@gatwech/auth 1.0.0-beta.21 → 1.0.0-beta.23

package/dist/{sentinel-B4Wo79HK.mjs → sentinel-CYtaI3eO.mjs}

@@ -2,14 +2,16 @@ import { t as getIp } from "./get-request-ip-DSjrEpGo.mjs";
 import { t as safeJSONParse } from "./json-D0TBLy4q.mjs";
 import { n as deleteSessionCookie } from "./cookies-BuvlgcA-.mjs";
 import { n as mergeSchema } from "./date-CMr04reD.mjs";
-import { a as CREDENTIAL_SIGN_IN_PATHS, c as SIGN_IN_PATHS, l as VERIFICATION_PATHS, s as SECURITY_EVENT_TYPES, t as getAuditRecorder } from "./registry-CqG_3Qnx.mjs";
-import { t as getPasswordBreachCount } from "./haveibeenpwned-CzNda7Tn.mjs";
+import { u as sessionMiddleware } from "./session-BB3oqApE.mjs";
+import { a as CREDENTIAL_SIGN_IN_PATHS, c as SIGN_IN_PATHS, l as VERIFICATION_PATHS, s as SECURITY_EVENT_TYPES, t as getAuditRecorder, u as hasRole } from "./registry-GztLf62p.mjs";
+import { t as getPasswordBreachCount } from "./haveibeenpwned-_3a5amT-.mjs";
 import { c as verifySolution, i as createNonce, n as POW_REASON_HEADER, o as parsePowHeader, r as POW_SOLUTION_HEADER, t as POW_CHALLENGE_HEADER } from "./pow-DvkUopsK.mjs";
 import { env } from "@gatwech/core/env";
 import { PayvoAuthError } from "@gatwech/core/error";
 import { defineErrorCodes } from "@gatwech/core/utils";
 import { APIError } from "better-call";
-import { createAuthMiddleware } from "@gatwech/core/api";
+import { createAuthEndpoint, createAuthMiddleware } from "@gatwech/core/api";
+import * as z$1 from "zod";
 import { betterFetch } from "@better-fetch/fetch";
 
 //#region src/plugins/sentinel/actions.ts
@@ -111,7 +113,9 @@ function challengeHeaders(decision) {
 }
 const SENTINEL_ERROR_CODES = defineErrorCodes({
 	POW_CHALLENGE_REQUIRED: "Challenge required",
-	SECURITY_BLOCKED: "Request blocked for security reasons"
+	SECURITY_BLOCKED: "Request blocked for security reasons",
+	SECURITY_ADMIN_REQUIRED: "Only an administrator can manage security blocks",
+	BLOCK_NOT_FOUND: "That block doesn't exist or has ended"
 });
 /** The error for a decision, or null when the request is allowed */
 function errorForDecision(decision) {
@@ -285,6 +289,28 @@ function looksGenerated(email) {
 //#region src/plugins/sentinel/geo.ts
 const EARTH_RADIUS_KM = 6371;
 const toRadians = (degrees) => degrees * Math.PI / 180;
+/** Stored coordinates are whole numbers of millionths of a degree */
+const COORDINATE_SCALE = 1e6;
+/** The largest whole-degree value, which tells an older, unscaled row apart */
+const MAX_DEGREES = 360;
+/**
+* A coordinate as stored. The database column is an integer (the schema has
+* no float type), so degrees are scaled to millionths of a degree, which is
+* about 11 cm.
+*/
+function toStoredCoordinate(degrees) {
+	if (degrees == null) return null;
+	const scaled = Math.round(degrees * COORDINATE_SCALE);
+	return scaled !== 0 && Math.abs(scaled) <= MAX_DEGREES ? Math.sign(scaled) * (MAX_DEGREES + 1) : scaled;
+}
+/**
+* A stored coordinate in degrees. Rows written before coordinates were scaled
+* hold whole degrees, which are never more than 360 in size.
+*/
+function fromStoredCoordinate(stored) {
+	if (stored == null) return null;
+	return Math.abs(stored) <= MAX_DEGREES ? stored : stored / COORDINATE_SCALE;
+}
 /** Great-circle distance between two coordinates, in kilometres */
 function haversineDistanceKm(from, to) {
 	const dLat = toRadians(to.latitude - from.latitude);
@@ -498,6 +524,37 @@ const schema = {
 			required: true
 		}
 	} },
+	sentinelBlock: { fields: {
+		key: {
+			type: "string",
+			required: true,
+			unique: true
+		},
+		feature: {
+			type: "string",
+			required: true
+		},
+		kind: {
+			type: "string",
+			required: true
+		},
+		identifier: {
+			type: "string",
+			required: true
+		},
+		account: {
+			type: "string",
+			required: false
+		},
+		blockedUntil: {
+			type: "date",
+			required: true
+		},
+		createdAt: {
+			type: "date",
+			required: true
+		}
+	} },
 	sentinelSignIn: { fields: {
 		userId: {
 			type: "string",
@@ -610,6 +667,27 @@ async function deleteAllExpiredRows(auth, byPassLastCheckTime = false) {
 		auth.logger.error("[sentinel] Failed to delete expired rows:", error);
 	});
 }
+/** When each auth instance last deleted expired blocks */
+const lastBlocksChecked = /* @__PURE__ */ new WeakMap();
+/**
+* Deletes blocks that ended a while ago, at most every 10 seconds per auth
+* instance. Blocks live in the database even with secondary storage.
+*/
+async function deleteExpiredBlocks(auth, byPassLastCheckTime = false) {
+	const checkedAt = lastBlocksChecked.get(auth.adapter);
+	if (!byPassLastCheckTime && checkedAt && Date.now() - checkedAt < 1e4) return;
+	lastBlocksChecked.set(auth.adapter, Date.now());
+	await auth.adapter.deleteMany({
+		model: "sentinelBlock",
+		where: [{
+			field: "blockedUntil",
+			operator: "lt",
+			value: new Date(Date.now() - EXPIRED_ROW_GRACE_MS)
+		}]
+	}).catch((error) => {
+		auth.logger.error("[sentinel] Failed to delete expired blocks:", error);
+	});
+}
 /**
 * Counters and challenges, kept in secondary storage when it's configured
 * and in the database otherwise
@@ -697,6 +775,92 @@ function createSentinelStore(auth) {
 			if (!row || new Date(row.expiresAt).getTime() <= Date.now()) return 0;
 			return row.count;
 		},
+		async recordBlock(block) {
+			deleteExpiredBlocks(auth);
+			const existing = await auth.adapter.findOne({
+				model: "sentinelBlock",
+				where: [{
+					field: "key",
+					value: block.key
+				}]
+			});
+			if (existing) {
+				await auth.adapter.update({
+					model: "sentinelBlock",
+					where: [{
+						field: "id",
+						value: existing.id
+					}],
+					update: {
+						...block,
+						createdAt: /* @__PURE__ */ new Date()
+					}
+				});
+				return;
+			}
+			await auth.adapter.create({
+				model: "sentinelBlock",
+				data: {
+					...block,
+					createdAt: /* @__PURE__ */ new Date()
+				}
+			}).catch(async () => {
+				await auth.adapter.updateMany({
+					model: "sentinelBlock",
+					where: [{
+						field: "key",
+						value: block.key
+					}],
+					update: {
+						...block,
+						createdAt: /* @__PURE__ */ new Date()
+					}
+				});
+			});
+		},
+		async listBlocks(page) {
+			const where = [{
+				field: "blockedUntil",
+				operator: "gt",
+				value: /* @__PURE__ */ new Date()
+			}];
+			const [blocks, total] = await Promise.all([auth.adapter.findMany({
+				model: "sentinelBlock",
+				where,
+				limit: page.limit,
+				offset: page.offset,
+				sortBy: {
+					field: "createdAt",
+					direction: "desc"
+				}
+			}), auth.adapter.count({
+				model: "sentinelBlock",
+				where
+			})]);
+			return {
+				blocks,
+				total
+			};
+		},
+		async removeBlock(id) {
+			const block = await auth.adapter.findOne({
+				model: "sentinelBlock",
+				where: [{
+					field: "id",
+					value: id
+				}]
+			});
+			if (!block) return null;
+			await auth.adapter.delete({
+				model: "sentinelBlock",
+				where: [{
+					field: "id",
+					value: id
+				}]
+			});
+			await this.reset(`${block.key}:blocked`);
+			return new Date(block.blockedUntil).getTime() > Date.now() ? block : null;
+		},
 		async reset(name) {
 			const key = PREFIX + name;
 			if (storage) {
@@ -1076,6 +1240,16 @@ const sentinel = (options) => {
 		}));
 		return Math.max(0, ...failures);
 	}
+	/** What an attempt counter's key is for: `cs:ip:<ip>` or `cs:visitor:<id>`, plus `:account:<email>` */
+	function describeAttemptKey(key) {
+		const accountAt = key.indexOf(":account:");
+		const [, kind = "visitor", ...identifier] = (accountAt === -1 ? key : key.slice(0, accountAt)).split(":");
+		return {
+			kind,
+			identifier: identifier.join(":"),
+			account: accountAt === -1 ? null : key.slice(accountAt + 9)
+		};
+	}
 	function counterNames(keys) {
 		return keys.flatMap(({ scope, account }) => account ? [scope, account] : [scope]);
 	}
@@ -1143,10 +1317,12 @@ const sentinel = (options) => {
 	}
 	/** The travel speed from the previous sign-in, when both have coordinates */
 	function travel(previous, geo) {
-		if (previous?.latitude == null || previous.longitude == null || geo?.latitude == null || geo.longitude == null) return null;
+		const previousLatitude = fromStoredCoordinate(previous?.latitude);
+		const previousLongitude = fromStoredCoordinate(previous?.longitude);
+		if (!previous || previousLatitude == null || previousLongitude == null || geo?.latitude == null || geo.longitude == null) return null;
 		const speedKmh = travelSpeedKmh({
-			latitude: previous.latitude,
-			longitude: previous.longitude,
+			latitude: previousLatitude,
+			longitude: previousLongitude,
 			at: new Date(previous.createdAt)
 		}, {
 			latitude: geo.latitude,
@@ -1275,6 +1451,10 @@ const sentinel = (options) => {
 			}));
 		}
 	}
+	const adminRoles = opts.adminRoles ?? ["admin"];
+	function requireAdmin(user) {
+		if (!hasRole(user.role, adminRoles)) throw new APIError("FORBIDDEN", { message: SENTINEL_ERROR_CODES.SECURITY_ADMIN_REQUIRED });
+	}
 	return {
 		id: "sentinel",
 		init(ctx) {
@@ -1472,6 +1652,14 @@ const sentinel = (options) => {
 							const block = async (key, also = []) => {
 								await store.increment(`${key}:blocked`, cooldownSeconds);
 								await Promise.all([key, ...also].map((name) => store.reset(name)));
+								await store.recordBlock({
+									key,
+									feature: "credential_stuffing",
+									...describeAttemptKey(key),
+									blockedUntil: new Date(Date.now() + cooldownSeconds * 1e3)
+								}).catch((e) => {
+									ctx.context.logger.error("[sentinel] Failed to record block", e);
+								});
 							};
 							for (const { scope, account } of keys) {
 								const [total, succeeded] = await Promise.all([store.get(scope), store.get(`${scope}:succeeded`)]);
@@ -1599,8 +1787,8 @@ const sentinel = (options) => {
 								userAgent: details.userAgent,
 								country: geo?.country ?? null,
 								city: geo?.city ?? null,
-								latitude: geo?.latitude ?? null,
-								longitude: geo?.longitude ?? null,
+								latitude: toStoredCoordinate(geo?.latitude),
+								longitude: toStoredCoordinate(geo?.longitude),
 								createdAt: /* @__PURE__ */ new Date()
 							}
 						});
@@ -1616,6 +1804,73 @@ const sentinel = (options) => {
 			...schema,
 			...normalizedEmailSchema
 		} : schema, opts.schema),
+		endpoints: {
+			listBlocks: createAuthEndpoint("/sentinel/blocks", {
+				method: "GET",
+				use: [sessionMiddleware],
+				query: z$1.object({
+					limit: z$1.string().or(z$1.number()).optional(),
+					offset: z$1.string().or(z$1.number()).optional()
+				}).optional(),
+				metadata: { openapi: {
+					operationId: "listSentinelBlocks",
+					summary: "List active blocks",
+					description: "List the visitors and IP addresses sentinel is blocking, for admins"
+				} }
+			}, async (ctx) => {
+				requireAdmin(ctx.context.session.user);
+				const limit = Math.min(Math.max(Math.trunc(Number(ctx.query?.limit) || 50), 1), 100);
+				const offset = Math.max(Math.trunc(Number(ctx.query?.offset) || 0), 0);
+				const { blocks, total } = await createSentinelStore(ctx.context).listBlocks({
+					limit,
+					offset
+				});
+				return ctx.json({
+					blocks,
+					total,
+					limit,
+					offset
+				});
+			}),
+			unblock: createAuthEndpoint("/sentinel/unblock", {
+				method: "POST",
+				use: [sessionMiddleware],
+				body: z$1.object({ id: z$1.string() }),
+				metadata: { openapi: {
+					operationId: "unblockSentinel",
+					summary: "Lift a block",
+					description: "Lift a block before its cooldown ends, for admins. Recorded in the audit log."
+				} }
+			}, async (ctx) => {
+				const { user } = ctx.context.session;
+				requireAdmin(user);
+				const block = await createSentinelStore(ctx.context).removeBlock(ctx.body.id);
+				if (!block) throw new APIError("NOT_FOUND", { message: SENTINEL_ERROR_CODES.BLOCK_NOT_FOUND });
+				await getAuditRecorder(ctx.context)?.(ctx, {
+					eventType: SECURITY_EVENT_TYPES.UNBLOCKED,
+					status: "success",
+					userId: user.id,
+					identifier: user.email,
+					eventData: {
+						key: block.key,
+						kind: block.kind,
+						blocked: block.identifier,
+						account: block.account
+					}
+				});
+				return ctx.json({ success: true });
+			}),
+			deleteExpired: createAuthEndpoint("/sentinel/delete-expired", {
+				method: "POST",
+				metadata: {
+					SERVER_ONLY: true,
+					client: false
+				}
+			}, async (ctx) => {
+				await Promise.all([deleteExpiredBlocks(ctx.context, true), deleteAllExpiredRows(ctx.context, true)]);
+				return ctx.json({ success: true });
+			})
+		},
 		$ERROR_CODES: SENTINEL_ERROR_CODES,
 		options: opts
 	};

package/dist/src/plugins/audit-log/events.d.ts

@@ -74,6 +74,7 @@ export declare const SECURITY_EVENT_TYPES: {
     readonly COMPROMISED_PASSWORD: "security_compromised_password";
     readonly STALE_ACCOUNT: "security_stale_account";
     readonly INVALID_EMAIL: "security_invalid_email";
+    readonly UNBLOCKED: "security_unblocked";
 };
 export type AuditEventType = (typeof AUDIT_EVENT_TYPES)[keyof typeof AUDIT_EVENT_TYPES] | (typeof SECURITY_EVENT_TYPES)[keyof typeof SECURITY_EVENT_TYPES];
 export declare const ALL_EVENT_TYPES: AuditEventType[];

package/dist/src/plugins/audit-log/index.d.ts

@@ -527,6 +527,51 @@ export declare const auditLog: (options?: AuditLogOptions | undefined) => {
             };
             path: "/audit-log/get-event-types";
         };
+        deleteOldEvents: {
+            <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+                body: {
+                    olderThanDays: number;
+                };
+            } & {
+                method?: "POST" | undefined;
+            } & {
+                query?: Record<string, any> | undefined;
+            } & {
+                params?: Record<string, any>;
+            } & {
+                request?: Request;
+            } & {
+                headers?: HeadersInit;
+            } & {
+                asResponse?: boolean;
+                returnHeaders?: boolean;
+                use?: import("better-call").Middleware[];
+                path?: string;
+            } & {
+                asResponse?: AsResponse | undefined;
+                returnHeaders?: ReturnHeaders | undefined;
+            }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+                headers: Headers;
+                response: {
+                    deleted: number;
+                };
+            } : {
+                deleted: number;
+            }>;
+            options: {
+                method: "POST";
+                body: z.ZodObject<{
+                    olderThanDays: z.ZodNumber;
+                }, z.core.$strip>;
+                metadata: {
+                    SERVER_ONLY: true;
+                    client: boolean;
+                };
+            } & {
+                use: any[];
+            };
+            path: "/audit-log/delete-old-events";
+        };
     };
     schema: {
         auditLog: {

package/dist/src/plugins/sentinel/actions.d.ts

@@ -39,6 +39,8 @@ export declare function executeAction(params: {
 export declare const SENTINEL_ERROR_CODES: {
     readonly POW_CHALLENGE_REQUIRED: "Challenge required";
     readonly SECURITY_BLOCKED: "Request blocked for security reasons";
+    readonly SECURITY_ADMIN_REQUIRED: "Only an administrator can manage security blocks";
+    readonly BLOCK_NOT_FOUND: "That block doesn't exist or has ended";
 };
 /** The error for a decision, or null when the request is allowed */
 export declare function errorForDecision(decision: Decision): ({

package/dist/src/plugins/sentinel/geo.d.ts

@@ -1,3 +1,14 @@
+/**
+ * A coordinate as stored. The database column is an integer (the schema has
+ * no float type), so degrees are scaled to millionths of a degree, which is
+ * about 11 cm.
+ */
+export declare function toStoredCoordinate(degrees: number | null | undefined): number | null;
+/**
+ * A stored coordinate in degrees. Rows written before coordinates were scaled
+ * hold whole degrees, which are never more than 360 in size.
+ */
+export declare function fromStoredCoordinate(stored: number | null | undefined): number | null;
 /** Great-circle distance between two coordinates, in kilometres */
 export declare function haversineDistanceKm(from: {
     latitude: number;