@madauth/server 0.3.0-beta.2 → 0.5.0-beta.1

package/dist/{chunk-56MOVFO4.js → chunk-O2URPWA6.js}

@@ -1,10 +1,10 @@
 import {
   madauthSchema
-} from "./chunk-CD7Y4T66.js";
+} from "./chunk-NP75Y3IV.js";
 
 // src/store/sql.ts
 function tableName(model) {
-  return `madauth_${model}`;
+  return `madauth_${columnName(model)}`;
 }
 function columnName(field) {
   return field.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
@@ -15,6 +15,10 @@ var columnTypes = {
   postgres: { string: "TEXT", number: "DOUBLE PRECISION", boolean: "BOOLEAN" },
   mysql: { string: "TEXT", number: "DOUBLE", boolean: "BOOLEAN" }
 };
+function columnType(dialect, def) {
+  const keyed = def.primaryKey || def.unique || def.index;
+  return dialect === "mysql" && def.type === "string" && keyed ? "VARCHAR(255)" : columnTypes[dialect][def.type];
+}
 var upgrades = [
   {
     version: 2,
@@ -45,6 +49,36 @@ var upgrades = [
       `DROP TABLE ${tableName("role")};`,
       createTablesSql(dialect, { version: 4, models: { setting: madauthSchema.models.setting } })
     ].join("\n")
+  },
+  {
+    // The authenticator app: which code was used last, and the recovery codes.
+    version: 5,
+    sql: (dialect) => [
+      `ALTER TABLE ${tableName("account")} ADD COLUMN ${columnName("lastUsedStep")} ${columnTypes[dialect].number} NOT NULL DEFAULT 0;`,
+      `ALTER TABLE ${tableName("account")} ADD COLUMN ${columnName("setupId")} ${columnTypes[dialect].string};`,
+      createTablesSql(dialect, { version: 5, models: { recoveryCode: madauthSchema.models.recoveryCode } })
+    ].join("\n")
+  },
+  {
+    // SMS codes as a second factor: the phone number of an sms account, and when the last SMS went to a user.
+    version: 6,
+    sql: (dialect) => [
+      `ALTER TABLE ${tableName("account")} ADD COLUMN ${columnName("phone")} ${columnTypes[dialect].string};`,
+      `ALTER TABLE ${tableName("user")} ADD COLUMN ${columnName("lastSmsAt")} ${columnTypes[dialect].number};`
+    ].join("\n")
+  },
+  {
+    // One primary sign-in method per user, which accounts are second factors, and when a user's sign-up was
+    // complete. Older records stay empty: madAuth tells them apart by the account's key, and counts their
+    // sign-up as complete.
+    version: 7,
+    sql: (dialect) => [
+      `ALTER TABLE ${tableName("user")} ADD COLUMN ${columnName("signedUpAt")} ${columnTypes[dialect].number};`,
+      // SQLite can't add a UNIQUE column, so the constraint is an index.
+      `ALTER TABLE ${tableName("account")} ADD COLUMN ${columnName("primaryUserId")} ${columnType(dialect, madauthSchema.models.account.fields.primaryUserId)};`,
+      `CREATE UNIQUE INDEX ${tableName("account")}_${columnName("primaryUserId")} ON ${tableName("account")} (${columnName("primaryUserId")});`,
+      `ALTER TABLE ${tableName("account")} ADD COLUMN ${columnName("secondFactor")} ${columnType(dialect, madauthSchema.models.account.fields.secondFactor)};`
+    ].join("\n")
   }
 ];
 function upgradeTablesSql(dialect, fromVersion) {
@@ -55,8 +89,7 @@ function createTablesSql(dialect, schema = madauthSchema) {
   for (const [model, { fields }] of Object.entries(schema.models)) {
     const table = tableName(model);
     const columns = Object.entries(fields).map(([field, def]) => {
-      const keyed = def.primaryKey || def.unique || def.index;
-      const type = dialect === "mysql" && def.type === "string" && keyed ? "VARCHAR(255)" : columnTypes[dialect][def.type];
+      const type = columnType(dialect, def);
       const constraints = def.primaryKey ? " PRIMARY KEY" : `${def.nullable ? "" : " NOT NULL"}${def.unique ? " UNIQUE" : ""}`;
       return `  ${columnName(field)} ${type}${constraints}`;
     });

package/dist/{chunk-3QRKWLR7.js → chunk-SISM7YUZ.js}

@@ -1,24 +1,29 @@
 // src/webhooks.ts
 import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "crypto";
 var WEBHOOK_TYPES = [
-  "email.verify",
-  "email.reset",
-  "email.already_registered",
-  "email.no_password",
-  "signup.before",
-  "user.created",
-  "email.verified",
-  "email.password_reset",
+  "email.send_verification",
+  "email.send_password_reset",
+  "email.send_signin_link",
+  "email.send_already_registered",
+  "email.send_password_reset_no_password",
+  "sms.send_code",
+  "user.signing_up",
+  "user.signed_up",
+  "user.email_verified",
+  "user.password_reset",
   "user.signed_in",
   "user.deleted",
-  "user.claims_changed"
+  "user.claims_changed",
+  "user.second_factor_enabled",
+  "user.second_factor_disabled",
+  "user.recovery_code_used"
 ];
 var WEBHOOK_TIMEOUT_MS = 1e4;
 var MAX_LOCALE_LENGTH = 35;
 function localeOf(value) {
   return typeof value === "string" && value.length <= MAX_LOCALE_LENGTH ? value : void 0;
 }
-var REQUIRED_EMAIL_TYPES = ["email.verify", "email.reset"];
+var REQUIRED_EMAIL_TYPES = ["email.send_verification", "email.send_password_reset"];
 var SECRET_PREFIX = "whsec_";
 var DEV_WEBHOOK_RECEIVER_URL = "https://github.com/inouiw/madAuth-webhooks/tree/main/dev-receiver";
 var WEBHOOK_TOLERANCE_SECONDS = 5 * 60;

package/dist/{config-Dg2fZuWR.d.ts → config-CcGlHVAN.d.ts}

@@ -1,6 +1,6 @@
 import { JWK, JWTVerifyGetKey } from 'jose';
-import { S as StoreAdapter } from './schema-3yhCc2jH.js';
-import { W as WebhookSettings } from './webhook-j5u9Kv9l.js';
+import { S as StoreAdapter } from './schema-BTgDj1Xn.js';
+import { W as WebhookSettings } from './webhook-DlmfG_kS.js';
 
 interface MadauthConfig {
     /** Public base URL of the server (MADAUTH_ISSUER). */
@@ -15,6 +15,8 @@ interface MadauthConfig {
     renewalTtlSeconds: number;
     /** Cookie domain, e.g. `.example.com` (COOKIE_DOMAIN). */
     cookieDomain?: string;
+    /** The name authenticator apps show next to the account (TOTP_ISSUER). Default: the host of the app that asked for the setup. */
+    totpIssuer?: string;
     /** Google sign-in; off when GOOGLE_CLIENT_ID is not set. */
     google?: {
         /** OAuth web client ID (GOOGLE_CLIENT_ID). */
@@ -22,13 +24,20 @@ interface MadauthConfig {
         /** Enables the server-side code flow (GOOGLE_CLIENT_SECRET). */
         clientSecret?: string;
     };
+    /** GitHub sign-in; off when GITHUB_CLIENT_ID is not set. GitHub only has the redirect flow, so the secret is needed too. */
+    github?: {
+        /** The client ID of the OAuth App (GITHUB_CLIENT_ID). */
+        clientId: string;
+        /** Its client secret (GITHUB_CLIENT_SECRET). */
+        clientSecret: string;
+    };
     /** Where the users, their accounts, claims and the settings are kept (DATABASE_URL or the `store` option). */
     store: StoreAdapter;
-    /** E-mail & password sign-in; off unless the webhook sends the e-mails (`email.verify` and `email.reset`). */
-    password?: {
-        /** PASSWORD_MIN_LENGTH. */
-        minLength: number;
-    };
+    /**
+     * E-mail & password sign-in; off unless the webhook sends the e-mails (`email.send_verification` and `email.send_password_reset`).
+     * Its rules for new passwords are a setting, see `Settings.passwordRules`.
+     */
+    password?: Record<string, never>;
     /** Where madAuth sends e-mails, sign-up checks and events (WEBHOOK_URL). */
     webhook?: WebhookSettings;
     /** Test hook: resolves Google's signing keys. Defaults to Google's published JWKS. */
@@ -43,8 +52,10 @@ declare const envVars: {
     readonly ALLOWED_ORIGINS: true;
     readonly GOOGLE_CLIENT_ID: false;
     readonly GOOGLE_CLIENT_SECRET: false;
+    readonly GITHUB_CLIENT_ID: false;
+    readonly GITHUB_CLIENT_SECRET: false;
     readonly DATABASE_URL: true;
-    readonly PASSWORD_MIN_LENGTH: false;
+    readonly TOTP_ISSUER: false;
     readonly WEBHOOK_URL: false;
     readonly WEBHOOK_SECRET: false;
     readonly WEBHOOK_EVENTS: false;

package/dist/dynamodb.js

@@ -1,6 +1,6 @@
 import {
   madauthSchema
-} from "./chunk-CD7Y4T66.js";
+} from "./chunk-NP75Y3IV.js";
 
 // src/store/dynamodb.ts
 var SORT_KEY = "#";

package/dist/entry/azure.d.ts

@@ -1,7 +1,7 @@
-import { E as EntryOptions } from '../config-Dg2fZuWR.js';
+import { E as EntryOptions } from '../config-CcGlHVAN.js';
 import 'jose';
-import '../schema-3yhCc2jH.js';
-import '../webhook-j5u9Kv9l.js';
+import '../schema-BTgDj1Xn.js';
+import '../webhook-DlmfG_kS.js';
 
 /**
  * Registers madAuth as an Azure Functions v4 HTTP function that handles every route. Pass `store` to use your

package/dist/entry/azure.js

@@ -1,13 +1,13 @@
 import {
   createApp
-} from "../chunk-DVVBIFIV.js";
-import "../chunk-DCDTO5LG.js";
+} from "../chunk-7DHKDRGY.js";
+import "../chunk-A7UYZRBL.js";
 import {
   loadConfig,
   resolveEnv
-} from "../chunk-TI35AZ2U.js";
+} from "../chunk-NYIEFI4B.js";
 import "../chunk-JDQLSL36.js";
-import "../chunk-3QRKWLR7.js";
+import "../chunk-SISM7YUZ.js";
 
 // src/entry/azure.ts
 import { app } from "@azure/functions";

package/dist/entry/lambda.d.ts

@@ -1,8 +1,8 @@
 import { LambdaEvent, LambdaContext, handle } from 'hono/aws-lambda';
-import { E as EntryOptions } from '../config-Dg2fZuWR.js';
+import { E as EntryOptions } from '../config-CcGlHVAN.js';
 import 'jose';
-import '../schema-3yhCc2jH.js';
-import '../webhook-j5u9Kv9l.js';
+import '../schema-BTgDj1Xn.js';
+import '../webhook-DlmfG_kS.js';
 
 type LambdaHandler = (event: LambdaEvent, context: LambdaContext) => ReturnType<ReturnType<typeof handle>>;
 /**

package/dist/entry/lambda.js

@@ -1,13 +1,13 @@
 import {
   createApp
-} from "../chunk-DVVBIFIV.js";
-import "../chunk-DCDTO5LG.js";
+} from "../chunk-7DHKDRGY.js";
+import "../chunk-A7UYZRBL.js";
 import {
   loadConfig,
   resolveEnv
-} from "../chunk-TI35AZ2U.js";
+} from "../chunk-NYIEFI4B.js";
 import "../chunk-JDQLSL36.js";
-import "../chunk-3QRKWLR7.js";
+import "../chunk-SISM7YUZ.js";
 
 // src/entry/lambda.ts
 import { handle } from "hono/aws-lambda";

package/dist/entry/node.d.ts

@@ -1,7 +1,7 @@
-import { E as EntryOptions } from '../config-Dg2fZuWR.js';
+import { E as EntryOptions } from '../config-CcGlHVAN.js';
 import 'jose';
-import '../schema-3yhCc2jH.js';
-import '../webhook-j5u9Kv9l.js';
+import '../schema-BTgDj1Xn.js';
+import '../webhook-DlmfG_kS.js';
 
 type StartOptions = EntryOptions;
 /**

package/dist/entry/node.js

@@ -1,13 +1,13 @@
 import {
   createApp
-} from "../chunk-DVVBIFIV.js";
-import "../chunk-DCDTO5LG.js";
+} from "../chunk-7DHKDRGY.js";
+import "../chunk-A7UYZRBL.js";
 import {
   loadConfig,
   resolveEnv
-} from "../chunk-TI35AZ2U.js";
+} from "../chunk-NYIEFI4B.js";
 import "../chunk-JDQLSL36.js";
-import "../chunk-3QRKWLR7.js";
+import "../chunk-SISM7YUZ.js";
 
 // src/entry/node.ts
 import { serve } from "@hono/node-server";

package/dist/index.d.ts

@@ -1,22 +1,44 @@
 import { Hono } from 'hono';
-import { M as MadauthConfig } from './config-Dg2fZuWR.js';
-export { C as ConfigError, a as ConfigOverrides, E as EntryOptions, e as envVars, l as loadConfig } from './config-Dg2fZuWR.js';
+import { M as MadauthConfig } from './config-CcGlHVAN.js';
+export { C as ConfigError, a as ConfigOverrides, E as EntryOptions, e as envVars, l as loadConfig } from './config-CcGlHVAN.js';
 import { JWK } from 'jose';
-import { a as Schema } from './schema-3yhCc2jH.js';
-export { F as FieldDef, b as FieldType, R as Row, S as StoreAdapter, V as Value, W as Where, m as madauthSchema } from './schema-3yhCc2jH.js';
-export { M as MadauthUser } from './user-BMWEWREH.js';
-import './webhook-j5u9Kv9l.js';
+import { a as Schema } from './schema-BTgDj1Xn.js';
+export { F as FieldDef, b as FieldType, R as Row, S as StoreAdapter, V as Value, W as Where, m as madauthSchema } from './schema-BTgDj1Xn.js';
+export { M as MadauthUser } from './user-yoGjrw4k.js';
+import './webhook-DlmfG_kS.js';
+
+/**
+ * The primary sign-in methods madAuth has: Google, GitHub, e-mail & password, the authenticator app on its
+ * own (`totp`: the e-mail address and a code from the app), and the passwordless e-mail link (`email-link`:
+ * the address, then the link or the code from an e-mail).
+ */
+declare const SIGN_IN_METHODS: readonly ["google", "github", "password", "totp", "email-link"];
+type SignInMethod = (typeof SIGN_IN_METHODS)[number];
+/**
+ * Every key of the methods setting: the primary methods, and `sms`, which signs nobody in by itself: SMS
+ * codes as a second factor of the methods whose policy asks for one, next to the authenticator app.
+ */
+declare const METHODS: readonly ["google", "github", "password", "totp", "email-link", "sms"];
+type MethodId = (typeof METHODS)[number];
+/** The methods that can ask for a second factor (a code from the authenticator app) after they succeeded. */
+declare const METHODS_WITH_SECOND_FACTOR: readonly ["google", "github", "password", "email-link"];
+/**
+ * Whether a method asks for the authenticator app as a second factor: never, when the user has set one up
+ * (`optional`), or always, so that a user without one sets it up at the next sign-in (`required`).
+ */
+declare const SECOND_FACTOR_POLICIES: readonly ["none", "optional", "required"];
+type SecondFactorPolicy = (typeof SECOND_FACTOR_POLICIES)[number];
+/** The settings of a method that is on. `secondFactor` is for the METHODS_WITH_SECOND_FACTOR; it defaults to `none`. */
+interface MethodSetting {
+    secondFactor?: SecondFactorPolicy;
+}
+/** The sign-in methods that are on, each with its settings. A method that is not listed is off. */
+type MethodSettings = Partial<Record<MethodId, MethodSetting>>;
 
 /** Creates a new private ES256 JWK for MADAUTH_SIGNING_KEY. */
 declare function generateSigningKey(): Promise<JWK>;
 
-/** The sign-in methods madAuth has. */
-declare const SIGN_IN_METHODS: readonly ["google", "password"];
-type SignInMethod = (typeof SIGN_IN_METHODS)[number];
-/** Which sign-in methods are on. A method that is not mentioned is on. */
-type MethodSettings = Partial<Record<SignInMethod, boolean>>;
-
-/** Hash parameter that carries a sign-in error back to the app after the code flow. */
+/** Hash parameter that carries a sign-in error back to the app after the redirect flow. */
 declare const REDIRECT_ERROR_PARAM = "madauth_error";
 
 /**
@@ -25,7 +47,7 @@ declare const REDIRECT_ERROR_PARAM = "madauth_error";
  */
 declare function createApp(config: MadauthConfig): Hono;
 
-/** The SQL table that holds a model, e.g. `madauth_user`. */
+/** The SQL table that holds a model, e.g. `madauth_user`, or `madauth_recovery_code` for `recoveryCode`. */
 declare function tableName(model: string): string;
 /** The SQL column that holds a field, e.g. `email_normalized` for `emailNormalized`. */
 declare function columnName(field: string): string;
@@ -55,4 +77,4 @@ declare function parseRoles(input: unknown): string[] | null;
  */
 declare function parseClaims(input: unknown): Claims | null;
 
-export { ADMIN_ROLE, type Claims, MadauthConfig, type MethodSettings, REDIRECT_ERROR_PARAM, SIGN_IN_METHODS, Schema, type SignInMethod, type SqlDialect, columnName, createApp, createTablesSql, generateSigningKey, parseClaims, parseRoles, tableName, upgradeTablesSql };
+export { ADMIN_ROLE, type Claims, METHODS, METHODS_WITH_SECOND_FACTOR, MadauthConfig, type MethodId, type MethodSetting, type MethodSettings, REDIRECT_ERROR_PARAM, SECOND_FACTOR_POLICIES, SIGN_IN_METHODS, Schema, type SecondFactorPolicy, type SignInMethod, type SqlDialect, columnName, createApp, createTablesSql, generateSigningKey, parseClaims, parseRoles, tableName, upgradeTablesSql };

package/dist/index.js

@@ -3,32 +3,38 @@ import {
   createTablesSql,
   tableName,
   upgradeTablesSql
-} from "./chunk-56MOVFO4.js";
+} from "./chunk-O2URPWA6.js";
 import {
   madauthSchema
-} from "./chunk-CD7Y4T66.js";
+} from "./chunk-NP75Y3IV.js";
 import {
   REDIRECT_ERROR_PARAM,
   createApp
-} from "./chunk-DVVBIFIV.js";
-import "./chunk-DCDTO5LG.js";
+} from "./chunk-7DHKDRGY.js";
+import "./chunk-A7UYZRBL.js";
 import {
   ADMIN_ROLE,
   ConfigError,
+  METHODS,
+  METHODS_WITH_SECOND_FACTOR,
+  SECOND_FACTOR_POLICIES,
   SIGN_IN_METHODS,
   envVars,
   loadConfig,
   parseClaims,
   parseRoles
-} from "./chunk-TI35AZ2U.js";
+} from "./chunk-NYIEFI4B.js";
 import {
   generateSigningKey
 } from "./chunk-JDQLSL36.js";
-import "./chunk-3QRKWLR7.js";
+import "./chunk-SISM7YUZ.js";
 export {
   ADMIN_ROLE,
   ConfigError,
+  METHODS,
+  METHODS_WITH_SECOND_FACTOR,
   REDIRECT_ERROR_PARAM,
+  SECOND_FACTOR_POLICIES,
   SIGN_IN_METHODS,
   columnName,
   createApp,

package/dist/{schema-3yhCc2jH.d.ts → schema-BTgDj1Xn.d.ts}

@@ -43,7 +43,7 @@ interface Schema {
 }
 /** The records madAuth stores. Timestamps are milliseconds since 1970. */
 declare const madauthSchema: {
-    readonly version: 4;
+    readonly version: 7;
     readonly models: {
         /** Someone who signed in, whichever way: the e-mail address is the identity shared by the sign-in methods. */
         readonly user: {
@@ -69,9 +69,15 @@ declare const madauthSchema: {
                 readonly sessionVersion: {
                     readonly type: "number";
                 };
+                /** When the last e-mail was sent to the user: at most one per minute. */
                 readonly lastMailAt: {
                     readonly type: "number";
                 };
+                /** When the last SMS was sent to the user: at most one per minute, counted apart from the e-mails (since version 6). */
+                readonly lastSmsAt: {
+                    readonly type: "number";
+                    readonly nullable: true;
+                };
                 /** Wrong e-mail codes in a row, counted across e-mails (since version 2). */
                 readonly wrongCodes: {
                     readonly type: "number";
@@ -81,12 +87,25 @@ declare const madauthSchema: {
                     readonly type: "string";
                     readonly nullable: true;
                 };
+                /**
+                 * When the user's first session started: the sign-up was complete, with every second factor the
+                 * policy asked for. 0 until then. Empty in records from before version 7, whose sign-up counts as
+                 * complete (since version 7).
+                 */
+                readonly signedUpAt: {
+                    readonly type: "number";
+                    readonly nullable: true;
+                };
                 readonly createdAt: {
                     readonly type: "number";
                 };
             };
         };
-        /** How a user signs in. `key` is `password:<userId>` or `google:<sub>`; later e.g. `totp:<userId>`. */
+        /**
+         * How a user signs in. `key` is `password:<userId>`, `google:<sub>`, `totp:<userId>` (the authenticator
+         * app, whose `secret` is encrypted), `email-link:<userId>` or `sms:<userId>` (the phone that gets the
+         * codes of the second factor).
+         */
         readonly account: {
             readonly fields: {
                 readonly id: {
@@ -116,12 +135,69 @@ declare const madauthSchema: {
                     readonly type: "string";
                     readonly nullable: true;
                 };
+                /** The time step of the last authenticator code that was accepted, so a code works once; 0 before (since version 5). */
+                readonly lastUsedStep: {
+                    readonly type: "number";
+                };
+                /**
+                 * The setup an authenticator secret came from; its recovery codes carry the same id, so the app and
+                 * its codes always belong together. Empty for other accounts (since version 5).
+                 */
+                readonly setupId: {
+                    readonly type: "string";
+                    readonly nullable: true;
+                };
+                /** The phone number of an `sms:` account, in E.164 form (`+41791234567`). Empty for other accounts (since version 6). */
+                readonly phone: {
+                    readonly type: "string";
+                    readonly nullable: true;
+                };
+                /**
+                 * The user's id when the account is how they sign in (their one primary method), empty for a second
+                 * factor. Unique, so a user has one primary method at most (since version 7; empty in older records).
+                 */
+                readonly primaryUserId: {
+                    readonly type: "string";
+                    readonly nullable: true;
+                    readonly unique: true;
+                };
+                /**
+                 * Whether the account is a second factor (an authenticator app that is a step of the user's sign-in
+                 * method, or a phone for SMS codes) rather than a sign-in method. Empty in records from before version 7,
+                 * which madAuth tells apart by their key (since version 7).
+                 */
+                readonly secondFactor: {
+                    readonly type: "boolean";
+                    readonly nullable: true;
+                };
+                readonly createdAt: {
+                    readonly type: "number";
+                };
+            };
+        };
+        /**
+         * A recovery code of a user's authenticator app (since version 5). `id` is the code's keyed hash; the
+         * record goes when the code is used. It works only while the account's `setupId` is its own.
+         */
+        readonly recoveryCode: {
+            readonly fields: {
+                readonly id: {
+                    readonly type: "string";
+                    readonly primaryKey: true;
+                };
+                readonly userId: {
+                    readonly type: "string";
+                    readonly index: true;
+                };
+                readonly setupId: {
+                    readonly type: "string";
+                };
                 readonly createdAt: {
                     readonly type: "number";
                 };
             };
         };
-        /** A pending e-mail verification or password reset. `id` is the SHA-256 of the link token. */
+        /** A pending e-mail verification, password reset, sign-in link or SMS code. `id` is the SHA-256 of the link token. */
         readonly verification: {
             readonly fields: {
                 readonly id: {

package/dist/sqlite.js

@@ -3,10 +3,10 @@ import {
   createTablesSql,
   tableName,
   upgradeTablesSql
-} from "./chunk-56MOVFO4.js";
+} from "./chunk-O2URPWA6.js";
 import {
   madauthSchema
-} from "./chunk-CD7Y4T66.js";
+} from "./chunk-NP75Y3IV.js";
 
 // src/store/sqlite.ts
 function createSqliteAdapter(path) {