@korajs/auth 0.6.0 → 1.0.0-beta.1

package/dist/server.d.cts

@@ -3602,6 +3602,13 @@ interface TotpSecret {
     createdAt: number;
     /** When MFA was verified (confirmed with first valid code) */
     verifiedAt: number | null;
+    /**
+     * The most recent TOTP time-step counter that was successfully consumed
+     * during authentication. Used to enforce single-use of codes (RFC 6238 §5.2):
+     * a code at or before this time-step is rejected as a replay. `undefined`
+     * until the first code is consumed.
+     */
+    lastUsedTimeStep?: number;
 }
 /**
  * Setup result returned when enabling TOTP MFA.
@@ -3702,6 +3709,11 @@ declare class TotpManager {
     /**
      * Verify a TOTP code during login.
      * Returns true if the code is valid, false otherwise.
+     *
+     * Enforces single-use: a code is rejected if its time-step has already
+     * been consumed (or predates a previously consumed time-step). This
+     * prevents an attacker who observes one valid code from replaying it
+     * within the acceptance window (RFC 6238 §5.2).
      */
     verify(userId: string, code: string): Promise<boolean>;
     /**
@@ -3728,6 +3740,18 @@ declare class TotpManager {
      */
     remainingRecoveryCodes(userId: string): Promise<number>;
     private validateCode;
+    /**
+     * Find the TOTP time-step counter (within the acceptance window) whose
+     * generated code matches `code`, or null if none matches. Comparison is
+     * timing-safe.
+     */
+    private matchTimeStep;
+    /**
+     * Validate a code AND consume its time-step so it (and any earlier code in
+     * the window) cannot be reused. Returns false for an invalid code or a
+     * replay of an already-consumed time-step. Persists the consumed time-step.
+     */
+    private consumeCode;
 }
 /**
  * Encode bytes to base32 string (RFC 4648, no padding).

package/dist/server.d.ts

@@ -3602,6 +3602,13 @@ interface TotpSecret {
     createdAt: number;
     /** When MFA was verified (confirmed with first valid code) */
     verifiedAt: number | null;
+    /**
+     * The most recent TOTP time-step counter that was successfully consumed
+     * during authentication. Used to enforce single-use of codes (RFC 6238 §5.2):
+     * a code at or before this time-step is rejected as a replay. `undefined`
+     * until the first code is consumed.
+     */
+    lastUsedTimeStep?: number;
 }
 /**
  * Setup result returned when enabling TOTP MFA.
@@ -3702,6 +3709,11 @@ declare class TotpManager {
     /**
      * Verify a TOTP code during login.
      * Returns true if the code is valid, false otherwise.
+     *
+     * Enforces single-use: a code is rejected if its time-step has already
+     * been consumed (or predates a previously consumed time-step). This
+     * prevents an attacker who observes one valid code from replaying it
+     * within the acceptance window (RFC 6238 §5.2).
      */
     verify(userId: string, code: string): Promise<boolean>;
     /**
@@ -3728,6 +3740,18 @@ declare class TotpManager {
      */
     remainingRecoveryCodes(userId: string): Promise<number>;
     private validateCode;
+    /**
+     * Find the TOTP time-step counter (within the acceptance window) whose
+     * generated code matches `code`, or null if none matches. Comparison is
+     * timing-safe.
+     */
+    private matchTimeStep;
+    /**
+     * Validate a code AND consume its time-step so it (and any earlier code in
+     * the window) cannot be reused. Returns false for an invalid code or a
+     * replay of an already-consumed time-step. Persists the consumed time-step.
+     */
+    private consumeCode;
 }
 /**
  * Encode bytes to base32 string (RFC 4648, no padding).

package/dist/server.js

@@ -77,7 +77,7 @@ var MAX_PASSWORD_LENGTH = 128;
 var MAX_NAME_LENGTH = 200;
 var CHALLENGE_TTL_MS = 6e4;
 function isValidEmail(email) {
-  if (email.length === 0 || email.length > 254) {
+  if (typeof email !== "string" || email.length === 0 || email.length > 254) {
     return false;
   }
   const atIndex = email.indexOf("@");
@@ -97,6 +97,9 @@ function isValidEmail(email) {
   return true;
 }
 function sanitizeName(name) {
+  if (typeof name !== "string") {
+    return "";
+  }
   const cleaned = name.replace(/[\x00-\x1f\x7f]/g, "");
   const trimmed = cleaned.trim();
   if (trimmed.length > MAX_NAME_LENGTH) {
@@ -147,7 +150,7 @@ var BuiltInAuthRoutes = class {
         }
       };
     }
-    if (body.password.length < MIN_PASSWORD_LENGTH) {
+    if (typeof body.password !== "string" || body.password.length < MIN_PASSWORD_LENGTH) {
       return {
         status: 400,
         body: {
@@ -211,6 +214,12 @@ var BuiltInAuthRoutes = class {
    * @returns Auth response with the user and tokens, or an error
    */
   async handleSignIn(body, clientIp) {
+    if (typeof body.email !== "string" || typeof body.password !== "string") {
+      return {
+        status: 400,
+        body: { error: "Email and password are required." }
+      };
+    }
     const rateLimitKey = clientIp ? `signin:${body.email.toLowerCase()}:${clientIp}` : `signin:${body.email.toLowerCase()}`;
     if (!await this.rateLimiter.isAllowed(rateLimitKey)) {
       return {
@@ -714,6 +723,9 @@ function decodeJwt(token) {
   }
 }
 function verifyJwt(token, secret) {
+  if (typeof token !== "string") {
+    return null;
+  }
   const parts = token.split(".");
   if (parts.length !== 3) {
     return null;
@@ -1716,6 +1728,11 @@ function createDefaultTokenManager(options) {
       "createKoraAuthServer requires jwtSecret in production. Set KORA_AUTH_SECRET or pass jwtSecret."
     );
   }
+  if (!secret) {
+    console.warn(
+      "[kora] No JWT secret configured; using an ephemeral random secret. Every token is invalidated when the process restarts. Set KORA_AUTH_SECRET or pass jwtSecret to createKoraAuthServer for stable sessions."
+    );
+  }
   return new TokenManager({
     secret: secret ?? TokenManager.generateSecret(),
     revocationStore: new InMemoryTokenRevocationStore(),
@@ -2018,7 +2035,11 @@ function notFound() {
   return { status: 404, body: { error: "Not found" } };
 }
 function readEnvSecret() {
-  return typeof process !== "undefined" ? process.env.KORA_AUTH_SECRET : void 0;
+  if (typeof process === "undefined") {
+    return void 0;
+  }
+  const value = process.env.KORA_AUTH_SECRET;
+  return value && value.trim().length > 0 ? value : void 0;
 }
 function isProduction() {
   return typeof process !== "undefined" && process.env.NODE_ENV === "production";
@@ -3515,7 +3536,7 @@ var MAX_ORG_NAME_LENGTH = 200;
 var MAX_SLUG_LENGTH = 100;
 var SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,98}[a-z0-9]$/;
 function isValidEmail2(email) {
-  if (email.length === 0 || email.length > 254) return false;
+  if (typeof email !== "string" || email.length === 0 || email.length > 254) return false;
   const atIndex = email.indexOf("@");
   if (atIndex < 1) return false;
   const domain = email.slice(atIndex + 1);
@@ -3783,6 +3804,13 @@ var OrgRoutes = class {
         body: { error: "Cannot assign owner role directly. Use ownership transfer." }
       };
     }
+    const org = await this.store.getOrg(orgId);
+    if (org && org.ownerId === params.targetUserId) {
+      return {
+        status: 403,
+        body: { error: "The organization owner's role cannot be changed. Use ownership transfer." }
+      };
+    }
     const callerMembership = await this.store.getMembership(orgId, userId);
     if (callerMembership && callerMembership.role !== "owner" && params.role === "admin") {
       return { status: 403, body: { error: "Only the owner can assign admin role." } };
@@ -5358,9 +5386,9 @@ var TotpManager = class {
       throw new TotpNotEnabledError(userId);
     }
     if (stored.verified) {
-      return this.validateCode(stored.secret, code);
+      return this.consumeCode(stored, code);
     }
-    const valid = this.validateCode(stored.secret, code);
+    const valid = await this.consumeCode(stored, code);
     if (!valid) {
       throw new TotpInvalidCodeError();
     }
@@ -5372,6 +5400,11 @@ var TotpManager = class {
   /**
    * Verify a TOTP code during login.
    * Returns true if the code is valid, false otherwise.
+   *
+   * Enforces single-use: a code is rejected if its time-step has already
+   * been consumed (or predates a previously consumed time-step). This
+   * prevents an attacker who observes one valid code from replaying it
+   * within the acceptance window (RFC 6238 §5.2).
    */
   async verify(userId, code) {
     const stored = await this.store.getByUserId(userId);
@@ -5381,7 +5414,7 @@ var TotpManager = class {
     if (!stored.verified) {
       throw new TotpNotVerifiedError(userId);
     }
-    return this.validateCode(stored.secret, code);
+    return this.consumeCode(stored, code);
   }
   /**
    * Verify a recovery code as an alternative to TOTP.
@@ -5465,16 +5498,41 @@ var TotpManager = class {
   }
   // --- Private ---
   validateCode(base32Secret, code) {
+    return this.matchTimeStep(base32Secret, code) !== null;
+  }
+  /**
+   * Find the TOTP time-step counter (within the acceptance window) whose
+   * generated code matches `code`, or null if none matches. Comparison is
+   * timing-safe.
+   */
+  matchTimeStep(base32Secret, code) {
     const secretBytes = base32Decode(base32Secret);
     const now = Math.floor(Date.now() / 1e3);
     for (let offset = -this.window; offset <= this.window; offset++) {
       const timeCounter = Math.floor((now + offset * this.period) / this.period);
       const expected = generateTotpCode(secretBytes, timeCounter, this.digits, this.algorithm);
       if (timingSafeEqual(code, expected)) {
-        return true;
+        return timeCounter;
       }
     }
-    return false;
+    return null;
+  }
+  /**
+   * Validate a code AND consume its time-step so it (and any earlier code in
+   * the window) cannot be reused. Returns false for an invalid code or a
+   * replay of an already-consumed time-step. Persists the consumed time-step.
+   */
+  async consumeCode(stored, code) {
+    const matched = this.matchTimeStep(stored.secret, code);
+    if (matched === null) {
+      return false;
+    }
+    if (stored.lastUsedTimeStep !== void 0 && matched <= stored.lastUsedTimeStep) {
+      return false;
+    }
+    stored.lastUsedTimeStep = matched;
+    await this.store.save(stored);
+    return true;
   }
 };
 function generateTotpCode(secret, counter, digits, algorithm) {