@gatwech/auth 1.0.0-beta.22 → 1.0.0-beta.23

package/dist/plugins/sentinel/index.d.mts

@@ -1,29 +1,29 @@
 import "../../helper-BgOIGHsu.mjs";
-import "../../index-DngQlUSI.mjs";
+import "../../index-3lfPQHhX.mjs";
 import "../../types-DNQ9XQrB.mjs";
 import "../../index-BL_t8cRp-C4QYBsac.mjs";
 import "../../plugins-Dy_FrD4Y.mjs";
 import "../../index-CxlWnL9c.mjs";
-import "../../index-D3uQsW8T.mjs";
-import "../../index-CRiKKdkb.mjs";
-import { S as SentinelOptions, _ as haversineDistanceKm, b as GeoLocation, c as sentinel, d as POW_SOLUTION_HEADER, f as createNonce, g as verifySolution, h as solveChallenge, l as POW_CHALLENGE_HEADER, m as parsePowHeader, p as hasLeadingZeroBits, u as POW_REASON_HEADER, v as normalizeEmail, x as SecurityAction, y as SENTINEL_ERROR_CODES } from "../../index-AiKdOFSd.mjs";
-import "../../index-BzzhaGLe.mjs";
-import "../../index-DlS-HqZR.mjs";
-import "../../index-Dl0bD1_6.mjs";
-import "../../index-CBGNX7W1.mjs";
-import "../../index-Do8AV4PF.mjs";
-import "../../index-SYRh5FW7.mjs";
-import "../../index-BC0aAKsT.mjs";
-import "../../index-D-rjuF7p.mjs";
-import "../../index-DKirx_GW.mjs";
-import "../../index-BfLofiXO.mjs";
-import "../../index-Dkm27DLN.mjs";
-import "../../index-CxhQu1HM.mjs";
-import "../../index-hP8gvyp-.mjs";
+import "../../index-Blq8KrTy.mjs";
+import "../../index-B4aWSJEd.mjs";
+import { S as SentinelOptions, _ as haversineDistanceKm, b as GeoLocation, c as sentinel, d as POW_SOLUTION_HEADER, f as createNonce, g as verifySolution, h as solveChallenge, l as POW_CHALLENGE_HEADER, m as parsePowHeader, p as hasLeadingZeroBits, u as POW_REASON_HEADER, v as normalizeEmail, x as SecurityAction, y as SENTINEL_ERROR_CODES } from "../../index-B7iZf_Dl.mjs";
+import "../../index-CWxKeTtE.mjs";
+import "../../index-382PsmkK.mjs";
+import "../../index-D0SgItjY.mjs";
+import "../../index-DxRAXHrZ.mjs";
+import "../../index-C8F7PsET.mjs";
+import "../../index-DUu0ieh6.mjs";
+import "../../index-DCliG2n6.mjs";
+import "../../index-DPVukjga.mjs";
+import "../../index-DxIqV3rU.mjs";
+import "../../index-Dg6Ftb6f.mjs";
+import "../../index-C-z4TCHD.mjs";
+import "../../index-CIxFDcfQ.mjs";
+import "../../index-B5r4oL5q.mjs";
 import "../../index-QmocqGM-.mjs";
-import "../../index-DSoiUc1C.mjs";
-import "../../index-CRNh-5Tc.mjs";
-import "../../index-B4hJVVRn.mjs";
-import "../../index-eOfQxlQV.mjs";
-import "../../index-pdl9MzQu.mjs";
+import "../../index-CExSHSFz.mjs";
+import "../../index-Dgyj1fTk.mjs";
+import "../../index-CWwQ1Q7t.mjs";
+import "../../index-COFPq-mg.mjs";
+import "../../index-De2a2OyC.mjs";
 export { GeoLocation, POW_CHALLENGE_HEADER, POW_REASON_HEADER, POW_SOLUTION_HEADER, SENTINEL_ERROR_CODES, SecurityAction, SentinelOptions, createNonce, hasLeadingZeroBits, haversineDistanceKm, normalizeEmail, parsePowHeader, sentinel, solveChallenge, verifySolution };

package/dist/plugins/sentinel/index.mjs

@@ -14,9 +14,9 @@ import "../../get-tables-CKvSyDST.mjs";
 import "../../types-DCPpFKUB.mjs";
 import "../../misc-fKH4d5XQ.mjs";
 import "../../session-BB3oqApE.mjs";
-import "../../registry-CqG_3Qnx.mjs";
+import "../../registry-GztLf62p.mjs";
 import "../../haveibeenpwned-_3a5amT-.mjs";
 import { a as hasLeadingZeroBits, c as verifySolution, i as createNonce, n as POW_REASON_HEADER, o as parsePowHeader, r as POW_SOLUTION_HEADER, s as solveChallenge, t as POW_CHALLENGE_HEADER } from "../../pow-DvkUopsK.mjs";
-import { i as SENTINEL_ERROR_CODES, n as haversineDistanceKm, r as normalizeEmail, t as sentinel } from "../../sentinel-B-2jmmZh.mjs";
+import { i as SENTINEL_ERROR_CODES, n as haversineDistanceKm, r as normalizeEmail, t as sentinel } from "../../sentinel-CYtaI3eO.mjs";
 
 export { POW_CHALLENGE_HEADER, POW_REASON_HEADER, POW_SOLUTION_HEADER, SENTINEL_ERROR_CODES, createNonce, hasLeadingZeroBits, haversineDistanceKm, normalizeEmail, parsePowHeader, sentinel, solveChallenge, verifySolution };

package/dist/plugins/two-factor/index.d.mts

@@ -1,7 +1,7 @@
 import "../../helper-BgOIGHsu.mjs";
-import "../../index-DngQlUSI.mjs";
+import "../../index-3lfPQHhX.mjs";
 import "../../types-DNQ9XQrB.mjs";
 import "../../index-BL_t8cRp-C4QYBsac.mjs";
 import "../../plugins-Dy_FrD4Y.mjs";
-import { a as TwoFactorProvider, i as TwoFactorOptions, n as twoFactorClient, o as TwoFactorTable, r as TWO_FACTOR_ERROR_CODES, s as UserWithTwoFactor, t as twoFactor } from "../../index-B4hJVVRn.mjs";
+import { a as TwoFactorProvider, i as TwoFactorOptions, n as twoFactorClient, o as TwoFactorTable, r as TWO_FACTOR_ERROR_CODES, s as UserWithTwoFactor, t as twoFactor } from "../../index-CWwQ1Q7t.mjs";
 export { TWO_FACTOR_ERROR_CODES, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor, twoFactor, twoFactorClient };

package/dist/plugins/username/index.d.mts

@@ -1,4 +1,4 @@
 import "../../helper-BgOIGHsu.mjs";
 import "../../plugins-Dy_FrD4Y.mjs";
-import { n as username, r as USERNAME_ERROR_CODES, t as UsernameOptions } from "../../index-pdl9MzQu.mjs";
+import { n as username, r as USERNAME_ERROR_CODES, t as UsernameOptions } from "../../index-De2a2OyC.mjs";
 export { USERNAME_ERROR_CODES, UsernameOptions, username };

package/dist/{registry-CqG_3Qnx.mjs → registry-GztLf62p.mjs}

@@ -1,3 +1,14 @@
+//#region src/utils/has-role.ts
+/**
+* Whether a user's role field, a single role or a comma separated list,
+* includes one of the given roles
+*/
+function hasRole(roleField, roles) {
+	if (typeof roleField !== "string") return false;
+	return roleField.split(",").map((role) => role.trim()).some((role) => roles.includes(role));
+}
+
+//#endregion
 //#region src/plugins/audit-log/events.ts
 /**
 * Audit event types recorded by the audit log plugin
@@ -74,7 +85,8 @@ const SECURITY_EVENT_TYPES = {
 	FREE_TRIAL_ABUSE: "security_free_trial_abuse",
 	COMPROMISED_PASSWORD: "security_compromised_password",
 	STALE_ACCOUNT: "security_stale_account",
-	INVALID_EMAIL: "security_invalid_email"
+	INVALID_EMAIL: "security_invalid_email",
+	UNBLOCKED: "security_unblocked"
 };
 const ALL_EVENT_TYPES = [...Object.values(AUDIT_EVENT_TYPES), ...Object.values(SECURITY_EVENT_TYPES)];
 /** Endpoints that complete a sign-in by creating a session */
@@ -191,4 +203,4 @@ function getAuditRecorder(context) {
 }
 
 //#endregion
-export { CREDENTIAL_SIGN_IN_PATHS as a, SIGN_IN_PATHS as c, AUDIT_EVENT_TYPES as i, VERIFICATION_PATHS as l, registerAuditRecorder as n, PATH_EVENTS as o, ALL_EVENT_TYPES as r, SECURITY_EVENT_TYPES as s, getAuditRecorder as t };
+export { CREDENTIAL_SIGN_IN_PATHS as a, SIGN_IN_PATHS as c, AUDIT_EVENT_TYPES as i, VERIFICATION_PATHS as l, registerAuditRecorder as n, PATH_EVENTS as o, ALL_EVENT_TYPES as r, SECURITY_EVENT_TYPES as s, getAuditRecorder as t, hasRole as u };

package/dist/{sentinel-B-2jmmZh.mjs → sentinel-CYtaI3eO.mjs}

@@ -2,14 +2,16 @@ import { t as getIp } from "./get-request-ip-DSjrEpGo.mjs";
 import { t as safeJSONParse } from "./json-D0TBLy4q.mjs";
 import { n as deleteSessionCookie } from "./cookies-BuvlgcA-.mjs";
 import { n as mergeSchema } from "./date-CMr04reD.mjs";
-import { a as CREDENTIAL_SIGN_IN_PATHS, c as SIGN_IN_PATHS, l as VERIFICATION_PATHS, s as SECURITY_EVENT_TYPES, t as getAuditRecorder } from "./registry-CqG_3Qnx.mjs";
+import { u as sessionMiddleware } from "./session-BB3oqApE.mjs";
+import { a as CREDENTIAL_SIGN_IN_PATHS, c as SIGN_IN_PATHS, l as VERIFICATION_PATHS, s as SECURITY_EVENT_TYPES, t as getAuditRecorder, u as hasRole } from "./registry-GztLf62p.mjs";
 import { t as getPasswordBreachCount } from "./haveibeenpwned-_3a5amT-.mjs";
 import { c as verifySolution, i as createNonce, n as POW_REASON_HEADER, o as parsePowHeader, r as POW_SOLUTION_HEADER, t as POW_CHALLENGE_HEADER } from "./pow-DvkUopsK.mjs";
 import { env } from "@gatwech/core/env";
 import { PayvoAuthError } from "@gatwech/core/error";
 import { defineErrorCodes } from "@gatwech/core/utils";
 import { APIError } from "better-call";
-import { createAuthMiddleware } from "@gatwech/core/api";
+import { createAuthEndpoint, createAuthMiddleware } from "@gatwech/core/api";
+import * as z$1 from "zod";
 import { betterFetch } from "@better-fetch/fetch";
 
 //#region src/plugins/sentinel/actions.ts
@@ -111,7 +113,9 @@ function challengeHeaders(decision) {
 }
 const SENTINEL_ERROR_CODES = defineErrorCodes({
 	POW_CHALLENGE_REQUIRED: "Challenge required",
-	SECURITY_BLOCKED: "Request blocked for security reasons"
+	SECURITY_BLOCKED: "Request blocked for security reasons",
+	SECURITY_ADMIN_REQUIRED: "Only an administrator can manage security blocks",
+	BLOCK_NOT_FOUND: "That block doesn't exist or has ended"
 });
 /** The error for a decision, or null when the request is allowed */
 function errorForDecision(decision) {
@@ -520,6 +524,37 @@ const schema = {
 			required: true
 		}
 	} },
+	sentinelBlock: { fields: {
+		key: {
+			type: "string",
+			required: true,
+			unique: true
+		},
+		feature: {
+			type: "string",
+			required: true
+		},
+		kind: {
+			type: "string",
+			required: true
+		},
+		identifier: {
+			type: "string",
+			required: true
+		},
+		account: {
+			type: "string",
+			required: false
+		},
+		blockedUntil: {
+			type: "date",
+			required: true
+		},
+		createdAt: {
+			type: "date",
+			required: true
+		}
+	} },
 	sentinelSignIn: { fields: {
 		userId: {
 			type: "string",
@@ -632,6 +667,27 @@ async function deleteAllExpiredRows(auth, byPassLastCheckTime = false) {
 		auth.logger.error("[sentinel] Failed to delete expired rows:", error);
 	});
 }
+/** When each auth instance last deleted expired blocks */
+const lastBlocksChecked = /* @__PURE__ */ new WeakMap();
+/**
+* Deletes blocks that ended a while ago, at most every 10 seconds per auth
+* instance. Blocks live in the database even with secondary storage.
+*/
+async function deleteExpiredBlocks(auth, byPassLastCheckTime = false) {
+	const checkedAt = lastBlocksChecked.get(auth.adapter);
+	if (!byPassLastCheckTime && checkedAt && Date.now() - checkedAt < 1e4) return;
+	lastBlocksChecked.set(auth.adapter, Date.now());
+	await auth.adapter.deleteMany({
+		model: "sentinelBlock",
+		where: [{
+			field: "blockedUntil",
+			operator: "lt",
+			value: new Date(Date.now() - EXPIRED_ROW_GRACE_MS)
+		}]
+	}).catch((error) => {
+		auth.logger.error("[sentinel] Failed to delete expired blocks:", error);
+	});
+}
 /**
 * Counters and challenges, kept in secondary storage when it's configured
 * and in the database otherwise
@@ -719,6 +775,92 @@ function createSentinelStore(auth) {
 			if (!row || new Date(row.expiresAt).getTime() <= Date.now()) return 0;
 			return row.count;
 		},
+		async recordBlock(block) {
+			deleteExpiredBlocks(auth);
+			const existing = await auth.adapter.findOne({
+				model: "sentinelBlock",
+				where: [{
+					field: "key",
+					value: block.key
+				}]
+			});
+			if (existing) {
+				await auth.adapter.update({
+					model: "sentinelBlock",
+					where: [{
+						field: "id",
+						value: existing.id
+					}],
+					update: {
+						...block,
+						createdAt: /* @__PURE__ */ new Date()
+					}
+				});
+				return;
+			}
+			await auth.adapter.create({
+				model: "sentinelBlock",
+				data: {
+					...block,
+					createdAt: /* @__PURE__ */ new Date()
+				}
+			}).catch(async () => {
+				await auth.adapter.updateMany({
+					model: "sentinelBlock",
+					where: [{
+						field: "key",
+						value: block.key
+					}],
+					update: {
+						...block,
+						createdAt: /* @__PURE__ */ new Date()
+					}
+				});
+			});
+		},
+		async listBlocks(page) {
+			const where = [{
+				field: "blockedUntil",
+				operator: "gt",
+				value: /* @__PURE__ */ new Date()
+			}];
+			const [blocks, total] = await Promise.all([auth.adapter.findMany({
+				model: "sentinelBlock",
+				where,
+				limit: page.limit,
+				offset: page.offset,
+				sortBy: {
+					field: "createdAt",
+					direction: "desc"
+				}
+			}), auth.adapter.count({
+				model: "sentinelBlock",
+				where
+			})]);
+			return {
+				blocks,
+				total
+			};
+		},
+		async removeBlock(id) {
+			const block = await auth.adapter.findOne({
+				model: "sentinelBlock",
+				where: [{
+					field: "id",
+					value: id
+				}]
+			});
+			if (!block) return null;
+			await auth.adapter.delete({
+				model: "sentinelBlock",
+				where: [{
+					field: "id",
+					value: id
+				}]
+			});
+			await this.reset(`${block.key}:blocked`);
+			return new Date(block.blockedUntil).getTime() > Date.now() ? block : null;
+		},
 		async reset(name) {
 			const key = PREFIX + name;
 			if (storage) {
@@ -1098,6 +1240,16 @@ const sentinel = (options) => {
 		}));
 		return Math.max(0, ...failures);
 	}
+	/** What an attempt counter's key is for: `cs:ip:<ip>` or `cs:visitor:<id>`, plus `:account:<email>` */
+	function describeAttemptKey(key) {
+		const accountAt = key.indexOf(":account:");
+		const [, kind = "visitor", ...identifier] = (accountAt === -1 ? key : key.slice(0, accountAt)).split(":");
+		return {
+			kind,
+			identifier: identifier.join(":"),
+			account: accountAt === -1 ? null : key.slice(accountAt + 9)
+		};
+	}
 	function counterNames(keys) {
 		return keys.flatMap(({ scope, account }) => account ? [scope, account] : [scope]);
 	}
@@ -1299,6 +1451,10 @@ const sentinel = (options) => {
 			}));
 		}
 	}
+	const adminRoles = opts.adminRoles ?? ["admin"];
+	function requireAdmin(user) {
+		if (!hasRole(user.role, adminRoles)) throw new APIError("FORBIDDEN", { message: SENTINEL_ERROR_CODES.SECURITY_ADMIN_REQUIRED });
+	}
 	return {
 		id: "sentinel",
 		init(ctx) {
@@ -1496,6 +1652,14 @@ const sentinel = (options) => {
 							const block = async (key, also = []) => {
 								await store.increment(`${key}:blocked`, cooldownSeconds);
 								await Promise.all([key, ...also].map((name) => store.reset(name)));
+								await store.recordBlock({
+									key,
+									feature: "credential_stuffing",
+									...describeAttemptKey(key),
+									blockedUntil: new Date(Date.now() + cooldownSeconds * 1e3)
+								}).catch((e) => {
+									ctx.context.logger.error("[sentinel] Failed to record block", e);
+								});
 							};
 							for (const { scope, account } of keys) {
 								const [total, succeeded] = await Promise.all([store.get(scope), store.get(`${scope}:succeeded`)]);
@@ -1640,6 +1804,73 @@ const sentinel = (options) => {
 			...schema,
 			...normalizedEmailSchema
 		} : schema, opts.schema),
+		endpoints: {
+			listBlocks: createAuthEndpoint("/sentinel/blocks", {
+				method: "GET",
+				use: [sessionMiddleware],
+				query: z$1.object({
+					limit: z$1.string().or(z$1.number()).optional(),
+					offset: z$1.string().or(z$1.number()).optional()
+				}).optional(),
+				metadata: { openapi: {
+					operationId: "listSentinelBlocks",
+					summary: "List active blocks",
+					description: "List the visitors and IP addresses sentinel is blocking, for admins"
+				} }
+			}, async (ctx) => {
+				requireAdmin(ctx.context.session.user);
+				const limit = Math.min(Math.max(Math.trunc(Number(ctx.query?.limit) || 50), 1), 100);
+				const offset = Math.max(Math.trunc(Number(ctx.query?.offset) || 0), 0);
+				const { blocks, total } = await createSentinelStore(ctx.context).listBlocks({
+					limit,
+					offset
+				});
+				return ctx.json({
+					blocks,
+					total,
+					limit,
+					offset
+				});
+			}),
+			unblock: createAuthEndpoint("/sentinel/unblock", {
+				method: "POST",
+				use: [sessionMiddleware],
+				body: z$1.object({ id: z$1.string() }),
+				metadata: { openapi: {
+					operationId: "unblockSentinel",
+					summary: "Lift a block",
+					description: "Lift a block before its cooldown ends, for admins. Recorded in the audit log."
+				} }
+			}, async (ctx) => {
+				const { user } = ctx.context.session;
+				requireAdmin(user);
+				const block = await createSentinelStore(ctx.context).removeBlock(ctx.body.id);
+				if (!block) throw new APIError("NOT_FOUND", { message: SENTINEL_ERROR_CODES.BLOCK_NOT_FOUND });
+				await getAuditRecorder(ctx.context)?.(ctx, {
+					eventType: SECURITY_EVENT_TYPES.UNBLOCKED,
+					status: "success",
+					userId: user.id,
+					identifier: user.email,
+					eventData: {
+						key: block.key,
+						kind: block.kind,
+						blocked: block.identifier,
+						account: block.account
+					}
+				});
+				return ctx.json({ success: true });
+			}),
+			deleteExpired: createAuthEndpoint("/sentinel/delete-expired", {
+				method: "POST",
+				metadata: {
+					SERVER_ONLY: true,
+					client: false
+				}
+			}, async (ctx) => {
+				await Promise.all([deleteExpiredBlocks(ctx.context, true), deleteAllExpiredRows(ctx.context, true)]);
+				return ctx.json({ success: true });
+			})
+		},
 		$ERROR_CODES: SENTINEL_ERROR_CODES,
 		options: opts
 	};

package/dist/src/plugins/audit-log/events.d.ts

@@ -74,6 +74,7 @@ export declare const SECURITY_EVENT_TYPES: {
     readonly COMPROMISED_PASSWORD: "security_compromised_password";
     readonly STALE_ACCOUNT: "security_stale_account";
     readonly INVALID_EMAIL: "security_invalid_email";
+    readonly UNBLOCKED: "security_unblocked";
 };
 export type AuditEventType = (typeof AUDIT_EVENT_TYPES)[keyof typeof AUDIT_EVENT_TYPES] | (typeof SECURITY_EVENT_TYPES)[keyof typeof SECURITY_EVENT_TYPES];
 export declare const ALL_EVENT_TYPES: AuditEventType[];

package/dist/src/plugins/audit-log/index.d.ts

@@ -527,6 +527,51 @@ export declare const auditLog: (options?: AuditLogOptions | undefined) => {
             };
             path: "/audit-log/get-event-types";
         };
+        deleteOldEvents: {
+            <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+                body: {
+                    olderThanDays: number;
+                };
+            } & {
+                method?: "POST" | undefined;
+            } & {
+                query?: Record<string, any> | undefined;
+            } & {
+                params?: Record<string, any>;
+            } & {
+                request?: Request;
+            } & {
+                headers?: HeadersInit;
+            } & {
+                asResponse?: boolean;
+                returnHeaders?: boolean;
+                use?: import("better-call").Middleware[];
+                path?: string;
+            } & {
+                asResponse?: AsResponse | undefined;
+                returnHeaders?: ReturnHeaders | undefined;
+            }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+                headers: Headers;
+                response: {
+                    deleted: number;
+                };
+            } : {
+                deleted: number;
+            }>;
+            options: {
+                method: "POST";
+                body: z.ZodObject<{
+                    olderThanDays: z.ZodNumber;
+                }, z.core.$strip>;
+                metadata: {
+                    SERVER_ONLY: true;
+                    client: boolean;
+                };
+            } & {
+                use: any[];
+            };
+            path: "/audit-log/delete-old-events";
+        };
     };
     schema: {
         auditLog: {

package/dist/src/plugins/sentinel/actions.d.ts

@@ -39,6 +39,8 @@ export declare function executeAction(params: {
 export declare const SENTINEL_ERROR_CODES: {
     readonly POW_CHALLENGE_REQUIRED: "Challenge required";
     readonly SECURITY_BLOCKED: "Request blocked for security reasons";
+    readonly SECURITY_ADMIN_REQUIRED: "Only an administrator can manage security blocks";
+    readonly BLOCK_NOT_FOUND: "That block doesn't exist or has ended";
 };
 /** The error for a decision, or null when the request is allowed */
 export declare function errorForDecision(decision: Decision): ({