@getstrata/core 1.0.9 → 1.1.0

package/dist/entries/auth/basicAuthGuard.js

@@ -44,6 +44,71 @@ function resolveAuthUserDirectory(container) {
   return null;
 }
 
+// ../../src/core/database/boundConnection.ts
+var BOUND_CONNECTION_KEY = Symbol.for("@getstrata/boundDatabaseConnection");
+function boundConnectionState() {
+  const globalRecord = globalThis;
+  const existing = globalRecord[BOUND_CONNECTION_KEY];
+  if (existing) {
+    return existing;
+  }
+  const created = { connection: null };
+  globalRecord[BOUND_CONNECTION_KEY] = created;
+  return created;
+}
+function getBoundDatabaseConnection() {
+  return boundConnectionState().connection;
+}
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/database/connectionContext.ts
+var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
+function runWithDatabaseConnection(connection, callback) {
+  return activeConnection.run(connection, callback);
+}
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+function hasActiveDatabaseConnection() {
+  return activeConnection.getStore() !== undefined;
+}
+
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+
+// ../../src/core/database/defaultConnection.ts
+var DEFAULT_CONNECTION_KEY = Symbol.for("@getstrata/defaultDatabaseConnection");
+function defaultConnectionState() {
+  const globalRecord = globalThis;
+  const existing = globalRecord[DEFAULT_CONNECTION_KEY];
+  if (existing) {
+    return existing;
+  }
+  const created = { pool: null, query: null };
+  globalRecord[DEFAULT_CONNECTION_KEY] = created;
+  return created;
+}
+function getDefaultDatabasePool() {
+  const pool = defaultConnectionState().pool;
+  if (!pool) {
+    throw new Error("Default database pool is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
+  }
+  return pool;
+}
+
 // ../../src/core/http/statelessAuth.ts
 function authorizationScheme(request) {
   const header = request.headers.get("authorization")?.trim() ?? "";
@@ -90,13 +155,542 @@ function readBasicCredentials(request) {
 async function hashPassword(password) {
   return await Bun.password.hash(password, {
     algorithm: "bcrypt",
-    cost: 10
+    cost: 12
   });
 }
 async function verifyPassword(password, passwordHash) {
   return await Bun.password.verify(password, passwordHash);
 }
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
+// ../../src/core/crypto/fieldEncryption.ts
+import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "crypto";
+var ENCRYPTION_PREFIX = "enc:v1:";
+var IV_LENGTH = 12;
+var TAG_LENGTH = 16;
+function resolveEncryptionKey() {
+  const raw = process.env.KMS_ENCRYPTION_KEY?.trim();
+  if (!raw) {
+    return null;
+  }
+  if (/^[0-9a-f]{64}$/i.test(raw)) {
+    return Buffer.from(raw, "hex");
+  }
+  const decoded = Buffer.from(raw, "base64");
+  if (decoded.length === 32) {
+    return decoded;
+  }
+  throw new Error("KMS_ENCRYPTION_KEY must be 32 bytes (hex or base64).");
+}
+function isFieldEncryptionEnabled() {
+  const featureFlag = process.env.FEATURE_FIELD_ENCRYPTION;
+  if (featureFlag === "false") {
+    return false;
+  }
+  if (featureFlag === "true") {
+    return true;
+  }
+  return Boolean(resolveEncryptionKey());
+}
+function encryptField(plaintext, key) {
+  const iv = randomBytes(IV_LENGTH);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const payload = Buffer.concat([iv, encrypted, tag]).toString("base64");
+  return `${ENCRYPTION_PREFIX}${payload}`;
+}
+function decryptField(value, key) {
+  if (!value.startsWith(ENCRYPTION_PREFIX)) {
+    return value;
+  }
+  const payload = Buffer.from(value.slice(ENCRYPTION_PREFIX.length), "base64");
+  const iv = payload.subarray(0, IV_LENGTH);
+  const tag = payload.subarray(payload.length - TAG_LENGTH);
+  const ciphertext = payload.subarray(IV_LENGTH, payload.length - TAG_LENGTH);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+}
+function hashLookupValue(normalizedValue, key) {
+  return createHmac("sha256", key).update(normalizedValue).digest("hex");
+}
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+function protectEmail(email) {
+  const normalized = normalizeEmail(email);
+  const key = resolveEncryptionKey();
+  if (!key || !isFieldEncryptionEnabled()) {
+    return { storedEmail: normalized, emailLookup: normalized };
+  }
+  return {
+    storedEmail: encryptField(normalized, key),
+    emailLookup: hashLookupValue(normalized, key)
+  };
+}
+function revealEmail(storedEmail) {
+  const key = resolveEncryptionKey();
+  if (!key || !storedEmail.startsWith(ENCRYPTION_PREFIX)) {
+    return storedEmail;
+  }
+  return decryptField(storedEmail, key);
+}
+function emailLookupForQuery(email) {
+  const normalized = normalizeEmail(email);
+  const key = resolveEncryptionKey();
+  if (!key || !isFieldEncryptionEnabled()) {
+    return normalized;
+  }
+  return hashLookupValue(normalized, key);
+}
+
+// ../../src/core/crypto/mfaSecret.ts
+function protectMfaSecret(secret) {
+  const key = resolveEncryptionKey();
+  if (!key) {
+    throw new Error("MFA secrets require KMS_ENCRYPTION_KEY.");
+  }
+  return encryptField(secret, key);
+}
+function revealMfaSecret(stored) {
+  if (!stored) {
+    return null;
+  }
+  if (!stored.startsWith("enc:v1:")) {
+    if (isProductionEnv() || resolveEncryptionKey()) {
+      throw new Error("MFA secrets must be encrypted.");
+    }
+    return stored;
+  }
+  const key = resolveEncryptionKey();
+  if (!key) {
+    throw new Error("MFA secrets require KMS_ENCRYPTION_KEY.");
+  }
+  return decryptField(stored, key);
+}
+
+// ../../src/core/database/schema/driver.ts
+function normalizeConnectionName(connection) {
+  const normalized = connection.trim().toLowerCase();
+  if (normalized === "pgsql" || normalized === "postgres" || normalized === "postgresql") {
+    return "pgsql";
+  }
+  if (normalized === "mysql" || normalized === "mariadb") {
+    return "mysql";
+  }
+  if (normalized === "sqlite") {
+    return "sqlite";
+  }
+  throw new Error(`Unsupported DB_CONNECTION: ${connection}`);
+}
+function resolveDriverFromUrl(url) {
+  const normalized = url.trim().toLowerCase();
+  if (normalized.startsWith("postgres://") || normalized.startsWith("postgresql://") || normalized.startsWith("postgres:")) {
+    return "pgsql";
+  }
+  if (normalized.startsWith("mysql://") || normalized.startsWith("mysql:")) {
+    return "mysql";
+  }
+  if (normalized.startsWith("sqlite:")) {
+    return "sqlite";
+  }
+  return null;
+}
+function resolveDatabaseDriver(options = {}) {
+  const connection = options.connection ?? process.env.DB_CONNECTION;
+  if (connection) {
+    return normalizeConnectionName(connection);
+  }
+  const url = options.url ?? process.env.DATABASE_URL ?? "";
+  const fromUrl = resolveDriverFromUrl(url);
+  if (fromUrl) {
+    return fromUrl;
+  }
+  return "pgsql";
+}
+
+// ../../src/core/database/dialect.ts
+function assertSafeIdentifier(identifier) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
+    throw new Error(`Invalid SQL identifier: ${identifier}`);
+  }
+  return identifier;
+}
+function quoteIdentifierFor(dialect, column) {
+  return dialect.quoteIdentifier(column);
+}
+var postgresDialect = {
+  driver: "pgsql",
+  placeholder(index) {
+    return `$${index}`;
+  },
+  quoteIdentifier(identifier) {
+    return `"${assertSafeIdentifier(identifier)}"`;
+  },
+  nowExpression() {
+    return "NOW()";
+  },
+  timestampValue(value) {
+    return value.toISOString();
+  },
+  returningClause(columns) {
+    return ` RETURNING ${columns}`;
+  },
+  ilikeOperator() {
+    return "ILIKE";
+  },
+  nullsLastSuffix() {
+    return " NULLS LAST";
+  },
+  castToText(expression) {
+    return `${expression}::text`;
+  },
+  upsertSuffix(conflictColumns, updateColumns) {
+    const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
+    if (updateColumns.length === 0) {
+      return ` ON CONFLICT (${target}) DO NOTHING`;
+    }
+    const assignments = updateColumns.map((column) => {
+      const quoted = quoteIdentifierFor(this, column);
+      return `${quoted} = excluded.${quoted}`;
+    }).join(", ");
+    return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
+  }
+};
+var mysqlDialect = {
+  driver: "mysql",
+  placeholder() {
+    return "?";
+  },
+  quoteIdentifier(identifier) {
+    return `\`${assertSafeIdentifier(identifier)}\``;
+  },
+  nowExpression() {
+    return "CURRENT_TIMESTAMP";
+  },
+  timestampValue(value) {
+    return value.toISOString().slice(0, 19).replace("T", " ");
+  },
+  returningClause() {
+    return "";
+  },
+  ilikeOperator() {
+    return "LIKE";
+  },
+  nullsLastSuffix() {
+    return "";
+  },
+  castToText(expression) {
+    return `CAST(${expression} AS CHAR)`;
+  },
+  upsertSuffix(conflictColumns, updateColumns) {
+    if (updateColumns.length === 0) {
+      const anchor = quoteIdentifierFor(this, conflictColumns[0] ?? "");
+      return ` ON DUPLICATE KEY UPDATE ${anchor} = ${anchor}`;
+    }
+    const assignments = updateColumns.map((column) => {
+      const quoted = quoteIdentifierFor(this, column);
+      return `${quoted} = VALUES(${quoted})`;
+    }).join(", ");
+    return ` ON DUPLICATE KEY UPDATE ${assignments}`;
+  }
+};
+var sqliteDialect = {
+  driver: "sqlite",
+  placeholder() {
+    return "?";
+  },
+  quoteIdentifier(identifier) {
+    return `"${assertSafeIdentifier(identifier)}"`;
+  },
+  nowExpression() {
+    return "strftime('%Y-%m-%dT%H:%M:%fZ', 'now')";
+  },
+  timestampValue(value) {
+    return value.toISOString();
+  },
+  returningClause(columns) {
+    return ` RETURNING ${columns}`;
+  },
+  ilikeOperator() {
+    return "LIKE";
+  },
+  nullsLastSuffix() {
+    return "";
+  },
+  castToText(expression) {
+    return `CAST(${expression} AS TEXT)`;
+  },
+  upsertSuffix(conflictColumns, updateColumns) {
+    const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
+    if (updateColumns.length === 0) {
+      return ` ON CONFLICT (${target}) DO NOTHING`;
+    }
+    const assignments = updateColumns.map((column) => {
+      const quoted = quoteIdentifierFor(this, column);
+      return `${quoted} = excluded.${quoted}`;
+    }).join(", ");
+    return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
+  }
+};
+var dialects = {
+  pgsql: postgresDialect,
+  mysql: mysqlDialect,
+  sqlite: sqliteDialect
+};
+var dialectContext = createAsyncContextStore("@getstrata/sqlDialect");
+var dialectOverride = null;
+function dialectFor(driver) {
+  return dialects[driver];
+}
+function currentSqlDialect() {
+  return dialectContext.getStore() ?? dialectOverride ?? dialectFor(resolveDatabaseDriver());
+}
+
+// ../../src/core/security/recoveryCodes.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { hashApiToken } from "@getstrata/core/auth/tokenHash";
+import { timingSafeCompareString } from "@getstrata/core/security/timingSafeCompare";
+var DEFAULT_RECOVERY_CODE_COUNT = 8;
+var RECOVERY_CODE_BYTES = 16;
+function normalizeRecoveryCode(code) {
+  return code.replace(/[^a-z0-9]/giu, "").toLowerCase();
+}
+function formatRecoveryCode(normalized) {
+  if (normalized.length !== RECOVERY_CODE_BYTES * 2) {
+    return normalized;
+  }
+  return normalized.match(/.{1,4}/gu)?.join("-") ?? normalized;
+}
+function generateRecoveryCodes(count = DEFAULT_RECOVERY_CODE_COUNT) {
+  const size = Number.isInteger(count) && count > 0 ? count : DEFAULT_RECOVERY_CODE_COUNT;
+  const codes = new Set;
+  while (codes.size < size) {
+    codes.add(formatRecoveryCode(randomBytes2(RECOVERY_CODE_BYTES).toString("hex")));
+  }
+  return [...codes];
+}
+function hashRecoveryCode(code) {
+  return hashApiToken(normalizeRecoveryCode(code));
+}
+function recoveryCodeMatches(code, hash) {
+  return timingSafeCompareString(hashRecoveryCode(code), hash);
+}
+
+// ../../src/core/security/totp.ts
+import { createHmac as createHmac2, randomBytes as randomBytes3 } from "crypto";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "strata";
+}
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "Strata";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
+
+// ../../src/core/security/timingSafeCompare.ts
+import { timingSafeEqual } from "crypto";
+function timingSafeCompareString2(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(leftBuffer, rightBuffer);
+}
+
+// ../../src/core/security/totp.ts
+function decodeBase32(input) {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  const normalized = input.replace(/=+$/u, "").toUpperCase();
+  let bits = "";
+  for (const char of normalized) {
+    const value = alphabet.indexOf(char);
+    if (value === -1) {
+      throw new Error("Invalid base32 character in MFA secret.");
+    }
+    bits += value.toString(2).padStart(5, "0");
+  }
+  const bytes = [];
+  for (let index = 0;index + 8 <= bits.length; index += 8) {
+    bytes.push(Number.parseInt(bits.slice(index, index + 8), 2));
+  }
+  return Buffer.from(bytes);
+}
+function encodeBase32(bytes) {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  let bits = "";
+  for (const byte of bytes) {
+    bits += byte.toString(2).padStart(8, "0");
+  }
+  let output = "";
+  for (let index = 0;index < bits.length; index += 5) {
+    const chunk = bits.slice(index, index + 5).padEnd(5, "0");
+    output += alphabet[Number.parseInt(chunk, 2)] ?? "";
+  }
+  return output;
+}
+function generateTotpSecret(byteLength = 20) {
+  return encodeBase32(randomBytes3(byteLength));
+}
+function buildOtpauthUrl(options) {
+  const issuer = options.issuer?.trim() || appDisplayName();
+  const label = `${issuer}:${options.account}`;
+  const params = new URLSearchParams({
+    secret: options.secret,
+    issuer,
+    algorithm: "SHA1",
+    digits: "6",
+    period: "30"
+  });
+  return `otpauth://totp/${encodeURIComponent(label)}?${params.toString()}`;
+}
+function generateTotp(secret, counter = Math.floor(Date.now() / 30000), digits = 6) {
+  const key = decodeBase32(secret);
+  const buffer = Buffer.alloc(8);
+  buffer.writeBigUInt64BE(BigInt(counter));
+  const digest = createHmac2("sha1", key).update(buffer).digest();
+  const lastByte = digest[digest.length - 1] ?? 0;
+  const offset = lastByte & 15;
+  const b0 = digest[offset] ?? 0;
+  const b1 = digest[offset + 1] ?? 0;
+  const b2 = digest[offset + 2] ?? 0;
+  const b3 = digest[offset + 3] ?? 0;
+  const code = (b0 & 127) << 24 | (b1 & 255) << 16 | (b2 & 255) << 8 | b3 & 255;
+  return String(code % 10 ** digits).padStart(digits, "0");
+}
+function verifyTotp(secret, token, window = 1) {
+  const normalized = token.trim();
+  if (!/^\d{6}$/u.test(normalized)) {
+    return false;
+  }
+  const timestep = Math.floor(Date.now() / 30000);
+  let matched = false;
+  for (let offset = -window;offset <= window; offset += 1) {
+    if (timingSafeCompareString2(generateTotp(secret, timestep + offset), normalized)) {
+      matched = true;
+    }
+  }
+  return matched;
+}
+
+// ../../src/core/auth/passwordLogin.ts
+function parseRecoveryHashes(raw) {
+  if (!raw?.trim()) {
+    return [];
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed) ? parsed.filter((item) => typeof item === "string") : [];
+  } catch {
+    return [];
+  }
+}
+function completePasswordLogin(user, options = {}) {
+  if (!user.mfa_enabled) {
+    return { ok: true };
+  }
+  const submitted = options.mfaCode?.trim() ?? "";
+  if (!submitted) {
+    return { ok: false, error: "mfa_required" };
+  }
+  const secret = revealMfaSecret(user.mfa_secret);
+  if (secret && verifyTotp(secret, submitted)) {
+    return { ok: true };
+  }
+  const hashes = parseRecoveryHashes(user.mfa_recovery_codes);
+  const matched = hashes.find((hash) => recoveryCodeMatches(submitted, hash));
+  if (matched) {
+    return { ok: true, consumedRecoveryHash: matched };
+  }
+  return { ok: false, error: "mfa_invalid" };
+}
+async function persistConsumedRecoveryHash(sql, userId, currentRaw, consumedHash) {
+  if (!consumedHash) {
+    return;
+  }
+  const dialect = currentSqlDialect();
+  await sql.unsafe(`UPDATE users SET mfa_recovery_codes = ${dialect.placeholder(1)} WHERE id = ${dialect.placeholder(2)}`, [
+    JSON.stringify(parseRecoveryHashes(currentRaw).filter((hash) => hash !== consumedHash)),
+    userId
+  ]);
+}
+
 // ../../src/core/auth/basicAuthGuard.ts
 class BasicAuthGuard {
   container;
@@ -112,24 +706,51 @@ class BasicAuthGuard {
     if (!directory) {
       return null;
     }
-    if (typeof directory.verifyCredentials === "function") {
-      return await directory.verifyCredentials(credentials.username, credentials.password);
+    const record = typeof directory.findByEmail === "function" ? await directory.findByEmail(credentials.username) : null;
+    if (record?.password) {
+      if (!await verifyPassword(credentials.password, record.password)) {
+        return null;
+      }
+      const mfa = completePasswordLogin(record, {
+        mfaCode: request.headers.get("x-mfa-code")
+      });
+      if (!mfa.ok) {
+        return null;
+      }
+      if (mfa.consumedRecoveryHash) {
+        await persistConsumedRecoveryHash(getBoundDatabaseConnection() ?? getDefaultDatabasePool(), record.id, record.mfa_recovery_codes, mfa.consumedRecoveryHash);
+      }
+      return {
+        id: record.id,
+        role: record.role,
+        emailVerifiedAt: record.email_verified_at ?? null
+      };
     }
-    if (typeof directory.findByEmail !== "function") {
-      return null;
-    }
-    const record = await directory.findByEmail(credentials.username);
-    if (!record?.password) {
-      return null;
-    }
-    if (!await verifyPassword(credentials.password, record.password)) {
-      return null;
+    if (typeof directory.verifyCredentials === "function") {
+      const user = await directory.verifyCredentials(credentials.username, credentials.password);
+      if (!user) {
+        return null;
+      }
+      let record = typeof directory.findByEmail === "function" ? await directory.findByEmail(credentials.username) : null;
+      if (!record) {
+        try {
+          record = await directory.findByIdOrThrow(Number(user.id));
+        } catch {
+          return null;
+        }
+      }
+      const mfa = completePasswordLogin(record, {
+        mfaCode: request.headers.get("x-mfa-code")
+      });
+      if (!mfa.ok) {
+        return null;
+      }
+      if (mfa.consumedRecoveryHash) {
+        await persistConsumedRecoveryHash(getBoundDatabaseConnection() ?? getDefaultDatabasePool(), record.id, record.mfa_recovery_codes, mfa.consumedRecoveryHash);
+      }
+      return user;
     }
-    return {
-      id: record.id,
-      role: record.role,
-      emailVerifiedAt: record.email_verified_at ?? null
-    };
+    return null;
   }
 }
 export {

package/dist/entries/auth/emailVerification.js

@@ -4,7 +4,7 @@ function isEmailVerificationRequired() {
   return (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true";
 }
 function hasVerifiedEmail(user) {
-  return user.emailVerifiedAt !== null;
+  return user.emailVerifiedAt != null;
 }
 export {
   hasVerifiedEmail,