@madauth/server 0.4.0-beta.1 → 0.5.0-beta.1

package/dist/{chunk-GA4TF7EI.js → chunk-NP75Y3IV.js}

@@ -1,6 +1,6 @@
 // src/store/schema.ts
 var madauthSchema = {
-  version: 5,
+  version: 7,
   models: {
     /** Someone who signed in, whichever way: the e-mail address is the identity shared by the sign-in methods. */
     user: {
@@ -11,17 +11,27 @@ var madauthSchema = {
         emailVerified: { type: "boolean" },
         name: { type: "string", nullable: true },
         sessionVersion: { type: "number" },
+        /** When the last e-mail was sent to the user: at most one per minute. */
         lastMailAt: { type: "number" },
+        /** When the last SMS was sent to the user: at most one per minute, counted apart from the e-mails (since version 6). */
+        lastSmsAt: { type: "number", nullable: true },
         /** Wrong e-mail codes in a row, counted across e-mails (since version 2). */
         wrongCodes: { type: "number" },
         /** What admins attached to the user, as JSON, e.g. `{"roles":["admin"]}` (since version 4). */
         claims: { type: "string", nullable: true },
+        /**
+         * When the user's first session started: the sign-up was complete, with every second factor the
+         * policy asked for. 0 until then. Empty in records from before version 7, whose sign-up counts as
+         * complete (since version 7).
+         */
+        signedUpAt: { type: "number", nullable: true },
         createdAt: { type: "number" }
       }
     },
     /**
-     * How a user signs in. `key` is `password:<userId>`, `google:<sub>` or `totp:<userId>` (the authenticator
-     * app, whose `secret` is encrypted).
+     * How a user signs in. `key` is `password:<userId>`, `google:<sub>`, `totp:<userId>` (the authenticator
+     * app, whose `secret` is encrypted), `email-link:<userId>` or `sms:<userId>` (the phone that gets the
+     * codes of the second factor).
      */
     account: {
       fields: {
@@ -40,6 +50,19 @@ var madauthSchema = {
          * its codes always belong together. Empty for other accounts (since version 5).
          */
         setupId: { type: "string", nullable: true },
+        /** The phone number of an `sms:` account, in E.164 form (`+41791234567`). Empty for other accounts (since version 6). */
+        phone: { type: "string", nullable: true },
+        /**
+         * The user's id when the account is how they sign in (their one primary method), empty for a second
+         * factor. Unique, so a user has one primary method at most (since version 7; empty in older records).
+         */
+        primaryUserId: { type: "string", nullable: true, unique: true },
+        /**
+         * Whether the account is a second factor (an authenticator app that is a step of the user's sign-in
+         * method, or a phone for SMS codes) rather than a sign-in method. Empty in records from before version 7,
+         * which madAuth tells apart by their key (since version 7).
+         */
+        secondFactor: { type: "boolean", nullable: true },
         createdAt: { type: "number" }
       }
     },
@@ -55,7 +78,7 @@ var madauthSchema = {
         createdAt: { type: "number" }
       }
     },
-    /** A pending e-mail verification or password reset. `id` is the SHA-256 of the link token. */
+    /** A pending e-mail verification, password reset, sign-in link or SMS code. `id` is the SHA-256 of the link token. */
     verification: {
       fields: {
         id: { type: "string", primaryKey: true },

package/dist/{chunk-ISJGOCF3.js → chunk-NYIEFI4B.js}

@@ -8,7 +8,7 @@ import {
   WEBHOOK_TYPES,
   checkWebhookSecret,
   generateWebhookSecret
-} from "./chunk-Y7ZSUROX.js";
+} from "./chunk-SISM7YUZ.js";
 
 // src/claims.ts
 var ADMIN_ROLE = "admin";
@@ -69,10 +69,23 @@ function isAdmin(user) {
 
 // src/config.ts
 function sendsVerificationEmails(config) {
-  return !!config.webhook?.events.has("email.verify");
+  return !!config.webhook?.events.has("email.send_verification");
+}
+function sendsSignInEmails(config) {
+  return !!config.webhook?.events.has("email.send_signin_link");
+}
+function sendsSms(config) {
+  return !!config.webhook?.events.has("sms.send_code");
 }
 function methodConfig(config) {
-  return { google: config.google, password: config.password, emailVerification: sendsVerificationEmails(config) };
+  return {
+    google: config.google,
+    github: config.github,
+    password: config.password,
+    emailVerification: sendsVerificationEmails(config),
+    emailLink: sendsSignInEmails(config),
+    sms: sendsSms(config)
+  };
 }
 var envVars = {
   MADAUTH_ISSUER: true,
@@ -80,8 +93,9 @@ var envVars = {
   ALLOWED_ORIGINS: true,
   GOOGLE_CLIENT_ID: false,
   GOOGLE_CLIENT_SECRET: false,
+  GITHUB_CLIENT_ID: false,
+  GITHUB_CLIENT_SECRET: false,
   DATABASE_URL: true,
-  PASSWORD_MIN_LENGTH: false,
   TOTP_ISSUER: false,
   WEBHOOK_URL: false,
   WEBHOOK_SECRET: false,
@@ -95,7 +109,6 @@ async function resolveEnv(source = process.env) {
 }
 var DEFAULT_SESSION_TTL = 8 * 60 * 60;
 var DEFAULT_RENEWAL_TTL = 30 * 24 * 60 * 60;
-var DEFAULT_PASSWORD_MIN_LENGTH = 8;
 var ConfigError = class extends Error {
   constructor() {
     super(...arguments);
@@ -124,6 +137,11 @@ async function loadConfig(env, overrides = {}) {
     if (!value) throw new ConfigError(`${name} is not set. See docs/server.md.`);
     return value;
   };
+  if (env.PASSWORD_MIN_LENGTH?.trim()) {
+    throw new ConfigError(
+      `PASSWORD_MIN_LENGTH was removed: the password rules are a setting now (default: at least 8 characters). Remove the variable and set the rules with \`npx @madauth/server set-password-rules min-length=${env.PASSWORD_MIN_LENGTH.trim()}\` or Madauth.admin.setSettings. See docs/upgrading.md.`
+    );
+  }
   const issuerValue = require2("MADAUTH_ISSUER");
   parseOrigin("MADAUTH_ISSUER", issuerValue);
   const issuer = issuerValue.replace(/\/+$/, "");
@@ -150,13 +168,21 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
   if (clientId && !clientId.endsWith(".apps.googleusercontent.com")) {
     throw new ConfigError(`GOOGLE_CLIENT_ID must end with ".apps.googleusercontent.com" but is "${clientId}".`);
   }
+  const githubClientId = read("GITHUB_CLIENT_ID");
+  const githubClientSecret = read("GITHUB_CLIENT_SECRET");
+  if (githubClientId && !githubClientSecret) {
+    throw new ConfigError(
+      "GITHUB_CLIENT_ID needs GITHUB_CLIENT_SECRET: GitHub only has the redirect flow, in which the server exchanges the code. Set both from your OAuth App at https://github.com/settings/developers."
+    );
+  }
   const webhook = webhookFromEnv(read("WEBHOOK_URL"), read("WEBHOOK_SECRET"), read("WEBHOOK_EVENTS"));
   const sendsEmails = !!webhook && REQUIRED_EMAIL_TYPES.every((type) => webhook.events.has(type));
-  const password = sendsEmails ? { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")) } : void 0;
-  const emailVerification = !!webhook && webhook.events.has("email.verify");
-  if (!clientId && !password && !emailVerification) {
+  const password = sendsEmails ? {} : void 0;
+  const emailVerification = !!webhook && webhook.events.has("email.send_verification");
+  const emailLink = !!webhook && webhook.events.has("email.send_signin_link");
+  if (!clientId && !githubClientId && !password && !emailVerification && !emailLink) {
     throw new ConfigError(
-      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, and/or a webhook that sends the e-mails: e-mail & password sign-in needs email.verify and email.reset, sign-up with the authenticator app needs email.verify. For development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered,email.no_password. See docs/server.md.`
+      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET for GitHub sign-in, and/or a webhook that sends the e-mails: e-mail & password sign-in needs email.send_verification and email.send_password_reset, the passwordless e-mail link needs email.send_signin_link, sign-up with the authenticator app needs email.send_verification. For development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.send_signin_link,email.send_already_registered,email.send_password_reset_no_password. See docs/server.md.`
     );
   }
   const store = overrides.store ?? await storeFromDatabaseUrl(read("DATABASE_URL"));
@@ -186,26 +212,17 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
     cookieDomain: read("COOKIE_DOMAIN"),
     totpIssuer: read("TOTP_ISSUER"),
     google: clientId ? { clientId, clientSecret: read("GOOGLE_CLIENT_SECRET") } : void 0,
+    github: githubClientId && githubClientSecret ? { clientId: githubClientId, clientSecret: githubClientSecret } : void 0,
     store,
     password,
     webhook
   };
 }
-async function loadUserStoreConfig(env) {
-  return { store: await loadStore(env), minLength: passwordMinLength(readEnv(env, "PASSWORD_MIN_LENGTH")) };
-}
 async function loadStore(env) {
   const store = await storeFromDatabaseUrl(readEnv(env, "DATABASE_URL"));
   if (!store) throw new ConfigError("Set DATABASE_URL to manage users.");
   return store;
 }
-function passwordMinLength(value) {
-  const minLength = value ? Number(value) : DEFAULT_PASSWORD_MIN_LENGTH;
-  if (!Number.isInteger(minLength) || minLength < 1 || minLength > 128) {
-    throw new ConfigError(`PASSWORD_MIN_LENGTH must be a whole number from 1 to 128 but is "${value}".`);
-  }
-  return minLength;
-}
 async function storeFromDatabaseUrl(url) {
   if (!url) return void 0;
   if (url.startsWith("dynamodb:")) return dynamoDbStore(url.slice("dynamodb:".length));
@@ -240,7 +257,27 @@ async function dynamoDbStore(tableName) {
   const { createDynamoDbAdapter } = await import("./dynamodb.js");
   return createDynamoDbAdapter({ tableName });
 }
-var RENAMED_TYPES = { "password.reset": "email.password_reset", "roles.changed": "user.claims_changed" };
+var RENAMED_TYPES = {
+  "password.reset": "user.password_reset",
+  "roles.changed": "user.claims_changed",
+  "email.verify": "email.send_verification",
+  "email.reset": "email.send_password_reset",
+  "email.signin": "email.send_signin_link",
+  "email.already_registered": "email.send_already_registered",
+  "email.no_password": "email.send_password_reset_no_password",
+  "sms.code": "sms.send_code",
+  "signup.before": "user.signing_up",
+  "email.verified": "user.email_verified",
+  "email.password_reset": "user.password_reset",
+  "totp.enabled": 'user.second_factor_enabled (with method "totp")',
+  "totp.disabled": 'user.second_factor_disabled (with method "totp")',
+  "sms.enabled": 'user.second_factor_enabled (with method "sms")',
+  "sms.disabled": 'user.second_factor_disabled (with method "sms")',
+  "totp.recovery_code_used": "user.recovery_code_used"
+};
+var REMOVED_TYPES = {
+  "user.created": "user.created is gone: user.signed_up tells when a user can sign in (an unconfirmed sign-up is no user yet)"
+};
 var LOCAL_HOSTS = ["localhost", "127.0.0.1", "[::1]", "host.docker.internal"];
 function webhookFromEnv(url, secret, events) {
   if (!url) {
@@ -272,11 +309,11 @@ WEBHOOK_SECRET=${generateWebhookSecret()}
   const allTypes = `All types: ${WEBHOOK_TYPES.join(", ")}. See "Webhooks" in docs/server.md.`;
   if (!selected.size) {
     throw new ConfigError(
-      `WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. E-mail & password sign-in is on when they include ${REQUIRED_EMAIL_TYPES.join(" and ")}. For a receiver that sends the e-mails:
+      `WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. E-mail & password sign-in is on when they include ${REQUIRED_EMAIL_TYPES.join(" and ")}, the passwordless e-mail link when they include email.send_signin_link. For a receiver that sends the e-mails:
 
-WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered,email.no_password
+WEBHOOK_EVENTS=email.send_verification,email.send_password_reset,email.send_signin_link,email.send_already_registered,email.send_password_reset_no_password
 
-For one that only wants to know who signed in:
+SMS codes as a second factor need a receiver that sends the SMS: add sms.send_code,user.second_factor_enabled,user.second_factor_disabled. For one that only wants to know who signed in:
 
 WEBHOOK_EVENTS=user.signed_in
 
@@ -285,7 +322,7 @@ WEBHOOK_EVENTS=user.signed_in
   }
   const unknown = [...selected].filter((e) => !WEBHOOK_TYPES.includes(e));
   if (unknown.length) {
-    const renamed = unknown.filter((e) => e in RENAMED_TYPES).map((e) => `${e} is now ${RENAMED_TYPES[e]}`);
+    const renamed = unknown.flatMap((e) => e in RENAMED_TYPES ? [`${e} is now ${RENAMED_TYPES[e]}`] : e in REMOVED_TYPES ? [REMOVED_TYPES[e]] : []);
     throw new ConfigError(
       `WEBHOOK_EVENTS: unknown type ${unknown.join(", ")}. ${renamed.length ? `${renamed.join("; ")}. ` : ""}Known types: ${WEBHOOK_TYPES.join(", ")}.`
     );
@@ -294,17 +331,31 @@ WEBHOOK_EVENTS=user.signed_in
 }
 
 // src/settings.ts
-var SIGN_IN_METHODS = ["google", "password", "totp"];
-var METHODS_WITH_SECOND_FACTOR = ["google", "password"];
+var SIGN_IN_METHODS = ["google", "github", "password", "totp", "email-link"];
+var METHODS = [...SIGN_IN_METHODS, "sms"];
+var METHODS_WITH_SECOND_FACTOR = ["google", "github", "password", "email-link"];
 var SECOND_FACTOR_POLICIES = ["none", "optional", "required"];
 var METHODS_SETTING = "methods";
-var isSignInMethod = (value) => SIGN_IN_METHODS.includes(value);
+var PASSWORD_SETTING = "password";
+var DEFAULT_PASSWORD_RULES = { minLength: 8, minScore: 2 };
+var MAX_MIN_LENGTH = 128;
+var isPasswordScore = (value) => Number.isInteger(value) && value >= 0 && value <= 4;
+function parsePasswordRules(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
+  const { minLength = DEFAULT_PASSWORD_RULES.minLength, minScore = DEFAULT_PASSWORD_RULES.minScore, ...rest } = input;
+  if (Object.keys(rest).length) return null;
+  if (!Number.isInteger(minLength) || minLength < 1 || minLength > MAX_MIN_LENGTH) return null;
+  if (!isPasswordScore(minScore)) return null;
+  return { minLength, minScore };
+}
+var isMethodId = (value) => METHODS.includes(value);
+var hasSecondFactor = (method) => METHODS_WITH_SECOND_FACTOR.includes(method);
 var isPolicy = (value) => SECOND_FACTOR_POLICIES.includes(value);
 function parseMethodSettings(input, options = {}) {
   if (!input || typeof input !== "object" || Array.isArray(input)) return null;
   const settings = {};
   for (const [method, value] of Object.entries(input)) {
-    if (!isSignInMethod(method)) return null;
+    if (!isMethodId(method)) return null;
     if (typeof value === "boolean") {
       if (!options.booleans) return null;
       if (value) settings[method] = {};
@@ -313,7 +364,7 @@ function parseMethodSettings(input, options = {}) {
     if (!value || typeof value !== "object" || Array.isArray(value)) return null;
     const setting = {};
     for (const [field, fieldValue] of Object.entries(value)) {
-      if (field !== "secondFactor" || method === "totp" || !isPolicy(fieldValue)) return null;
+      if (field !== "secondFactor" || !hasSecondFactor(method) || !isPolicy(fieldValue)) return null;
       setting.secondFactor = fieldValue;
     }
     settings[method] = setting;
@@ -322,7 +373,10 @@ function parseMethodSettings(input, options = {}) {
 }
 function isConfigured(config, method) {
   if (method === "google") return !!config.google;
+  if (method === "github") return !!config.github;
   if (method === "password") return !!config.password;
+  if (method === "email-link") return !!config.emailLink;
+  if (method === "sms") return !!config.sms;
   return true;
 }
 function canSignUp(config, method) {
@@ -331,8 +385,11 @@ function canSignUp(config, method) {
 function initialMethods(config) {
   const methods = {};
   if (config.google) methods.google = { secondFactor: "none" };
+  if (config.github) methods.github = { secondFactor: "none" };
   if (config.password) methods.password = { secondFactor: "none" };
-  if (!config.google && !config.password && config.emailVerification) methods.totp = {};
+  if (config.emailLink) methods["email-link"] = { secondFactor: "none" };
+  if (!config.google && !config.github && !config.password && !config.emailLink && config.emailVerification) methods.totp = {};
+  if (config.sms) methods.sms = {};
   return methods;
 }
 var MAX_TRIES = 3;
@@ -342,6 +399,7 @@ var Settings = class {
     this.store = store;
     this.initial = initial;
     this.warned = false;
+    this.warnedRules = false;
   }
   /** The setting's value, or undefined if it was never set. */
   async get(id) {
@@ -386,6 +444,23 @@ var Settings = class {
   async changeMethods(apply, updatedBy) {
     return this.change(METHODS_SETTING, (current) => apply(this.current(current)), updatedBy);
   }
+  /** The rules for new passwords; the defaults until an admin set them. */
+  async passwordRules() {
+    const stored = await this.get(PASSWORD_SETTING);
+    if (stored === void 0) return DEFAULT_PASSWORD_RULES;
+    const parsed = parsePasswordRules(stored);
+    if (parsed) return parsed;
+    if (!this.warnedRules) {
+      this.warnedRules = true;
+      console.warn("[madauth] The stored password rules are not in the form this version expects. Set them again with set-password-rules; until then the defaults count.");
+    }
+    return DEFAULT_PASSWORD_RULES;
+  }
+  /** Replaces the rules for new passwords. */
+  async setPasswordRules(rules, updatedBy) {
+    await this.set(PASSWORD_SETTING, rules, updatedBy);
+    return rules;
+  }
   /** The stored methods, or the initial ones if nothing (usable) is stored. */
   current(stored) {
     if (stored === void 0) return this.initial;
@@ -414,6 +489,23 @@ function authenticatorOn(configured, methods) {
 
 // src/password.ts
 import { createHash, createHmac, hkdfSync, randomBytes, randomInt, scrypt, timingSafeEqual } from "crypto";
+
+// src/strength.ts
+var RATED_LENGTH = 64;
+var loading;
+async function passwordScore(password, userInputs = []) {
+  loading ??= Promise.all([import("@zxcvbn-ts/core"), import("@zxcvbn-ts/language-common")]).then(
+    ([core, common]) => new core.ZxcvbnFactory({
+      dictionary: common.dictionary,
+      graphs: common.adjacencyGraphs,
+      useLevenshteinDistance: true,
+      maxLength: RATED_LENGTH
+    })
+  );
+  return (await loading).check(password, userInputs).score;
+}
+
+// src/password.ts
 var HASH_PARAMS = { logN: 15, r: 8, p: 3 };
 var KEY_LENGTH = 64;
 var SALT_LENGTH = 16;
@@ -453,11 +545,17 @@ async function verifyAgainstDummy(password) {
   dummyHash ??= hashPassword(randomBytes(16).toString("hex"));
   await verifyPassword(password, await dummyHash);
 }
-function checkPasswordPolicy(password, minLength) {
-  if (typeof password !== "string") return "password is missing";
+async function checkPasswordPolicy(password, rules, userInputs = []) {
+  if (typeof password !== "string") return { message: "password is missing" };
   const length = [...password].length;
-  if (length < minLength) return `The password must have at least ${minLength} characters.`;
-  if (length > MAX_PASSWORD_LENGTH) return `The password must have at most ${MAX_PASSWORD_LENGTH} characters.`;
+  if (length > MAX_PASSWORD_LENGTH) return { message: `The password must have at most ${MAX_PASSWORD_LENGTH} characters.` };
+  if (length < rules.minLength) return { message: `The password must have at least ${rules.minLength} characters.`, minLength: rules.minLength };
+  if (rules.minScore > 0 && await passwordScore(password, userInputs) < rules.minScore) {
+    return {
+      message: "This password is too easy to guess. Add another word or two, or choose less common ones.",
+      minScore: rules.minScore
+    };
+  }
   return null;
 }
 function normalizeEmail(email) {
@@ -498,9 +596,27 @@ function passwordAccountKey(userId) {
 function googleAccountKey(sub) {
   return `google:${sub}`;
 }
+function githubAccountKey(id) {
+  return `github:${id}`;
+}
 function totpAccountKey(userId) {
   return `totp:${userId}`;
 }
+function emailLinkAccountKey(userId) {
+  return `email-link:${userId}`;
+}
+function smsAccountKey(userId) {
+  return `sms:${userId}`;
+}
+var methodOf = (account) => String(account.key).split(":")[0];
+var ALWAYS_PRIMARY = ["password", "google", "github", "email-link"];
+function isPrimary(account, accounts) {
+  if (account.primaryUserId) return true;
+  if (account.secondFactor === true) return false;
+  const method = methodOf(account);
+  if (method !== "totp") return ALWAYS_PRIMARY.includes(method);
+  return !accounts.some((other) => ALWAYS_PRIMARY.includes(methodOf(other)));
+}
 function toMadauthUser(user, profile = {}) {
   const result = { id: user.id, email: user.email };
   const name = user.name ?? profile.name;
@@ -533,19 +649,75 @@ var Users = class {
   async totpAccount(userId) {
     return this.findAccountByKey(totpAccountKey(userId));
   }
-  /** Whether the user has any way to sign in; a sign-up with the authenticator app has none until it is set up. */
-  async hasAccounts(userId) {
-    return (await this.store.findMany("account", { userId }, { limit: 1 })).length > 0;
+  /** The user's e-mail link account, if they sign in that way. */
+  async emailLinkAccount(userId) {
+    return this.findAccountByKey(emailLinkAccountKey(userId));
+  }
+  /** The user's phone number for SMS codes, if they added one. */
+  async smsAccount(userId) {
+    return this.findAccountByKey(smsAccountKey(userId));
+  }
+  /** The user's accounts: their sign-in method and their second factors. */
+  async accounts(userId) {
+    return await this.store.findMany("account", { userId });
+  }
+  /** The account the user signs in with (they have one at most), or null; a sign-up with the authenticator app has none until it is set up. */
+  async primaryAccount(userId) {
+    const accounts = await this.accounts(userId);
+    return accounts.find((account) => isPrimary(account, accounts)) ?? null;
   }
   /**
-   * The ways the user can sign in, from their accounts: e.g. `['google']` for a user without a password.
-   * The authenticator app counts only when it signs in on its own (`methods` lists it); as a second
-   * factor it is a step of another method, not a way in.
+   * The user's authenticator app, if they set one up, and whether it is how they sign in (they signed up with
+   * it) as opposed to a second factor. One read: the app and the user's other accounts together.
+   */
+  async totpApp(userId) {
+    const accounts = await this.accounts(userId);
+    const account = accounts.find((a) => a.key === totpAccountKey(userId));
+    return account ? { account, signsIn: isPrimary(account, accounts) } : null;
+  }
+  /** Whether someone can sign in as the user: they have a sign-in method. */
+  async hasSignInMethod(userId) {
+    return await this.primaryAccount(userId) !== null;
+  }
+  /**
+   * How the user signs in, e.g. `['google']`; empty while nobody can. A user has one sign-in method (only
+   * users from before madAuth 0.4 may have a password and Google); a second factor (the authenticator app of
+   * a password user, SMS) is a step of it, not a way in. The app of a user who signed up with it counts only
+   * while it signs in on its own (`methods` lists it).
    */
   async signInMethods(userId, methods) {
+    const accounts = await this.accounts(userId);
+    const signIn = accounts.filter((account) => isPrimary(account, accounts)).map(methodOf);
+    return SIGN_IN_METHODS.filter((m) => signIn.includes(m) && (m !== "totp" || methods.totp !== void 0));
+  }
+  /**
+   * Notes that the user's first session started: their sign-up is complete. Resolves to true only for the
+   * request that wrote it, so `user.signed_up` is sent once; false for a later session, and for a user from
+   * before schema version 7.
+   */
+  async markSignedUp(userId) {
+    return await this.store.update("user", { id: userId, signedUpAt: 0 }, { signedUpAt: Date.now() }) === 1;
+  }
+  /**
+   * For a user whose sign-up is not complete (no confirmed address, or no sign-in method) and who is about to
+   * finish it or sign up again: one from before schema version 7 says nothing (`signedUpAt` empty, which
+   * counts as complete), so it is set to 0 and `user.signed_up` comes at their first session like for anyone.
+   */
+  async reopenSignUp(user) {
+    if (user.signedUpAt !== null && user.signedUpAt !== void 0) return user;
+    await this.store.update("user", { id: user.id, signedUpAt: null }, { signedUpAt: 0 });
+    return { ...user, signedUpAt: 0 };
+  }
+  /** The `sub` of the user's linked Google account, if they have one. */
+  async googleSub(userId) {
     const accounts = await this.store.findMany("account", { userId });
-    const keys = accounts.map((account) => String(account.key).split(":")[0]);
-    return SIGN_IN_METHODS.filter((method) => keys.includes(method) && (method !== "totp" || methods.totp !== void 0));
+    const key = accounts.map((account) => String(account.key)).find((k) => k.startsWith("google:"));
+    return key ? key.slice("google:".length) : null;
+  }
+  /** The user's GitHub account, if linked: its key holds GitHub's user id, its secret the encrypted access token of the last sign-in. */
+  async githubAccount(userId) {
+    const accounts = await this.accounts(userId);
+    return accounts.find((account) => account.key.startsWith("github:")) ?? null;
   }
   async findAccountByKey(key) {
     return await this.store.findOne("account", { key });
@@ -565,8 +737,10 @@ var Users = class {
       name: data.name,
       sessionVersion: 0,
       lastMailAt: 0,
+      lastSmsAt: 0,
       wrongCodes: 0,
       claims: null,
+      signedUpAt: 0,
       createdAt: Date.now()
     };
     if (!await this.store.create("user", user)) return null;
@@ -579,12 +753,24 @@ var Users = class {
     return user;
   }
   /**
-   * A provider verified the user's address: an unconfirmed password sign-up with it, whose password nobody
-   * has proven, is dropped (the account and its pending links and codes), and the user counts as verified.
+   * Removes what an unconfirmed sign-up set without proving it: the password, and the e-mail link account of
+   * a first link nobody used. Only `except`'s own account stays: the method that proves the address, or
+   * signs it up anew, is the one the user ends up with.
    */
-  async verifyByProvider(user) {
+  async dropUnprovenAccounts(userId, except) {
+    const keys = { password: passwordAccountKey(userId), "email-link": emailLinkAccountKey(userId) };
+    for (const [method, key] of Object.entries(keys)) {
+      if (method !== except) await this.store.delete("account", { key });
+    }
+  }
+  /**
+   * A provider verified the user's address: an unconfirmed sign-up with it, whose password or e-mail link
+   * nobody has proven, is dropped (its accounts, except `proven`'s own, and its pending links and codes),
+   * and the user counts as verified.
+   */
+  async verifyByProvider(user, proven) {
     if (user.emailVerified) return;
-    await this.store.delete("account", { key: passwordAccountKey(user.id) });
+    await this.dropUnprovenAccounts(user.id, proven);
     await this.clearVerifications(user.id);
     await this.updateUser(user.id, { emailVerified: true, wrongCodes: 0 });
   }
@@ -602,8 +788,16 @@ var Users = class {
     await this.clearRecoveryCodes(userId);
     return removed;
   }
-  /** Adds a sign-in method to a user. Resolves to null if the account key is taken. */
+  /** Removes the user's phone number for SMS codes. Resolves to false if they had none. */
+  async removeSms(userId) {
+    return this.unlinkAccount(smsAccountKey(userId));
+  }
+  /**
+   * Adds a sign-in method or a second factor to a user. Resolves to null if the account key is taken, or if
+   * it is a sign-in method and the user has one already.
+   */
   async linkAccount(userId, account) {
+    const primary = account.primary ?? ALWAYS_PRIMARY.includes(methodOf(account));
     const record = {
       id: newId("acc"),
       userId,
@@ -614,6 +808,9 @@ var Users = class {
       email: account.email ?? null,
       lastUsedStep: account.lastUsedStep ?? 0,
       setupId: account.setupId ?? null,
+      phone: account.phone ?? null,
+      primaryUserId: primary ? userId : null,
+      secondFactor: !primary,
       createdAt: Date.now()
     };
     return await this.store.create("account", record) ? record : null;
@@ -712,7 +909,7 @@ var Users = class {
     await this.store.delete("verification", { userId });
   }
   /**
-   * Starts a verification or password reset: replaces the user's earlier one for the same purpose and
+   * Starts a verification, password reset or e-mail link sign-in: replaces the user's earlier one for the same purpose and
    * returns the link token and the code for the e-mail. Only their hashes are stored.
    */
   async issueVerification(userId, purpose, ttlMs) {
@@ -743,22 +940,30 @@ var Users = class {
   }
   /**
    * Uses up the user's verification if `code` matches. Too many wrong codes delete it, and after
-   * MAX_WRONG_CODES wrong codes in a row the user's codes stop working until an e-mail link is used.
+   * MAX_WRONG_CODES wrong e-mail codes in a row the user's codes stop working until an e-mail link is used.
+   * SMS codes are not counted that way: that lock is only lifted by an e-mail link or a password reset, which
+   * a Google user with a phone never has. Their record's attempts, one SMS per minute and the lock on the
+   * sms account (routes/lockout.ts) are their limits.
    */
   async consumeCode(user, purpose, code) {
-    if ((user.wrongCodes ?? 0) >= MAX_WRONG_CODES) return { userId: null, locked: true };
+    const counted = purpose !== "sms";
+    if (counted && (user.wrongCodes ?? 0) >= MAX_WRONG_CODES) return { userId: null, locked: true };
     const record = await this.store.findOne("verification", { userId: user.id, purpose });
     if (!record) return { userId: null, locked: false };
     const attempts = record.attempts + 1;
     if (await this.store.update("verification", { id: record.id, attempts: record.attempts }, { attempts }) !== 1) {
       return { userId: null, locked: false };
     }
-    const wrongCodes = await this.countWrongCode(user);
-    if (wrongCodes === null) return { userId: null, locked: false };
-    if (wrongCodes > MAX_WRONG_CODES) return { userId: null, locked: true };
+    let wrongCodes = 0;
+    if (counted) {
+      const count = await this.countWrongCode(user);
+      if (count === null) return { userId: null, locked: false };
+      if (count > MAX_WRONG_CODES) return { userId: null, locked: true };
+      wrongCodes = count;
+    }
     if (!safeEqual(hashCode(this.key, code), record.codeHash)) {
       if (attempts >= MAX_CODE_ATTEMPTS) await this.store.delete("verification", { id: record.id });
-      return { userId: null, locked: wrongCodes >= MAX_WRONG_CODES };
+      return { userId: null, locked: counted && wrongCodes >= MAX_WRONG_CODES };
     }
     return { userId: await this.consume(record), locked: false };
   }
@@ -794,7 +999,6 @@ export {
   resolveEnv,
   ConfigError,
   loadConfig,
-  loadUserStoreConfig,
   loadStore,
   MAX_PASSWORD_LENGTH,
   hashPassword,
@@ -807,8 +1011,14 @@ export {
   hashCode,
   safeEqual,
   SIGN_IN_METHODS,
+  METHODS,
   METHODS_WITH_SECOND_FACTOR,
   SECOND_FACTOR_POLICIES,
+  DEFAULT_PASSWORD_RULES,
+  MAX_MIN_LENGTH,
+  isPasswordScore,
+  parsePasswordRules,
+  hasSecondFactor,
   parseMethodSettings,
   isConfigured,
   canSignUp,
@@ -821,7 +1031,10 @@ export {
   newId,
   passwordAccountKey,
   googleAccountKey,
+  githubAccountKey,
   totpAccountKey,
+  emailLinkAccountKey,
+  smsAccountKey,
   toMadauthUser,
   Users
 };