@mesob/auth-hono 0.5.0 → 0.5.2

package/dist/{index-DwIwuvVj.d.ts → index-CDgzxZzO.d.ts}

@@ -1,7 +1,7 @@
 import * as hono from 'hono';
 import { OpenAPIHono } from '@hono/zod-openapi';
 import { PermissionTree } from '@mesob/common';
-import { D as Database } from './index-D8OE85f8.js';
+import { D as Database } from './index-Dhe5obDc.js';
 
 type Tenant = {
     id: string;
@@ -89,6 +89,12 @@ type PhoneConfig = VerificationConfig & {
     phoneRegex?: RegExp | string;
 };
 type EmailConfig = VerificationConfig;
+type SignUpConfig = {
+    enabled: boolean;
+    emailEnabled: boolean;
+    phoneEnabled: boolean;
+    allowedEmailDomains?: readonly string[];
+};
 type SessionConfig = {
     /** Default session duration (e.g., '7d', '30d'). Default: '7d' */
     expiresIn: string;
@@ -147,6 +153,7 @@ type AuthConfig = {
     session: SessionConfig;
     email: EmailConfig;
     phone: PhoneConfig;
+    signUp?: SignUpConfig;
     security?: SecurityConfig;
 };
 

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { A as AuthConfig, M as MesobAuth } from './index-DwIwuvVj.js';
-export { a as SendInvitationParams, b as SendVerificationOTPParams, c as Session, S as SessionStatus, T as Tenant, U as User } from './index-DwIwuvVj.js';
-import { D as Database } from './index-D8OE85f8.js';
-export { c as createDatabase } from './index-D8OE85f8.js';
+import { A as AuthConfig, M as MesobAuth } from './index-CDgzxZzO.js';
+export { a as SendInvitationParams, b as SendVerificationOTPParams, c as Session, S as SessionStatus, T as Tenant, U as User } from './index-CDgzxZzO.js';
+import { D as Database } from './index-Dhe5obDc.js';
+export { c as createDatabase } from './index-Dhe5obDc.js';
 export { cleanupExpiredData, cleanupExpiredSessions, cleanupExpiredVerifications } from './lib/cleanup.js';
 export { hasPermission, hasPermissionThrow } from './lib/has-role-permission.js';
 import * as hono from 'hono';

package/dist/index.js

@@ -1283,6 +1283,19 @@ var checkAccountHandler = async (c) => {
   const resolvedTenantId = ensureTenantId(config, tenantId);
   const { username } = body;
   const isEmail = username.includes("@");
+  const disabledChannelResponse = {
+    exists: false,
+    verified: false,
+    hasPassword: false,
+    requiresPasswordSetup: false,
+    account: null
+  };
+  if (isEmail && !config.email.enabled) {
+    return c.json(disabledChannelResponse, 200);
+  }
+  if (!(isEmail || config.phone.enabled)) {
+    return c.json(disabledChannelResponse, 200);
+  }
   const userTypeFilter = sql4`${usersInIam.userType} @> ARRAY[${config.userType}]::text[]`;
   const whereClause = isEmail ? and6(
     eq6(usersInIam.tenantId, resolvedTenantId),
@@ -1846,6 +1859,20 @@ var SignUpError = class extends Error {
     this.status = status;
   }
 };
+var normalizeSignupDomain = (value) => {
+  return value.trim().toLowerCase().replace(/^@/, "");
+};
+var isAllowedSignupEmail = (email, allowedDomains) => {
+  const domain = email.split("@")[1]?.toLowerCase();
+  if (!domain) {
+    return false;
+  }
+  const normalizedDomains = allowedDomains.map(normalizeSignupDomain).filter(Boolean);
+  if (normalizedDomains.length === 0) {
+    return true;
+  }
+  return normalizedDomains.includes(domain);
+};
 var signUpHandler = async (c) => {
   const body = c.req.valid("json");
   const config = c.get("config");
@@ -1857,7 +1884,19 @@ var signUpHandler = async (c) => {
   if (!identifier) {
     return c.json({ error: "Either email or phone is required" }, 409);
   }
+  if (config.signUp && !config.signUp.enabled) {
+    return c.json({ error: "Sign up is disabled" }, 403);
+  }
   const isEmail = identifier.includes("@");
+  if (isEmail && config.signUp && !config.signUp.emailEnabled) {
+    return c.json({ error: "Email sign up is disabled" }, 403);
+  }
+  if (!isEmail && config.signUp && !config.signUp.phoneEnabled) {
+    return c.json({ error: "Phone sign up is disabled" }, 403);
+  }
+  if (isEmail && config.signUp?.allowedEmailDomains && !isAllowedSignupEmail(identifier, config.signUp.allowedEmailDomains)) {
+    return c.json({ error: "Email domain is not allowed for sign up" }, 403);
+  }
   if (phone) {
     const phoneValidator = createPhoneField(config);
     if (!phoneValidator.validate(phone)) {
@@ -3987,6 +4026,14 @@ var phoneVerificationRequestHandler = async (c) => {
     return c.json({ error: "Phone authentication is disabled" }, 400);
   }
   const { phone, context } = body;
+  if (context === "sign-up" && config.signUp) {
+    if (!config.signUp.enabled) {
+      return c.json({ error: "Sign up is disabled" }, 400);
+    }
+    if (!config.signUp.phoneEnabled) {
+      return c.json({ error: "Phone sign up is disabled" }, 400);
+    }
+  }
   if (!phone) {
     return c.json({ error: "Phone required" }, 400);
   }
@@ -8566,6 +8613,12 @@ var defaultAuthConfig = {
     ...defaultConfig,
     phoneRegex: defaultPhoneRegex
   },
+  signUp: {
+    enabled: true,
+    emailEnabled: true,
+    phoneEnabled: true,
+    allowedEmailDomains: []
+  },
   security: {
     maxLoginAttempts: 5,
     lockoutDuration: "15m"