@lastshotlabs/bunshot 0.0.16 → 0.0.19

package/dist/routes/auth.js

@@ -2,7 +2,7 @@ import { createRoute, withSecurity } from "../lib/createRoute";
 import { z } from "zod";
 import { setCookie, getCookie, deleteCookie } from "hono/cookie";
 import * as AuthService from "../services/auth";
-import { makeRegisterSchema, makeLoginSchema } from "../schemas/auth";
+import { makeRegisterSchema, makeLoginSchema, resetPasswordSchema } from "../schemas/auth";
 import { COOKIE_TOKEN, HEADER_USER_TOKEN, COOKIE_REFRESH_TOKEN, HEADER_REFRESH_TOKEN } from "../lib/constants";
 import { userAuth } from "../middleware/userAuth";
 import { isLimited, trackAttempt, bustAuthLimit } from "../lib/authRateLimit";
@@ -10,8 +10,10 @@ import { getAuthAdapter } from "../lib/authAdapter";
 import { createRouter } from "../lib/context";
 import { getVerificationToken, deleteVerificationToken, createVerificationToken } from "../lib/emailVerification";
 import { createResetToken, consumeResetToken } from "../lib/resetPassword";
-import { getRefreshTokenExpiry, getAccessTokenExpiry } from "../lib/appConfig";
+import { getRefreshTokenExpiry, getAccessTokenExpiry, getCsrfEnabled } from "../lib/appConfig";
+import { refreshCsrfToken, clearCsrfToken } from "../middleware/csrf";
 import { getUserSessions, deleteSession, deleteUserSessions } from "../lib/session";
+import { getClientIp } from "../lib/clientIp";
 const isProd = process.env.NODE_ENV === "production";
 const TokenResponse = z.object({
     token: z.string().describe("JWT session token. Also set as an HttpOnly session cookie. Empty string when mfaRequired is true."),
@@ -33,7 +35,6 @@ const cookieOptions = (maxAge) => ({
     path: "/",
     maxAge: maxAge ?? 60 * 60 * 24 * 7, // 7 days
 });
-const clientIp = (xff, xri) => (xff ? xff.split(",")[0]?.trim() : undefined) ?? xri ?? undefined;
 export const createAuthRouter = ({ primaryField, emailVerification, passwordReset, rateLimit, accountDeletion, refreshTokens }) => {
     const router = createRouter();
     const RegisterSchema = makeRegisterSchema(primaryField);
@@ -61,7 +62,7 @@ export const createAuthRouter = ({ primaryField, emailVerification, passwordRese
             429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many registration attempts from this IP. Try again later." },
         },
     }), async (c) => {
-        const ip = clientIp(c.req.header("x-forwarded-for"), c.req.header("x-real-ip")) ?? "unknown";
+        const ip = getClientIp(c);
         if (await trackAttempt(`register:${ip}`, registerOpts)) {
             return c.json({ error: "Too many registration attempts. Try again later." }, 429);
         }
@@ -76,6 +77,8 @@ export const createAuthRouter = ({ primaryField, emailVerification, passwordRese
         if (result.refreshToken) {
             setCookie(c, COOKIE_REFRESH_TOKEN, result.refreshToken, cookieOptions(getRefreshTokenExpiry()));
         }
+        if (getCsrfEnabled())
+            refreshCsrfToken(c);
         return c.json(result, 201);
     });
     router.openapi(createRoute({
@@ -99,7 +102,7 @@ export const createAuthRouter = ({ primaryField, emailVerification, passwordRese
             return c.json({ error: "Too many failed login attempts. Try again later." }, 429);
         }
         const metadata = {
-            ipAddress: clientIp(c.req.header("x-forwarded-for"), c.req.header("x-real-ip")),
+            ipAddress: getClientIp(c),
             userAgent: c.req.header("user-agent") ?? undefined,
         };
         try {
@@ -110,6 +113,8 @@ export const createAuthRouter = ({ primaryField, emailVerification, passwordRese
                 if (result.refreshToken) {
                     setCookie(c, COOKIE_REFRESH_TOKEN, result.refreshToken, cookieOptions(getRefreshTokenExpiry()));
                 }
+                if (getCsrfEnabled())
+                    refreshCsrfToken(c);
             }
             return c.json(result, 200);
         }
@@ -255,6 +260,8 @@ export const createAuthRouter = ({ primaryField, emailVerification, passwordRese
         await AuthService.logout(token);
         deleteCookie(c, COOKIE_TOKEN, { path: "/" });
         deleteCookie(c, COOKIE_REFRESH_TOKEN, { path: "/" });
+        if (getCsrfEnabled())
+            clearCsrfToken(c);
         return c.json({ message: "Logged out" }, 200);
     });
     // Email verification routes — only mounted when emailVerification is configured and primaryField is "email"
@@ -272,7 +279,7 @@ export const createAuthRouter = ({ primaryField, emailVerification, passwordRese
                 429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many verification attempts from this IP. Try again later." },
             },
         }), async (c) => {
-            const ip = c.req.header("x-forwarded-for") ?? "unknown";
+            const ip = getClientIp(c);
             if (await trackAttempt(`verify:${ip}`, verifyOpts)) {
                 return c.json({ error: "Too many verification attempts. Try again later." }, 429);
             }
@@ -341,7 +348,7 @@ export const createAuthRouter = ({ primaryField, emailVerification, passwordRese
                 429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many attempts from this IP or for this email address. Try again later." },
             },
         }), async (c) => {
-            const ip = clientIp(c.req.header("x-forwarded-for"), c.req.header("x-real-ip")) ?? "unknown";
+            const ip = getClientIp(c);
             const { email } = c.req.valid("json");
             // Rate-limit by both IP and email to prevent distributed email-bombing
             const ipLimited = await trackAttempt(`forgot:ip:${ip}`, forgotOpts);
@@ -379,7 +386,7 @@ export const createAuthRouter = ({ primaryField, emailVerification, passwordRese
                         "application/json": {
                             schema: z.object({
                                 token: z.string().describe("Single-use reset token received via email."),
-                                password: z.string().min(8).describe("New password. Minimum 8 characters."),
+                                password: resetPasswordSchema().describe("New password."),
                             }),
                         },
                     },
@@ -393,7 +400,7 @@ export const createAuthRouter = ({ primaryField, emailVerification, passwordRese
                 501: { content: { "application/json": { schema: ErrorResponse } }, description: "The configured auth adapter does not support setPassword." },
             },
         }), async (c) => {
-            const ip = clientIp(c.req.header("x-forwarded-for"), c.req.header("x-real-ip")) ?? "unknown";
+            const ip = getClientIp(c);
             if (await trackAttempt(`reset:${ip}`, resetOpts)) {
                 return c.json({ error: "Too many attempts. Try again later." }, 429);
             }
@@ -444,8 +451,13 @@ export const createAuthRouter = ({ primaryField, emailVerification, passwordRese
             responses: {
                 200: { content: { "application/json": { schema: RefreshResponse } }, description: "New access and refresh tokens." },
                 401: { content: { "application/json": { schema: ErrorResponse } }, description: "Invalid or expired refresh token, or session invalidated due to token theft detection." },
+                429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many refresh attempts. Try again later." },
             },
         }), async (c) => {
+            const ip = getClientIp(c);
+            if (await trackAttempt(`refresh:ip:${ip}`, { max: 30, windowMs: 60_000 })) {
+                return c.json({ error: "Too many refresh attempts. Try again later." }, 429);
+            }
             const body = c.req.valid("json");
             const rt = body.refreshToken ?? getCookie(c, COOKIE_REFRESH_TOKEN) ?? c.req.header(HEADER_REFRESH_TOKEN) ?? null;
             if (!rt) {

package/dist/routes/mfa.d.ts

@@ -1 +1,5 @@
-export declare const createMfaRouter: () => import("@hono/zod-openapi").OpenAPIHono<import("../lib/context").AppEnv, {}, "/">;
+import type { AuthRateLimitConfig } from "../app";
+export interface MfaRouterOptions {
+    rateLimit?: AuthRateLimitConfig;
+}
+export declare const createMfaRouter: ({ rateLimit }?: MfaRouterOptions) => import("@hono/zod-openapi").OpenAPIHono<import("../lib/context").AppEnv, {}, "/">;

package/dist/routes/mfa.js

@@ -7,8 +7,11 @@ import * as MfaService from "../services/mfa";
 import * as AuthService from "../services/auth";
 import { consumeMfaChallenge, replaceMfaChallengeOtp } from "../lib/mfaChallenge";
 import { COOKIE_TOKEN, COOKIE_REFRESH_TOKEN } from "../lib/constants";
-import { getRefreshTokenConfig, getAccessTokenExpiry, getRefreshTokenExpiry, getMfaEmailOtpConfig } from "../lib/appConfig";
+import { getRefreshTokenConfig, getAccessTokenExpiry, getRefreshTokenExpiry, getMfaEmailOtpConfig, getMfaWebAuthnConfig, getCsrfEnabled } from "../lib/appConfig";
+import { refreshCsrfToken } from "../middleware/csrf";
 import { getAuthAdapter } from "../lib/authAdapter";
+import { trackAttempt } from "../lib/authRateLimit";
+import { getClientIp } from "../lib/clientIp";
 const isProd = process.env.NODE_ENV === "production";
 const cookieOptions = (maxAge) => ({
     httpOnly: true,
@@ -19,8 +22,11 @@ const cookieOptions = (maxAge) => ({
 });
 const tags = ["MFA"];
 const ErrorResponse = z.object({ error: z.string() }).openapi("MfaErrorResponse");
-export const createMfaRouter = () => {
+export const createMfaRouter = ({ rateLimit } = {}) => {
     const router = createRouter();
+    // Resolve MFA rate limits with defaults
+    const mfaVerifyOpts = { windowMs: rateLimit?.mfaVerify?.windowMs ?? 15 * 60 * 1000, max: rateLimit?.mfaVerify?.max ?? 10 };
+    const mfaResendOpts = { windowMs: rateLimit?.mfaResend?.windowMs ?? 60 * 1000, max: rateLimit?.mfaResend?.max ?? 5 };
     // All MFA setup/management routes require auth
     router.use("/auth/mfa/setup", userAuth);
     router.use("/auth/mfa/verify-setup", userAuth);
@@ -107,7 +113,7 @@ export const createMfaRouter = () => {
         method: "post",
         path: "/auth/mfa/verify",
         summary: "Complete MFA login",
-        description: "Completes login by verifying a TOTP code, email OTP code, or recovery code after password authentication. Requires the mfaToken returned from the login endpoint. Optionally specify 'method' to target a specific verification method.",
+        description: "Completes login by verifying a TOTP code, email OTP code, recovery code, or WebAuthn assertion after password authentication. Requires the mfaToken returned from the login endpoint. Optionally specify 'method' to target a specific verification method.",
         tags,
         request: {
             body: {
@@ -115,8 +121,9 @@ export const createMfaRouter = () => {
                     "application/json": {
                         schema: z.object({
                             mfaToken: z.string().describe("MFA challenge token from the login response."),
-                            code: z.string().describe("6-digit TOTP/email OTP code or 8-character recovery code."),
-                            method: z.enum(["totp", "emailOtp"]).optional().describe("Specify which MFA method to verify. If omitted, methods are tried automatically."),
+                            code: z.string().optional().describe("6-digit TOTP/email OTP code or 8-character recovery code. Required unless using WebAuthn."),
+                            method: z.enum(["totp", "emailOtp", "webauthn"]).optional().describe("Specify which MFA method to verify. If omitted, methods are tried automatically."),
+                            webauthnResponse: z.record(z.string(), z.unknown()).optional().describe("WebAuthn authentication response from navigator.credentials.get(). Pass the entire response object."),
                         }),
                     },
                 },
@@ -125,24 +132,39 @@ export const createMfaRouter = () => {
         responses: {
             200: { content: { "application/json": { schema: MfaLoginResponse } }, description: "MFA verified. Session created." },
             401: { content: { "application/json": { schema: ErrorResponse } }, description: "Invalid or expired MFA token, or invalid code." },
+            429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many MFA verification attempts. Try again later." },
         },
     }), async (c) => {
-        const { mfaToken, code, method } = c.req.valid("json");
+        const ip = getClientIp(c);
+        if (await trackAttempt(`mfa-verify:${ip}`, mfaVerifyOpts)) {
+            return c.json({ error: "Too many MFA verification attempts. Try again later." }, 429);
+        }
+        const { mfaToken, code, method, webauthnResponse } = c.req.valid("json");
+        if (!code && !webauthnResponse) {
+            return c.json({ error: "Either 'code' or 'webauthnResponse' is required" }, 401);
+        }
         const challenge = await consumeMfaChallenge(mfaToken);
         if (!challenge)
             return c.json({ error: "Invalid or expired MFA token" }, 401);
-        const { userId, emailOtpHash } = challenge;
+        const { userId, emailOtpHash, webauthnChallenge } = challenge;
         let valid = false;
-        if (method === "totp") {
+        if (method === "webauthn" || (!method && webauthnResponse)) {
+            // WebAuthn verification
+            if (webauthnResponse && webauthnChallenge) {
+                valid = await MfaService.verifyWebAuthn(userId, webauthnResponse, webauthnChallenge);
+            }
+        }
+        else if (method === "totp") {
             // Only try TOTP
-            valid = await MfaService.verifyTotp(userId, code);
+            if (code)
+                valid = await MfaService.verifyTotp(userId, code);
         }
         else if (method === "emailOtp") {
             // Only try email OTP
-            if (emailOtpHash)
+            if (code && emailOtpHash)
                 valid = MfaService.verifyEmailOtp(emailOtpHash, code);
         }
-        else {
+        else if (code) {
             // Auto-detect: use emailOtpHash presence to pick order
             if (emailOtpHash) {
                 // Email OTP first, then TOTP, then recovery
@@ -155,15 +177,15 @@ export const createMfaRouter = () => {
                 valid = await MfaService.verifyTotp(userId, code);
             }
         }
-        // Always try recovery code as fallback
-        if (!valid) {
+        // Always try recovery code as fallback (code-based only)
+        if (!valid && code) {
             valid = await MfaService.verifyRecoveryCode(userId, code);
         }
         if (!valid)
             return c.json({ error: "Invalid MFA code" }, 401);
         // Create session — reuse the service helper for refresh token support
         const result = await AuthService.createSessionForUser(userId, {
-            ipAddress: (c.req.header("x-forwarded-for")?.split(",")[0]?.trim()) ?? c.req.header("x-real-ip") ?? undefined,
+            ipAddress: getClientIp(c),
             userAgent: c.req.header("user-agent") ?? undefined,
         });
         const rtConfig = getRefreshTokenConfig();
@@ -171,6 +193,8 @@ export const createMfaRouter = () => {
         if (result.refreshToken) {
             setCookie(c, COOKIE_REFRESH_TOKEN, result.refreshToken, cookieOptions(getRefreshTokenExpiry()));
         }
+        if (getCsrfEnabled())
+            refreshCsrfToken(c);
         return c.json({ token: result.token, userId, refreshToken: result.refreshToken }, 200);
     });
     // ─── Disable MFA ──────────────────────────────────────────────────────────
@@ -364,6 +388,10 @@ export const createMfaRouter = () => {
             429: { content: { "application/json": { schema: ErrorResponse } }, description: "Maximum resends reached." },
         },
     }), async (c) => {
+        const ip = getClientIp(c);
+        if (await trackAttempt(`mfa-resend:${ip}`, mfaResendOpts)) {
+            return c.json({ error: "Too many resend attempts. Try again later." }, 429);
+        }
         const { mfaToken } = c.req.valid("json");
         const emailOtpConfig = getMfaEmailOtpConfig();
         if (!emailOtpConfig)
@@ -405,5 +433,184 @@ export const createMfaRouter = () => {
         const methods = await MfaService.getMfaMethods(userId);
         return c.json({ methods }, 200);
     });
+    // ─── WebAuthn / Security Keys ─────────────────────────────────────────────
+    if (getMfaWebAuthnConfig()) {
+        // Eager dependency check — fail fast at server start
+        MfaService.assertWebAuthnDependency().catch((err) => { throw err; });
+        router.use("/auth/mfa/webauthn/*", userAuth);
+        // Register options
+        router.openapi(withSecurity(createRoute({
+            method: "post",
+            path: "/auth/mfa/webauthn/register-options",
+            summary: "Generate WebAuthn registration options",
+            description: "Generates registration options for the client to pass to navigator.credentials.create(). Returns a registrationToken to confirm registration.",
+            tags,
+            responses: {
+                200: {
+                    content: {
+                        "application/json": {
+                            schema: z.object({
+                                options: z.record(z.string(), z.unknown()).describe("PublicKeyCredentialCreationOptions — pass directly to navigator.credentials.create()."),
+                                registrationToken: z.string().describe("Token to pass back when completing registration."),
+                            }),
+                        },
+                    },
+                    description: "Registration options generated.",
+                },
+                401: { content: { "application/json": { schema: ErrorResponse } }, description: "No valid session." },
+                501: { content: { "application/json": { schema: ErrorResponse } }, description: "WebAuthn not configured or adapter does not support it." },
+            },
+        }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+            const userId = c.get("authUserId");
+            const result = await MfaService.initiateWebAuthnRegistration(userId);
+            return c.json(result, 200);
+        });
+        // Complete registration
+        router.openapi(withSecurity(createRoute({
+            method: "post",
+            path: "/auth/mfa/webauthn/register",
+            summary: "Complete WebAuthn registration",
+            description: "Verifies the attestation response from navigator.credentials.create() and stores the credential. Returns recovery codes.",
+            tags,
+            request: {
+                body: {
+                    content: {
+                        "application/json": {
+                            schema: z.object({
+                                registrationToken: z.string().describe("Token from POST /auth/mfa/webauthn/register-options."),
+                                attestationResponse: z.record(z.string(), z.unknown()).describe("Full response from navigator.credentials.create()."),
+                                name: z.string().optional().describe("User-friendly name for the key (e.g. 'YubiKey 5')."),
+                            }),
+                        },
+                    },
+                },
+            },
+            responses: {
+                200: {
+                    content: {
+                        "application/json": {
+                            schema: z.object({
+                                message: z.string(),
+                                credentialId: z.string(),
+                                recoveryCodes: z.array(z.string()).nullable().describe("Recovery codes (always returned when WebAuthn is enabled)."),
+                            }),
+                        },
+                    },
+                    description: "Security key registered.",
+                },
+                401: { content: { "application/json": { schema: ErrorResponse } }, description: "Invalid registration token or verification failed." },
+                409: { content: { "application/json": { schema: ErrorResponse } }, description: "Security key already registered to another account." },
+                501: { content: { "application/json": { schema: ErrorResponse } }, description: "WebAuthn not configured or adapter does not support it." },
+            },
+        }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+            const userId = c.get("authUserId");
+            const { registrationToken, attestationResponse, name } = c.req.valid("json");
+            const result = await MfaService.completeWebAuthnRegistration(userId, registrationToken, attestationResponse, name);
+            return c.json({ message: "Security key registered", ...result }, 200);
+        });
+        // List credentials
+        router.openapi(withSecurity(createRoute({
+            method: "get",
+            path: "/auth/mfa/webauthn/credentials",
+            summary: "List WebAuthn credentials",
+            description: "Returns the security keys registered for the authenticated user. Does not include private key data.",
+            tags,
+            responses: {
+                200: {
+                    content: {
+                        "application/json": {
+                            schema: z.object({
+                                credentials: z.array(z.object({
+                                    credentialId: z.string(),
+                                    name: z.string().optional(),
+                                    createdAt: z.number(),
+                                    transports: z.array(z.string()).optional(),
+                                })),
+                            }),
+                        },
+                    },
+                    description: "List of registered security keys.",
+                },
+                401: { content: { "application/json": { schema: ErrorResponse } }, description: "No valid session." },
+            },
+        }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+            const userId = c.get("authUserId");
+            const adapter = getAuthAdapter();
+            const creds = adapter.getWebAuthnCredentials ? await adapter.getWebAuthnCredentials(userId) : [];
+            return c.json({
+                credentials: creds.map((cr) => ({
+                    credentialId: cr.credentialId,
+                    name: cr.name,
+                    createdAt: cr.createdAt,
+                    transports: cr.transports,
+                })),
+            }, 200);
+        });
+        // Remove a single credential
+        router.openapi(withSecurity(createRoute({
+            method: "delete",
+            path: "/auth/mfa/webauthn/credentials/{credentialId}",
+            summary: "Remove a WebAuthn credential",
+            description: "Removes a single security key. Identity verification is only required when removing the last MFA credential.",
+            tags,
+            request: {
+                params: z.object({ credentialId: z.string() }),
+                body: {
+                    content: {
+                        "application/json": {
+                            schema: z.object({
+                                code: z.string().optional().describe("TOTP code (required when removing the last MFA credential, if TOTP is enabled)."),
+                                password: z.string().optional().describe("Password (required when removing the last MFA credential, if no TOTP)."),
+                            }),
+                        },
+                    },
+                },
+            },
+            responses: {
+                200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "Credential removed." },
+                400: { content: { "application/json": { schema: ErrorResponse } }, description: "Missing required verification." },
+                401: { content: { "application/json": { schema: ErrorResponse } }, description: "Invalid code/password or no valid session." },
+                404: { content: { "application/json": { schema: ErrorResponse } }, description: "Credential not found." },
+                501: { content: { "application/json": { schema: ErrorResponse } }, description: "Adapter does not support WebAuthn." },
+            },
+        }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+            const userId = c.get("authUserId");
+            const { credentialId } = c.req.valid("param");
+            const { code, password } = c.req.valid("json");
+            await MfaService.removeWebAuthnCredential(userId, credentialId, { code, password });
+            return c.json({ message: "Credential removed" }, 200);
+        });
+        // Disable WebAuthn entirely
+        router.openapi(withSecurity(createRoute({
+            method: "delete",
+            path: "/auth/mfa/webauthn",
+            summary: "Disable WebAuthn MFA",
+            description: "Removes all WebAuthn credentials and disables WebAuthn as an MFA method. Requires identity verification.",
+            tags,
+            request: {
+                body: {
+                    content: {
+                        "application/json": {
+                            schema: z.object({
+                                code: z.string().optional().describe("TOTP code (if TOTP is enabled)."),
+                                password: z.string().optional().describe("Password (if TOTP is not enabled)."),
+                            }),
+                        },
+                    },
+                },
+            },
+            responses: {
+                200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "WebAuthn disabled." },
+                400: { content: { "application/json": { schema: ErrorResponse } }, description: "Missing required verification." },
+                401: { content: { "application/json": { schema: ErrorResponse } }, description: "Invalid code/password or no valid session." },
+                501: { content: { "application/json": { schema: ErrorResponse } }, description: "Adapter does not support WebAuthn." },
+            },
+        }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+            const userId = c.get("authUserId");
+            const { code, password } = c.req.valid("json");
+            await MfaService.disableWebAuthn(userId, { code, password });
+            return c.json({ message: "WebAuthn disabled" }, 200);
+        });
+    }
     return router;
 };