@luckystack/login 0.14.0 → 0.16.0

package/dist/index.js

@@ -14,7 +14,7 @@ import {
   registerOAuthProviderFactory,
   registerOAuthProviders,
   registerUserAdapter
-} from "./chunk-CLYMWF3A.js";
+} from "./chunk-CYGFR56I.js";
 import {
   activeUsersKeyFor,
   deleteSession,
@@ -29,10 +29,10 @@ import {
   revokeUserSessions,
   saveSession,
   sessionKeyFor
-} from "./chunk-6IGNAMXW.js";
+} from "./chunk-MZNCQ26U.js";
 
 // src/index.ts
-import { registerSessionProvider } from "@luckystack/core";
+import { registerRedactedLogKeys, registerSessionProvider } from "@luckystack/core";
 
 // src/authLockout.ts
 import {
@@ -515,6 +515,17 @@ var readStringField = (record, key, fallback = "") => {
   if (typeof value === "boolean") return String(value);
   return fallback;
 };
+var readAccountId = (record, key) => {
+  const value = record[key];
+  if (typeof value === "string" && value !== "") return value;
+  if (typeof value === "number" && Number.isSafeInteger(value)) return String(value);
+  return void 0;
+};
+var compareStoredAccountId = (stored, accountId) => {
+  if (stored === null || stored === void 0 || stored === "") return "unbound";
+  const comparable = typeof stored === "string" || typeof stored === "number" || typeof stored === "bigint";
+  return comparable && String(stored) === accountId ? "match" : "mismatch";
+};
 var generateAvatarFallbackColor = () => `#${Math.floor(Math.random() * 16777215).toString(16).padStart(6, "0")}`;
 var resolveUploadedAvatar = async (userId) => {
   const filePath = path.join(uploadsFolder(), `${userId}.webp`);
@@ -522,7 +533,13 @@ var resolveUploadedAvatar = async (userId) => {
   return avatarStat ? `${userId}.webp` : null;
 };
 var sanitizeUserForSession = (user) => {
-  const { password: _password, totpSecret: _totpSecret, recoveryCodes: _recoveryCodes, ...safeUser } = user;
+  const {
+    password: _password,
+    totpSecret: _totpSecret,
+    recoveryCodes: _recoveryCodes,
+    providerAccountId: _providerAccountId,
+    ...safeUser
+  } = user;
   return safeUser;
 };
 var emitLoginFailed = (payload) => {
@@ -841,6 +858,7 @@ var exchangeOAuthToken = async (provider, code, codeVerifier) => {
   }
   return accessToken;
 };
+var refuseOAuth = (refusal = "oauth.userResolveFailed", userId) => userId === void 0 ? { refusal } : { refusal, userId };
 var fetchOAuthProfile = async (provider, accessToken) => {
   const getUserData = async () => {
     const response2 = await fetch(provider.userInfoURL, {
@@ -863,9 +881,20 @@ var fetchOAuthProfile = async (provider, accessToken) => {
     return null;
   }
   const userData = asRecord(response);
+  let accountId;
+  if (provider.accountIdKey) {
+    accountId = readAccountId(userData, provider.accountIdKey);
+    if (accountId === void 0) {
+      getLogger3().warn("oauth: provider userinfo has no stable account id \u2014 refusing the login", {
+        provider: provider.name,
+        accountIdKey: provider.accountIdKey
+      });
+      return refuseOAuth("oauth.accountIdMissing");
+    }
+  }
   const resolvedName = readStringField(userData, provider.nameKey);
   const name = resolvedName === "" ? "didnt find a name" : resolvedName;
-  const emailValue = userData[provider.emailKey];
+  const emailValue = provider.alwaysUseGetEmail ? void 0 : userData[provider.emailKey];
   let email = typeof emailValue === "string" ? emailValue : void 0;
   let emailVerified = false;
   if (email && provider.emailVerifiedKey) {
@@ -883,13 +912,14 @@ var fetchOAuthProfile = async (provider, accessToken) => {
   const avatarValue = provider.avatarKey ? readStringField(userData, provider.avatarKey) : provider.getAvatar ? await provider.getAvatar({ userData, avatarId: typeof avatarId === "string" ? avatarId : "", accessToken }) : "";
   const avatar = typeof avatarValue === "string" ? avatarValue : "";
   if (!email && provider.getEmail) {
-    const selectedEmail = await provider.getEmail(accessToken);
+    const selected = await provider.getEmail(accessToken, userData);
+    const selectedEmail = typeof selected === "object" ? selected.email : selected;
     if (!selectedEmail) {
       getLogger3().warn("oauth: no email found via provider.getEmail", { provider: provider.name });
       return null;
     }
     email = selectedEmail;
-    emailVerified = true;
+    emailVerified = typeof selected === "object" ? selected.verified : true;
   }
   if (email !== void 0) {
     const normalizedEmail = email.trim().toLowerCase();
@@ -899,23 +929,75 @@ var fetchOAuthProfile = async (provider, accessToken) => {
     }
     email = normalizedEmail;
   }
-  return { email, name, avatar, emailVerified, rawUserData: userData };
+  return { email, name, avatar, emailVerified, accountId, rawUserData: userData };
 };
-var findOrCreateOAuthUser = async (provider, profile) => {
-  const { email, name, avatar, emailVerified } = profile;
-  if (!email) return null;
-  const preLoginResult = await dispatchHook("preLogin", { email, provider: provider.name });
+var warnedMissingAccountIdLookup = false;
+var supportsAccountBinding = (adapter) => {
+  if (typeof adapter.findByProviderAccountId === "function") return true;
+  if (!warnedMissingAccountIdLookup) {
+    warnedMissingAccountIdLookup = true;
+    getLogger3().warn(
+      "[login] the registered UserAdapter does not implement findByProviderAccountId \u2014 OAuth accounts are not bound to the provider id: existing accounts are still matched by verified email only, and an email change at the provider starts a new account. Implement findByProviderAccountId and store providerAccountId to enable binding."
+    );
+  }
+  return false;
+};
+var signInExistingOAuthUser = async (userAdapter, existing) => {
+  const uploadedAvatar = await resolveUploadedAvatar(existing.id);
+  if (uploadedAvatar) {
+    existing.avatar = uploadedAvatar;
+  }
+  const previousLogin = existing.lastLogin ?? null;
+  const nowLogin = /* @__PURE__ */ new Date();
+  await tryCatch2(() => userAdapter.update(existing.id, { lastLogin: nowLogin }));
+  return {
+    user: {
+      ...sanitizeUserForSession(existing),
+      token: "",
+      lastLogin: nowLogin,
+      previousLogin
+    },
+    isNewUser: false
+  };
+};
+var passesOAuthPreLogin = async (provider, providerEmail, existing) => {
+  const storedEmail = typeof existing?.email === "string" && existing.email !== "" ? existing.email : void 0;
+  const preLoginResult = await dispatchHook("preLogin", {
+    email: storedEmail ?? providerEmail,
+    provider: provider.name,
+    ...existing ? { userId: existing.id } : {},
+    providerEmail
+  });
   if (preLoginResult.stopped) {
     getLogger3().warn(`oauth login aborted by preLogin hook`, { errorCode: preLoginResult.signal.errorCode });
-    return null;
+    return false;
   }
+  return true;
+};
+var findOrCreateOAuthUser = async (provider, profile) => {
+  const { email, name, avatar, emailVerified, accountId } = profile;
+  if (!email) return refuseOAuth();
   const userAdapter = getUserAdapter();
+  const bindingId = accountId !== void 0 && supportsAccountBinding(userAdapter) ? accountId : void 0;
+  if (bindingId !== void 0) {
+    const [boundError, boundUser] = await tryCatch2(
+      async () => await userAdapter.findByProviderAccountId?.({ provider: provider.name, providerAccountId: bindingId }) ?? null
+    );
+    if (boundError) {
+      getLogger3().error("oauth: findByProviderAccountId failed", boundError);
+      return refuseOAuth();
+    }
+    if (boundUser?.id) {
+      if (!await passesOAuthPreLogin(provider, email, boundUser)) return refuseOAuth(void 0, boundUser.id);
+      return signInExistingOAuthUser(userAdapter, boundUser);
+    }
+  }
   const [findError, findResponse] = await tryCatch2(
     () => resolveUserByEmail(userAdapter, { email, provider: provider.name })
   );
   if (findError) {
     getLogger3().error("oauth: findByEmail failed", findError);
-    return null;
+    return refuseOAuth();
   }
   if (findResponse?.id) {
     const existingProvider = findResponse.provider ?? null;
@@ -925,40 +1007,56 @@ var findOrCreateOAuthUser = async (provider, profile) => {
         "oauth: refusing to link an unverified provider email to an existing account created by a different provider (account-takeover guard)",
         { provider: provider.name, existingProvider }
       );
-      return null;
+      return refuseOAuth("oauth.emailUnverified", findResponse.id);
     }
-    const uploadedAvatar = await resolveUploadedAvatar(findResponse.id);
-    if (uploadedAvatar) {
-      findResponse.avatar = uploadedAvatar;
+    let bindTo;
+    if (accountId !== void 0 && (!isCrossProviderLink || existingProvider === null)) {
+      const stored = compareStoredAccountId(findResponse.providerAccountId, accountId);
+      if (stored === "mismatch") {
+        getLogger3().warn(
+          "oauth: refusing login \u2014 the account with this email is bound to a different provider account (account-takeover guard)",
+          { provider: provider.name, userId: findResponse.id }
+        );
+        return refuseOAuth("oauth.accountBoundElsewhere", findResponse.id);
+      }
+      if (stored === "unbound" && !isCrossProviderLink) {
+        if (!emailVerified) {
+          getLogger3().warn(
+            "oauth: refusing login \u2014 the account with this email is not bound to a provider id yet and the provider did not verify the email (account-takeover guard)",
+            { provider: provider.name, userId: findResponse.id }
+          );
+          return refuseOAuth("oauth.emailUnverified", findResponse.id);
+        }
+        bindTo = bindingId;
+      }
     }
-    const previousLogin = findResponse.lastLogin ?? null;
-    const nowLogin = /* @__PURE__ */ new Date();
-    await tryCatch2(() => userAdapter.update(findResponse.id, { lastLogin: nowLogin }));
-    return {
-      user: {
-        ...sanitizeUserForSession(findResponse),
-        token: "",
-        lastLogin: nowLogin,
-        previousLogin
-      },
-      isNewUser: false
-    };
+    if (!await passesOAuthPreLogin(provider, email, findResponse)) return refuseOAuth(void 0, findResponse.id);
+    if (bindTo !== void 0) {
+      const providerAccountId = bindTo;
+      const [bindError] = await tryCatch2(() => userAdapter.update(findResponse.id, { providerAccountId }));
+      if (bindError) {
+        getLogger3().error("oauth: binding the account to the provider id failed", bindError);
+        return refuseOAuth(void 0, findResponse.id);
+      }
+    }
+    return signInExistingOAuthUser(userAdapter, findResponse);
   }
+  if (!await passesOAuthPreLogin(provider, email)) return refuseOAuth();
   if (!emailVerified) {
     getLogger3().warn(
       "oauth: refusing first-login account creation for an unverified provider email (account-squatting guard)",
       { provider: provider.name }
     );
-    return null;
+    return refuseOAuth();
   }
   if (!getProjectConfig4().auth.allowRegistration) {
     getLogger3().warn("oauth: registration disabled \u2014 refusing first-login account creation");
-    return null;
+    return refuseOAuth();
   }
   const preRegisterResult = await dispatchHook("preRegister", { email, provider: provider.name, name });
   if (preRegisterResult.stopped) {
     getLogger3().warn(`oauth register aborted by preRegister hook`, { errorCode: preRegisterResult.signal.errorCode });
-    return null;
+    return refuseOAuth();
   }
   const createNewUser = async () => userAdapter.create({
     email,
@@ -966,14 +1064,15 @@ var findOrCreateOAuthUser = async (provider, profile) => {
     name,
     avatar,
     avatarFallback: generateAvatarFallbackColor(),
-    language: getProjectConfig4().defaultLanguage
+    language: getProjectConfig4().defaultLanguage,
+    ...bindingId === void 0 ? {} : { providerAccountId: bindingId }
   });
   const [createError, createResponse] = await tryCatch2(createNewUser);
   if (createError) {
     getLogger3().error("oauth: user create failed", createError);
-    return null;
+    return refuseOAuth();
   }
-  if (!createResponse) return null;
+  if (!createResponse) return refuseOAuth();
   return {
     user: { ...sanitizeUserForSession(createResponse), token: "" },
     isNewUser: true
@@ -1075,9 +1174,19 @@ var loginCallback = async (pathname, req, _res, options = {}) => {
     emitLoginFailed({ provider: providerName, reason: "oauth.profileFetchFailed", stage: "oauth" });
     return false;
   }
+  if ("refusal" in profile) {
+    emitLoginFailed({ provider: providerName, reason: profile.refusal, stage: "oauth" });
+    return false;
+  }
   const resolved = await findOrCreateOAuthUser(provider, profile);
-  if (!resolved) {
-    emitLoginFailed({ provider: providerName, email: profile.email, reason: "oauth.userResolveFailed", stage: "oauth" });
+  if ("refusal" in resolved) {
+    emitLoginFailed({
+      provider: providerName,
+      email: profile.email,
+      ...resolved.userId === void 0 ? {} : { userId: resolved.userId },
+      reason: resolved.refusal,
+      stage: "oauth"
+    });
     return false;
   }
   const newToken = randomBytes(32).toString("hex");
@@ -1137,6 +1246,14 @@ var createPasswordResetToken = async (userId) => {
 var consumePasswordResetToken = async (token) => {
   return consumeOneTimeToken(PWRESET_NAMESPACE, token);
 };
+var invalidatePasswordResetToken = async (userId) => {
+  const pointerKey = pwresetUserKey(userId);
+  const priorKey = await redis.get(pointerKey);
+  if (priorKey) {
+    await redis.del(priorKey);
+  }
+  await redis.del(pointerKey);
+};
 var updatePasswordHash = async (userId, plaintext) => {
   const reason = validatePassword(plaintext);
   if (reason) {
@@ -1196,28 +1313,34 @@ var sendPasswordResetEmail = async ({ email, brand }) => {
     });
     return { ok: true };
   }
-  const token = await createPasswordResetToken(user.id);
-  void dispatchHook2("passwordResetRequested", {
-    email,
-    matched: true,
-    userId: user.id,
-    ttlSeconds: config.auth.passwordResetTtlSeconds
-  });
-  const baseUrl = (config.app.publicUrl || "").replace(/\/+$/, "");
-  const resetUrl = `${baseUrl}/reset-password?token=${encodeURIComponent(token)}`;
-  const ttlMinutes = Math.round(config.auth.passwordResetTtlSeconds / 60);
-  const result = await sendEmail({
-    to: user.email,
-    template: "password-reset",
-    data: { resetUrl, userName: user.name, brand: resolvedBrand, ttlMinutes },
-    adapterHint: "transactional"
+  const deliverResetEmail = async () => {
+    const token = await createPasswordResetToken(user.id);
+    void dispatchHook2("passwordResetRequested", {
+      email,
+      matched: true,
+      userId: user.id,
+      ttlSeconds: config.auth.passwordResetTtlSeconds
+    });
+    const baseUrl = (config.app.publicUrl || "").replace(/\/+$/, "");
+    const resetPath = config.auth.passwordResetPath || "/reset-password";
+    const resetUrl = `${baseUrl}${resetPath}?token=${encodeURIComponent(token)}`;
+    const ttlMinutes = Math.round(config.auth.passwordResetTtlSeconds / 60);
+    const result = await sendEmail({
+      to: user.email,
+      template: "password-reset",
+      data: { resetUrl, userName: user.name, brand: resolvedBrand, ttlMinutes },
+      adapterHint: "transactional"
+    });
+    if (result.ok) {
+      getLogger4().info("[forgotPassword] reset email dispatched", { userId: user.id });
+    } else {
+      getLogger4().warn("[forgotPassword] reset email send FAILED", { userId: user.id, reason: result.reason });
+    }
+  };
+  void deliverResetEmail().catch((error) => {
+    getLogger4().error("[forgotPassword] reset email delivery failed", { userId: user.id, error: String(error) });
   });
-  if (result.ok) {
-    getLogger4().info("[forgotPassword] reset email dispatched", { userId: user.id });
-  } else {
-    getLogger4().warn("[forgotPassword] reset email send FAILED", { userId: user.id, reason: result.reason });
-  }
-  return result.ok ? { ok: true } : { ok: false, reason: result.reason };
+  return { ok: true };
 };
 
 // src/emailChange.ts
@@ -1247,6 +1370,14 @@ var consumeEmailChangeToken = async (token) => {
   }
   return parsed;
 };
+var invalidateEmailChangeToken = async (userId) => {
+  const pointerKey = emailChangeUserKey(userId);
+  const priorKey = await redis2.get(pointerKey);
+  if (priorKey) {
+    await redis2.del(priorKey);
+  }
+  await redis2.del(pointerKey);
+};
 
 // src/emailChangeNotification.ts
 import { getProjectConfig as getProjectConfig8 } from "@luckystack/core";
@@ -1770,9 +1901,13 @@ var confirmTotpEnrollment = async (user, code) => {
   }
 };
 var disableTwoFactor = async (user, code) => {
+  if (await isTwoFactorAccountLocked(user.id)) return { ok: false, reason: "login.twoFactorLocked" };
   const viaTotp = await verifyTotpForUser(user, code, false);
   const viaRecovery = viaTotp ? false : await consumeRecoveryCode(user, code);
-  if (!viaTotp && !viaRecovery) return { ok: false, reason: "login.twoFactorInvalidCode" };
+  if (!viaTotp && !viaRecovery) {
+    await recordTwoFactorAccountFailure(user.id);
+    return { ok: false, reason: "login.twoFactorInvalidCode" };
+  }
   const [updateError] = await tryCatch3(() => getUserAdapter().update(user.id, {
     totpSecret: null,
     twoFactorEnabled: false,
@@ -1786,7 +1921,12 @@ var disableTwoFactor = async (user, code) => {
   return { ok: true };
 };
 var regenerateRecoveryCodes = async (user, code) => {
-  if (!await verifyTotpForUser(user, code, false)) return { ok: false, reason: "login.twoFactorInvalidCode" };
+  if (await isTwoFactorAccountLocked(user.id)) return { ok: false, reason: "login.twoFactorLocked" };
+  if (!await verifyTotpForUser(user, code, false)) {
+    await recordTwoFactorAccountFailure(user.id);
+    return { ok: false, reason: "login.twoFactorInvalidCode" };
+  }
+  await clearTwoFactorAccountFailures(user.id);
   const { raw, hashes } = generateRecoveryCodes();
   const [updateError] = await tryCatch3(() => getUserAdapter().update(user.id, { recoveryCodes: hashes }));
   if (updateError) {
@@ -1879,6 +2019,7 @@ registerSessionProvider({
   logout: ({ token, socket, userId, skipSessionDelete }) => logout({ token, socket, userId: userId ?? null, skipSessionDelete })
 });
 registerAuthLockoutHook();
+registerRedactedLogKeys(["recoverycode", "totp", "totpcode"]);
 export {
   OAUTH_STATE_COOKIE_NAME,
   PasswordPolicyError,
@@ -1917,6 +2058,8 @@ export {
   githubProvider,
   googleProvider,
   hotp,
+  invalidateEmailChangeToken,
+  invalidatePasswordResetToken,
   isAccountLocked,
   isFullOAuthProvider,
   isUserAdapterRegistered,