@luckystack/login 0.14.0 → 0.15.0

package/dist/index.js

@@ -14,7 +14,7 @@ import {
   registerOAuthProviderFactory,
   registerOAuthProviders,
   registerUserAdapter
-} from "./chunk-CLYMWF3A.js";
+} from "./chunk-ML3OQ6R4.js";
 import {
   activeUsersKeyFor,
   deleteSession,
@@ -29,10 +29,10 @@ import {
   revokeUserSessions,
   saveSession,
   sessionKeyFor
-} from "./chunk-6IGNAMXW.js";
+} from "./chunk-S7TST3X6.js";
 
 // src/index.ts
-import { registerSessionProvider } from "@luckystack/core";
+import { registerRedactedLogKeys, registerSessionProvider } from "@luckystack/core";
 
 // src/authLockout.ts
 import {
@@ -865,7 +865,7 @@ var fetchOAuthProfile = async (provider, accessToken) => {
   const userData = asRecord(response);
   const resolvedName = readStringField(userData, provider.nameKey);
   const name = resolvedName === "" ? "didnt find a name" : resolvedName;
-  const emailValue = userData[provider.emailKey];
+  const emailValue = provider.alwaysUseGetEmail ? void 0 : userData[provider.emailKey];
   let email = typeof emailValue === "string" ? emailValue : void 0;
   let emailVerified = false;
   if (email && provider.emailVerifiedKey) {
@@ -883,13 +883,14 @@ var fetchOAuthProfile = async (provider, accessToken) => {
   const avatarValue = provider.avatarKey ? readStringField(userData, provider.avatarKey) : provider.getAvatar ? await provider.getAvatar({ userData, avatarId: typeof avatarId === "string" ? avatarId : "", accessToken }) : "";
   const avatar = typeof avatarValue === "string" ? avatarValue : "";
   if (!email && provider.getEmail) {
-    const selectedEmail = await provider.getEmail(accessToken);
+    const selected = await provider.getEmail(accessToken, userData);
+    const selectedEmail = typeof selected === "object" ? selected.email : selected;
     if (!selectedEmail) {
       getLogger3().warn("oauth: no email found via provider.getEmail", { provider: provider.name });
       return null;
     }
     email = selectedEmail;
-    emailVerified = true;
+    emailVerified = typeof selected === "object" ? selected.verified : true;
   }
   if (email !== void 0) {
     const normalizedEmail = email.trim().toLowerCase();
@@ -1137,6 +1138,14 @@ var createPasswordResetToken = async (userId) => {
 var consumePasswordResetToken = async (token) => {
   return consumeOneTimeToken(PWRESET_NAMESPACE, token);
 };
+var invalidatePasswordResetToken = async (userId) => {
+  const pointerKey = pwresetUserKey(userId);
+  const priorKey = await redis.get(pointerKey);
+  if (priorKey) {
+    await redis.del(priorKey);
+  }
+  await redis.del(pointerKey);
+};
 var updatePasswordHash = async (userId, plaintext) => {
   const reason = validatePassword(plaintext);
   if (reason) {
@@ -1196,28 +1205,34 @@ var sendPasswordResetEmail = async ({ email, brand }) => {
     });
     return { ok: true };
   }
-  const token = await createPasswordResetToken(user.id);
-  void dispatchHook2("passwordResetRequested", {
-    email,
-    matched: true,
-    userId: user.id,
-    ttlSeconds: config.auth.passwordResetTtlSeconds
-  });
-  const baseUrl = (config.app.publicUrl || "").replace(/\/+$/, "");
-  const resetUrl = `${baseUrl}/reset-password?token=${encodeURIComponent(token)}`;
-  const ttlMinutes = Math.round(config.auth.passwordResetTtlSeconds / 60);
-  const result = await sendEmail({
-    to: user.email,
-    template: "password-reset",
-    data: { resetUrl, userName: user.name, brand: resolvedBrand, ttlMinutes },
-    adapterHint: "transactional"
+  const deliverResetEmail = async () => {
+    const token = await createPasswordResetToken(user.id);
+    void dispatchHook2("passwordResetRequested", {
+      email,
+      matched: true,
+      userId: user.id,
+      ttlSeconds: config.auth.passwordResetTtlSeconds
+    });
+    const baseUrl = (config.app.publicUrl || "").replace(/\/+$/, "");
+    const resetPath = config.auth.passwordResetPath || "/reset-password";
+    const resetUrl = `${baseUrl}${resetPath}?token=${encodeURIComponent(token)}`;
+    const ttlMinutes = Math.round(config.auth.passwordResetTtlSeconds / 60);
+    const result = await sendEmail({
+      to: user.email,
+      template: "password-reset",
+      data: { resetUrl, userName: user.name, brand: resolvedBrand, ttlMinutes },
+      adapterHint: "transactional"
+    });
+    if (result.ok) {
+      getLogger4().info("[forgotPassword] reset email dispatched", { userId: user.id });
+    } else {
+      getLogger4().warn("[forgotPassword] reset email send FAILED", { userId: user.id, reason: result.reason });
+    }
+  };
+  void deliverResetEmail().catch((error) => {
+    getLogger4().error("[forgotPassword] reset email delivery failed", { userId: user.id, error: String(error) });
   });
-  if (result.ok) {
-    getLogger4().info("[forgotPassword] reset email dispatched", { userId: user.id });
-  } else {
-    getLogger4().warn("[forgotPassword] reset email send FAILED", { userId: user.id, reason: result.reason });
-  }
-  return result.ok ? { ok: true } : { ok: false, reason: result.reason };
+  return { ok: true };
 };
 
 // src/emailChange.ts
@@ -1247,6 +1262,14 @@ var consumeEmailChangeToken = async (token) => {
   }
   return parsed;
 };
+var invalidateEmailChangeToken = async (userId) => {
+  const pointerKey = emailChangeUserKey(userId);
+  const priorKey = await redis2.get(pointerKey);
+  if (priorKey) {
+    await redis2.del(priorKey);
+  }
+  await redis2.del(pointerKey);
+};
 
 // src/emailChangeNotification.ts
 import { getProjectConfig as getProjectConfig8 } from "@luckystack/core";
@@ -1770,9 +1793,13 @@ var confirmTotpEnrollment = async (user, code) => {
   }
 };
 var disableTwoFactor = async (user, code) => {
+  if (await isTwoFactorAccountLocked(user.id)) return { ok: false, reason: "login.twoFactorLocked" };
   const viaTotp = await verifyTotpForUser(user, code, false);
   const viaRecovery = viaTotp ? false : await consumeRecoveryCode(user, code);
-  if (!viaTotp && !viaRecovery) return { ok: false, reason: "login.twoFactorInvalidCode" };
+  if (!viaTotp && !viaRecovery) {
+    await recordTwoFactorAccountFailure(user.id);
+    return { ok: false, reason: "login.twoFactorInvalidCode" };
+  }
   const [updateError] = await tryCatch3(() => getUserAdapter().update(user.id, {
     totpSecret: null,
     twoFactorEnabled: false,
@@ -1786,7 +1813,12 @@ var disableTwoFactor = async (user, code) => {
   return { ok: true };
 };
 var regenerateRecoveryCodes = async (user, code) => {
-  if (!await verifyTotpForUser(user, code, false)) return { ok: false, reason: "login.twoFactorInvalidCode" };
+  if (await isTwoFactorAccountLocked(user.id)) return { ok: false, reason: "login.twoFactorLocked" };
+  if (!await verifyTotpForUser(user, code, false)) {
+    await recordTwoFactorAccountFailure(user.id);
+    return { ok: false, reason: "login.twoFactorInvalidCode" };
+  }
+  await clearTwoFactorAccountFailures(user.id);
   const { raw, hashes } = generateRecoveryCodes();
   const [updateError] = await tryCatch3(() => getUserAdapter().update(user.id, { recoveryCodes: hashes }));
   if (updateError) {
@@ -1879,6 +1911,7 @@ registerSessionProvider({
   logout: ({ token, socket, userId, skipSessionDelete }) => logout({ token, socket, userId: userId ?? null, skipSessionDelete })
 });
 registerAuthLockoutHook();
+registerRedactedLogKeys(["recoverycode", "totp", "totpcode"]);
 export {
   OAUTH_STATE_COOKIE_NAME,
   PasswordPolicyError,
@@ -1917,6 +1950,8 @@ export {
   githubProvider,
   googleProvider,
   hotp,
+  invalidateEmailChangeToken,
+  invalidatePasswordResetToken,
   isAccountLocked,
   isFullOAuthProvider,
   isUserAdapterRegistered,