@h-ai/iam 0.1.0-alpha.10 → 0.1.0-alpha.12

package/dist/index.d.ts

@@ -755,6 +755,7 @@ interface UserOperations {
      *
      * @param userId - 用户 ID
      * @param options - 查询选项（可选 include: ['roles'] 同时返回角色列表）
+     * @param options.include - 指定需要额外展开的关联字段；传入 ['roles'] 时同时返回角色列表
      * @returns 成功返回用户信息或 null（用户不存在时）
      */
     getUser: (userId: string, options?: {

package/dist/index.js

@@ -1362,8 +1362,18 @@ function createLdapStrategy(config) {
   };
 }
 var OTP_KEY_PREFIX = "hai:iam:otp:";
+var OTP_ATTEMPTS_KEY_PREFIX = "hai:iam:otp:attempts:";
+function normalizeOtpIdentifier(identifier) {
+  const trimmed = identifier.trim();
+  if (trimmed.includes("@"))
+    return trimmed.toLowerCase();
+  return trimmed.replace(/[\s-]/g, "");
+}
 function buildOtpKey(identifier) {
-  return `${OTP_KEY_PREFIX}${identifier}`;
+  return `${OTP_KEY_PREFIX}${normalizeOtpIdentifier(identifier)}`;
+}
+function buildOtpAttemptsKey(identifier) {
+  return `${OTP_ATTEMPTS_KEY_PREFIX}${normalizeOtpIdentifier(identifier)}`;
 }
 function restoreOtpDates(record) {
   return {
@@ -1383,7 +1393,7 @@ function createCacheOtpRepository() {
     async saveOtp(identifier, code, expiresIn) {
       const now = Date.now();
       const record = {
-        identifier,
+        identifier: normalizeOtpIdentifier(identifier),
         code,
         expiresAt: new Date(now + expiresIn * 1e3),
         attempts: 0,
@@ -1397,6 +1407,7 @@ function createCacheOtpRepository() {
           result.error
         );
       }
+      await cache.kv.del(buildOtpAttemptsKey(identifier));
       return ok(void 0);
     },
     async fetchOtp(identifier) {
@@ -1411,10 +1422,14 @@ function createCacheOtpRepository() {
       if (!result.data) {
         return ok(null);
       }
-      return ok(restoreOtpDates(result.data));
+      const attemptsResult = await cache.kv.get(buildOtpAttemptsKey(identifier));
+      const attempts = attemptsResult.success && typeof attemptsResult.data === "number" ? attemptsResult.data : 0;
+      const restored = restoreOtpDates(result.data);
+      return ok({ ...restored, attempts });
     },
     async incrementOtpAttempts(identifier) {
       const otpKey = buildOtpKey(identifier);
+      const attemptsKey = buildOtpAttemptsKey(identifier);
       const current = await cache.kv.get(otpKey);
       if (!current.success) {
         return err(
@@ -1426,19 +1441,18 @@ function createCacheOtpRepository() {
       if (!current.data) {
         return ok(0);
       }
-      const record = restoreOtpDates(current.data);
-      const nextAttempts = record.attempts + 1;
-      const ttlResult = await cache.kv.ttl(otpKey);
-      const ttl = ttlResult.success && ttlResult.data > 0 ? ttlResult.data : 1;
-      const updateResult = await cache.kv.set(otpKey, { ...record, attempts: nextAttempts }, { ex: ttl });
-      if (!updateResult.success) {
+      const incrResult = await cache.kv.incr(attemptsKey);
+      if (!incrResult.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_updateOtpAttemptsFailed", { params: { message: updateResult.error.message } }),
-          updateResult.error
+          iamM("iam_updateOtpAttemptsFailed", { params: { message: incrResult.error.message } }),
+          incrResult.error
         );
       }
-      return ok(nextAttempts);
+      const ttlResult = await cache.kv.ttl(otpKey);
+      const ttl = ttlResult.success && ttlResult.data > 0 ? ttlResult.data : 1;
+      await cache.kv.expire(attemptsKey, ttl);
+      return ok(incrResult.data);
     },
     async removeOtp(identifier) {
       const result = await cache.kv.del(buildOtpKey(identifier));
@@ -1449,6 +1463,7 @@ function createCacheOtpRepository() {
           result.error
         );
       }
+      await cache.kv.del(buildOtpAttemptsKey(identifier));
       return ok(void 0);
     }
   };
@@ -3562,6 +3577,7 @@ function createCacheSessionRepository(sessionMaxAge, refreshTokenMaxAge) {
       }
       const saddResult = await cache.set_.sadd(buildUserTokensKey(userId), accessToken);
       if (!saddResult.success) {
+        await cache.kv.del(buildTokenKey(accessToken));
         return err(
           HaiIamError.REPOSITORY_ERROR,
           iamM("iam_saveUserSessionCacheFailed", { params: { message: saddResult.error.message } }),
@@ -3575,6 +3591,8 @@ function createCacheSessionRepository(sessionMaxAge, refreshTokenMaxAge) {
         { ex: refreshTokenMaxAge }
       );
       if (!refreshResult.success) {
+        await cache.kv.del(buildTokenKey(accessToken));
+        await cache.set_.srem(buildUserTokensKey(userId), accessToken);
         return err(
           HaiIamError.REPOSITORY_ERROR,
           iamM("iam_saveSessionMappingCacheFailed", { params: { message: refreshResult.error.message } }),
@@ -3635,13 +3653,18 @@ function createCacheSessionRepository(sessionMaxAge, refreshTokenMaxAge) {
     },
     async removeByUserId(userId) {
       const tokensResult = await cache.set_.smembers(buildUserTokensKey(userId));
-      if (tokensResult.success) {
-        for (const token of tokensResult.data) {
-          await repo.removeByAccessToken(token);
+      let removed = 0;
+      if (tokensResult.success && tokensResult.data.length > 0) {
+        const results = await Promise.allSettled(
+          tokensResult.data.map((token) => repo.removeByAccessToken(token))
+        );
+        for (const r of results) {
+          if (r.status === "fulfilled" && r.value.success)
+            removed += 1;
         }
       }
       await cache.kv.del(buildUserTokensKey(userId));
-      return ok(void 0);
+      return ok(removed);
     },
     async getByRefreshToken(refreshToken) {
       const mappingResult = await cache.kv.get(buildRefreshKey(refreshToken));
@@ -3720,6 +3743,13 @@ function createCacheSessionRepository(sessionMaxAge, refreshTokenMaxAge) {
 }
 
 // src/session/iam-session-functions.ts
+function stripInternalSessionFields(session) {
+  if (!session.data || !("_tokenPair" in session.data))
+    return session;
+  const { _tokenPair, ...rest } = session.data;
+  const hasExtraKeys = Object.keys(rest).length > 0;
+  return { ...session, data: hasExtraKeys ? rest : void 0 };
+}
 var logger8 = core.logger.child({ module: "iam", scope: "session" });
 async function createSessionOperations(deps) {
   try {
@@ -3805,7 +3835,7 @@ function buildSessionFunctions(config) {
           expiresAt: new Date(now.getTime() + maxAge * 1e3)
         });
       }
-      return ok(session);
+      return ok(stripInternalSessionFields(session));
     },
     async verifyToken(accessToken) {
       const sessionResult = await this.get(accessToken);
@@ -3824,7 +3854,7 @@ function buildSessionFunctions(config) {
       return repo.updateByAccessToken(accessToken, data);
     },
     async delete(accessToken) {
-      logger8.debug("Session deleted", { accessToken });
+      logger8.debug("Session delete requested");
       return repo.removeByAccessToken(accessToken);
     },
     async deleteByUserId(userId) {
@@ -3832,7 +3862,7 @@ function buildSessionFunctions(config) {
       if (!result.success) {
         return result;
       }
-      return ok(0);
+      return ok(result.data);
     },
     async refresh(refreshToken) {
       try {
@@ -4454,6 +4484,12 @@ function buildPasswordChangeOps(ctx) {
         );
       }
       const user = userResult.data;
+      if (!user.enabled) {
+        return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
+      }
+      if (isAccountLocked(user)) {
+        return err(HaiIamError.USER_LOCKED, iamM("iam_accountLocked"));
+      }
       if (!user.passwordHash) {
         return err(
           HaiIamError.INVALID_CREDENTIALS,
@@ -4462,11 +4498,16 @@ function buildPasswordChangeOps(ctx) {
       }
       const verifyResult = crypto$1.password.verify(oldPassword, user.passwordHash);
       if (!verifyResult.success || !verifyResult.data) {
+        await recordLoginFailure(userRepository, user, {
+          maxLoginAttempts: ctx.loginConfig.maxLoginAttempts,
+          lockoutDuration: ctx.loginConfig.lockoutDuration
+        });
         return err(
           HaiIamError.INVALID_CREDENTIALS,
           iamM("iam_originalPasswordWrong")
         );
       }
+      await resetLoginFailures(userRepository, user);
       const validateResult = validatePassword(newPassword);
       if (!validateResult.success)
         return validateResult;
@@ -4502,12 +4543,12 @@ function buildPasswordChangeOps(ctx) {
   };
 }
 function buildPasswordResetOps(ctx) {
-  const { userRepository, resetTokenRepository, sessionFunctions, config, onPasswordResetRequest } = ctx;
+  const { userRepository, resetTokenRepository, sessionFunctions, onPasswordResetRequest } = ctx;
   const { validatePassword, hashPassword } = ctx;
   return {
     async requestPasswordReset(identifier) {
       logger9.debug("Password reset requested", { identifier });
-      const resetConfig = PasswordResetConfigSchema.parse(config.passwordReset ?? {});
+      const resetConfig = ctx.resetConfig;
       const userResult = await userRepository.findByIdentifier(identifier);
       if (!userResult.success) {
         logger9.warn("Failed to look up user for password reset", { identifier });
@@ -4538,7 +4579,7 @@ function buildPasswordResetOps(ctx) {
     },
     async confirmPasswordReset(token, newPassword) {
       logger9.debug("Confirming password reset");
-      const resetConfig = PasswordResetConfigSchema.parse(config.passwordReset ?? {});
+      const resetConfig = ctx.resetConfig;
       const validateResult = validatePassword(newPassword);
       if (!validateResult.success)
         return validateResult;
@@ -4581,7 +4622,9 @@ function buildUserFunctions(deps) {
     validatePassword,
     hashPassword,
     registerConfig: RegisterConfigSchema.parse(deps.config.register ?? {}),
-    agreementConfig: AgreementConfigSchema.parse(deps.config.agreements ?? {})
+    agreementConfig: AgreementConfigSchema.parse(deps.config.agreements ?? {}),
+    resetConfig: PasswordResetConfigSchema.parse(deps.config.passwordReset ?? {}),
+    loginConfig: SecurityConfigSchema.parse(deps.config.security ?? {})
   };
   return {
     ...buildRegistrationOps(ctx),