@gatwech/auth 1.0.0-beta.23 → 1.0.0-beta.24

package/dist/plugins/sentinel/index.d.mts

@@ -1,29 +1,29 @@
 import "../../helper-BgOIGHsu.mjs";
-import "../../index-3lfPQHhX.mjs";
+import "../../index-CZtQ0rUe.mjs";
 import "../../types-DNQ9XQrB.mjs";
 import "../../index-BL_t8cRp-C4QYBsac.mjs";
 import "../../plugins-Dy_FrD4Y.mjs";
 import "../../index-CxlWnL9c.mjs";
-import "../../index-Blq8KrTy.mjs";
-import "../../index-B4aWSJEd.mjs";
-import { S as SentinelOptions, _ as haversineDistanceKm, b as GeoLocation, c as sentinel, d as POW_SOLUTION_HEADER, f as createNonce, g as verifySolution, h as solveChallenge, l as POW_CHALLENGE_HEADER, m as parsePowHeader, p as hasLeadingZeroBits, u as POW_REASON_HEADER, v as normalizeEmail, x as SecurityAction, y as SENTINEL_ERROR_CODES } from "../../index-B7iZf_Dl.mjs";
-import "../../index-CWxKeTtE.mjs";
-import "../../index-382PsmkK.mjs";
-import "../../index-D0SgItjY.mjs";
-import "../../index-DxRAXHrZ.mjs";
-import "../../index-C8F7PsET.mjs";
-import "../../index-DUu0ieh6.mjs";
-import "../../index-DCliG2n6.mjs";
-import "../../index-DPVukjga.mjs";
-import "../../index-DxIqV3rU.mjs";
-import "../../index-Dg6Ftb6f.mjs";
-import "../../index-C-z4TCHD.mjs";
-import "../../index-CIxFDcfQ.mjs";
-import "../../index-B5r4oL5q.mjs";
+import "../../index-BYxt8qOP.mjs";
+import "../../index-Dt6JhAV4.mjs";
+import { S as SentinelOptions, _ as haversineDistanceKm, b as GeoLocation, c as sentinel, d as POW_SOLUTION_HEADER, f as createNonce, g as verifySolution, h as solveChallenge, l as POW_CHALLENGE_HEADER, m as parsePowHeader, p as hasLeadingZeroBits, u as POW_REASON_HEADER, v as normalizeEmail, x as SecurityAction, y as SENTINEL_ERROR_CODES } from "../../index-DWSbFJWU.mjs";
+import "../../index-Czr_eQFE.mjs";
+import "../../index-Dmjw6re9.mjs";
+import "../../index-CLhlur69.mjs";
+import "../../index-rcUKPBBy.mjs";
+import "../../index-DYqQWdEv.mjs";
+import "../../index-Clwezlxm.mjs";
+import "../../index-D85KXOKz.mjs";
+import "../../index-UDzaYKxq.mjs";
+import "../../index-D5cyFBEb.mjs";
+import "../../index-B-i2ob-C.mjs";
+import "../../index-Cl9ITXy1.mjs";
+import "../../index-DGRGLg16.mjs";
+import "../../index-BRUQHEUF.mjs";
 import "../../index-QmocqGM-.mjs";
-import "../../index-CExSHSFz.mjs";
-import "../../index-Dgyj1fTk.mjs";
-import "../../index-CWwQ1Q7t.mjs";
-import "../../index-COFPq-mg.mjs";
-import "../../index-De2a2OyC.mjs";
+import "../../index-JzSy-vFn.mjs";
+import "../../index-CGGitykk.mjs";
+import "../../index-DWGj7du8.mjs";
+import "../../index-CHMYUshk.mjs";
+import "../../index-Hoybqpnt.mjs";
 export { GeoLocation, POW_CHALLENGE_HEADER, POW_REASON_HEADER, POW_SOLUTION_HEADER, SENTINEL_ERROR_CODES, SecurityAction, SentinelOptions, createNonce, hasLeadingZeroBits, haversineDistanceKm, normalizeEmail, parsePowHeader, sentinel, solveChallenge, verifySolution };

package/dist/plugins/sentinel/index.mjs

@@ -17,6 +17,6 @@ import "../../session-BB3oqApE.mjs";
 import "../../registry-GztLf62p.mjs";
 import "../../haveibeenpwned-_3a5amT-.mjs";
 import { a as hasLeadingZeroBits, c as verifySolution, i as createNonce, n as POW_REASON_HEADER, o as parsePowHeader, r as POW_SOLUTION_HEADER, s as solveChallenge, t as POW_CHALLENGE_HEADER } from "../../pow-DvkUopsK.mjs";
-import { i as SENTINEL_ERROR_CODES, n as haversineDistanceKm, r as normalizeEmail, t as sentinel } from "../../sentinel-CYtaI3eO.mjs";
+import { i as SENTINEL_ERROR_CODES, n as haversineDistanceKm, r as normalizeEmail, t as sentinel } from "../../sentinel-b8XEetew.mjs";
 
 export { POW_CHALLENGE_HEADER, POW_REASON_HEADER, POW_SOLUTION_HEADER, SENTINEL_ERROR_CODES, createNonce, hasLeadingZeroBits, haversineDistanceKm, normalizeEmail, parsePowHeader, sentinel, solveChallenge, verifySolution };

package/dist/plugins/two-factor/index.d.mts

@@ -1,7 +1,7 @@
 import "../../helper-BgOIGHsu.mjs";
-import "../../index-3lfPQHhX.mjs";
+import "../../index-CZtQ0rUe.mjs";
 import "../../types-DNQ9XQrB.mjs";
 import "../../index-BL_t8cRp-C4QYBsac.mjs";
 import "../../plugins-Dy_FrD4Y.mjs";
-import { a as TwoFactorProvider, i as TwoFactorOptions, n as twoFactorClient, o as TwoFactorTable, r as TWO_FACTOR_ERROR_CODES, s as UserWithTwoFactor, t as twoFactor } from "../../index-CWwQ1Q7t.mjs";
+import { a as TwoFactorProvider, i as TwoFactorOptions, n as twoFactorClient, o as TwoFactorTable, r as TWO_FACTOR_ERROR_CODES, s as UserWithTwoFactor, t as twoFactor } from "../../index-DWGj7du8.mjs";
 export { TWO_FACTOR_ERROR_CODES, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor, twoFactor, twoFactorClient };

package/dist/plugins/username/index.d.mts

@@ -1,4 +1,4 @@
 import "../../helper-BgOIGHsu.mjs";
 import "../../plugins-Dy_FrD4Y.mjs";
-import { n as username, r as USERNAME_ERROR_CODES, t as UsernameOptions } from "../../index-De2a2OyC.mjs";
+import { n as username, r as USERNAME_ERROR_CODES, t as UsernameOptions } from "../../index-Hoybqpnt.mjs";
 export { USERNAME_ERROR_CODES, UsernameOptions, username };

package/dist/{sentinel-CYtaI3eO.mjs → sentinel-b8XEetew.mjs}

@@ -1240,6 +1240,39 @@ const sentinel = (options) => {
 		}));
 		return Math.max(0, ...failures);
 	}
+	/**
+	* Blocks an attempt counter for the cooldown and clears its counts. The
+	* block is also recorded so an admin can list and lift it; it holds
+	* without the record.
+	*/
+	async function blockKey(auth, store, key, also = []) {
+		if (!credentialStuffing) return;
+		const { cooldownSeconds } = credentialStuffing;
+		await store.increment(`${key}:blocked`, cooldownSeconds);
+		await Promise.all([key, ...also].map((name) => store.reset(name)));
+		await store.recordBlock({
+			key,
+			feature: "credential_stuffing",
+			...describeAttemptKey(key),
+			blockedUntil: new Date(Date.now() + cooldownSeconds * 1e3)
+		}).catch((e) => {
+			auth.logger.error("[sentinel] Failed to record block", e);
+		});
+	}
+	/**
+	* Turns the counters that passed the block threshold into blocks that last
+	* the cooldown, so they end then and can be listed and lifted. `count`
+	* includes the attempt just made.
+	*/
+	async function blockOverThreshold(auth, store, keys) {
+		if (!credentialStuffing) return;
+		const { thresholds } = credentialStuffing;
+		for (const { scope, account } of keys) {
+			const [total, succeeded] = await Promise.all([store.get(scope), store.get(`${scope}:succeeded`)]);
+			if (total - succeeded - 1 >= thresholds.block) await blockKey(auth, store, scope, [`${scope}:succeeded`]);
+			if (account && await store.get(account) - 1 >= thresholds.block) await blockKey(auth, store, account);
+		}
+	}
 	/** What an attempt counter's key is for: `cs:ip:<ip>` or `cs:visitor:<id>`, plus `:account:<email>` */
 	function describeAttemptKey(key) {
 		const accountAt = key.indexOf(":account:");
@@ -1581,7 +1614,10 @@ const sentinel = (options) => {
 							failedAttempts: failures,
 							thresholds
 						};
-						if (blocked || failures >= thresholds.block) return act(ctx, store, details, credentialStuffing.action === "log" ? "log" : "block", SECURITY_EVENT_TYPES.CREDENTIAL_STUFFING, "credential_stuffing", metadata);
+						if (blocked || failures >= thresholds.block) {
+							if (!blocked && credentialStuffing.action !== "log") await blockOverThreshold(ctx.context, store, keys);
+							return act(ctx, store, details, credentialStuffing.action === "log" ? "log" : "block", SECURITY_EVENT_TYPES.CREDENTIAL_STUFFING, "credential_stuffing", metadata);
+						}
 						if (failures >= thresholds.challenge) return act(ctx, store, details, credentialStuffing.action === "log" ? "log" : "challenge", SECURITY_EVENT_TYPES.CREDENTIAL_STUFFING, "credential_stuffing", metadata);
 						return { outcome: "allow" };
 					}));
@@ -1635,7 +1671,7 @@ const sentinel = (options) => {
 					try {
 						const store = createSentinelStore(ctx.context);
 						const keys = attemptKeys(await requestDetails(ctx));
-						const { windowSeconds, cooldownSeconds, thresholds } = credentialStuffing;
+						const { windowSeconds, thresholds } = credentialStuffing;
 						if (status < 400) for (const { scope, account } of keys) {
 							const [total, succeeded, own] = await Promise.all([
 								store.get(scope),
@@ -1649,18 +1685,7 @@ const sentinel = (options) => {
 							} else await store.increment(`${scope}:succeeded`, windowSeconds);
 						}
 						else if (!SENTINEL_STATUSES.has(status) && status < 500) {
-							const block = async (key, also = []) => {
-								await store.increment(`${key}:blocked`, cooldownSeconds);
-								await Promise.all([key, ...also].map((name) => store.reset(name)));
-								await store.recordBlock({
-									key,
-									feature: "credential_stuffing",
-									...describeAttemptKey(key),
-									blockedUntil: new Date(Date.now() + cooldownSeconds * 1e3)
-								}).catch((e) => {
-									ctx.context.logger.error("[sentinel] Failed to record block", e);
-								});
-							};
+							const block = (key, also = []) => blockKey(ctx.context, store, key, also);
 							for (const { scope, account } of keys) {
 								const [total, succeeded] = await Promise.all([store.get(scope), store.get(`${scope}:succeeded`)]);
 								if (total - succeeded >= thresholds.block) await block(scope, [`${scope}:succeeded`]);