@maestro-js/password 1.0.0-alpha.19 → 1.0.0-alpha.2

package/dist/index.d.ts

@@ -4,62 +4,38 @@ import { Hash } from '@maestro-js/hash';
 
 declare function create<Id, Credentials extends {
     password: string;
-}>(config: Password.Internal.Config<Id, Credentials>): Password.Internal.Service<Id, Credentials>;
-declare function provider<Key extends Password.Provider.Key>(key: Key): Password.PasswordService<Key>;
-/**
- * Password verification and reset with pluggable credential lookups and secure token-based resets.
- * Call methods directly on the default instance, or use `Password.Provider.create()` for named instances.
- */
-declare const PasswordBase: {
-    Provider: {
-        create: typeof create;
-        register: (name: Password.Provider.Key, item: Password.AnyPasswordService) => void;
-    };
-    provider: typeof provider;
+}>(config: Password.Config<Id, Credentials>): Password.Service<Id, Credentials>;
+declare const Password: {
+    create: typeof create;
     errors: {
         ThrottledError: CustomErrors.CustomErrorConstructor<undefined, {}, "tooManyRequests">;
         InvalidTokenError: CustomErrors.CustomErrorConstructor<undefined, {}, "unprocessableContent">;
         ExpiredTokenError: CustomErrors.CustomErrorConstructor<undefined, {}, "unprocessableContent">;
     };
 };
-type KeysWithFallback = keyof Password.Provider.Keys extends never ? {
-    default: {
-        Id: unknown;
-        Credentials: {
-            password: string;
-        } & Record<string, unknown>;
-    };
-} : Password.Provider.Keys;
-declare const Password: Password.PasswordService<'default'> & typeof PasswordBase;
 declare namespace Password {
-    type PasswordService<ProviderKey extends Password.Provider.Key = 'default'> = Internal.Service<KeysWithFallback[ProviderKey]['Id'], KeysWithFallback[ProviderKey]['Credentials']>;
-    type AnyPasswordService = Internal.Service<any, any>;
-    type PasswordServiceConfig<ProviderKey extends Password.Provider.Key = 'default'> = Internal.Config<KeysWithFallback[ProviderKey]['Id'], KeysWithFallback[ProviderKey]['Credentials']>;
-    namespace Internal {
-        interface Service<Id, Credentials extends {
-            password: string;
-        }> {
-            verifyCredentials(credentials: Credentials): Promise<Password.Authenticatable<Id> | null>;
-            createPasswordResetToken: (authenticatableId: Id, options: {
-                expirationMinutes: number;
-            }) => Promise<string>;
-            resetPassword: (options: {
-                token: string;
-                newPassword: string;
-            }) => Promise<void>;
-        }
-        interface Config<Id, Credentials extends {
-            password: string;
-        }> {
-            getAuthenticatableByCredentials(credentials: Omit<Credentials, 'password'>): Promise<(Password.Authenticatable<Id> & {
-                passwordHash: string;
-            }) | null>;
-            updatePasswordHash(id: Id, passwordHash: string): Promise<void>;
-            updateCredentialsInvalidBefore(id: Id, date: Iso.Instant): Promise<void>;
-            /** Used for password hashing and verification. `Hash.drivers.bcrypt()` is recommended. */
-            hash: Hash.HashService;
-            passwordResetOptions?: Password.ResetOptions<Id>;
-        }
+    interface Service<Id, Credentials extends {
+        password: string;
+    }> {
+        verifyCredentials(credentials: Credentials): Promise<Password.Authenticatable<Id> | null>;
+        createPasswordResetToken: (authenticatableId: Id) => Promise<string>;
+        resetPassword: (options: {
+            authenticatableId: Id;
+            token: string;
+            newPassword: string;
+        }) => Promise<void>;
+    }
+    interface Config<Id, Credentials extends {
+        password: string;
+    }> {
+        getAuthenticatableByCredentials(credentials: Omit<Credentials, 'password'>): Promise<(Password.Authenticatable<Id> & {
+            passwordHash: string;
+        }) | null>;
+        updatePasswordHash(id: Id, passwordHash: string): Promise<void>;
+        updateCredentialsInvalidBefore(id: Id, date: Iso.Instant): Promise<void>;
+        /** Used for password hashing and verification. `Hash.drivers.bcrypt()` is recommended. */
+        hash: Hash.HashService;
+        passwordResetOptions?: Password.ResetOptions<Id>;
     }
     interface Authenticatable<Id> {
         id: Id;
@@ -77,14 +53,11 @@ declare namespace Password {
         getBySelector(selector: string): Promise<Password.ResetTokenRecord<Id> | null>;
         getByAuthenticatableId(authenticatableId: Id): Promise<Password.ResetTokenRecord<Id> | null>;
         deleteByAuthenticatableId(authenticatableId: Id): Promise<void>;
+        /** Token lifetime in minutes. Default: 60 */
+        tokenExpirationMinutes?: number;
         /** Minimum seconds between createToken calls for the same authenticatable. Default: 60 */
         throttleSeconds?: number;
     }
-    namespace Provider {
-        type Key = keyof KeysWithFallback;
-        interface Keys {
-        }
-    }
 }
 
 export { Password };

package/dist/index.js

@@ -1,7 +1,6 @@
 // src/index.ts
 import crypto from "crypto";
 import { CustomErrors } from "@maestro-js/custom-errors";
-import { ServiceRegistry } from "@maestro-js/service-registry";
 import { instantFns } from "iso-fns2";
 function create(config) {
   const hashService = config.hash;
@@ -24,7 +23,7 @@ function create(config) {
     }
     return { id: authenticatable.id, credentialsInvalidBefore: authenticatable.credentialsInvalidBefore };
   }
-  async function createPasswordResetToken(authenticatableId, options) {
+  async function createPasswordResetToken(authenticatableId) {
     if (!passwordResetOptions) {
       throw new Error("Password reset is not configured. Provide `passwordResetOptions` when creating the password service.");
     }
@@ -39,7 +38,7 @@ function create(config) {
     const verifier = crypto.randomBytes(32).toString("base64url");
     const verifierHash = await config.hash.hash(verifier);
     const now = instantFns.now();
-    const expirationDate = instantFns.add(now, { minutes: options.expirationMinutes });
+    const expirationDate = instantFns.add(now, { minutes: passwordResetOptions.tokenExpirationMinutes ?? 60 });
     await passwordResetOptions.create({
       authenticatableId,
       selector,
@@ -49,7 +48,11 @@ function create(config) {
     });
     return `${selector}|${verifier}`;
   }
-  async function resetPassword({ token, newPassword }) {
+  async function resetPassword({
+    authenticatableId,
+    token,
+    newPassword
+  }) {
     if (!passwordResetOptions) {
       throw new Error("Password reset is not configured. Provide `passwordResetOptions` when creating the password service.");
     }
@@ -68,10 +71,13 @@ function create(config) {
     if (record.expirationDate < instantFns.now()) {
       throw new PasswordResetExpiredTokenError();
     }
+    if (record.authenticatableId !== authenticatableId) {
+      throw new PasswordResetInvalidTokenError();
+    }
     const passwordHash = await config.hash.hash(newPassword);
-    await config.updatePasswordHash(record.authenticatableId, passwordHash);
-    await config.updateCredentialsInvalidBefore(record.authenticatableId, instantFns.now());
-    await passwordResetOptions.deleteByAuthenticatableId(record.authenticatableId);
+    await config.updatePasswordHash(authenticatableId, passwordHash);
+    await config.updateCredentialsInvalidBefore(authenticatableId, instantFns.now());
+    await passwordResetOptions.deleteByAuthenticatableId(authenticatableId);
   }
   return {
     verifyCredentials,
@@ -79,21 +85,6 @@ function create(config) {
     resetPassword
   };
 }
-var registry = ServiceRegistry.createRegistry(
-  ServiceRegistry.proxyFunctionsForObject
-);
-var Provider = {
-  create,
-  register: registry.register
-};
-function provider(key) {
-  const service = registry.resolve(key);
-  return {
-    verifyCredentials: service.verifyCredentials,
-    createPasswordResetToken: service.createPasswordResetToken,
-    resetPassword: service.resetPassword
-  };
-}
 var PasswordResetThrottledError = CustomErrors.create({
   name: "PasswordResetThrottledError",
   message: "Password reset requests are being throttled. Please try again later.",
@@ -109,19 +100,14 @@ var PasswordResetExpiredTokenError = CustomErrors.create({
   message: "The password reset token has expired.",
   httpStatusCode: "unprocessableContent"
 });
-var PasswordBase = {
-  Provider,
-  provider,
+var Password = {
+  create,
   errors: {
     ThrottledError: PasswordResetThrottledError,
     InvalidTokenError: PasswordResetInvalidTokenError,
     ExpiredTokenError: PasswordResetExpiredTokenError
   }
 };
-var Password = {
-  ...PasswordBase,
-  ...provider("default")
-};
 function decodePasswordResetToken(token) {
   const [selector, verifier] = token.split("|");
   if (!selector || !verifier) return null;

package/package.json

@@ -7,7 +7,7 @@
       "default": "./dist/index.js"
     }
   },
-  "version": "1.0.0-alpha.19",
+  "version": "1.0.0-alpha.2",
   "publishConfig": {
     "access": "restricted"
   },
@@ -16,15 +16,11 @@
   ],
   "dependencies": {
     "iso-fns2": "npm:iso-fns@2.0.0-alpha.26",
-    "@maestro-js/custom-errors": "1.0.0-alpha.19",
-    "@maestro-js/service-registry": "1.0.0-alpha.19"
-  },
-  "peerDependencies": {
-    "@maestro-js/hash": "1.0.0-alpha.19"
+    "@maestro-js/custom-errors": "1.0.0-alpha.2",
+    "@maestro-js/hash": "1.0.0-alpha.2"
   },
   "devDependencies": {
-    "@types/node": "^22.19.11",
-    "@maestro-js/hash": "1.0.0-alpha.19"
+    "@types/node": "^22.19.11"
   },
   "license": "UNLICENSED",
   "engines": {