@luckystack/login 0.15.0 → 0.16.0

package/dist/index.js

@@ -14,7 +14,7 @@ import {
   registerOAuthProviderFactory,
   registerOAuthProviders,
   registerUserAdapter
-} from "./chunk-ML3OQ6R4.js";
+} from "./chunk-CYGFR56I.js";
 import {
   activeUsersKeyFor,
   deleteSession,
@@ -29,7 +29,7 @@ import {
   revokeUserSessions,
   saveSession,
   sessionKeyFor
-} from "./chunk-S7TST3X6.js";
+} from "./chunk-MZNCQ26U.js";
 
 // src/index.ts
 import { registerRedactedLogKeys, registerSessionProvider } from "@luckystack/core";
@@ -515,6 +515,17 @@ var readStringField = (record, key, fallback = "") => {
   if (typeof value === "boolean") return String(value);
   return fallback;
 };
+var readAccountId = (record, key) => {
+  const value = record[key];
+  if (typeof value === "string" && value !== "") return value;
+  if (typeof value === "number" && Number.isSafeInteger(value)) return String(value);
+  return void 0;
+};
+var compareStoredAccountId = (stored, accountId) => {
+  if (stored === null || stored === void 0 || stored === "") return "unbound";
+  const comparable = typeof stored === "string" || typeof stored === "number" || typeof stored === "bigint";
+  return comparable && String(stored) === accountId ? "match" : "mismatch";
+};
 var generateAvatarFallbackColor = () => `#${Math.floor(Math.random() * 16777215).toString(16).padStart(6, "0")}`;
 var resolveUploadedAvatar = async (userId) => {
   const filePath = path.join(uploadsFolder(), `${userId}.webp`);
@@ -522,7 +533,13 @@ var resolveUploadedAvatar = async (userId) => {
   return avatarStat ? `${userId}.webp` : null;
 };
 var sanitizeUserForSession = (user) => {
-  const { password: _password, totpSecret: _totpSecret, recoveryCodes: _recoveryCodes, ...safeUser } = user;
+  const {
+    password: _password,
+    totpSecret: _totpSecret,
+    recoveryCodes: _recoveryCodes,
+    providerAccountId: _providerAccountId,
+    ...safeUser
+  } = user;
   return safeUser;
 };
 var emitLoginFailed = (payload) => {
@@ -841,6 +858,7 @@ var exchangeOAuthToken = async (provider, code, codeVerifier) => {
   }
   return accessToken;
 };
+var refuseOAuth = (refusal = "oauth.userResolveFailed", userId) => userId === void 0 ? { refusal } : { refusal, userId };
 var fetchOAuthProfile = async (provider, accessToken) => {
   const getUserData = async () => {
     const response2 = await fetch(provider.userInfoURL, {
@@ -863,6 +881,17 @@ var fetchOAuthProfile = async (provider, accessToken) => {
     return null;
   }
   const userData = asRecord(response);
+  let accountId;
+  if (provider.accountIdKey) {
+    accountId = readAccountId(userData, provider.accountIdKey);
+    if (accountId === void 0) {
+      getLogger3().warn("oauth: provider userinfo has no stable account id \u2014 refusing the login", {
+        provider: provider.name,
+        accountIdKey: provider.accountIdKey
+      });
+      return refuseOAuth("oauth.accountIdMissing");
+    }
+  }
   const resolvedName = readStringField(userData, provider.nameKey);
   const name = resolvedName === "" ? "didnt find a name" : resolvedName;
   const emailValue = provider.alwaysUseGetEmail ? void 0 : userData[provider.emailKey];
@@ -900,23 +929,75 @@ var fetchOAuthProfile = async (provider, accessToken) => {
     }
     email = normalizedEmail;
   }
-  return { email, name, avatar, emailVerified, rawUserData: userData };
+  return { email, name, avatar, emailVerified, accountId, rawUserData: userData };
 };
-var findOrCreateOAuthUser = async (provider, profile) => {
-  const { email, name, avatar, emailVerified } = profile;
-  if (!email) return null;
-  const preLoginResult = await dispatchHook("preLogin", { email, provider: provider.name });
+var warnedMissingAccountIdLookup = false;
+var supportsAccountBinding = (adapter) => {
+  if (typeof adapter.findByProviderAccountId === "function") return true;
+  if (!warnedMissingAccountIdLookup) {
+    warnedMissingAccountIdLookup = true;
+    getLogger3().warn(
+      "[login] the registered UserAdapter does not implement findByProviderAccountId \u2014 OAuth accounts are not bound to the provider id: existing accounts are still matched by verified email only, and an email change at the provider starts a new account. Implement findByProviderAccountId and store providerAccountId to enable binding."
+    );
+  }
+  return false;
+};
+var signInExistingOAuthUser = async (userAdapter, existing) => {
+  const uploadedAvatar = await resolveUploadedAvatar(existing.id);
+  if (uploadedAvatar) {
+    existing.avatar = uploadedAvatar;
+  }
+  const previousLogin = existing.lastLogin ?? null;
+  const nowLogin = /* @__PURE__ */ new Date();
+  await tryCatch2(() => userAdapter.update(existing.id, { lastLogin: nowLogin }));
+  return {
+    user: {
+      ...sanitizeUserForSession(existing),
+      token: "",
+      lastLogin: nowLogin,
+      previousLogin
+    },
+    isNewUser: false
+  };
+};
+var passesOAuthPreLogin = async (provider, providerEmail, existing) => {
+  const storedEmail = typeof existing?.email === "string" && existing.email !== "" ? existing.email : void 0;
+  const preLoginResult = await dispatchHook("preLogin", {
+    email: storedEmail ?? providerEmail,
+    provider: provider.name,
+    ...existing ? { userId: existing.id } : {},
+    providerEmail
+  });
   if (preLoginResult.stopped) {
     getLogger3().warn(`oauth login aborted by preLogin hook`, { errorCode: preLoginResult.signal.errorCode });
-    return null;
+    return false;
   }
+  return true;
+};
+var findOrCreateOAuthUser = async (provider, profile) => {
+  const { email, name, avatar, emailVerified, accountId } = profile;
+  if (!email) return refuseOAuth();
   const userAdapter = getUserAdapter();
+  const bindingId = accountId !== void 0 && supportsAccountBinding(userAdapter) ? accountId : void 0;
+  if (bindingId !== void 0) {
+    const [boundError, boundUser] = await tryCatch2(
+      async () => await userAdapter.findByProviderAccountId?.({ provider: provider.name, providerAccountId: bindingId }) ?? null
+    );
+    if (boundError) {
+      getLogger3().error("oauth: findByProviderAccountId failed", boundError);
+      return refuseOAuth();
+    }
+    if (boundUser?.id) {
+      if (!await passesOAuthPreLogin(provider, email, boundUser)) return refuseOAuth(void 0, boundUser.id);
+      return signInExistingOAuthUser(userAdapter, boundUser);
+    }
+  }
   const [findError, findResponse] = await tryCatch2(
     () => resolveUserByEmail(userAdapter, { email, provider: provider.name })
   );
   if (findError) {
     getLogger3().error("oauth: findByEmail failed", findError);
-    return null;
+    return refuseOAuth();
   }
   if (findResponse?.id) {
     const existingProvider = findResponse.provider ?? null;
@@ -926,40 +1007,56 @@ var findOrCreateOAuthUser = async (provider, profile) => {
         "oauth: refusing to link an unverified provider email to an existing account created by a different provider (account-takeover guard)",
         { provider: provider.name, existingProvider }
       );
-      return null;
+      return refuseOAuth("oauth.emailUnverified", findResponse.id);
+    }
+    let bindTo;
+    if (accountId !== void 0 && (!isCrossProviderLink || existingProvider === null)) {
+      const stored = compareStoredAccountId(findResponse.providerAccountId, accountId);
+      if (stored === "mismatch") {
+        getLogger3().warn(
+          "oauth: refusing login \u2014 the account with this email is bound to a different provider account (account-takeover guard)",
+          { provider: provider.name, userId: findResponse.id }
+        );
+        return refuseOAuth("oauth.accountBoundElsewhere", findResponse.id);
+      }
+      if (stored === "unbound" && !isCrossProviderLink) {
+        if (!emailVerified) {
+          getLogger3().warn(
+            "oauth: refusing login \u2014 the account with this email is not bound to a provider id yet and the provider did not verify the email (account-takeover guard)",
+            { provider: provider.name, userId: findResponse.id }
+          );
+          return refuseOAuth("oauth.emailUnverified", findResponse.id);
+        }
+        bindTo = bindingId;
+      }
     }
-    const uploadedAvatar = await resolveUploadedAvatar(findResponse.id);
-    if (uploadedAvatar) {
-      findResponse.avatar = uploadedAvatar;
+    if (!await passesOAuthPreLogin(provider, email, findResponse)) return refuseOAuth(void 0, findResponse.id);
+    if (bindTo !== void 0) {
+      const providerAccountId = bindTo;
+      const [bindError] = await tryCatch2(() => userAdapter.update(findResponse.id, { providerAccountId }));
+      if (bindError) {
+        getLogger3().error("oauth: binding the account to the provider id failed", bindError);
+        return refuseOAuth(void 0, findResponse.id);
+      }
     }
-    const previousLogin = findResponse.lastLogin ?? null;
-    const nowLogin = /* @__PURE__ */ new Date();
-    await tryCatch2(() => userAdapter.update(findResponse.id, { lastLogin: nowLogin }));
-    return {
-      user: {
-        ...sanitizeUserForSession(findResponse),
-        token: "",
-        lastLogin: nowLogin,
-        previousLogin
-      },
-      isNewUser: false
-    };
+    return signInExistingOAuthUser(userAdapter, findResponse);
   }
+  if (!await passesOAuthPreLogin(provider, email)) return refuseOAuth();
   if (!emailVerified) {
     getLogger3().warn(
       "oauth: refusing first-login account creation for an unverified provider email (account-squatting guard)",
       { provider: provider.name }
     );
-    return null;
+    return refuseOAuth();
   }
   if (!getProjectConfig4().auth.allowRegistration) {
     getLogger3().warn("oauth: registration disabled \u2014 refusing first-login account creation");
-    return null;
+    return refuseOAuth();
   }
   const preRegisterResult = await dispatchHook("preRegister", { email, provider: provider.name, name });
   if (preRegisterResult.stopped) {
     getLogger3().warn(`oauth register aborted by preRegister hook`, { errorCode: preRegisterResult.signal.errorCode });
-    return null;
+    return refuseOAuth();
   }
   const createNewUser = async () => userAdapter.create({
     email,
@@ -967,14 +1064,15 @@ var findOrCreateOAuthUser = async (provider, profile) => {
     name,
     avatar,
     avatarFallback: generateAvatarFallbackColor(),
-    language: getProjectConfig4().defaultLanguage
+    language: getProjectConfig4().defaultLanguage,
+    ...bindingId === void 0 ? {} : { providerAccountId: bindingId }
   });
   const [createError, createResponse] = await tryCatch2(createNewUser);
   if (createError) {
     getLogger3().error("oauth: user create failed", createError);
-    return null;
+    return refuseOAuth();
   }
-  if (!createResponse) return null;
+  if (!createResponse) return refuseOAuth();
   return {
     user: { ...sanitizeUserForSession(createResponse), token: "" },
     isNewUser: true
@@ -1076,9 +1174,19 @@ var loginCallback = async (pathname, req, _res, options = {}) => {
     emitLoginFailed({ provider: providerName, reason: "oauth.profileFetchFailed", stage: "oauth" });
     return false;
   }
+  if ("refusal" in profile) {
+    emitLoginFailed({ provider: providerName, reason: profile.refusal, stage: "oauth" });
+    return false;
+  }
   const resolved = await findOrCreateOAuthUser(provider, profile);
-  if (!resolved) {
-    emitLoginFailed({ provider: providerName, email: profile.email, reason: "oauth.userResolveFailed", stage: "oauth" });
+  if ("refusal" in resolved) {
+    emitLoginFailed({
+      provider: providerName,
+      email: profile.email,
+      ...resolved.userId === void 0 ? {} : { userId: resolved.userId },
+      reason: resolved.refusal,
+      stage: "oauth"
+    });
     return false;
   }
   const newToken = randomBytes(32).toString("hex");