@gatwech/auth 1.0.0-beta.19 → 1.0.0-beta.21

package/dist/{sentinel-C-D1IHJo.mjs → sentinel-B4Wo79HK.mjs}

@@ -4,7 +4,7 @@ import { n as deleteSessionCookie } from "./cookies-BuvlgcA-.mjs";
 import { n as mergeSchema } from "./date-CMr04reD.mjs";
 import { a as CREDENTIAL_SIGN_IN_PATHS, c as SIGN_IN_PATHS, l as VERIFICATION_PATHS, s as SECURITY_EVENT_TYPES, t as getAuditRecorder } from "./registry-CqG_3Qnx.mjs";
 import { t as getPasswordBreachCount } from "./haveibeenpwned-CzNda7Tn.mjs";
-import { c as verifySolution, i as createNonce, n as POW_REASON_HEADER, o as parsePowHeader, r as POW_SOLUTION_HEADER, t as POW_CHALLENGE_HEADER } from "./pow-OK01yPG3.mjs";
+import { c as verifySolution, i as createNonce, n as POW_REASON_HEADER, o as parsePowHeader, r as POW_SOLUTION_HEADER, t as POW_CHALLENGE_HEADER } from "./pow-DvkUopsK.mjs";
 import { env } from "@gatwech/core/env";
 import { PayvoAuthError } from "@gatwech/core/error";
 import { defineErrorCodes } from "@gatwech/core/utils";
@@ -15,15 +15,20 @@ import { betterFetch } from "@better-fetch/fetch";
 //#region src/plugins/sentinel/actions.ts
 const CHALLENGE_TTL_MS = 6e4;
 /**
+* Challenges an IP address can be issued within one challenge lifetime.
+* Each one is stored, so past this the request is blocked instead.
+*/
+const MAX_CHALLENGES_PER_IP = 30;
+/**
 * Applies a security action: records the event and decides whether the
 * request continues, gets a proof-of-work challenge or is blocked
 */
 async function executeAction(params) {
 	const { auth, event, action, reason } = params;
 	const recorder = getAuditRecorder(auth);
-	const record = async (eventType, status) => {
+	const record = async (eventType, status, metadata = params.metadata) => {
 		if (!recorder) {
-			auth.logger.warn(`[sentinel] ${reason}: ${status}`, params.metadata);
+			auth.logger.warn(`[sentinel] ${reason}: ${status}`, metadata);
 			return;
 		}
 		await recorder(event, {
@@ -36,7 +41,7 @@ async function executeAction(params) {
 			eventData: {
 				reason,
 				action,
-				...params.metadata
+				...metadata
 			}
 		});
 	};
@@ -49,12 +54,32 @@ async function executeAction(params) {
 			await record(SECURITY_EVENT_TYPES.ALLOWED_AFTER_CHALLENGE, "success");
 			return { outcome: "allow" };
 		}
+		if (params.ipAddress) {
+			const challengesIssued = await params.store.increment(`pow-issued:${params.ipAddress}`, CHALLENGE_TTL_MS / 1e3).catch((e) => {
+				auth.logger.error("[sentinel] Failed to count challenges", e);
+				return 0;
+			});
+			if (challengesIssued > MAX_CHALLENGES_PER_IP) {
+				const metadata = {
+					...params.metadata,
+					challengesIssued,
+					maxChallenges: MAX_CHALLENGES_PER_IP
+				};
+				await record(params.eventType, "blocked", metadata);
+				await record(SECURITY_EVENT_TYPES.BLOCKED, "blocked", metadata);
+				return {
+					outcome: "block",
+					reason
+				};
+			}
+		}
 		const nonce = createNonce();
 		try {
 			await params.store.saveChallenge({
 				nonce,
 				difficulty: params.difficulty,
 				reason,
+				path: event.path ?? null,
 				ipAddress: params.ipAddress,
 				visitorId: params.visitorId,
 				expiresAt: new Date(Date.now() + CHALLENGE_TTL_MS)
@@ -194,23 +219,54 @@ async function isDisposableDomain(domain) {
 	for (let i = 0; i < labels.length - 1; i++) if (isDisposable(labels.slice(i).join("."))) return true;
 	return false;
 }
+/** How long a mail lookup may take before it counts as unknown */
+const MAIL_LOOKUP_TIMEOUT_MS = 2e3;
+/** The lookup found nothing, as opposed to failing */
+const isMissingRecord = (e) => {
+	const code = e.code;
+	return code === "ENOTFOUND" || code === "ENODATA" || code === "ENOTIMP";
+};
+/** Whether a domain has an A or AAAA record, null when a lookup failed */
+async function hasAddressRecords(dns, domain) {
+	const addressLookups = await Promise.allSettled([dns.resolve4(domain), dns.resolve6(domain)]);
+	if (addressLookups.some((lookup) => lookup.status === "fulfilled" && lookup.value.length > 0)) return true;
+	return addressLookups.some((lookup) => lookup.status === "rejected" && !isMissingRecord(lookup.reason)) ? null : false;
+}
+async function canReceiveMail(dns, domain) {
+	try {
+		const mxRecords = await dns.resolveMx(domain);
+		if (mxRecords.length === 1 && (mxRecords[0].exchange === "" || mxRecords[0].exchange === ".")) return false;
+		if (mxRecords.length > 0) return true;
+	} catch (e) {
+		const code = e.code;
+		if (code === "ENOTFOUND" || code === "ENOTIMP") return false;
+		if (!isMissingRecord(e)) return null;
+	}
+	return hasAddressRecords(dns, domain);
+}
 /**
-* Whether a domain has at least one MX record. Returns null when the lookup
-* isn't possible, e.g. on runtimes without DNS access.
+* Whether a domain can receive mail: it has an MX record, or an address
+* record to fall back to when it has none. A null MX record, which marks a
+* domain that accepts no mail, doesn't count.
+*
+* Returns null when that can't be told: runtimes without DNS access, lookup
+* failures, or a lookup that takes longer than `timeoutMs`.
 */
-async function hasMxRecords(domain) {
+async function hasMxRecords(domain, options = {}) {
 	let dns;
 	try {
 		dns = await import("node:dns/promises");
 	} catch {
 		return null;
 	}
+	let timer;
+	const timeout = new Promise((resolve) => {
+		timer = setTimeout(() => resolve(null), options.timeoutMs ?? MAIL_LOOKUP_TIMEOUT_MS);
+	});
 	try {
-		return (await dns.resolveMx(domain)).length > 0;
-	} catch (e) {
-		const code = e.code;
-		if (code === "ENOTFOUND" || code === "ENODATA" || code === "ENOTIMP") return false;
-		return null;
+		return await Promise.race([canReceiveMail(dns, domain), timeout]);
+	} finally {
+		clearTimeout(timer);
 	}
 }
 /**
@@ -247,6 +303,41 @@ function travelSpeedKmh(from, to) {
 	return distance / (Math.max(Math.abs(to.at.getTime() - from.at.getTime()), 6e4) / 36e5);
 }
 
+//#endregion
+//#region src/plugins/sentinel/memory-cache.ts
+/**
+* A small in-memory cache that forgets entries after a TTL and drops the
+* least recently used one when it's full. Used when there's no secondary
+* storage to share verdicts through.
+*/
+function createMemoryCache(options) {
+	const entries = /* @__PURE__ */ new Map();
+	return {
+		get(key) {
+			const entry = entries.get(key);
+			if (!entry) return void 0;
+			if (entry.expiresAt <= Date.now()) {
+				entries.delete(key);
+				return;
+			}
+			entries.delete(key);
+			entries.set(key, entry);
+			return entry.value;
+		},
+		set(key, value, ttlMs = options.ttlMs) {
+			entries.delete(key);
+			if (entries.size >= options.maxSize) {
+				const oldest = entries.keys().next().value;
+				if (oldest !== void 0) entries.delete(oldest);
+			}
+			entries.set(key, {
+				value,
+				expiresAt: Date.now() + ttlMs
+			});
+		}
+	};
+}
+
 //#endregion
 //#region src/plugins/sentinel/intel.ts
 const BOT_USER_AGENT = /bot|crawl|spider|slurp|headless|phantomjs|selenium|puppeteer|playwright|curl|wget|httpie|python-requests|python-urllib|aiohttp|go-http-client|okhttp|java\/|libwww|scrapy|postman|insomnia/i;
@@ -265,9 +356,18 @@ const UNKNOWN = {
 	bot: null,
 	geo: null
 };
+/** Verdicts kept in memory when there's no secondary storage */
+const MEMORY_CACHE_SIZE = 5e3;
+/** How long a verified visitor id is remembered */
+const VISITOR_CACHE_SECONDS = 300;
+/** How long an in-memory request verdict lasts when the backend sets none */
+const DEFAULT_INTEL_CACHE_SECONDS = 60;
+/** The longest an in-memory request verdict lasts */
+const MAX_INTEL_CACHE_SECONDS = 300;
 /**
 * Asks the hosted backend about a request's IP address and client. Verdicts
-* are cached in secondary storage for as long as the backend allows.
+* are cached for as long as the backend allows, in secondary storage or, when
+* there is none, in memory.
 * Returns null verdicts when the backend isn't configured or can't answer.
 */
 function createIntelClient(options) {
@@ -281,15 +381,26 @@ function createIntelClient(options) {
 		baseDelay: options.kvOptions?.retry?.baseDelay ?? 400,
 		maxDelay: options.kvOptions?.retry?.maxDelay ?? 600
 	};
+	const visitorVerdicts = createMemoryCache({
+		maxSize: MEMORY_CACHE_SIZE,
+		ttlMs: VISITOR_CACHE_SECONDS * 1e3
+	});
+	const requestVerdicts = createMemoryCache({
+		maxSize: MEMORY_CACHE_SIZE,
+		ttlMs: DEFAULT_INTEL_CACHE_SECONDS * 1e3
+	});
 	return {
 		configured,
 		verifiesVisitors: Boolean(kvUrl && apiKey),
 		misconfigured: Boolean((apiUrl || kvUrl) && !apiKey) || Boolean(apiKey && !apiUrl && !kvUrl),
-		async verifyVisitor(auth, request) {
+		async verifyVisitor(auth, request, limit) {
 			if (!kvUrl || !apiKey) return request.visitorId;
 			const cacheKey = `sentinel:visitor:${request.visitorId}:${request.ip ?? ""}`;
 			const cached = await auth.secondaryStorage?.get(cacheKey);
 			if (typeof cached === "string") return cached || null;
+			const remembered = visitorVerdicts.get(cacheKey);
+			if (remembered !== void 0 && !auth.secondaryStorage) return remembered;
+			if (limit && !await limit.allowed()) return null;
 			for (let attempt = 0; attempt <= kv.attempts; attempt++) {
 				if (attempt > 0) {
 					const wait = Math.min(kv.baseDelay * 2 ** (attempt - 1), kv.maxDelay);
@@ -309,7 +420,9 @@ function createIntelClient(options) {
 				}));
 				if (data && !error) {
 					const visitorId = data.valid ? data.visitorId ?? request.visitorId : null;
-					await auth.secondaryStorage?.set(cacheKey, visitorId ?? "", 300);
+					if (!visitorId) await limit?.rejected();
+					if (auth.secondaryStorage) await auth.secondaryStorage.set(cacheKey, visitorId ?? "", VISITOR_CACHE_SECONDS);
+					else visitorVerdicts.set(cacheKey, visitorId);
 					return visitorId;
 				}
 			}
@@ -321,6 +434,8 @@ function createIntelClient(options) {
 			const cacheKey = `sentinel:intel:${ip}:${visitorId ?? ""}`;
 			const cached = safeJSONParse(await auth.secondaryStorage?.get(cacheKey));
 			if (cached) return cached;
+			const remembered = auth.secondaryStorage ? void 0 : requestVerdicts.get(cacheKey);
+			if (remembered) return remembered;
 			const { data, error } = await betterFetch(`${apiUrl}/v1/intel/request`, {
 				method: "POST",
 				headers: {
@@ -347,7 +462,12 @@ function createIntelClient(options) {
 				bot: data.bot?.verdict === "bot" ? true : data.bot?.verdict === "human" ? false : null,
 				geo: data.geo ?? null
 			};
-			if (data.ttlSeconds && auth.secondaryStorage) await auth.secondaryStorage.set(cacheKey, JSON.stringify(intel), data.ttlSeconds);
+			if (auth.secondaryStorage) {
+				if (data.ttlSeconds) await auth.secondaryStorage.set(cacheKey, JSON.stringify(intel), data.ttlSeconds);
+			} else {
+				const ttlSeconds = Math.min(data.ttlSeconds ?? DEFAULT_INTEL_CACHE_SECONDS, MAX_INTEL_CACHE_SECONDS);
+				requestVerdicts.set(cacheKey, intel, ttlSeconds * 1e3);
+			}
 			return intel;
 		}
 	};
@@ -435,6 +555,10 @@ const schema = {
 			type: "string",
 			required: true
 		},
+		path: {
+			type: "string",
+			required: false
+		},
 		ipAddress: {
 			type: "string",
 			required: false
@@ -457,6 +581,35 @@ const schema = {
 //#endregion
 //#region src/plugins/sentinel/store.ts
 const PREFIX = "sentinel:";
+/** How long after expiring a row is deleted */
+const EXPIRED_ROW_GRACE_MS = 6e4;
+/** Tries to increment a counter in the database before giving up */
+const MAX_COUNTER_ATTEMPTS = 20;
+/** When each auth instance last deleted expired rows, keyed by its adapter */
+const lastChecked = /* @__PURE__ */ new WeakMap();
+/**
+* Deletes expired counters and challenges from the database, at most every
+* 10 seconds per auth instance. Secondary storage expires them itself.
+*/
+async function deleteAllExpiredRows(auth, byPassLastCheckTime = false) {
+	if (auth.secondaryStorage) return;
+	const checkedAt = lastChecked.get(auth.adapter);
+	if (checkedAt && !byPassLastCheckTime) {
+		if (Date.now() - checkedAt.getTime() < 1e4) return;
+	}
+	lastChecked.set(auth.adapter, /* @__PURE__ */ new Date());
+	const expiredBefore = new Date(Date.now() - EXPIRED_ROW_GRACE_MS);
+	await Promise.all(["sentinelCounter", "powChallenge"].map((model) => auth.adapter.deleteMany({
+		model,
+		where: [{
+			field: "expiresAt",
+			operator: "lt",
+			value: expiredBefore
+		}]
+	}))).catch((error) => {
+		auth.logger.error("[sentinel] Failed to delete expired rows:", error);
+	});
+}
 /**
 * Counters and challenges, kept in secondary storage when it's configured
 * and in the database otherwise
@@ -491,45 +644,45 @@ function createSentinelStore(auth) {
 				}), Math.max(Math.ceil((expiresAt - now) / 1e3), 1));
 				return count;
 			}
-			let row = await findCounter(key);
-			if (!row) {
-				if (await auth.adapter.create({
-					model: "sentinelCounter",
-					data: {
-						key,
-						count: 1,
-						expiresAt: new Date(Date.now() + ttlSeconds * 1e3)
-					}
-				}).then(() => true, () => false)) return 1;
-				row = await findCounter(key);
-				if (!row) throw new Error(`Failed to create counter ${key}`);
-			}
-			if (new Date(row.expiresAt).getTime() <= Date.now()) {
-				await auth.adapter.update({
+			deleteAllExpiredRows(auth);
+			for (let attempt = 0; attempt < MAX_COUNTER_ATTEMPTS; attempt++) {
+				const row = await findCounter(key);
+				if (!row) {
+					if (await auth.adapter.create({
+						model: "sentinelCounter",
+						data: {
+							key,
+							count: 1,
+							expiresAt: new Date(Date.now() + ttlSeconds * 1e3)
+						}
+					}).then(() => true, () => false)) return 1;
+					continue;
+				}
+				const expiresAt = new Date(row.expiresAt);
+				const expired = expiresAt.getTime() <= Date.now();
+				if (await auth.adapter.updateMany({
 					model: "sentinelCounter",
-					where: [{
-						field: "id",
-						value: row.id
-					}],
+					where: [
+						{
+							field: "id",
+							value: row.id
+						},
+						{
+							field: "count",
+							value: row.count
+						},
+						{
+							field: "expiresAt",
+							value: expiresAt
+						}
+					],
 					update: {
-						count: 1,
-						expiresAt: new Date(Date.now() + ttlSeconds * 1e3)
+						count: expired ? 1 : row.count + 1,
+						...expired || options.sliding ? { expiresAt: new Date(Date.now() + ttlSeconds * 1e3) } : {}
 					}
-				});
-				return 1;
+				}) > 0) return expired ? 1 : row.count + 1;
 			}
-			await auth.adapter.update({
-				model: "sentinelCounter",
-				where: [{
-					field: "id",
-					value: row.id
-				}],
-				update: {
-					count: row.count + 1,
-					...options.sliding ? { expiresAt: new Date(Date.now() + ttlSeconds * 1e3) } : {}
-				}
-			});
-			return row.count + 1;
+			throw new Error(`Failed to increment counter ${key}`);
 		},
 		async get(name) {
 			const key = PREFIX + name;
@@ -564,6 +717,7 @@ function createSentinelStore(auth) {
 				await storage.set(`${PREFIX}pow:${challenge.nonce}`, JSON.stringify(challenge), ttlSeconds);
 				return;
 			}
+			deleteAllExpiredRows(auth);
 			await auth.adapter.create({
 				model: "powChallenge",
 				data: {
@@ -647,11 +801,26 @@ const NEW_PASSWORD_FIELDS = {
 * towards credential stuffing
 */
 const isAttemptPath = (path) => CREDENTIAL_SIGN_IN_PATHS.includes(path) || VERIFICATION_PATHS.includes(path);
+/** Endpoints a bot is blocked on: sign-in, sign-up and password reset */
+const BOT_CHECK_PATHS = [
+	...CREDENTIAL_SIGN_IN_PATHS,
+	...VERIFICATION_PATHS,
+	...SIGN_UP_PATHS,
+	...PASSWORD_RESET_PATHS
+];
 /** Account creation that isn't done by the visitor signing up */
 const isManagedAccountCreation = (path) => !path || path.startsWith("/admin/") || path === "/sign-in/anonymous";
 /** Social sign-ups, whose email the provider has already verified */
 const OAUTH_CALLBACK_PATHS = ["/callback/:id", "/oauth2/callback/:providerId"];
 const DAY_SECONDS = 1440 * 60;
+/** Window the identification service limits per IP address count over */
+const VISITOR_LIMIT_WINDOW_SECONDS = 60;
+/** Calls to the identification service per IP address in the window */
+const MAX_VERIFICATIONS_PER_IP = 20;
+/** Visitor ids that weren't genuine per IP address in the window */
+const MAX_INVALID_VISITORS_PER_IP = 5;
+/** Sign-ins kept per user for impossible travel, stale and new devices */
+const SIGN_IN_HISTORY_LIMIT = 50;
 /**
 * Sign-ins checked with a password, which can be repeated with a challenge
 * solution
@@ -701,7 +870,10 @@ const sentinel = (options) => {
 		thresholds: security.freeTrialAbuse.thresholds,
 		maxAccountsPerVisitor: security.freeTrialAbuse.maxAccountsPerVisitor ?? 3,
 		retentionSeconds: Math.min(Math.max(security.freeTrialAbuse.retentionSeconds ?? 90 * DAY_SECONDS, DAY_SECONDS), 365 * DAY_SECONDS),
-		action: security.freeTrialAbuse.action ?? "block"
+		action: security.freeTrialAbuse.action ?? "block",
+		maxAccountsPerIp: security.freeTrialAbuse.maxAccountsPerIp ?? 10,
+		ipWindowSeconds: Math.min(Math.max(security.freeTrialAbuse.ipWindowSeconds ?? DAY_SECONDS, 1), 365 * DAY_SECONDS),
+		requireVerifiedVisitor: security.freeTrialAbuse.requireVerifiedVisitor ?? false
 	} : null;
 	const botBlocking = resolveToggle(security.botBlocking, "challenge");
 	const suspiciousIpBlocking = resolveToggle(security.suspiciousIpBlocking, "block");
@@ -735,16 +907,32 @@ const sentinel = (options) => {
 	const unknownDeviceNotification = security.unknownDeviceNotification ?? false;
 	const tracksSignIns = Boolean(impossibleTravel || staleUsers || unknownDeviceNotification);
 	const checksAccountCreation = Boolean(freeTrialAbuse || velocity || emailValidation);
-	/** Challenge results, so each solution is checked once per request */
-	const challengeResults = /* @__PURE__ */ new WeakMap();
-	/** Verified visitor ids, so each request is checked once */
-	const visitorResults = /* @__PURE__ */ new WeakMap();
+	/** Whether each request's solution was accepted, so it's checked once */
+	const acceptedSolutions = /* @__PURE__ */ new WeakMap();
+	/** Each request's verified visitor, so it's checked once */
+	const verifiedVisitors = /* @__PURE__ */ new WeakMap();
 	function clientIp(request, auth) {
 		if (!request) return null;
 		if (opts.providers?.getClientIp) return opts.providers.getClientIp(request);
 		return getIp(request, auth.options);
 	}
 	/**
+	* Limits the calls to the identification service for one IP address: after
+	* too many calls, or too many ids that weren't genuine, its ids go
+	* unchecked and aren't trusted
+	*/
+	function visitorVerificationLimit(store, ip) {
+		return {
+			async allowed() {
+				if (await store.get(`visitor-invalid:${ip}`) >= MAX_INVALID_VISITORS_PER_IP) return false;
+				return await store.increment(`visitor-verify:${ip}`, VISITOR_LIMIT_WINDOW_SECONDS) <= MAX_VERIFICATIONS_PER_IP;
+			},
+			async rejected() {
+				await store.increment(`visitor-invalid:${ip}`, VISITOR_LIMIT_WINDOW_SECONDS);
+			}
+		};
+	}
+	/**
 	* The visitor id sent by the client, checked with the identification
 	* service when one is configured
 	*/
@@ -754,22 +942,23 @@ const sentinel = (options) => {
 			id: null,
 			verified: false
 		});
-		const existing = visitorResults.get(headers);
-		if (existing) return existing;
+		const cachedVisitor = verifiedVisitors.get(headers);
+		if (cachedVisitor) return cachedVisitor;
 		const unchecked = {
 			id: opts.failOpen ? sent : null,
 			verified: false
 		};
-		const result = intel.verifyVisitor(auth, {
+		const store = createSentinelStore(auth);
+		const visitor = intel.verifyVisitor(auth, {
 			visitorId: sent,
 			ip,
 			userAgent: headers.get("user-agent")
-		}).then((verified) => verified === void 0 ? unchecked : {
+		}, ip ? visitorVerificationLimit(store, ip) : void 0).then((verified) => verified === void 0 ? unchecked : {
 			id: verified,
 			verified: intel.verifiesVisitors
 		}).catch(() => unchecked);
-		visitorResults.set(headers, result);
-		return result;
+		verifiedVisitors.set(headers, visitor);
+		return visitor;
 	}
 	function relativePath(request, auth) {
 		const pathname = new URL(request.url).pathname;
@@ -778,27 +967,28 @@ const sentinel = (options) => {
 	}
 	/**
 	* Whether the request carries a valid, unused solution to a challenge
-	* issued to the same IP address and visitor
+	* issued to the same IP address and visitor, for the same endpoint
 	*/
-	function challengePassed(key, details, store, auth) {
-		const existing = challengeResults.get(key);
-		if (existing) return existing;
-		const result = (async () => {
-			const parsed = parsePowHeader(details.headers?.get(POW_SOLUTION_HEADER));
-			if (!parsed) return false;
+	function challengePassed(key, details, store, auth, path) {
+		const cachedAcceptance = acceptedSolutions.get(key);
+		if (cachedAcceptance) return cachedAcceptance;
+		const accepted = (async () => {
+			const solution = parsePowHeader(details.headers?.get(POW_SOLUTION_HEADER));
+			if (!solution) return false;
 			try {
-				const challenge = await store.consumeChallenge(parsed.nonce);
+				const challenge = await store.consumeChallenge(solution.nonce);
 				if (!challenge) return false;
 				if (challenge.ipAddress && challenge.ipAddress !== details.ip) return false;
 				if (challenge.visitorId && challenge.visitorId !== details.visitorId) return false;
-				return await verifySolution(parsed.nonce, parsed.value, challenge.difficulty);
+				if (challenge.path && challenge.path !== path) return false;
+				return await verifySolution(solution.nonce, solution.value, challenge.difficulty);
 			} catch (e) {
 				auth.logger.error("[sentinel] Failed to verify challenge", e);
 				return false;
 			}
 		})();
-		challengeResults.set(key, result);
-		return result;
+		acceptedSolutions.set(key, accepted);
+		return accepted;
 	}
 	/** Runs a check, applying `failOpen` when it can't complete */
 	async function guard(auth, check) {
@@ -845,12 +1035,12 @@ const sentinel = (options) => {
 			visitorId: details.visitorId,
 			identifier: details.identifier,
 			userId,
-			challengePassed: action === "challenge" ? await challengePassed(challengeKey(ctx, details), details, store, ctx.context) : false,
+			challengePassed: action === "challenge" ? await challengePassed(challengeKey(ctx, details), details, store, ctx.context, ctx.path) : false,
 			difficulty,
 			metadata
 		}));
 	}
-	/** The key a request's challenge result is cached under */
+	/** The key a request's accepted solution is cached under */
 	function challengeKey(ctx, details) {
 		return ctx.request ?? details.headers ?? ctx;
 	}
@@ -908,6 +1098,31 @@ const sentinel = (options) => {
 		if (opts.providers?.resolveGeo) return opts.providers.resolveGeo(details.ip);
 		return (await intel.lookup(auth, details)).geo;
 	}
+	/** Deletes a user's sign-ins beyond the most recent ones Sentinel keeps */
+	async function deleteOlderSignIns(auth, userId) {
+		const olderSignIns = await auth.adapter.findMany({
+			model: "sentinelSignIn",
+			where: [{
+				field: "userId",
+				value: userId
+			}],
+			sortBy: {
+				field: "createdAt",
+				direction: "desc"
+			},
+			offset: SIGN_IN_HISTORY_LIMIT,
+			limit: 100
+		});
+		if (!olderSignIns.length) return;
+		await auth.adapter.deleteMany({
+			model: "sentinelSignIn",
+			where: [{
+				field: "id",
+				operator: "in",
+				value: olderSignIns.map((signIn) => signIn.id)
+			}]
+		});
+	}
 	async function lastSignIn(auth, userId) {
 		const [row] = await auth.adapter.findMany({
 			model: "sentinelSignIn",
@@ -1031,6 +1246,20 @@ const sentinel = (options) => {
 				});
 			}));
 		}
+		if (freeTrialAbuse) {
+			if (details.ip) {
+				const ip = details.ip;
+				throwForDecision(await guard(ctx.context, async () => {
+					const created = await store.get(`trial:ip:${ip}`);
+					if (created < freeTrialAbuse.maxAccountsPerIp) return { outcome: "allow" };
+					return act(event, store, details, freeTrialAbuse.action, SECURITY_EVENT_TYPES.FREE_TRIAL_ABUSE, "free_trial_abuse", {
+						accounts: created,
+						signal: "ip"
+					});
+				}));
+			}
+			if (freeTrialAbuse.requireVerifiedVisitor && !details.visitorVerified) throwForDecision(await act(event, store, details, "challenge", SECURITY_EVENT_TYPES.FREE_TRIAL_ABUSE, "visitor_not_verified", {}));
+		}
 		if (freeTrialAbuse && details.visitorId) {
 			const visitorId = details.visitorId;
 			throwForDecision(await guard(ctx.context, async () => {
@@ -1068,9 +1297,10 @@ const sentinel = (options) => {
 						const headers = event.headers ?? event.request?.headers;
 						const ip = clientIp(event.request ?? headers, context.context);
 						const { id: visitorId } = await resolveVisitor(context.context, headers, ip);
-						if (!visitorId) return;
 						try {
-							await createSentinelStore(context.context).increment(`trial:${visitorId}`, freeTrialAbuse.retentionSeconds, { sliding: true });
+							const store = createSentinelStore(context.context);
+							if (visitorId) await store.increment(`trial:${visitorId}`, freeTrialAbuse.retentionSeconds, { sliding: true });
+							if (ip) await store.increment(`trial:ip:${ip}`, freeTrialAbuse.ipWindowSeconds);
 						} catch (e) {
 							context.context.logger.error("[sentinel] Failed to track sign-up", e);
 						}
@@ -1087,34 +1317,37 @@ const sentinel = (options) => {
 		},
 		async onRequest(request, ctx) {
 			if (!botBlocking && !suspiciousIpBlocking && !geoBlocking) return;
+			const path = relativePath(request, ctx);
+			const checkBot = Boolean(botBlocking) && BOT_CHECK_PATHS.includes(path);
+			if (!checkBot && !suspiciousIpBlocking && !geoBlocking) return;
 			const store = createSentinelStore(ctx);
 			const event = {
 				context: ctx,
 				request,
 				headers: request.headers,
-				path: relativePath(request, ctx)
+				path
 			};
 			const response = responseForDecision(await guard(ctx, async () => {
 				const details = await requestDetails(event);
 				const { ip } = details;
-				const remote = await intel.lookup(ctx, details);
+				const backendVerdicts = await intel.lookup(ctx, details);
 				if (suspiciousIpBlocking && ip) {
-					if (opts.providers?.isSuspiciousIp ? await opts.providers.isSuspiciousIp(ip) : remote.suspiciousIp) {
-						const result = await act(event, store, details, suspiciousIpBlocking.action, SECURITY_EVENT_TYPES.SUSPICIOUS_IP, "suspicious_ip", { ip });
-						if (result.outcome !== "allow") return result;
+					if (opts.providers?.isSuspiciousIp ? await opts.providers.isSuspiciousIp(ip) : backendVerdicts.suspiciousIp) {
+						const suspiciousIpDecision = await act(event, store, details, suspiciousIpBlocking.action, SECURITY_EVENT_TYPES.SUSPICIOUS_IP, "suspicious_ip", { ip });
+						if (suspiciousIpDecision.outcome !== "allow") return suspiciousIpDecision;
 					}
 				}
 				if (geoBlocking && ip) {
-					const country = (opts.providers?.resolveGeo ? await opts.providers.resolveGeo(ip) : remote.geo)?.country?.toUpperCase() ?? null;
+					const country = (opts.providers?.resolveGeo ? await opts.providers.resolveGeo(ip) : backendVerdicts.geo)?.country?.toUpperCase() ?? null;
 					if (country ? geoBlocking.allowList ? !geoBlocking.allowList.includes(country) : Boolean(geoBlocking.denyList?.includes(country)) : Boolean(geoBlocking.allowList) && !opts.failOpen) {
-						const result = await act(event, store, details, geoBlocking.action, SECURITY_EVENT_TYPES.GEO_BLOCKED, "geo_blocking", { country });
-						if (result.outcome !== "allow") return result;
+						const geoDecision = await act(event, store, details, geoBlocking.action, SECURITY_EVENT_TYPES.GEO_BLOCKED, "geo_blocking", { country });
+						if (geoDecision.outcome !== "allow") return geoDecision;
 					}
 				}
-				if (botBlocking) {
-					if (opts.providers?.isBot ? await opts.providers.isBot(request) : remote.bot ?? looksLikeBot(request)) {
-						const result = await act(event, store, details, botBlocking.action, SECURITY_EVENT_TYPES.BOT_BLOCKED, "bot", { userAgent: request.headers.get("user-agent") });
-						if (result.outcome !== "allow") return result;
+				if (botBlocking && checkBot) {
+					if (opts.providers?.isBot ? await opts.providers.isBot(request) : backendVerdicts.bot ?? looksLikeBot(request)) {
+						const botDecision = await act(event, store, details, botBlocking.action, SECURITY_EVENT_TYPES.BOT_BLOCKED, "bot", { userAgent: request.headers.get("user-agent") });
+						if (botDecision.outcome !== "allow") return botDecision;
 					}
 				}
 				return { outcome: "allow" };
@@ -1160,7 +1393,7 @@ const sentinel = (options) => {
 					}
 					if (credentialStuffing && isAttemptPath(ctx.path)) throwForDecision(await guard(ctx.context, async () => {
 						const keys = attemptKeys(details);
-						const solved = Boolean(details.headers?.get(POW_SOLUTION_HEADER)) && await challengePassed(challengeKey(ctx, details), details, store, ctx.context);
+						const solved = Boolean(details.headers?.get(POW_SOLUTION_HEADER)) && await challengePassed(challengeKey(ctx, details), details, store, ctx.context, ctx.path);
 						const blocked = (await Promise.all(counterNames(keys).map((key) => store.get(`${key}:blocked`)))).some((value) => value > 0);
 						const failures = await countAttempt(store, keys, { readOnly: solved || blocked });
 						const { thresholds } = credentialStuffing;
@@ -1189,12 +1422,12 @@ const sentinel = (options) => {
 							if (limit) {
 								const count = await store.increment(limit.name, windowSeconds);
 								if (count > limit.max) {
-									const result = await act(ctx, store, details, velocity.action, SECURITY_EVENT_TYPES.VELOCITY_EXCEEDED, "velocity", {
+									const limitDecision = await act(ctx, store, details, velocity.action, SECURITY_EVENT_TYPES.VELOCITY_EXCEEDED, "velocity", {
 										count,
 										limit: limit.max,
 										windowSeconds
 									});
-									if (result.outcome !== "allow") return result;
+									if (limitDecision.outcome !== "allow") return limitDecision;
 								}
 							}
 							if (ids.length && isTracked) {
@@ -1371,6 +1604,7 @@ const sentinel = (options) => {
 								createdAt: /* @__PURE__ */ new Date()
 							}
 						});
+						await deleteOlderSignIns(auth, user.id);
 					} catch (e) {
 						if (e instanceof APIError) throw e;
 						auth.logger.error("[sentinel] Failed to track sign-in", e);