@jini-ai/user-management 0.3.4 → 0.6.11

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.6.11
+
+### Patch Changes
+
+- Pure email sign-in challenge primitive (member auth, shard A).
+- Updated dependencies
+- Updated dependencies
+  - @jini-ai/core@0.6.11
+
+## 0.6.10
+
+### Patch Changes
+
+- 82ed2d3: Members requires FetchQueryProvider. Await the authoritative roster refresh before reporting a completed disable, and restore settlement rationale beside the keyed panel/loading logic.
+- ea8d883: Preserve successful member-disable state and detail when the follow-up roster read fails.
+- Updated dependencies [22f0619]
+- Updated dependencies [82ed2d3]
+- Updated dependencies [5a3de86]
+  - @jini-ai/core@0.6.10
+
 ## 0.3.4 — 2026-10-22
 
 - 2026-10-22: Named-argument identity guards, optional translate with a custom Users hook, cancellation kept across confirm-to-run, coverage.
@@ -77,7 +97,6 @@
 - Add `sessionTtlMs` and replaceable authentication messages options; preserve the 30-day default. Invalid lifetimes raise RangeError before persistence. Sessions retain required workspace scope because repositories require it.
 - Merge the job-specific test configuration into the existing config and rename its setup file.
 
-
 - Remove specification identifiers from admin safety errors and direct-grant tool text; authorization and ownership checks retain their behavior.
 
 - Reject reserved wildcard registration with a typed validation error and converge

package/dist/server/auth-challenge.d.ts

@@ -0,0 +1,111 @@
+/** Pure email-challenge primitives. Hosts own persistence, delivery and atomic consumption. */
+import type { PasswordHasherPort } from "../core/ports.js";
+import type { SessionTokenPort } from "../core/runtime-ports.js";
+/** Persisted metadata only; raw link tokens and codes must never enter this record. */
+export interface AuthChallengeRecord {
+    readonly id: string;
+    readonly workspaceId: string;
+    readonly realm: string;
+    readonly purpose: string;
+    readonly tokenHash: string;
+    /** Null for legacy link-only challenges. */
+    readonly codeHash: string | null;
+    readonly expiresAt: string;
+    readonly consumedAt?: string | null;
+    /**
+     * Code attempts spent. Each is reserved before its code is verified, and a correct code
+     * consumes the challenge, so on a live challenge every counted attempt failed or is in flight.
+     */
+    readonly failedAttempts: number;
+}
+export interface ChallengeScope {
+    readonly workspaceId: string;
+    readonly realm: string;
+    readonly purpose: string;
+}
+/**
+ * Storage contract only: implementations live in the host. Reads are scope-bound.
+ * Link completion: findByTokenHash -> decideChallenge -> consume.
+ * Code completion: findById -> decideChallenge -> reserveCodeAttempt -> verifyChallengeCode -> consume.
+ * Any false or "invalid" step gives the caller the same uniform failure.
+ */
+export interface ChallengeStorePort {
+    save(record: AuthChallengeRecord): Promise<void>;
+    findById(input: ChallengeScope & {
+        id: string;
+    }): Promise<AuthChallengeRecord | null>;
+    findByTokenHash(input: ChallengeScope & {
+        tokenHash: string;
+    }): Promise<AuthChallengeRecord | null>;
+    /**
+     * Atomically (lock/CAS) increment failedAttempts while decideChallenge is "ok" on current
+     * state; false when none remain. It runs BEFORE the code is verified, so parallel guesses
+     * cannot each read a stale counter and outrun the limit. Never resets the counter.
+     */
+    reserveCodeAttempt(input: ChallengeScope & {
+        id: string;
+        nowIso: string;
+        maxAttempts?: number;
+    }): Promise<boolean>;
+    /**
+     * Atomically stamp consumedAt while in scope, unconsumed and unexpired; link and code share
+     * this one stamp. Attempts are not rechecked: link completion checked them in decideChallenge
+     * and code completion already spent one. Returns false if another completion won.
+     */
+    consume(input: ChallengeScope & {
+        id: string;
+        nowIso: string;
+    }): Promise<boolean>;
+}
+export interface ChallengeSecretDependencies {
+    /** Inject NodeSessionTokens (32 cryptographic random bytes, SHA-256 digest), or equivalent. */
+    readonly tokens: SessionTokenPort;
+    /** Inject crypto.randomInt via ({ min, max }) => randomInt(min, max); max is exclusive. */
+    readonly randomInt: (input: {
+        min: number;
+        max: number;
+    }) => number;
+}
+export interface ChallengeSecrets {
+    readonly token: string;
+    readonly tokenHash: string;
+    readonly code: string;
+}
+/**
+ * Generate one 256-bit link bearer and uniform six-digit code through injected entropy.
+ * Only tokenHash and hashChallengeCode's result may be persisted. No clock or I/O is read.
+ * @throws RangeError if the supplied random-integer adapter violates its bounds.
+ * @complexity O(1), with one token generation/digest and one bounded integer draw.
+ */
+export declare function newChallengeSecrets({ tokens, randomInt }: ChallengeSecretDependencies, _options?: Record<string, never>): ChallengeSecrets;
+/**
+ * Hash the low-entropy code using the existing password hasher, never a fast digest.
+ * @throws RangeError for malformed codes; hashing adapter errors propagate.
+ * @complexity O(1) adapter calls; hashing cost belongs to PasswordHasherPort.
+ */
+export declare function hashChallengeCode({ code, hasher }: {
+    code: string;
+    hasher: PasswordHasherPort;
+}, _options?: Record<string, never>): Promise<string>;
+/**
+ * Verify through PasswordHasherPort's timing-safe verifier (Argon2PasswordHasher in Node).
+ * Legacy link-only hashes and malformed codes return false. Adapter errors propagate.
+ * @complexity O(1) adapter calls; no repository access or attempt mutation.
+ */
+export declare function verifyChallengeCode({ code, hash, hasher }: {
+    code: string;
+    hash: string | null;
+    hasher: PasswordHasherPort;
+}, _options?: Record<string, never>): Promise<boolean>;
+/**
+ * Decide metadata eligibility only; callers must also verify the token/code and use the
+ * store's atomic steps above. nowIso is the caller's injected clock value. Expiry is exclusive.
+ * Every denial returns the same result, including malformed timestamps/counters.
+ * @complexity O(1) for fixed-size metadata; no I/O, clock reads or input mutation.
+ */
+export declare function decideChallenge({ record, workspaceId, realm, purpose, nowIso, maxAttempts }: ChallengeScope & {
+    record: AuthChallengeRecord | null;
+    nowIso: string;
+    maxAttempts?: number;
+}, _options?: Record<string, never>): "ok" | "invalid";
+//# sourceMappingURL=auth-challenge.d.ts.map

package/dist/server/auth-challenge.js

@@ -0,0 +1,64 @@
+/**
+ * Generate one 256-bit link bearer and uniform six-digit code through injected entropy.
+ * Only tokenHash and hashChallengeCode's result may be persisted. No clock or I/O is read.
+ * @throws RangeError if the supplied random-integer adapter violates its bounds.
+ * @complexity O(1), with one token generation/digest and one bounded integer draw.
+ */
+export function newChallengeSecrets({ tokens, randomInt }, _options = {}) {
+    const value = randomInt({ min: 0, max: 1_000_000 });
+    if (!Number.isInteger(value) || value < 0 || value >= 1_000_000) {
+        throw new RangeError("Challenge entropy must be an integer in [0, 1000000).");
+    }
+    const token = tokens.newToken({});
+    return { token, tokenHash: tokens.hashToken({ rawToken: token }), code: String(value).padStart(6, "0") };
+}
+/** Exact ASCII shape; without the m flag, $ also refuses trailing line terminators. O(1). */
+function isChallengeCode(code) {
+    return /^[0-9]{6}$/.test(code);
+}
+/**
+ * Hash the low-entropy code using the existing password hasher, never a fast digest.
+ * @throws RangeError for malformed codes; hashing adapter errors propagate.
+ * @complexity O(1) adapter calls; hashing cost belongs to PasswordHasherPort.
+ */
+export function hashChallengeCode({ code, hasher }, _options = {}) {
+    if (!isChallengeCode(code))
+        throw new RangeError("Challenge code must contain exactly six ASCII digits.");
+    return hasher.hash({ password: code });
+}
+/**
+ * Verify through PasswordHasherPort's timing-safe verifier (Argon2PasswordHasher in Node).
+ * Legacy link-only hashes and malformed codes return false. Adapter errors propagate.
+ * @complexity O(1) adapter calls; no repository access or attempt mutation.
+ */
+export async function verifyChallengeCode({ code, hash, hasher }, _options = {}) {
+    if (!hash || !isChallengeCode(code))
+        return false;
+    return hasher.verify({ hash, password: code });
+}
+/** Invalid counters or limits deny access; O(1), without changing the stored counter. */
+function hasAttemptsRemaining(failedAttempts, maxAttempts) {
+    return Number.isSafeInteger(failedAttempts) && failedAttempts >= 0
+        && Number.isSafeInteger(maxAttempts) && maxAttempts > 0 && failedAttempts < maxAttempts;
+}
+/**
+ * Decide metadata eligibility only; callers must also verify the token/code and use the
+ * store's atomic steps above. nowIso is the caller's injected clock value. Expiry is exclusive.
+ * Every denial returns the same result, including malformed timestamps/counters.
+ * @complexity O(1) for fixed-size metadata; no I/O, clock reads or input mutation.
+ */
+export function decideChallenge({ record, workspaceId, realm, purpose, nowIso, maxAttempts = 5 }, _options = {}) {
+    if (!record)
+        return "invalid";
+    if (record.workspaceId !== workspaceId || record.realm !== realm || record.purpose !== purpose)
+        return "invalid";
+    if (record.consumedAt != null)
+        return "invalid";
+    if (!hasAttemptsRemaining(record.failedAttempts, maxAttempts))
+        return "invalid";
+    const now = Date.parse(nowIso);
+    const expires = Date.parse(record.expiresAt);
+    // Invalid dates parse to NaN, so the comparison also denies malformed timestamps.
+    return expires > now ? "ok" : "invalid";
+}
+//# sourceMappingURL=auth-challenge.js.map

package/dist/server/index.d.ts

@@ -13,6 +13,7 @@ export * from "./permission-migrations.js";
 export { identityAgentToolCatalog, type IdentityAgentToolDefinition, } from "./agent-tools.js";
 export { parseIdentityToolInput, type IdentityToolInputResult } from "./agent-tool-input.js";
 export * from "./session-tokens.js";
+export * from "./auth-challenge.js";
 export { buildIdentityRegistrations, identityDerivedRisk, type IdentityToolDeps } from "./agent-tool-registrations.js";
 export { defaultUserManagementMessages, type UserManagementMessages } from "./messages.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.js

@@ -15,6 +15,7 @@ export * from "./permission-migrations.js";
 export { identityAgentToolCatalog, } from "./agent-tools.js";
 export { parseIdentityToolInput } from "./agent-tool-input.js";
 export * from "./session-tokens.js";
+export * from "./auth-challenge.js";
 export { buildIdentityRegistrations, identityDerivedRisk } from "./agent-tool-registrations.js";
 export { defaultUserManagementMessages } from "./messages.js";
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/user-management",
-  "version": "0.3.4",
+  "version": "0.6.11",
   "description": "Runtime-separated user management contracts and Node authentication, authorization, and administration services.",
   "license": "Apache-2.0",
   "repository": {
@@ -87,16 +87,16 @@
     "registry": "https://registry.npmjs.org"
   },
   "dependencies": {
-    "@jini-ai/core": "^0.4.9"
+    "@jini-ai/core": "^0.6.11"
   },
   "peerDependencies": {
     "argon2": "^0.44.0",
     "react": "^18.3.0 || ^19.0.0",
     "react-dom": "^18.3.0 || ^19.0.0",
-    "@jini-ai/ui": "^0.4.8 || ^0.5.0",
-    "@jini-ai/admin": "^0.4.6",
-    "@jini-ai/agentic": "^0.4.4",
-    "@jini-ai/ui-kit": "^0.1.3"
+    "@jini-ai/ui": "^0.6.10",
+    "@jini-ai/admin": "^0.6.10",
+    "@jini-ai/agentic": "^0.6.10",
+    "@jini-ai/ui-kit": "^0.6.10"
   },
   "peerDependenciesMeta": {
     "argon2": {
@@ -134,12 +134,12 @@
     "@testing-library/user-event": "^14.5.0",
     "@testing-library/jest-dom": "^6.6.3",
     "jsdom": "^25.0.1",
-    "@jini-ai/ui": "0.5.6",
-    "@jini-ai/agentic": "0.4.5",
-    "@jini-ai/core": "^0.4.9",
-    "@jini-ai/ui-kit": "^0.1.5",
-    "@jini-ai/admin": "0.4.13",
-    "@jini-ai/cms": "0.5.14"
+    "@jini-ai/ui": "0.6.11",
+    "@jini-ai/cms": "0.6.11",
+    "@jini-ai/core": "^0.6.11",
+    "@jini-ai/admin": "0.6.11",
+    "@jini-ai/agentic": "0.6.11",
+    "@jini-ai/ui-kit": "^0.6.11"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",