantTime, hashPassword, verifyPasswordDigest };

package/dist/utils/passwords.js

@@ -0,0 +1,84 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.equalsInConstantTime = equalsInConstantTime;
+exports.hashPassword = hashPassword;
+exports.verifyPasswordDigest = verifyPasswordDigest;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const crypto_1 = require("crypto");
+const SCRYPT_PARAMS = { N: Math.pow(2, 15), r: 8, p: 1 };
+const KEY_LENGTH = 64;
+const SALT_LENGTH = 16;
+function deriveKey(password, salt, params) {
+    const options = Object.assign(Object.assign({}, params), { 
+        // scrypt needs 128 * N * r bytes; leave headroom over Node's 32 MiB default.
+        maxmem: 256 * params.N * params.r });
+    return new Promise((resolve, reject) => (0, crypto_1.scrypt)(password, salt, KEY_LENGTH, options, (error, key) => error ? reject(error) : resolve(key)));
+}
+/**
+ * One-way digest for storing a password: `scrypt$N$r$p$salt$hash`
+ * (base64 salt and hash). The parameters travel with the digest so they can
+ * be raised later without invalidating existing ones.
+ */
+function hashPassword(password) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const salt = (0, crypto_1.randomBytes)(SALT_LENGTH);
+        const { N, r, p } = SCRYPT_PARAMS;
+        const key = yield deriveKey(password, salt, SCRYPT_PARAMS);
+        return [
+            "scrypt",
+            N,
+            r,
+            p,
+            salt.toString("base64"),
+            key.toString("base64")
+        ].join("$");
+    });
+}
+/** Checks a password against a digest from `hashPassword`, in constant time. */
+function verifyPasswordDigest(password, digest) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const [scheme, N, r, p, salt, hash] = digest.split("$");
+        if (scheme !== "scrypt" || !salt || !hash) {
+            return false;
+        }
+        const expected = Buffer.from(hash, "base64");
+        const actual = yield deriveKey(password, Buffer.from(salt, "base64"), {
+            N: Number(N),
+            r: Number(r),
+            p: Number(p)
+        });
+        return actual.length === expected.length && (0, crypto_1.timingSafeEqual)(actual, expected);
+    });
+}
+/** Constant-time comparison for legacy (decrypted) passwords. */
+function equalsInConstantTime(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    return left.length === right.length && (0, crypto_1.timingSafeEqual)(left, right);
+}

package/dist/utils/rateLimiter.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Fixed-window counter kept in this process's memory. With several replicas each enforces its own
+ * limit, and a restart resets it: use createSharedRateLimiter in the service.
+ */
+declare function createRateLimiter(params: {
+    limit: number;
+    windowMs: number;
+}): (key: string, now?: number) => boolean;
+/**
+ * The same fixed-window counter in the Identity database (table rate_limit_windows), so the limit
+ * holds across every replica and survives a restart (ST-4). One statement counts the use and
+ * starts a new window when the old one is over. `name` keeps the counters of different limits
+ * apart. If the database cannot be reached the use is counted in this process instead.
+ */
+declare function createSharedRateLimiter(prisma: unknown, params: {
+    name: string;
+    limit: number;
+    windowMs: number;
+}): (key: string) => Promise<boolean>;
+export { createRateLimiter, createSharedRateLimiter };

package/dist/utils/rateLimiter.js

@@ -0,0 +1,108 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRateLimiter = createRateLimiter;
+exports.createSharedRateLimiter = createSharedRateLimiter;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const logger_1 = require("@fonoster/logger");
+const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
+/**
+ * Fixed-window counter kept in this process's memory. With several replicas each enforces its own
+ * limit, and a restart resets it: use createSharedRateLimiter in the service.
+ */
+function createRateLimiter(params) {
+    const { limit, windowMs } = params;
+    const windows = new Map();
+    /** Counts one use of `key`; false when it's over the limit. */
+    return function tryConsume(key, now = Date.now()) {
+        const window = windows.get(key);
+        if (!window || now - window.startedAt >= windowMs) {
+            windows.set(key, { startedAt: now, count: 1 });
+            // Keep the map from growing without bound.
+            if (windows.size > 10000) {
+                windows.forEach((w, k) => {
+                    if (now - w.startedAt >= windowMs)
+                        windows.delete(k);
+                });
+            }
+            return true;
+        }
+        if (window.count >= limit) {
+            return false;
+        }
+        window.count += 1;
+        return true;
+    };
+}
+/**
+ * The same fixed-window counter in the Identity database (table rate_limit_windows), so the limit
+ * holds across every replica and survives a restart (ST-4). One statement counts the use and
+ * starts a new window when the old one is over. `name` keeps the counters of different limits
+ * apart. If the database cannot be reached the use is counted in this process instead.
+ */
+function createSharedRateLimiter(prisma, params) {
+    const { name, limit, windowMs } = params;
+    const local = createRateLimiter({ limit, windowMs });
+    const db = prisma;
+    if (typeof db.$queryRaw !== "function") {
+        // A stand-in client without SQL (unit tests): this process only.
+        return (key) => __awaiter(this, void 0, void 0, function* () { return local(`${name}:${key}`); });
+    }
+    const sql = db;
+    let lastPrune = 0;
+    return function tryConsume(key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const k = `${name}:${key}`.slice(0, 255);
+            try {
+                const rows = yield sql.$queryRaw `
+        INSERT INTO "rate_limit_windows" ("key", "started_at", "count")
+        VALUES (${k}, now(), 1)
+        ON CONFLICT ("key") DO UPDATE SET
+          "started_at" = CASE
+            WHEN "rate_limit_windows"."started_at" <= now() - (${windowMs} * interval '1 millisecond')
+            THEN now() ELSE "rate_limit_windows"."started_at" END,
+          "count" = CASE
+            WHEN "rate_limit_windows"."started_at" <= now() - (${windowMs} * interval '1 millisecond')
+            THEN 1 ELSE "rate_limit_windows"."count" + 1 END
+        RETURNING "count"`;
+                if (Date.now() - lastPrune > windowMs) {
+                    lastPrune = Date.now();
+                    void sql.$executeRaw `
+          DELETE FROM "rate_limit_windows"
+          WHERE "started_at" < now() - (${windowMs} * interval '1 millisecond')`.catch(() => undefined);
+                }
+                return Number((_b = (_a = rows[0]) === null || _a === void 0 ? void 0 : _a.count) !== null && _b !== void 0 ? _b : 1) <= limit;
+            }
+            catch (e) {
+                logger.warn(`rate limit ${name}: database unavailable (${e.message}); counting in this process`);
+                return local(k);
+            }
+        });
+    };
+}

package/dist/utils/signInThrottle.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { status } from "@grpc/grpc-js";
+type SignInFailureLimits = {
+    perEmail: number;
+    perIp: number;
+    windowMs: number;
+};
+/**
+ * Slows down password and code guessing on sign-in. Failed attempts are
+ * counted per email and per client IP; once either reaches its limit, sign-in
+ * for that email (or from that IP) is refused for one window, right or wrong.
+ * Only failures count, so someone who knows an email can't lock its owner out
+ * by signing in successfully elsewhere, and a user who signs in fine is never
+ * slowed down.
+ *
+ * Kept in this process's memory, like the other Identity limits: with several
+ * replicas each enforces its own limit.
+ */
+declare function createSignInThrottle(limits?: SignInFailureLimits): {
+    /** True while sign-in for this email, or from this IP, is refused. */
+    isBlocked(email: string, ip: string, now?: number): boolean;
+    /** Counts one failed sign-in for the email and the IP. */
+    recordFailure(email: string, ip: string, now?: number): void;
+};
+type SignInThrottle = ReturnType<typeof createSignInThrottle>;
+declare const tooManySignInAttempts: {
+    code: status;
+    message: string;
+};
+export { createSignInThrottle, SignInFailureLimits, SignInThrottle, tooManySignInAttempts };