@meith/accounts 0.34.0 → 0.35.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meith/accounts",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -20,7 +20,7 @@
   },
   "dependencies": {
     "hash-wasm": "^4.12.0",
-    "@meith/i18n": "0.34.0",
-    "@meith/subscriptions": "0.34.0"
+    "@meith/i18n": "0.35.0",
+    "@meith/subscriptions": "0.35.0"
   }
 }

package/src/federation/oidc.ts

@@ -135,10 +135,14 @@ function profileFrom(claims: IdTokenClaims, userinfo: IdTokenClaims): ProviderPr
     throw new ValidationError(msg('error.accounts.identity-provider-sent-account-with'))
   }
 
+  const emailFromToken = stringClaim(claims, 'email')
+  const emailSource = emailFromToken !== null ? claims : userinfo
+  const email = emailFromToken ?? stringClaim(userinfo, 'email')
+
   return {
     subject,
-    email: stringClaim(merged, 'email') ?? stringClaim(userinfo, 'email'),
-    emailVerified: readBoolean(merged, 'email_verified') || readBoolean(userinfo, 'email_verified'),
+    email,
+    emailVerified: email !== null && readBoolean(emailSource, 'email_verified'),
     username:
       stringClaim(merged, 'preferred_username') ??
       stringClaim(merged, 'nickname') ??

package/src/memory-repos.ts

@@ -524,11 +524,12 @@ class MemoryPasskeys implements PasskeyRepository {
     return true
   }
 
-  async markUsed(passkeyId: number, signCount: number, now: Date): Promise<void> {
+  async markUsed(passkeyId: number, signCount: number, now: Date): Promise<boolean> {
     const record = this.byId.get(passkeyId)
-    if (record !== undefined) {
-      this.byId.set(passkeyId, { ...record, signCount, lastUsedAt: now })
-    }
+    if (record === undefined) return false
+    if (signCount !== 0 && signCount <= record.signCount) return false
+    this.byId.set(passkeyId, { ...record, signCount, lastUsedAt: now })
+    return true
   }
 }
 

package/src/ports.ts

@@ -230,7 +230,7 @@ export interface PasskeyRepository {
   listForUser(userId: number): Promise<readonly PasskeyRecord[]>
   create(input: NewPasskey): Promise<PasskeyRecord>
   remove(userId: number, passkeyId: number): Promise<boolean>
-  markUsed(passkeyId: number, signCount: number, now: Date): Promise<void>
+  markUsed(passkeyId: number, signCount: number, now: Date): Promise<boolean>
 }
 
 export interface TwoFactorRecord {

package/src/session-service.ts

@@ -49,25 +49,19 @@ export class SessionService {
     return this.mintSession(userId, this.now(), context)
   }
 
-  async startRemembered(userId: number, context: RequestContext = {}): Promise<RememberedLogin> {
+  async issueRemember(
+    userId: number,
+  ): Promise<{ readonly rememberToken: string; readonly rememberExpiresAt: Date }> {
     const at = this.now()
-    const familyId = generateToken()
     const rememberToken = generateToken()
     const rememberExpiresAt = new Date(at.getTime() + this.rememberDays * DAY_MS)
     await this.store.remember.issue({
       tokenHash: await hashToken(rememberToken),
-      familyId,
+      familyId: generateToken(),
       userId,
       expiresAt: rememberExpiresAt,
     })
-    const session = await this.mintSession(userId, at, context)
-    return {
-      userId,
-      sessionToken: session.token,
-      sessionExpiresAt: session.expiresAt,
-      rememberToken,
-      rememberExpiresAt,
-    }
+    return { rememberToken, rememberExpiresAt }
   }
 
   async resume(rememberToken: string, context: RequestContext = {}): Promise<ResumeOutcome> {

package/src/webauthn/service.ts

@@ -194,8 +194,11 @@ export class PasskeyService {
       throw new ForbiddenError(msg('error.accounts.account-behind-passkey-longer-exists'))
     }
 
+    if (!(await this.passkeys.markUsed(passkey.id, verified.signCount, this.now()))) {
+      throw new ForbiddenError(msg('error.accounts.passkey-replayed-counter-board-already'))
+    }
+
     const login = await this.identity.startSessionFor(account, input.context ?? {})
-    await this.passkeys.markUsed(passkey.id, verified.signCount, this.now())
 
     return { account, login }
   }
@@ -218,8 +221,7 @@ export class PasskeyService {
       storedSignCount: passkey.signCount,
     })
 
-    await this.passkeys.markUsed(passkey.id, verified.signCount, this.now())
-    return true
+    return this.passkeys.markUsed(passkey.id, verified.signCount, this.now())
   }
 
   async remove(input: {