@molecule/api-resource-user 1.0.0

package/dist/authorizers/authSelf.d.ts

@@ -0,0 +1,14 @@
+import type { MoleculeRequestHandler } from '@molecule/api-resource';
+/**
+ * Middleware that checks if the authenticated user's ID matches the `:id` route parameter.
+ * Ensures users can only access their own resource. Calls `next()` on match or `next('Unauthorized')` otherwise.
+ *
+ * As a convenience, `:id === 'me'` is treated as the current authenticated
+ * user — `req.params.id` is rewritten to the session's userId so downstream
+ * handlers receive the real id. This lets pages call `/api/users/me`
+ * without needing the user's UUID in scope.
+ *
+ * @returns An Express-compatible middleware function.
+ */
+export declare const authSelf: () => MoleculeRequestHandler;
+//# sourceMappingURL=authSelf.d.ts.map

package/dist/authorizers/authSelf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authSelf.d.ts","sourceRoot":"","sources":["../../src/authorizers/authSelf.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAEpE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,QAAO,sBAgB3B,CAAA"}

package/dist/authorizers/authSelf.js

@@ -0,0 +1,31 @@
+import { t } from '@molecule/api-i18n';
+/**
+ * Middleware that checks if the authenticated user's ID matches the `:id` route parameter.
+ * Ensures users can only access their own resource. Calls `next()` on match or `next('Unauthorized')` otherwise.
+ *
+ * As a convenience, `:id === 'me'` is treated as the current authenticated
+ * user — `req.params.id` is rewritten to the session's userId so downstream
+ * handlers receive the real id. This lets pages call `/api/users/me`
+ * without needing the user's UUID in scope.
+ *
+ * @returns An Express-compatible middleware function.
+ */
+export const authSelf = () => (req, res, next) => {
+    try {
+        const { session } = res.locals;
+        if (session?.userId) {
+            if (req.params.id === 'me') {
+                req.params.id = session.userId;
+                return next();
+            }
+            if (session.userId === req.params.id) {
+                return next();
+            }
+        }
+    }
+    catch (_error) {
+        // session read failed — fall through to next('Unauthorized') below, which is the correct safe result
+    }
+    return next(t('resource.error.unauthorized', undefined, { defaultValue: 'Unauthorized' }));
+};
+//# sourceMappingURL=authSelf.js.map

package/dist/authorizers/authSelf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authSelf.js","sourceRoot":"","sources":["../../src/authorizers/authSelf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAA;AAGtC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,GAA2B,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,CAAA;QAC9B,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC3B,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;gBAC9B,OAAO,IAAI,EAAE,CAAA;YACf,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACrC,OAAO,IAAI,EAAE,CAAA;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,qGAAqG;IACvG,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,6BAA6B,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;AAC5F,CAAC,CAAA"}

package/dist/authorizers/index.d.ts

@@ -0,0 +1,5 @@
+export * from './auth.js';
+export * from './authSelf.js';
+export * from './rateLimit.js';
+export * from './requireWebhookAuthenticity.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/authorizers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorizers/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAA;AACzB,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,iCAAiC,CAAA"}

package/dist/authorizers/index.js

@@ -0,0 +1,5 @@
+export * from './auth.js';
+export * from './authSelf.js';
+export * from './rateLimit.js';
+export * from './requireWebhookAuthenticity.js';
+//# sourceMappingURL=index.js.map

package/dist/authorizers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authorizers/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAA;AACzB,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,iCAAiC,CAAA"}

package/dist/authorizers/rateLimit.d.ts

@@ -0,0 +1,84 @@
+import type { MoleculeRequest, MoleculeRequestHandler } from '@molecule/api-resource';
+/**
+ * Configuration for {@link rateLimit}.
+ */
+export interface RateLimitAuthOptions {
+    /**
+     * Key namespace so each protected surface gets an isolated bucket
+     * (e.g. `'login'`, `'forgot-password'`, `'2fa'`). Buckets never collide
+     * across scopes.
+     */
+    scope: string;
+    /** Sliding window in milliseconds (default: 15 minutes). */
+    windowMs?: number;
+    /**
+     * Maximum attempts per window for the per-account bucket before a 429
+     * (default: 10). This is the tight brute-force gate; a legitimate user makes
+     * only a handful of attempts, so it never trips for them.
+     */
+    max?: number;
+    /**
+     * Maximum attempts per window for the per-IP bucket (default: 60). Kept
+     * higher than {@link RateLimitAuthOptions.max} so shared public IPs aren't
+     * locked out; primarily catches single-source flooding and password-spray
+     * across many accounts, and is the only guard when no account is resolvable
+     * (e.g. an OAuth login carrying no email).
+     */
+    ipMax?: number;
+    /**
+     * Optional extractors for an account identifier (submitted email/username,
+     * the target user id, etc.). When one resolves, the request is ALSO bucketed
+     * per account — so a distributed attack against a single account is throttled
+     * even when the source IP rotates, and the second factor is temp-locked after
+     * `max` consecutive misses regardless of IP. Each extractor is tried; every
+     * value that resolves contributes a bucket.
+     */
+    accountFrom?: ReadonlyArray<(req: MoleculeRequest) => string | undefined>;
+}
+/**
+ * Creates an authorizer middleware that brute-force-protects an auth endpoint.
+ *
+ * Consumes a rate-limit token per request, keyed by client IP and — where
+ * resolvable — by account identifier, returning HTTP 429 once the low ceiling
+ * is exceeded. This closes the unthrottled-auth default that left passwords and
+ * the 6-digit TOTP second factor brute-forceable on `mlcl`-generated apps.
+ *
+ * Availability is preserved over absolute enforcement: if no rate-limit
+ * provider is bonded (an app deliberately removed it) or the limiter itself
+ * errors, the request is allowed through (with a logged warning/error) so a
+ * limiter outage never locks out every legitimate login. Generated apps wire
+ * the default in-memory provider via the registry's `alwaysInclude`/
+ * `defaultProvider`, so the throttle is active out of the box.
+ *
+ * @param options - Scope, window, ceiling, and optional account-key extractors.
+ * @returns A `MoleculeRequestHandler` to place ahead of the protected handler.
+ */
+export declare const rateLimit: (options: RateLimitAuthOptions) => MoleculeRequestHandler;
+/**
+ * Account-identifier extractor for the login endpoint: the submitted username
+ * or email. Bucketing on this temp-locks a single targeted account after `max`
+ * failed attempts even across rotating IPs (which also covers TOTP-via-login
+ * brute force, since the login handler verifies the second factor).
+ *
+ * @param req - The incoming request.
+ * @returns The submitted username or email (if present).
+ */
+export declare const loginAccountKey: (req: MoleculeRequest) => string | undefined;
+/**
+ * Account-identifier extractor for the forgot-password endpoint: the submitted
+ * email.
+ *
+ * @param req - The incoming request.
+ * @returns The submitted email (if present).
+ */
+export declare const emailAccountKey: (req: MoleculeRequest) => string | undefined;
+/**
+ * Account-identifier extractor for the verify-two-factor endpoint: the target
+ * user id in the route params. Temp-locks the second factor per account after
+ * `max` consecutive misses.
+ *
+ * @param req - The incoming request.
+ * @returns The target user id (if present).
+ */
+export declare const paramIdAccountKey: (req: MoleculeRequest) => string | undefined;
+//# sourceMappingURL=rateLimit.d.ts.map

package/dist/authorizers/rateLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.d.ts","sourceRoot":"","sources":["../../src/authorizers/rateLimit.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAmBrF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC,CAAC,GAAG,EAAE,eAAe,KAAK,MAAM,GAAG,SAAS,CAAC,CAAA;CAC1E;AAeD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,SAAS,GAAI,SAAS,oBAAoB,KAAG,sBAmEzD,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,eAAe,KAAG,MAAM,GAAG,SAK/D,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,eAAe,KAAG,MAAM,GAAG,SAG/D,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAAI,KAAK,eAAe,KAAG,MAAM,GAAG,SAGjE,CAAA"}

package/dist/authorizers/rateLimit.js

@@ -0,0 +1,144 @@
+import { getLogger } from '@molecule/api-bond';
+import { t } from '@molecule/api-i18n';
+import { configure, consume, hasProvider } from '@molecule/api-rate-limit';
+const logger = getLogger();
+/** Default sliding window for auth endpoints: 15 minutes. */
+const DEFAULT_WINDOW_MS = 15 * 60_000;
+/** Default per-account max attempts per window — a deliberately low ceiling. */
+const DEFAULT_MAX = 10;
+/**
+ * Default per-IP max attempts per window. Deliberately more generous than the
+ * per-account ceiling so a shared-NAT / office / mobile-carrier IP isn't locked
+ * out by many distinct legitimate users — the tight per-account bucket is the
+ * real anti-brute-force gate. Still bounds raw flooding and password-spray from
+ * a single source.
+ */
+const DEFAULT_IP_MAX = 60;
+/**
+ * Resolves the client IP for rate-limit bucketing. Prefers the
+ * framework-populated `req.ip` (Express honors `trust proxy`, so it is not
+ * client-spoofable) and falls back to `'unknown'` so a missing IP still shares
+ * a single throttled bucket rather than bypassing the limit.
+ *
+ * @param req - The incoming request.
+ * @returns A stable IP key.
+ */
+const resolveIp = (req) => {
+    return req.ip ?? 'unknown';
+};
+/**
+ * Creates an authorizer middleware that brute-force-protects an auth endpoint.
+ *
+ * Consumes a rate-limit token per request, keyed by client IP and — where
+ * resolvable — by account identifier, returning HTTP 429 once the low ceiling
+ * is exceeded. This closes the unthrottled-auth default that left passwords and
+ * the 6-digit TOTP second factor brute-forceable on `mlcl`-generated apps.
+ *
+ * Availability is preserved over absolute enforcement: if no rate-limit
+ * provider is bonded (an app deliberately removed it) or the limiter itself
+ * errors, the request is allowed through (with a logged warning/error) so a
+ * limiter outage never locks out every legitimate login. Generated apps wire
+ * the default in-memory provider via the registry's `alwaysInclude`/
+ * `defaultProvider`, so the throttle is active out of the box.
+ *
+ * @param options - Scope, window, ceiling, and optional account-key extractors.
+ * @returns A `MoleculeRequestHandler` to place ahead of the protected handler.
+ */
+export const rateLimit = (options) => {
+    const { scope } = options;
+    const windowMs = options.windowMs ?? DEFAULT_WINDOW_MS;
+    const max = options.max ?? DEFAULT_MAX;
+    const ipMax = options.ipMax ?? Math.max(DEFAULT_IP_MAX, max);
+    const accountFrom = options.accountFrom ?? [];
+    return async (req, res, next) => {
+        if (!hasProvider()) {
+            logger.warn(`Rate-limit provider not bonded; auth endpoint "${scope}" is running unthrottled. ` +
+                'Wire @molecule/api-rate-limit-memory (or -redis) to enable brute-force protection.');
+            return next();
+        }
+        try {
+            // Each bucket carries its own ceiling: the per-IP bucket is generous (so
+            // shared public IPs aren't locked out) while each per-account bucket is
+            // tight (the real brute-force gate). `configure` is applied right before
+            // each `consume` so the bucket-specific limit is in effect for it.
+            const buckets = [
+                { key: `auth:${scope}:ip:${resolveIp(req)}`, max: ipMax },
+                ...[...new Set(accountFrom.map((extract) => extract(req)).filter(Boolean))].map((value) => ({ key: `auth:${scope}:acct:${value.toLowerCase()}`, max })),
+            ];
+            let tightest;
+            let limited;
+            for (const bucket of buckets) {
+                configure({ windowMs, max: bucket.max });
+                const result = await consume(bucket.key);
+                if (!tightest || result.remaining < tightest.remaining) {
+                    tightest = result;
+                }
+                if (!result.allowed && (!limited || (result.retryAfter ?? 0) > (limited.retryAfter ?? 0))) {
+                    limited = result;
+                }
+            }
+            if (tightest) {
+                res.setHeader('RateLimit-Limit', String(tightest.total));
+                res.setHeader('RateLimit-Remaining', String(tightest.remaining));
+                res.setHeader('RateLimit-Reset', String(Math.ceil(tightest.resetAt.getTime() / 1000)));
+            }
+            if (limited) {
+                res.setHeader('Retry-After', String(limited.retryAfter ?? 1));
+                res.status(429).json({
+                    error: t('user.error.tooManyRequests', undefined, {
+                        defaultValue: 'Too many attempts. Please wait and try again.',
+                    }),
+                    errorKey: 'user.error.tooManyRequests',
+                });
+                return;
+            }
+        }
+        catch (error) {
+            // A rate-limit infrastructure failure (e.g. Redis down) must never lock
+            // out legitimate users: log and let the request through. The handler
+            // still enforces credentials/authorization.
+            logger.error(`Rate-limit check failed for auth endpoint "${scope}"`, { error });
+            return next();
+        }
+        return next();
+    };
+};
+/**
+ * Account-identifier extractor for the login endpoint: the submitted username
+ * or email. Bucketing on this temp-locks a single targeted account after `max`
+ * failed attempts even across rotating IPs (which also covers TOTP-via-login
+ * brute force, since the login handler verifies the second factor).
+ *
+ * @param req - The incoming request.
+ * @returns The submitted username or email (if present).
+ */
+export const loginAccountKey = (req) => {
+    const body = (req.body ?? {});
+    const username = typeof body.username === 'string' ? body.username : undefined;
+    const email = typeof body.email === 'string' ? body.email : undefined;
+    return username || email;
+};
+/**
+ * Account-identifier extractor for the forgot-password endpoint: the submitted
+ * email.
+ *
+ * @param req - The incoming request.
+ * @returns The submitted email (if present).
+ */
+export const emailAccountKey = (req) => {
+    const body = (req.body ?? {});
+    return typeof body.email === 'string' ? body.email : undefined;
+};
+/**
+ * Account-identifier extractor for the verify-two-factor endpoint: the target
+ * user id in the route params. Temp-locks the second factor per account after
+ * `max` consecutive misses.
+ *
+ * @param req - The incoming request.
+ * @returns The target user id (if present).
+ */
+export const paramIdAccountKey = (req) => {
+    const id = req.params?.id;
+    return typeof id === 'string' ? id : undefined;
+};
+//# sourceMappingURL=rateLimit.js.map

package/dist/authorizers/rateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/authorizers/rateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAA;AAEtC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAG1E,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;AAE1B,6DAA6D;AAC7D,MAAM,iBAAiB,GAAG,EAAE,GAAG,MAAM,CAAA;AAErC,gFAAgF;AAChF,MAAM,WAAW,GAAG,EAAE,CAAA;AAEtB;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,EAAE,CAAA;AA2CzB;;;;;;;;GAQG;AACH,MAAM,SAAS,GAAG,CAAC,GAAoB,EAAU,EAAE;IACjD,OAAO,GAAG,CAAC,EAAE,IAAI,SAAS,CAAA;AAC5B,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAA6B,EAA0B,EAAE;IACjF,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAA;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,WAAW,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,CAAA;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAA;IAE7C,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CACT,kDAAkD,KAAK,4BAA4B;gBACjF,oFAAoF,CACvF,CAAA;YACD,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QAED,IAAI,CAAC;YACH,yEAAyE;YACzE,wEAAwE;YACxE,yEAAyE;YACzE,mEAAmE;YACnE,MAAM,OAAO,GAAgD;gBAC3D,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE;gBACzD,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC,CAAC,CAAC,GAAG,CACzF,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,KAAK,SAAS,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CACvE;aACF,CAAA;YAED,IAAI,QAAqC,CAAA;YACzC,IAAI,OAAoC,CAAA;YACxC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,SAAS,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;gBACxC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACxC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;oBACvD,QAAQ,GAAG,MAAM,CAAA;gBACnB,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC1F,OAAO,GAAG,MAAM,CAAA;gBAClB,CAAC;YACH,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;gBACxD,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;gBAChE,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACxF,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAA;gBAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,CAAC,CAAC,4BAA4B,EAAE,SAAS,EAAE;wBAChD,YAAY,EAAE,+CAA+C;qBAC9D,CAAC;oBACF,QAAQ,EAAE,4BAA4B;iBACvC,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,qEAAqE;YACrE,4CAA4C;YAC5C,MAAM,CAAC,KAAK,CAAC,8CAA8C,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YAC/E,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QAED,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAoB,EAAsB,EAAE;IAC1E,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4C,CAAA;IACxE,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9E,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IACrE,OAAO,QAAQ,IAAI,KAAK,CAAA;AAC1B,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAoB,EAAsB,EAAE;IAC1E,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwB,CAAA;IACpD,OAAO,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAChE,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAoB,EAAsB,EAAE;IAC5E,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,CAAA;IACzB,OAAO,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAChD,CAAC,CAAA"}

package/dist/authorizers/requireWebhookAuthenticity.d.ts

@@ -0,0 +1,23 @@
+import type { MoleculeRequestHandler } from '@molecule/api-resource';
+/**
+ * Middleware guarding the public `POST /users/payment-notification/:provider`
+ * endpoint against forged server-to-server (Apple/Google IAP) notifications.
+ *
+ * Self-verifying webhook providers (e.g. Stripe) authenticate the payload by
+ * cryptographic signature INSIDE the handler (`constructEvent`), so they pass
+ * through untouched.
+ *
+ * Server-to-server providers (Apple/Google RTDN) carry no transport signature —
+ * their endpoint is otherwise open to anyone — so a shared secret is REQUIRED by
+ * default ("IAP apps are not open by default"). The secret is supplied via the
+ * `x-payment-notification-secret` header or `?secret=` query param (configure
+ * the provider's notification URL accordingly) and is compared in constant time
+ * against `PAYMENT_NOTIFICATION_SECRET`. Deployments that rely solely on the
+ * provider's in-handler receipt re-verification can opt out with
+ * `PAYMENT_NOTIFICATION_REQUIRE_SECRET=false` — but the secure behavior ships ON
+ * by default and is never relaxed based on request presence.
+ *
+ * @returns An Express-compatible middleware function.
+ */
+export declare const requireWebhookAuthenticity: () => MoleculeRequestHandler;
+//# sourceMappingURL=requireWebhookAuthenticity.d.ts.map

package/dist/authorizers/requireWebhookAuthenticity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requireWebhookAuthenticity.d.ts","sourceRoot":"","sources":["../../src/authorizers/requireWebhookAuthenticity.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAmBpE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,0BAA0B,QAAO,sBA2C7C,CAAA"}

package/dist/authorizers/requireWebhookAuthenticity.js

@@ -0,0 +1,76 @@
+import crypto from 'node:crypto';
+import { get } from '@molecule/api-bond';
+import { get as getConfig } from '@molecule/api-config';
+import { t } from '@molecule/api-i18n';
+/**
+ * Constant-time string comparison. Returns `false` on length mismatch and
+ * otherwise uses `crypto.timingSafeEqual`, so the shared-secret check does not
+ * leak via comparison timing.
+ * @param a - First string.
+ * @param b - Second string.
+ * @returns `true` if the strings are equal.
+ */
+const timingSafeEqualString = (a, b) => {
+    const ab = Buffer.from(a);
+    const bb = Buffer.from(b);
+    if (ab.length !== bb.length) {
+        return false;
+    }
+    return crypto.timingSafeEqual(ab, bb);
+};
+/**
+ * Middleware guarding the public `POST /users/payment-notification/:provider`
+ * endpoint against forged server-to-server (Apple/Google IAP) notifications.
+ *
+ * Self-verifying webhook providers (e.g. Stripe) authenticate the payload by
+ * cryptographic signature INSIDE the handler (`constructEvent`), so they pass
+ * through untouched.
+ *
+ * Server-to-server providers (Apple/Google RTDN) carry no transport signature —
+ * their endpoint is otherwise open to anyone — so a shared secret is REQUIRED by
+ * default ("IAP apps are not open by default"). The secret is supplied via the
+ * `x-payment-notification-secret` header or `?secret=` query param (configure
+ * the provider's notification URL accordingly) and is compared in constant time
+ * against `PAYMENT_NOTIFICATION_SECRET`. Deployments that rely solely on the
+ * provider's in-handler receipt re-verification can opt out with
+ * `PAYMENT_NOTIFICATION_REQUIRE_SECRET=false` — but the secure behavior ships ON
+ * by default and is never relaxed based on request presence.
+ *
+ * @returns An Express-compatible middleware function.
+ */
+export const requireWebhookAuthenticity = () => (req, res, next) => {
+    try {
+        const rawProvider = req.params.provider;
+        const providerName = (Array.isArray(rawProvider) ? rawProvider[0] : rawProvider);
+        const provider = providerName ? get('payments', providerName) : null;
+        // Self-verifying webhook providers (Stripe) verify the signature in the
+        // handler — let them through.
+        if (provider &&
+            (provider.notificationFlow === 'webhook' ||
+                (!provider.notificationFlow && provider.handleWebhookEvent))) {
+            return next();
+        }
+        // Explicit opt-out for operators relying on in-provider receipt
+        // re-verification (Apple/Google) instead of an edge secret.
+        const requireSecret = getConfig('PAYMENT_NOTIFICATION_REQUIRE_SECRET', 'true') !== 'false';
+        if (!requireSecret) {
+            return next();
+        }
+        const configured = getConfig('PAYMENT_NOTIFICATION_SECRET', '') || '';
+        const headerVal = req.headers['x-payment-notification-secret'];
+        const headerSecret = Array.isArray(headerVal) ? headerVal[0] : headerVal;
+        const querySecret = typeof req.query?.secret === 'string' ? req.query.secret : undefined;
+        const supplied = headerSecret || querySecret;
+        if (configured && supplied && timingSafeEqualString(configured, supplied)) {
+            return next();
+        }
+    }
+    catch (_error) {
+        // Any failure resolving the provider/secret falls through to the safe
+        // reject below — fail closed, never open.
+    }
+    return next(t('user.error.webhookUnauthorized', undefined, {
+        defaultValue: 'Unauthorized payment notification',
+    }));
+};
+//# sourceMappingURL=requireWebhookAuthenticity.js.map

package/dist/authorizers/requireWebhookAuthenticity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requireWebhookAuthenticity.js","sourceRoot":"","sources":["../../src/authorizers/requireWebhookAuthenticity.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAEhC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAA;AACxC,OAAO,EAAE,GAAG,IAAI,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAA;AAItC;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;IAC9D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACzB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACzB,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;AACvC,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAA2B,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACzF,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAA;QACvC,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAC3D,CAAA;QACpB,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAkB,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAErF,wEAAwE;QACxE,8BAA8B;QAC9B,IACE,QAAQ;YACR,CAAC,QAAQ,CAAC,gBAAgB,KAAK,SAAS;gBACtC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,IAAI,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAC9D,CAAC;YACD,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QAED,gEAAgE;QAChE,4DAA4D;QAC5D,MAAM,aAAa,GACjB,SAAS,CAAS,qCAAqC,EAAE,MAAM,CAAC,KAAK,OAAO,CAAA;QAC9E,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QAED,MAAM,UAAU,GAAG,SAAS,CAAS,6BAA6B,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;QAC7E,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAA;QAC9D,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACxE,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;QACxF,MAAM,QAAQ,GAAG,YAAY,IAAI,WAAW,CAAA;QAE5C,IAAI,UAAU,IAAI,QAAQ,IAAI,qBAAqB,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC1E,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;IACH,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,sEAAsE;QACtE,0CAA0C;IAC5C,CAAC;IACD,OAAO,IAAI,CACT,CAAC,CAAC,gCAAgC,EAAE,SAAS,EAAE;QAC7C,YAAY,EAAE,mCAAmC;KAClD,CAAC,CACH,CAAA;AACH,CAAC,CAAA"}

package/dist/browser-guard.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=browser-guard.d.ts.map

package/dist/browser-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-guard.d.ts","sourceRoot":"","sources":["../src/browser-guard.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,CAAA"}

package/dist/browser-guard.js

@@ -0,0 +1,19 @@
+/**
+ * Browser guard — `@molecule/api-resource-user` is SERVER-ONLY.
+ *
+ * Generated by scripts/gen-browser-guards.mjs (workspace root) — edit THAT, not this.
+ * Evaluating a server package in a browser bundle is always an import-graph mistake
+ * (node APIs, secrets); without this guard it surfaces as a cryptic downstream crash
+ * ("Buffer is not defined") far from the culprit. Throwing here names the package and
+ * the fix at the exact moment the client bundle evaluates it. jsdom tests and SSR are
+ * unaffected: the throw requires browser globals AND the absence of a node runtime.
+ */
+const g = globalThis;
+if (g.window !== undefined && g.document !== undefined && !g.process?.versions?.node) {
+    throw new Error('@molecule/api-resource-user is SERVER-ONLY: it was bundled into browser/client code. Import it only ' +
+        'from server code (a server route/function or your API), or dynamic-import it inside ' +
+        'the server handler — never from components or shared client modules, and never ' +
+        'polyfill Buffer/process to silence this.');
+}
+export {};
+//# sourceMappingURL=browser-guard.js.map

package/dist/browser-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-guard.js","sourceRoot":"","sources":["../src/browser-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,GAAG,UAIT,CAAA;AACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACrF,MAAM,IAAI,KAAK,CACb,sGAAsG;QACpG,sFAAsF;QACtF,iFAAiF;QACjF,0CAA0C,CAC7C,CAAA;AACH,CAAC"}

package/dist/handlers/create.d.ts

@@ -0,0 +1,52 @@
+import type { MoleculeRequest, MoleculeResponse } from '@molecule/api-resource';
+import type * as types from '../types.js';
+/** Request body for user creation, including password and optional device name. */
+export interface CreateRequest extends MoleculeRequest {
+    body: types.CreateProps & {
+        password?: string;
+        deviceName?: string;
+    };
+}
+/**
+ * Creates a user with username and password. Validates username uniqueness and email format,
+ * hashes the password into a separate secrets table, creates a session device via the bonded
+ * DeviceService, and sets JWT authorization on the response.
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.name - The resource name.
+ * @param resource.tableName - The database table name for users.
+ * @param resource.schema - The validation schema for user properties.
+ * @returns A request handler that responds with `{ statusCode: 201, body: { props } }` on success.
+ */
+export declare const create: ({ name, tableName, schema }: types.Resource) => (req: CreateRequest, res: MoleculeResponse) => Promise<{
+    statusCode: number;
+    body: {
+        error: string;
+        errorKey: string;
+        props?: undefined;
+    };
+} | {
+    statusCode: number;
+    body: {
+        props: import("@molecule/api-resource/types").Props & Record<string, unknown>;
+        error?: undefined;
+        errorKey?: undefined;
+    };
+} | {
+    statusCode: number;
+    body: {
+        props: (import("@molecule/api-resource/types").Props & Record<string, unknown>) | {
+            username?: string | undefined;
+            name?: string | undefined;
+            email?: string | null | undefined;
+            id: string;
+        };
+        accessToken: string | null;
+        user: (import("@molecule/api-resource/types").Props & Record<string, unknown>) | {
+            username?: string | undefined;
+            name?: string | undefined;
+            email?: string | null | undefined;
+            id: string;
+        };
+    };
+}>;
+//# sourceMappingURL=create.d.ts.map

package/dist/handlers/create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/handlers/create.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAI/E,OAAO,KAAK,KAAK,KAAK,MAAM,aAAa,CAAA;AAMzC,mFAAmF;AACnF,MAAM,WAAW,aAAc,SAAQ,eAAe;IACpD,IAAI,EAAE,KAAK,CAAC,WAAW,GAAG;QACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACF;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,MAAM,GAAI,6BAA6B,KAAK,CAAC,QAAQ,MAOlD,KAAK,aAAa,EAAE,KAAK,gBAAgB;;;;;aAAf,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;EA4M1C,CAAA"}