@getstrata/core 2.2.28 → 2.2.29

package/dist/entries/auth/passwordLogin.js

@@ -510,6 +510,23 @@ function revealMfaSecret(stored) {
 // ../../src/core/auth/passwordLogin.ts
 init_dialect();
 
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+
 // ../../src/core/security/recoveryCodes.ts
 import { randomBytes as randomBytes2 } from "crypto";
 import { hashApiToken } from "@getstrata/core/auth/tokenHash";
@@ -730,11 +747,17 @@ async function persistConsumedRecoveryHash(sql, userId, currentRaw, consumedHash
   if (!consumedHash) {
     return;
   }
+  const hashes = parseRecoveryHashes(currentRaw);
+  if (typeof currentRaw !== "string" || !hashes.includes(consumedHash)) {
+    throw new UnprocessableEntityError("mfa_invalid");
+  }
   const dialect = currentSqlDialect();
-  await sql.unsafe(`UPDATE users SET mfa_recovery_codes = ${dialect.placeholder(1)} WHERE id = ${dialect.placeholder(2)}`, [
-    JSON.stringify(parseRecoveryHashes(currentRaw).filter((hash) => hash !== consumedHash)),
-    userId
-  ]);
+  const returning = dialect.returningClause("id");
+  const rows = await sql.unsafe(`UPDATE users SET mfa_recovery_codes = ${dialect.placeholder(1)} WHERE id = ${dialect.placeholder(2)} AND mfa_recovery_codes = ${dialect.placeholder(3)}${returning}`, [JSON.stringify(hashes.filter((hash) => hash !== consumedHash)), userId, currentRaw]);
+  const header = rows[0];
+  const affected = returning ? rows.length : typeof header === "object" && header !== null && ("affectedRows" in header) ? Number(header.affectedRows) : 0;
+  if (affected !== 1)
+    throw new UnprocessableEntityError("mfa_invalid");
 }
 export {
   completePasswordLogin,