@madauth/server 0.1.0 → 0.2.0-beta.2

package/dist/{chunk-V2XKGETK.js → chunk-5CKEMC6M.js}

@@ -3,10 +3,12 @@ import {
   generateSigningKey
 } from "./chunk-JDQLSL36.js";
 import {
+  DEV_WEBHOOK_RECEIVER_URL,
+  REQUIRED_EMAIL_TYPES,
   WEBHOOK_TYPES,
   checkWebhookSecret,
   generateWebhookSecret
-} from "./chunk-AVZE6FFR.js";
+} from "./chunk-6EJDVZCD.js";
 
 // src/config.ts
 var envVars = {
@@ -21,9 +23,14 @@ var envVars = {
   WEBHOOK_SECRET: false,
   WEBHOOK_EVENTS: false,
   SESSION_TTL: false,
+  SESSION_RENEWAL_TTL: false,
   COOKIE_DOMAIN: false
 };
+async function resolveEnv(source = process.env) {
+  return typeof source === "function" ? source() : source;
+}
 var DEFAULT_SESSION_TTL = 8 * 60 * 60;
+var DEFAULT_RENEWAL_TTL = 30 * 24 * 60 * 60;
 var DEFAULT_PASSWORD_MIN_LENGTH = 8;
 var ConfigError = class extends Error {
   constructor() {
@@ -79,17 +86,16 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
   if (clientId && !clientId.endsWith(".apps.googleusercontent.com")) {
     throw new ConfigError(`GOOGLE_CLIENT_ID must end with ".apps.googleusercontent.com" but is "${clientId}".`);
   }
-  const webhook = webhookFromEnv(read("WEBHOOK_URL"), read("WEBHOOK_SECRET"), read("WEBHOOK_EVENTS"));
+  const sendsEmails = !!(overrides.store || read("DATABASE_URL"));
+  const webhook = webhookFromEnv(read("WEBHOOK_URL"), read("WEBHOOK_SECRET"), read("WEBHOOK_EVENTS"), sendsEmails);
+  if (sendsEmails && !webhook) {
+    throw new ConfigError(
+      `WEBHOOK_URL is not set. E-mail & password sign-in sends its e-mails through your webhook. For development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered. See "Webhooks" in docs/server.md.`
+    );
+  }
   const store = overrides.store ?? await storeFromDatabaseUrl(read("DATABASE_URL"));
   let password;
-  if (store) {
-    if (!webhook) {
-      throw new ConfigError(
-        'WEBHOOK_URL is not set. E-mail & password sign-in sends its e-mails through your webhook. For development, run the example receiver (npm run dev:webhooks) and set WEBHOOK_URL=http://localhost:8790/webhook. See "Webhooks" in docs/server.md.'
-      );
-    }
-    password = { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")), store };
-  }
+  if (store) password = { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")), store };
   if (!clientId && !password) {
     throw new ConfigError(
       "No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in and/or DATABASE_URL (e.g. sqlite:./madauth.db) for e-mail & password sign-in. See docs/server.md."
@@ -100,11 +106,19 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
   if (!Number.isInteger(sessionTtlSeconds) || sessionTtlSeconds < 60) {
     throw new ConfigError(`SESSION_TTL must be a whole number of seconds (at least 60) but is "${ttlValue}".`);
   }
+  const renewalValue = read("SESSION_RENEWAL_TTL");
+  const renewalTtlSeconds = renewalValue ? Number(renewalValue) : Math.max(DEFAULT_RENEWAL_TTL, sessionTtlSeconds);
+  if (!Number.isInteger(renewalTtlSeconds) || renewalTtlSeconds < sessionTtlSeconds) {
+    throw new ConfigError(
+      `SESSION_RENEWAL_TTL must be a whole number of seconds, not less than SESSION_TTL (${sessionTtlSeconds}), but is "${renewalValue}".`
+    );
+  }
   return {
     issuer,
     signingKey,
     allowedOrigins,
     sessionTtlSeconds,
+    renewalTtlSeconds,
     cookieDomain: read("COOKIE_DOMAIN"),
     google: clientId ? { clientId, clientSecret: read("GOOGLE_CLIENT_SECRET") } : void 0,
     password,
@@ -112,9 +126,12 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
   };
 }
 async function loadUserStoreConfig(env) {
+  return { store: await loadStore(env), minLength: passwordMinLength(readEnv(env, "PASSWORD_MIN_LENGTH")) };
+}
+async function loadStore(env) {
   const store = await storeFromDatabaseUrl(readEnv(env, "DATABASE_URL"));
   if (!store) throw new ConfigError("Set DATABASE_URL to manage users.");
-  return { store, minLength: passwordMinLength(readEnv(env, "PASSWORD_MIN_LENGTH")) };
+  return store;
 }
 function passwordMinLength(value) {
   const minLength = value ? Number(value) : DEFAULT_PASSWORD_MIN_LENGTH;
@@ -125,9 +142,10 @@ function passwordMinLength(value) {
 }
 async function storeFromDatabaseUrl(url) {
   if (!url) return void 0;
+  if (url.startsWith("dynamodb:")) return dynamoDbStore(url.slice("dynamodb:".length));
   if (!url.startsWith("sqlite:")) {
     throw new ConfigError(
-      `DATABASE_URL must start with "sqlite:" (e.g. sqlite:/data/madauth.db) but is "${url}". For other databases, pass your own store adapter (see "Custom store adapter" in docs/server.md).`
+      `DATABASE_URL must start with "sqlite:" (e.g. sqlite:/data/madauth.db) or "dynamodb:" (e.g. dynamodb:madauth) but is "${url}". For other databases, pass your own store adapter (see "Custom store adapter" in docs/server.md).`
     );
   }
   const path = url.slice("sqlite:".length);
@@ -139,8 +157,25 @@ async function storeFromDatabaseUrl(url) {
     throw new ConfigError(`DATABASE_URL: could not open "${path}": ${e.message}`);
   }
 }
+async function dynamoDbStore(tableName) {
+  if (!tableName) throw new ConfigError("DATABASE_URL needs a table name, e.g. dynamodb:madauth");
+  if (!/^[\w.-]{3,255}$/.test(tableName)) {
+    throw new ConfigError(
+      `DATABASE_URL=dynamodb: needs a DynamoDB table name (3 to 255 letters, digits, _ . -) but has "${tableName}"`
+    );
+  }
+  try {
+    await import("@aws-sdk/client-dynamodb");
+  } catch (e) {
+    throw new ConfigError(
+      `DATABASE_URL=dynamodb: needs the AWS SDK. Install it next to madAuth: npm install @aws-sdk/client-dynamodb (${e.message})`
+    );
+  }
+  const { createDynamoDbAdapter } = await import("./dynamodb.js");
+  return createDynamoDbAdapter({ tableName });
+}
 var LOCAL_HOSTS = ["localhost", "127.0.0.1", "[::1]", "host.docker.internal"];
-function webhookFromEnv(url, secret, events) {
+function webhookFromEnv(url, secret, events, sendsEmails) {
   if (!url) {
     if (secret || events) throw new ConfigError("WEBHOOK_SECRET and WEBHOOK_EVENTS need WEBHOOK_URL.");
     return void 0;
@@ -166,13 +201,29 @@ WEBHOOK_SECRET=${generateWebhookSecret()}
   if (problem) {
     throw new ConfigError(`WEBHOOK_SECRET ${problem}. Generate one with: npx @madauth/server generate-webhook-secret`);
   }
-  let selected = null;
-  if (events) {
-    selected = new Set(events.split(",").map((e) => e.trim()).filter(Boolean));
-    const unknown = [...selected].filter((e) => !WEBHOOK_TYPES.includes(e));
-    if (unknown.length) {
-      throw new ConfigError(`WEBHOOK_EVENTS: unknown type ${unknown.join(", ")}. Known types: ${WEBHOOK_TYPES.join(", ")}.`);
-    }
+  const selected = new Set((events ?? "").split(",").map((e) => e.trim()).filter(Boolean));
+  const allTypes = `All types: ${WEBHOOK_TYPES.join(", ")}. See "Webhooks" in docs/server.md.`;
+  if (!selected.size) {
+    throw new ConfigError(
+      "WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. " + (sendsEmails ? `E-mail & password sign-in needs ${REQUIRED_EMAIL_TYPES.join(" and ")}. For a receiver that sends the e-mails:
+
+WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered
+
+` : "For example:\n\nWEBHOOK_EVENTS=user.signed_in\n\n") + allTypes
+    );
+  }
+  const unknown = [...selected].filter((e) => !WEBHOOK_TYPES.includes(e));
+  if (unknown.length) {
+    throw new ConfigError(`WEBHOOK_EVENTS: unknown type ${unknown.join(", ")}. Known types: ${WEBHOOK_TYPES.join(", ")}.`);
+  }
+  const missing = sendsEmails ? REQUIRED_EMAIL_TYPES.filter((type) => !selected.has(type)) : [];
+  if (missing.length) {
+    throw new ConfigError(
+      `WEBHOOK_EVENTS lacks ${missing.join(" and ")}. E-mail & password sign-in can't work without these e-mails, so your webhook receiver must send them:
+
+WEBHOOK_EVENTS=${[...selected, ...missing].join(",")}
+`
+    );
   }
   return { url: parsed.href, secret, events: selected };
 }
@@ -252,9 +303,49 @@ function safeEqual(a, b) {
   return x.length === y.length && timingSafeEqual(x, y);
 }
 
+// src/roles.ts
+var ADMIN_ROLE = "admin";
+var MAX_ROLES = 20;
+var ROLE_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
+function parseRoles(input) {
+  if (!Array.isArray(input)) return null;
+  if (!input.every((role) => typeof role === "string" && ROLE_NAME.test(role))) return null;
+  const roles = [...new Set(input)].sort();
+  return roles.length <= MAX_ROLES ? roles : null;
+}
+function sameRoles(a, b) {
+  return a.length === b.length && a.every((role, i) => role === b[i]);
+}
+var Roles = class {
+  constructor(store) {
+    this.store = store;
+  }
+  /** The address's roles, sorted; empty if it has none. */
+  async get(emailNormalized) {
+    const record = await this.store.findOne("role", { id: emailNormalized });
+    return typeof record?.roles === "string" && record.roles ? record.roles.split(" ").filter(Boolean) : [];
+  }
+  /** Replaces the address's roles. `updatedBy` is the address of the admin, or null for the command line. */
+  async set(emailNormalized, roles, updatedBy) {
+    if (!roles.length) {
+      await this.remove(emailNormalized);
+      return;
+    }
+    const data = { roles: roles.join(" "), updatedAt: Date.now(), updatedBy };
+    if (await this.store.update("role", { id: emailNormalized }, data) === 1) return;
+    if (!await this.store.create("role", { id: emailNormalized, ...data })) {
+      await this.store.update("role", { id: emailNormalized }, data);
+    }
+  }
+  async remove(emailNormalized) {
+    await this.store.delete("role", { id: emailNormalized });
+  }
+};
+
 // src/users.ts
 import { randomBytes as randomBytes2 } from "crypto";
 var MAX_CODE_ATTEMPTS = 5;
+var MAX_WRONG_CODES = 10;
 var newId = (prefix) => `${prefix}_${randomBytes2(16).toString("base64url")}`;
 function passwordAccountKey(userId) {
   return `password:${userId}`;
@@ -289,6 +380,7 @@ var Users = class {
       name: data.name,
       sessionVersion: 0,
       lastMailAt: 0,
+      wrongCodes: 0,
       createdAt: now
     };
     if (!await this.store.create("user", user)) return null;
@@ -307,6 +399,22 @@ var Users = class {
     }
     return user;
   }
+  /**
+   * Deletes the user with this e-mail address and everything stored for them. Resolves to the deleted
+   * user's ID, or null if there is no such user (any more).
+   */
+  async deleteByEmail(emailNormalized) {
+    const user = await this.findByEmail(emailNormalized);
+    if (!user) return null;
+    if (await this.store.delete("user", { id: user.id }) !== 1) return null;
+    try {
+      await this.store.delete("account", { userId: user.id });
+      await this.store.delete("verification", { userId: user.id });
+    } catch (e) {
+      console.error(`[madauth] Deleted user ${user.id}, but not all of their records: ${e.message}`);
+    }
+    return user.id;
+  }
   async updateUser(id, patch) {
     await this.store.update("user", { id }, patch);
   }
@@ -350,17 +458,38 @@ var Users = class {
     const record = await this.store.findOne("verification", { id, purpose });
     return record ? this.consume(record) : null;
   }
-  /** Uses up the user's verification if `code` matches. Too many wrong codes delete it. */
-  async consumeCode(userId, purpose, code) {
-    const record = await this.store.findOne("verification", { userId, purpose });
-    if (!record) return null;
+  /**
+   * Uses up the user's verification if `code` matches. Too many wrong codes delete it, and after
+   * MAX_WRONG_CODES wrong codes in a row the user's codes stop working until an e-mail link is used.
+   */
+  async consumeCode(user, purpose, code) {
+    if ((user.wrongCodes ?? 0) >= MAX_WRONG_CODES) return { userId: null, locked: true };
+    const record = await this.store.findOne("verification", { userId: user.id, purpose });
+    if (!record) return { userId: null, locked: false };
     const attempts = record.attempts + 1;
-    if (await this.store.update("verification", { id: record.id, attempts: record.attempts }, { attempts }) !== 1) return null;
+    if (await this.store.update("verification", { id: record.id, attempts: record.attempts }, { attempts }) !== 1) {
+      return { userId: null, locked: false };
+    }
+    const wrongCodes = await this.countWrongCode(user);
+    if (wrongCodes === null) return { userId: null, locked: false };
+    if (wrongCodes > MAX_WRONG_CODES) return { userId: null, locked: true };
     if (!safeEqual(hashCode(this.key, code), record.codeHash)) {
       if (attempts >= MAX_CODE_ATTEMPTS) await this.store.delete("verification", { id: record.id });
-      return null;
+      return { userId: null, locked: wrongCodes >= MAX_WRONG_CODES };
+    }
+    return { userId: await this.consume(record), locked: false };
+  }
+  /** Counts a code for the user and resolves to the new count; null if other requests kept changing it. */
+  async countWrongCode(user) {
+    let current = user;
+    for (let attempt = 0; attempt < 3 && current; attempt++) {
+      const wrongCodes = (current.wrongCodes ?? 0) + 1;
+      if (await this.store.update("user", { id: user.id, wrongCodes: current.wrongCodes ?? null }, { wrongCodes }) === 1) {
+        return wrongCodes;
+      }
+      current = await this.findById(user.id);
     }
-    return this.consume(record);
+    return null;
   }
   async consume(record) {
     const deleted = await this.store.delete("verification", { id: record.id });
@@ -378,9 +507,15 @@ export {
   normalizeEmail,
   isValidEmail,
   deriveCodeKey,
+  ADMIN_ROLE,
+  parseRoles,
+  sameRoles,
+  Roles,
   Users,
   envVars,
+  resolveEnv,
   ConfigError,
   loadConfig,
-  loadUserStoreConfig
+  loadUserStoreConfig,
+  loadStore
 };

package/dist/{chunk-AVZE6FFR.js → chunk-6EJDVZCD.js}

@@ -8,10 +8,13 @@ var WEBHOOK_TYPES = [
   "user.created",
   "email.verified",
   "password.reset",
-  "user.signed_in"
+  "user.signed_in",
+  "user.deleted",
+  "roles.changed"
 ];
-var isEmailType = (type) => type.startsWith("email.") && type !== "email.verified";
+var REQUIRED_EMAIL_TYPES = ["email.verify", "email.reset"];
 var SECRET_PREFIX = "whsec_";
+var DEV_WEBHOOK_RECEIVER_URL = "https://github.com/inouiw/madAuth-webhooks/tree/main/dev-receiver";
 var WEBHOOK_TOLERANCE_SECONDS = 5 * 60;
 function generateWebhookSecret() {
   return `${SECRET_PREFIX}${randomBytes(32).toString("base64")}`;
@@ -50,7 +53,7 @@ function verifyWebhook(secret, headers, body, options = {}) {
   });
 }
 function createWebhookClient(settings, fetchImpl = fetch) {
-  const wants = (type) => isEmailType(type) || !settings.events || settings.events.has(type);
+  const wants = (type) => settings.events.has(type);
   return {
     wants,
     async call(type, data, timeoutMs) {
@@ -90,6 +93,8 @@ function createWebhookClient(settings, fetchImpl = fetch) {
 
 export {
   WEBHOOK_TYPES,
+  REQUIRED_EMAIL_TYPES,
+  DEV_WEBHOOK_RECEIVER_URL,
   WEBHOOK_TOLERANCE_SECONDS,
   generateWebhookSecret,
   checkWebhookSecret,

package/dist/{chunk-PRRKLEW7.js → chunk-7CTAB3QV.js}

@@ -5,6 +5,9 @@ import {
 // src/user.ts
 var SESSION_COOKIE = "madauth_session";
 var SESSION_TYP = "madauth-session+jwt";
+var RENEWAL_COOKIE = "madauth_renewal";
+var RENEWAL_TYP = "madauth-renewal+jwt";
+var EXPIRY_COOKIE = "madauth_session_expires";
 
 // src/tokens.ts
 import { SignJWT, base64url, jwtVerify } from "jose";
@@ -31,24 +34,42 @@ function signSession(keys, issuer, ttlSeconds, user, amr, extra = {}) {
     email_verified: user.email ? true : void 0,
     name: user.name,
     picture: user.picture,
+    roles: user.roles?.length ? user.roles : void 0,
     amr
   };
   return signToken(keys, issuer, SESSION_TYP, claims, ttlSeconds);
 }
+function signRenewal(keys, issuer, ttlSeconds, user, amr, extra = {}) {
+  const claims = {
+    ...extra,
+    sub: user.id,
+    email: user.email,
+    email_verified: user.email ? true : void 0,
+    name: user.name,
+    picture: user.picture,
+    amr
+  };
+  return signToken(keys, issuer, RENEWAL_TYP, claims, ttlSeconds);
+}
 function userFromClaims(claims) {
   const user = { id: claims.sub };
   if (claims.email) user.email = claims.email;
   if (claims.name) user.name = claims.name;
   if (claims.picture) user.picture = claims.picture;
+  if (Array.isArray(claims.roles) && claims.roles.length) user.roles = claims.roles;
   return user;
 }
 
 export {
   SESSION_COOKIE,
   SESSION_TYP,
+  RENEWAL_COOKIE,
+  RENEWAL_TYP,
+  EXPIRY_COOKIE,
   randomString,
   signToken,
   readToken,
   signSession,
+  signRenewal,
   userFromClaims
 };

package/dist/{chunk-3WIWWKRI.js → chunk-CNL562LZ.js}

@@ -1,44 +1,6 @@
-// src/store/schema.ts
-var madauthSchema = {
-  version: 1,
-  models: {
-    user: {
-      fields: {
-        id: { type: "string", primaryKey: true },
-        email: { type: "string" },
-        emailNormalized: { type: "string", unique: true },
-        emailVerified: { type: "boolean" },
-        name: { type: "string", nullable: true },
-        sessionVersion: { type: "number" },
-        lastMailAt: { type: "number" },
-        createdAt: { type: "number" }
-      }
-    },
-    /** How a user signs in. `key` is e.g. `password:<userId>`; later `google:<sub>` or `totp:<userId>`. */
-    account: {
-      fields: {
-        id: { type: "string", primaryKey: true },
-        userId: { type: "string", index: true },
-        key: { type: "string", unique: true },
-        secret: { type: "string", nullable: true },
-        failedAttempts: { type: "number" },
-        lockedUntil: { type: "number" },
-        createdAt: { type: "number" }
-      }
-    },
-    /** A pending e-mail verification or password reset. `id` is the SHA-256 of the link token. */
-    verification: {
-      fields: {
-        id: { type: "string", primaryKey: true },
-        userId: { type: "string", index: true },
-        purpose: { type: "string" },
-        codeHash: { type: "string" },
-        attempts: { type: "number" },
-        expiresAt: { type: "number" }
-      }
-    }
-  }
-};
+import {
+  madauthSchema
+} from "./chunk-XNBWZZHT.js";
 
 // src/store/sql.ts
 function tableName(model) {
@@ -53,6 +15,19 @@ var columnTypes = {
   postgres: { string: "TEXT", number: "DOUBLE PRECISION", boolean: "BOOLEAN" },
   mysql: { string: "TEXT", number: "DOUBLE", boolean: "BOOLEAN" }
 };
+var upgrades = [
+  {
+    version: 2,
+    sql: (dialect) => `ALTER TABLE ${tableName("user")} ADD COLUMN ${columnName("wrongCodes")} ${columnTypes[dialect].number} NOT NULL DEFAULT 0;`
+  },
+  {
+    version: 3,
+    sql: (dialect) => createTablesSql(dialect, { version: 3, models: { role: madauthSchema.models.role } })
+  }
+];
+function upgradeTablesSql(dialect, fromVersion) {
+  return upgrades.filter((step) => step.version > fromVersion).map((step) => step.sql(dialect)).join("\n");
+}
 function createTablesSql(dialect, schema = madauthSchema) {
   const statements = [];
   for (const [model, { fields }] of Object.entries(schema.models)) {
@@ -74,8 +49,8 @@ ${columns.join(",\n")}
 }
 
 export {
-  madauthSchema,
   tableName,
   columnName,
+  upgradeTablesSql,
   createTablesSql
 };

package/dist/chunk-XNBWZZHT.js

@@ -0,0 +1,60 @@
+// src/store/schema.ts
+var madauthSchema = {
+  version: 3,
+  models: {
+    user: {
+      fields: {
+        id: { type: "string", primaryKey: true },
+        email: { type: "string" },
+        emailNormalized: { type: "string", unique: true },
+        emailVerified: { type: "boolean" },
+        name: { type: "string", nullable: true },
+        sessionVersion: { type: "number" },
+        lastMailAt: { type: "number" },
+        /** Wrong e-mail codes in a row, counted across e-mails (since version 2). */
+        wrongCodes: { type: "number" },
+        createdAt: { type: "number" }
+      }
+    },
+    /** How a user signs in. `key` is e.g. `password:<userId>`; later `google:<sub>` or `totp:<userId>`. */
+    account: {
+      fields: {
+        id: { type: "string", primaryKey: true },
+        userId: { type: "string", index: true },
+        key: { type: "string", unique: true },
+        secret: { type: "string", nullable: true },
+        failedAttempts: { type: "number" },
+        lockedUntil: { type: "number" },
+        createdAt: { type: "number" }
+      }
+    },
+    /** A pending e-mail verification or password reset. `id` is the SHA-256 of the link token. */
+    verification: {
+      fields: {
+        id: { type: "string", primaryKey: true },
+        userId: { type: "string", index: true },
+        purpose: { type: "string" },
+        codeHash: { type: "string" },
+        attempts: { type: "number" },
+        expiresAt: { type: "number" }
+      }
+    },
+    /**
+     * The roles of an e-mail address (since version 3). `id` is the normalized address, so the roles
+     * apply whichever way its owner signs in. `roles` holds the names separated by spaces.
+     */
+    role: {
+      fields: {
+        id: { type: "string", primaryKey: true },
+        roles: { type: "string" },
+        updatedAt: { type: "number" },
+        /** The address of the admin who set them; empty when set from the command line. */
+        updatedBy: { type: "string", nullable: true }
+      }
+    }
+  }
+};
+
+export {
+  madauthSchema
+};