@madauth/server 0.5.0-beta.1 → 0.5.0-beta.2

package/dist/{chunk-7DHKDRGY.js → chunk-6SF2WNOC.js}

@@ -790,9 +790,13 @@ function passwordRoutes(app, ctx, users, webhook) {
     if (existing) {
       if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
       if (!existing.emailVerified) await users.dropUnprovenAccounts(existing.id, "password");
+      if (existing.emailVerified) await users.updateUser(existing.id, { emailVerified: false });
       const account = await users.passwordAccount(existing.id);
       if (account) await users.updateAccount(account.id, { secret: passwordHash, failedAttempts: 0, lockedUntil: 0 });
-      else if (!await users.linkAccount(existing.id, { key: passwordAccountKey(existing.id), secret: passwordHash })) return accepted(c);
+      else if (!await users.linkAccount(existing.id, { key: passwordAccountKey(existing.id), secret: passwordHash })) {
+        if (existing.emailVerified && !await users.passwordAccount(existing.id)) await users.updateUser(existing.id, { emailVerified: true });
+        return accepted(c);
+      }
       await users.reopenSignUp(existing);
       await users.updateUser(existing.id, { name });
       return await emails.sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c) : unavailable(c);
@@ -1208,7 +1212,8 @@ function totpRoutes(app, ctx, keys) {
   app.post(`${COOKIE_PATH4}/confirm`, async (c) => {
     const who = await whoSetsUp(c);
     if (!who) return noSession(c);
-    const { user, challenge } = who;
+    const { challenge } = who;
+    let { user } = who;
     if (challenge && !await methodStillOn(c, ctx, challenge)) return methodOff(c);
     const data = await body(c);
     const setup = await readToken(await ctx.keys, issuer, SETUP_TYP2, getCookie5(c, SETUP_COOKIE2));
@@ -1217,6 +1222,11 @@ function totpRoutes(app, ctx, keys) {
     const step = typeof data.code === "string" ? verifyTotp(secret, data.code, Date.now(), TOTP_WINDOW) : null;
     if (step === null) return error(c, 400, "code_invalid", "The code is wrong. Enter the current code from the app.");
     const signUp = challenge?.method === "totp";
+    const fresh = signUp && !user.emailVerified ? await users.findById(user.id) : null;
+    if (fresh && !fresh.emailVerified) {
+      await users.verifyByProvider(fresh);
+      user = { ...user, emailVerified: true, wrongCodes: 0 };
+    }
     const { recoveryCodes, hashes } = newRecoveryCodes();
     await users.addRecoveryCodes(user.id, setup.setup, hashes);
     const patch = { secret: setup.secret, setupId: setup.setup, failedAttempts: 0, lockedUntil: 0, lastUsedStep: step };

package/dist/entry/azure.js

@@ -1,6 +1,6 @@
 import {
   createApp
-} from "../chunk-7DHKDRGY.js";
+} from "../chunk-6SF2WNOC.js";
 import "../chunk-A7UYZRBL.js";
 import {
   loadConfig,

package/dist/entry/lambda.js

@@ -1,6 +1,6 @@
 import {
   createApp
-} from "../chunk-7DHKDRGY.js";
+} from "../chunk-6SF2WNOC.js";
 import "../chunk-A7UYZRBL.js";
 import {
   loadConfig,

package/dist/entry/node.js

@@ -1,6 +1,6 @@
 import {
   createApp
-} from "../chunk-7DHKDRGY.js";
+} from "../chunk-6SF2WNOC.js";
 import "../chunk-A7UYZRBL.js";
 import {
   loadConfig,

package/dist/index.js

@@ -10,7 +10,7 @@ import {
 import {
   REDIRECT_ERROR_PARAM,
   createApp
-} from "./chunk-7DHKDRGY.js";
+} from "./chunk-6SF2WNOC.js";
 import "./chunk-A7UYZRBL.js";
 import {
   ADMIN_ROLE,

package/dist/standalone/azure.mjs

@@ -12760,9 +12760,13 @@ function passwordRoutes(app2, ctx, users, webhook) {
     if (existing) {
       if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
       if (!existing.emailVerified) await users.dropUnprovenAccounts(existing.id, "password");
+      if (existing.emailVerified) await users.updateUser(existing.id, { emailVerified: false });
       const account = await users.passwordAccount(existing.id);
       if (account) await users.updateAccount(account.id, { secret: passwordHash, failedAttempts: 0, lockedUntil: 0 });
-      else if (!await users.linkAccount(existing.id, { key: passwordAccountKey(existing.id), secret: passwordHash })) return accepted(c);
+      else if (!await users.linkAccount(existing.id, { key: passwordAccountKey(existing.id), secret: passwordHash })) {
+        if (existing.emailVerified && !await users.passwordAccount(existing.id)) await users.updateUser(existing.id, { emailVerified: true });
+        return accepted(c);
+      }
       await users.reopenSignUp(existing);
       await users.updateUser(existing.id, { name });
       return await emails.sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c) : unavailable(c);
@@ -13173,7 +13177,8 @@ function totpRoutes(app2, ctx, keys) {
   app2.post(`${COOKIE_PATH4}/confirm`, async (c) => {
     const who = await whoSetsUp(c);
     if (!who) return noSession(c);
-    const { user, challenge } = who;
+    const { challenge } = who;
+    let { user } = who;
     if (challenge && !await methodStillOn(c, ctx, challenge)) return methodOff(c);
     const data = await body(c);
     const setup = await readToken(await ctx.keys, issuer, SETUP_TYP2, getCookie(c, SETUP_COOKIE2));
@@ -13182,6 +13187,11 @@ function totpRoutes(app2, ctx, keys) {
     const step = typeof data.code === "string" ? verifyTotp(secret, data.code, Date.now(), TOTP_WINDOW) : null;
     if (step === null) return error(c, 400, "code_invalid", "The code is wrong. Enter the current code from the app.");
     const signUp = challenge?.method === "totp";
+    const fresh = signUp && !user.emailVerified ? await users.findById(user.id) : null;
+    if (fresh && !fresh.emailVerified) {
+      await users.verifyByProvider(fresh);
+      user = { ...user, emailVerified: true, wrongCodes: 0 };
+    }
     const { recoveryCodes, hashes } = newRecoveryCodes();
     await users.addRecoveryCodes(user.id, setup.setup, hashes);
     const patch = { secret: setup.secret, setupId: setup.setup, failedAttempts: 0, lockedUntil: 0, lastUsedStep: step };

package/dist/standalone/lambda.mjs

@@ -8912,9 +8912,13 @@ function passwordRoutes(app, ctx, users, webhook) {
     if (existing) {
       if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
       if (!existing.emailVerified) await users.dropUnprovenAccounts(existing.id, "password");
+      if (existing.emailVerified) await users.updateUser(existing.id, { emailVerified: false });
       const account = await users.passwordAccount(existing.id);
       if (account) await users.updateAccount(account.id, { secret: passwordHash, failedAttempts: 0, lockedUntil: 0 });
-      else if (!await users.linkAccount(existing.id, { key: passwordAccountKey(existing.id), secret: passwordHash })) return accepted(c);
+      else if (!await users.linkAccount(existing.id, { key: passwordAccountKey(existing.id), secret: passwordHash })) {
+        if (existing.emailVerified && !await users.passwordAccount(existing.id)) await users.updateUser(existing.id, { emailVerified: true });
+        return accepted(c);
+      }
       await users.reopenSignUp(existing);
       await users.updateUser(existing.id, { name });
       return await emails.sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c) : unavailable(c);
@@ -9325,7 +9329,8 @@ function totpRoutes(app, ctx, keys) {
   app.post(`${COOKIE_PATH4}/confirm`, async (c) => {
     const who = await whoSetsUp(c);
     if (!who) return noSession(c);
-    const { user, challenge } = who;
+    const { challenge } = who;
+    let { user } = who;
     if (challenge && !await methodStillOn(c, ctx, challenge)) return methodOff(c);
     const data = await body(c);
     const setup = await readToken(await ctx.keys, issuer, SETUP_TYP2, getCookie(c, SETUP_COOKIE2));
@@ -9334,6 +9339,11 @@ function totpRoutes(app, ctx, keys) {
     const step = typeof data.code === "string" ? verifyTotp(secret, data.code, Date.now(), TOTP_WINDOW) : null;
     if (step === null) return error(c, 400, "code_invalid", "The code is wrong. Enter the current code from the app.");
     const signUp = challenge?.method === "totp";
+    const fresh = signUp && !user.emailVerified ? await users.findById(user.id) : null;
+    if (fresh && !fresh.emailVerified) {
+      await users.verifyByProvider(fresh);
+      user = { ...user, emailVerified: true, wrongCodes: 0 };
+    }
     const { recoveryCodes, hashes } = newRecoveryCodes();
     await users.addRecoveryCodes(user.id, setup.setup, hashes);
     const patch = { secret: setup.secret, setupId: setup.setup, failedAttempts: 0, lockedUntil: 0, lastUsedStep: step };

package/dist/standalone/main.mjs

@@ -38381,9 +38381,13 @@ function passwordRoutes(app, ctx, users, webhook) {
     if (existing) {
       if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c6);
       if (!existing.emailVerified) await users.dropUnprovenAccounts(existing.id, "password");
+      if (existing.emailVerified) await users.updateUser(existing.id, { emailVerified: false });
       const account = await users.passwordAccount(existing.id);
       if (account) await users.updateAccount(account.id, { secret: passwordHash, failedAttempts: 0, lockedUntil: 0 });
-      else if (!await users.linkAccount(existing.id, { key: passwordAccountKey(existing.id), secret: passwordHash })) return accepted(c6);
+      else if (!await users.linkAccount(existing.id, { key: passwordAccountKey(existing.id), secret: passwordHash })) {
+        if (existing.emailVerified && !await users.passwordAccount(existing.id)) await users.updateUser(existing.id, { emailVerified: true });
+        return accepted(c6);
+      }
       await users.reopenSignUp(existing);
       await users.updateUser(existing.id, { name });
       return await emails.sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c6) : unavailable(c6);
@@ -38794,7 +38798,8 @@ function totpRoutes(app, ctx, keys) {
   app.post(`${COOKIE_PATH4}/confirm`, async (c6) => {
     const who = await whoSetsUp(c6);
     if (!who) return noSession(c6);
-    const { user, challenge } = who;
+    const { challenge } = who;
+    let { user } = who;
     if (challenge && !await methodStillOn(c6, ctx, challenge)) return methodOff(c6);
     const data = await body(c6);
     const setup = await readToken(await ctx.keys, issuer, SETUP_TYP2, getCookie(c6, SETUP_COOKIE2));
@@ -38803,6 +38808,11 @@ function totpRoutes(app, ctx, keys) {
     const step = typeof data.code === "string" ? verifyTotp(secret, data.code, Date.now(), TOTP_WINDOW) : null;
     if (step === null) return error(c6, 400, "code_invalid", "The code is wrong. Enter the current code from the app.");
     const signUp = challenge?.method === "totp";
+    const fresh = signUp && !user.emailVerified ? await users.findById(user.id) : null;
+    if (fresh && !fresh.emailVerified) {
+      await users.verifyByProvider(fresh);
+      user = { ...user, emailVerified: true, wrongCodes: 0 };
+    }
     const { recoveryCodes, hashes } = newRecoveryCodes();
     await users.addRecoveryCodes(user.id, setup.setup, hashes);
     const patch = { secret: setup.secret, setupId: setup.setup, failedAttempts: 0, lockedUntil: 0, lastUsedStep: step };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@madauth/server",
-  "version": "0.5.0-beta.1",
+  "version": "0.5.0-beta.2",
   "description": "madAuth server: Google, e-mail & password and authenticator-app sign-in with madAuth sessions, for Docker, AWS Lambda and Azure Functions.",
   "license": "MIT",
   "author": "David Neuy",