@lastshotlabs/bunshot 0.0.9 → 0.0.10

package/dist/routes/auth.js

@@ -9,6 +9,7 @@ import { isLimited, trackAttempt, bustAuthLimit } from "../lib/authRateLimit";
 import { getAuthAdapter } from "../lib/authAdapter";
 import { createRouter } from "../lib/context";
 import { getVerificationToken, deleteVerificationToken, createVerificationToken } from "../lib/emailVerification";
+import { createResetToken, consumeResetToken } from "../lib/resetPassword";
 import { getUserSessions, deleteSession } from "../lib/session";
 const isProd = process.env.NODE_ENV === "production";
 const TokenResponse = z.object({ token: z.string(), emailVerified: z.boolean().optional() });
@@ -22,7 +23,7 @@ const cookieOptions = {
     maxAge: 60 * 60 * 24 * 7, // 7 days
 };
 const clientIp = (xff, xri) => (xff ? xff.split(",")[0]?.trim() : undefined) ?? xri ?? undefined;
-export const createAuthRouter = ({ primaryField, emailVerification, rateLimit }) => {
+export const createAuthRouter = ({ primaryField, emailVerification, passwordReset, rateLimit }) => {
     const router = createRouter();
     const RegisterSchema = makeRegisterSchema(primaryField);
     const LoginSchema = makeLoginSchema(primaryField);
@@ -33,6 +34,8 @@ export const createAuthRouter = ({ primaryField, emailVerification, rateLimit })
     const registerOpts = { windowMs: rateLimit?.register?.windowMs ?? 60 * 60 * 1000, max: rateLimit?.register?.max ?? 5 };
     const verifyOpts = { windowMs: rateLimit?.verifyEmail?.windowMs ?? 15 * 60 * 1000, max: rateLimit?.verifyEmail?.max ?? 10 };
     const resendOpts = { windowMs: rateLimit?.resendVerification?.windowMs ?? 60 * 60 * 1000, max: rateLimit?.resendVerification?.max ?? 3 };
+    const forgotOpts = { windowMs: rateLimit?.forgotPassword?.windowMs ?? 15 * 60 * 1000, max: rateLimit?.forgotPassword?.max ?? 5 };
+    const resetOpts = { windowMs: rateLimit?.resetPassword?.windowMs ?? 15 * 60 * 1000, max: rateLimit?.resetPassword?.max ?? 10 };
     router.openapi(createRoute({
         method: "post",
         path: "/auth/register",
@@ -213,6 +216,78 @@ export const createAuthRouter = ({ primaryField, emailVerification, rateLimit })
             return c.json({ message: "Verification email sent" }, 200);
         });
     }
+    // Password reset routes — only mounted when passwordReset is configured and primaryField is "email"
+    if (passwordReset && primaryField === "email") {
+        router.openapi(createRoute({
+            method: "post",
+            path: "/auth/forgot-password",
+            tags,
+            request: { body: { content: { "application/json": { schema: z.object({ email: z.string().email() }) } } } },
+            responses: {
+                200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "Reset email sent if address is registered" },
+                400: { content: { "application/json": { schema: ErrorResponse } }, description: "Validation error" },
+                429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many attempts" },
+            },
+        }), async (c) => {
+            const ip = clientIp(c.req.header("x-forwarded-for"), c.req.header("x-real-ip")) ?? "unknown";
+            const { email } = c.req.valid("json");
+            // Rate-limit by both IP and email to prevent distributed email-bombing
+            const ipLimited = await trackAttempt(`forgot:ip:${ip}`, forgotOpts);
+            const emailLimited = await trackAttempt(`forgot:email:${email}`, forgotOpts);
+            if (ipLimited || emailLimited) {
+                return c.json({ error: "Too many attempts. Try again later." }, 429);
+            }
+            const adapter = getAuthAdapter();
+            const user = await adapter.findByEmail(email);
+            // Fire-and-forget: the response does not wait for token creation or email sending,
+            // which reduces obvious timing differences between registered and unregistered emails.
+            const msg = { message: "If that email is registered, a password reset link has been sent." };
+            if (user) {
+                void (async () => {
+                    try {
+                        const token = await createResetToken(user.id, email);
+                        await passwordReset.onSend(email, token);
+                    }
+                    catch (err) {
+                        console.error("Failed to send password reset email:", err);
+                    }
+                })();
+            }
+            return c.json(msg, 200);
+        });
+        router.openapi(createRoute({
+            method: "post",
+            path: "/auth/reset-password",
+            tags,
+            request: { body: { content: { "application/json": { schema: z.object({ token: z.string(), password: z.string().min(8) }) } } } },
+            responses: {
+                200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "Password reset successfully" },
+                400: { content: { "application/json": { schema: ErrorResponse } }, description: "Validation error or invalid/expired token" },
+                429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many attempts" },
+                501: { content: { "application/json": { schema: ErrorResponse } }, description: "Not supported by adapter" },
+            },
+        }), async (c) => {
+            const ip = clientIp(c.req.header("x-forwarded-for"), c.req.header("x-real-ip")) ?? "unknown";
+            if (await trackAttempt(`reset:${ip}`, resetOpts)) {
+                return c.json({ error: "Too many attempts. Try again later." }, 429);
+            }
+            const { token, password } = c.req.valid("json");
+            // consumeResetToken atomically gets and deletes — prevents concurrent replay
+            const entry = await consumeResetToken(token);
+            if (!entry)
+                return c.json({ error: "Invalid or expired reset token" }, 400);
+            const adapter = getAuthAdapter();
+            if (!adapter.setPassword) {
+                return c.json({ error: "Auth adapter does not support setPassword" }, 501);
+            }
+            const passwordHash = await Bun.password.hash(password);
+            await adapter.setPassword(entry.userId, passwordHash);
+            // Revoke all sessions so stolen JWTs can't stay valid after a reset
+            const sessions = await getUserSessions(entry.userId);
+            await Promise.all(sessions.map((s) => deleteSession(s.sessionId)));
+            return c.json({ message: "Password reset successfully" }, 200);
+        });
+    }
     // ---------------------------------------------------------------------------
     // Session management
     // ---------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lastshotlabs/bunshot",
-  "version": "0.0.9",
+  "version": "0.0.10",
   "description": "Batteries-included Bun + Hono API framework — auth, sessions, rate limiting, WebSocket, queues, and OpenAPI docs out of the box",
   "repository": {
     "type": "git",
@@ -22,6 +22,18 @@
     ".": {
       "import": "./dist/index.js",
       "types": "./dist/index.d.ts"
+    },
+    "./mongo": {
+      "import": "./dist/entrypoints/mongo.js",
+      "types": "./dist/entrypoints/mongo.d.ts"
+    },
+    "./redis": {
+      "import": "./dist/entrypoints/redis.js",
+      "types": "./dist/entrypoints/redis.d.ts"
+    },
+    "./queue": {
+      "import": "./dist/entrypoints/queue.js",
+      "types": "./dist/entrypoints/queue.d.ts"
     }
   },
   "bin": {
@@ -41,17 +53,35 @@
     "@hono/zod-openapi": "1.2.2",
     "@scalar/hono-api-reference": "0.10.0",
     "arctic": "^3.7.0",
-    "bullmq": "^5.70.4",
-    "hono": "4.12.7",
-    "ioredis": "5.10.0",
-    "jose": "6.2.0",
-    "mongoose": "9.2.4",
-    "zod": "4.3.6"
+    "jose": "6.2.0"
+  },
+  "peerDependencies": {
+    "hono": ">=4.12 <5",
+    "zod": ">=4.0 <5",
+    "mongoose": ">=9.0 <10",
+    "ioredis": ">=5.0 <6",
+    "bullmq": ">=5.0 <6"
+  },
+  "peerDependenciesMeta": {
+    "mongoose": {
+      "optional": true
+    },
+    "ioredis": {
+      "optional": true
+    },
+    "bullmq": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "@types/bun": "1.3.10",
     "tsc-alias": "^1.8.16",
-    "typescript": "^5.9.3"
+    "typescript": "^5.9.3",
+    "hono": ">=4.12",
+    "zod": ">=4.0",
+    "mongoose": "9.2.4",
+    "ioredis": "5.10.0",
+    "bullmq": "^5.70.4"
   },
   "publishConfig": {
     "access": "public"