@molecule/api-resource-user 1.0.0

package/dist/handlers/logIn.js

@@ -0,0 +1,223 @@
+import crypto from 'node:crypto';
+import { get, getAnalytics, getLogger } from '@molecule/api-bond';
+import { findById, findOne, updateById } from '@molecule/api-database';
+import { t } from '@molecule/api-i18n';
+import { compare, hash } from '@molecule/api-password';
+import * as authorization from '../authorization.js';
+import { hashResetToken } from '../utilities/hashResetToken.js';
+import { normalizeEmail } from '../utilities/normalizeEmail.js';
+import { notify } from '../utilities/notify.js';
+const analytics = getAnalytics();
+const logger = getLogger();
+/**
+ * Cached, real bcrypt hash used for the dummy compare on the user-not-found path.
+ *
+ * Computed lazily (not at import time) via the password bond — which honors the
+ * configured cost (`SALT_ROUNDS`) — because the bond may not be wired when this
+ * module loads. A previous implementation used a hardcoded literal that was
+ * structurally malformed (54 chars after the cost prefix instead of 53), so
+ * `compare()` short-circuited to `false` in ~0ms WITHOUT running the KDF,
+ * defeating the timing-equalization defense and reintroducing a user-enumeration
+ * oracle. Deriving the dummy hash from the bond's `hash()` guarantees it is
+ * valid and matches the exact work factor of real password hashes.
+ */
+let dummyHash;
+/**
+ * Logs in a user by username or email. Supports password authentication, password reset token
+ * authentication (1-hour expiry), and optional two-factor verification via `@molecule/api-two-factor`.
+ * On success, creates/updates a device via the bonded DeviceService, sets JWT authorization,
+ * and notifies other devices about the new login.
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.name - The resource name.
+ * @param resource.tableName - The database table name for users.
+ * @param resource.schema - The validation schema for user properties.
+ * @returns A request handler that responds with `{ statusCode: 200, body: { props } }` on success,
+ *   or `{ statusCode: 206, body: { twoFactorRequired: true } }` when 2FA is needed.
+ */
+export const logIn = ({ name: _name, tableName, schema: _schema }) => {
+    return async (req, res) => {
+        const { body } = req;
+        try {
+            // Get the user by username or email.
+            let user;
+            if (body.username) {
+                user =
+                    (await findOne(tableName, [
+                        { field: 'username', operator: '=', value: body.username },
+                    ])) ?? undefined;
+            }
+            else if (body.email) {
+                // Emails are stored normalized (lowercased) at signup — look them up the
+                // same way, or a mixed-case login (`User@x.com`) never matches its stored
+                // lowercase form and the user is locked out of their own account.
+                const normalizedEmail = normalizeEmail(body.email);
+                if (normalizedEmail) {
+                    user =
+                        (await findOne(tableName, [
+                            { field: 'email', operator: '=', value: normalizedEmail },
+                        ])) ?? undefined;
+                }
+            }
+            if (!user) {
+                // Perform a dummy password compare to prevent timing-based user enumeration.
+                // Without this, the ~100-300ms difference between "user not found" (instant)
+                // and "wrong password" (bcrypt cost) reveals whether an account exists.
+                // The dummy hash MUST be a real, correctly-costed hash so the KDF actually
+                // runs at the same work factor as the wrong-password path (see dummyHash docs).
+                if (body.password) {
+                    try {
+                        dummyHash ??= await hash('molecule-dummy-password');
+                        await compare(body.password, dummyHash);
+                    }
+                    catch (_error) {
+                        // Best-effort timing equalizer only: a hashing/compare failure must not
+                        // alter the response or surface an error — the not-found path always
+                        // returns the same generic invalid-credentials result below.
+                    }
+                }
+                analytics
+                    .track({ name: 'user.login_failed', properties: { reason: 'invalid_credentials' } })
+                    .catch(() => { });
+                return {
+                    statusCode: 403,
+                    body: {
+                        error: t('user.error.invalidCredentials'),
+                        errorKey: 'user.error.invalidCredentials',
+                    },
+                };
+            }
+            // Get the user's secrets.
+            const secrets = await findById(`${tableName}Secrets`, user.id);
+            if (!secrets) {
+                return {
+                    statusCode: 403,
+                    body: {
+                        error: t('user.error.invalidCredentials'),
+                        errorKey: 'user.error.invalidCredentials',
+                    },
+                };
+            }
+            let authenticated = false;
+            // Try password authentication.
+            if (body.password && secrets.passwordHash) {
+                authenticated = await compare(body.password, secrets.passwordHash);
+            }
+            // Try password reset token (constant-time comparison to prevent timing
+            // attacks). The stored value is sha256(token) — hash the incoming one.
+            if (!authenticated && body.passwordResetToken && secrets.passwordResetToken) {
+                const a = Buffer.from(hashResetToken(body.passwordResetToken), 'utf-8');
+                const b = Buffer.from(secrets.passwordResetToken, 'utf-8');
+                if (a.length === b.length && crypto.timingSafeEqual(a, b)) {
+                    // Check if the token is still valid (within 1 hour).
+                    if (secrets.passwordResetTokenAt) {
+                        const tokenAge = Date.now() - new Date(secrets.passwordResetTokenAt).getTime();
+                        if (tokenAge < 1000 * 60 * 60) {
+                            // Clear the reset token BEFORE granting auth to prevent concurrent
+                            // replay — two requests with the same token must not both succeed.
+                            await updateById(`${tableName}Secrets`, user.id, {
+                                passwordResetToken: null,
+                                passwordResetTokenAt: null,
+                            });
+                            authenticated = true;
+                        }
+                    }
+                }
+            }
+            if (!authenticated) {
+                analytics
+                    .track({ name: 'user.login_failed', properties: { reason: 'invalid_credentials' } })
+                    .catch(() => { });
+                return {
+                    statusCode: 403,
+                    body: {
+                        error: t('user.error.invalidCredentials'),
+                        errorKey: 'user.error.invalidCredentials',
+                    },
+                };
+            }
+            // Check for two-factor authentication.
+            if (user.twoFactorEnabled && secrets.twoFactorSecret) {
+                if (!body.twoFactorToken) {
+                    analytics.track({ name: 'user.two_factor_required', userId: user.id }).catch(() => { });
+                    return { statusCode: 206, body: { twoFactorRequired: true } };
+                }
+                try {
+                    const twoFactor = await import('@molecule/api-two-factor');
+                    const verifyResult = await twoFactor.verify({
+                        secret: secrets.twoFactorSecret,
+                        token: body.twoFactorToken,
+                        // Reject a code whose time step was already consumed (replay protection).
+                        afterTimeStep: secrets.lastTwoFactorTimeStep,
+                    });
+                    if (!verifyResult.valid) {
+                        analytics.track({ name: 'user.two_factor_failed', userId: user.id }).catch(() => { });
+                        return {
+                            statusCode: 403,
+                            body: {
+                                error: t('user.error.invalidTwoFactorToken'),
+                                errorKey: 'user.error.invalidTwoFactorToken',
+                            },
+                        };
+                    }
+                    // Persist the consumed time step so the same code cannot be replayed
+                    // on another session/endpoint within its validity window.
+                    if (verifyResult.timeStep !== undefined) {
+                        await updateById(`${tableName}Secrets`, user.id, {
+                            lastTwoFactorTimeStep: verifyResult.timeStep,
+                        });
+                    }
+                }
+                catch (error) {
+                    logger.error('2FA verification failed:', error);
+                    return {
+                        statusCode: 500,
+                        body: {
+                            error: t('user.error.twoFactorVerificationUnavailable'),
+                            errorKey: 'user.error.twoFactorVerificationUnavailable',
+                        },
+                    };
+                }
+            }
+            // Create or update device.
+            const deviceId = await get('device')?.createOrUpdate(user.id, body.deviceName || 'Unknown');
+            if (!deviceId) {
+                return {
+                    statusCode: 500,
+                    body: {
+                        error: t('user.error.failedToCreateSession'),
+                        errorKey: 'user.error.failedToCreateSession',
+                    },
+                };
+            }
+            // Set authorization.
+            const accessToken = authorization.set(req, res, { userId: user.id, deviceId });
+            // Notify other devices about the login.
+            notify({
+                userId: user.id,
+                deviceId,
+                title: t('user.notification.newLogin', undefined, {
+                    locale: user?.locale || 'en',
+                }),
+                titleKey: 'user.notification.newLogin',
+                body: t('user.notification.newLoginBody', { deviceName: body.deviceName || 'Unknown' }, { locale: user?.locale || 'en' }),
+                bodyKey: 'user.notification.newLoginBody',
+            }).catch(() => { });
+            analytics
+                .track({
+                name: 'user.login',
+                userId: user.id,
+                properties: { method: body.passwordResetToken ? 'reset_token' : 'password' },
+            })
+                .catch(() => { });
+            return { statusCode: 200, body: { props: user, accessToken, user } };
+        }
+        catch (error) {
+            logger.error(error);
+            return {
+                statusCode: 500,
+                body: { error: t('user.error.loginFailed'), errorKey: 'user.error.loginFailed' },
+            };
+        }
+    };
+};
+//# sourceMappingURL=logIn.js.map

package/dist/handlers/logIn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logIn.js","sourceRoot":"","sources":["../../src/handlers/logIn.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAEhC,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACjE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACtE,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAA;AAGtD,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAA;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAE/C,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;AAChC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;AAE1B;;;;;;;;;;;GAWG;AACH,IAAI,SAA6B,CAAA;AAcjC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAkB,EAAE,EAAE;IACnF,OAAO,KAAK,EAAE,GAAiB,EAAE,GAAqB,EAAE,EAAE;QACxD,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAA;QAEpB,IAAI,CAAC;YACH,qCAAqC;YACrC,IAAI,IAA6B,CAAA;YAEjC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,IAAI;oBACF,CAAC,MAAM,OAAO,CAAc,SAAS,EAAE;wBACrC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;qBAC3D,CAAC,CAAC,IAAI,SAAS,CAAA;YACpB,CAAC;iBAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACtB,yEAAyE;gBACzE,0EAA0E;gBAC1E,kEAAkE;gBAClE,MAAM,eAAe,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAClD,IAAI,eAAe,EAAE,CAAC;oBACpB,IAAI;wBACF,CAAC,MAAM,OAAO,CAAc,SAAS,EAAE;4BACrC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE;yBAC1D,CAAC,CAAC,IAAI,SAAS,CAAA;gBACpB,CAAC;YACH,CAAC;YAED,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,6EAA6E;gBAC7E,6EAA6E;gBAC7E,wEAAwE;gBACxE,2EAA2E;gBAC3E,gFAAgF;gBAChF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAClB,IAAI,CAAC;wBACH,SAAS,KAAK,MAAM,IAAI,CAAC,yBAAyB,CAAC,CAAA;wBACnD,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;oBACzC,CAAC;oBAAC,OAAO,MAAM,EAAE,CAAC;wBAChB,wEAAwE;wBACxE,qEAAqE;wBACrE,6DAA6D;oBAC/D,CAAC;gBACH,CAAC;gBACD,SAAS;qBACN,KAAK,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,CAAC;qBACnF,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBAClB,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,+BAA+B,CAAC;wBACzC,QAAQ,EAAE,+BAA+B;qBAC1C;iBACF,CAAA;YACH,CAAC;YAED,0BAA0B;YAC1B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAoB,GAAG,SAAS,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;YAEjF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,+BAA+B,CAAC;wBACzC,QAAQ,EAAE,+BAA+B;qBAC1C;iBACF,CAAA;YACH,CAAC;YAED,IAAI,aAAa,GAAG,KAAK,CAAA;YAEzB,+BAA+B;YAC/B,IAAI,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC1C,aAAa,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;YACpE,CAAC;YAED,uEAAuE;YACvE,uEAAuE;YACvE,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC5E,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC,CAAA;gBACvE,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAA;gBAC1D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;oBAC1D,qDAAqD;oBACrD,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;wBACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAA;wBAC9E,IAAI,QAAQ,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;4BAC9B,mEAAmE;4BACnE,mEAAmE;4BACnE,MAAM,UAAU,CAAC,GAAG,SAAS,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE;gCAC/C,kBAAkB,EAAE,IAAI;gCACxB,oBAAoB,EAAE,IAAI;6BAC3B,CAAC,CAAA;4BACF,aAAa,GAAG,IAAI,CAAA;wBACtB,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,SAAS;qBACN,KAAK,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,CAAC;qBACnF,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBAClB,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,+BAA+B,CAAC;wBACzC,QAAQ,EAAE,+BAA+B;qBAC1C;iBACF,CAAA;YACH,CAAC;YAED,uCAAuC;YACvC,IAAI,IAAI,CAAC,gBAAgB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;gBACrD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;oBACzB,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;oBACtF,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,CAAA;gBAC/D,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAA;oBAC1D,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC;wBAC1C,MAAM,EAAE,OAAO,CAAC,eAAe;wBAC/B,KAAK,EAAE,IAAI,CAAC,cAAc;wBAC1B,0EAA0E;wBAC1E,aAAa,EAAE,OAAO,CAAC,qBAAqB;qBAC7C,CAAC,CAAA;oBAEF,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;wBACxB,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;wBACpF,OAAO;4BACL,UAAU,EAAE,GAAG;4BACf,IAAI,EAAE;gCACJ,KAAK,EAAE,CAAC,CAAC,kCAAkC,CAAC;gCAC5C,QAAQ,EAAE,kCAAkC;6BAC7C;yBACF,CAAA;oBACH,CAAC;oBAED,qEAAqE;oBACrE,0DAA0D;oBAC1D,IAAI,YAAY,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;wBACxC,MAAM,UAAU,CAAC,GAAG,SAAS,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE;4BAC/C,qBAAqB,EAAE,YAAY,CAAC,QAAQ;yBAC7C,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;oBAC/C,OAAO;wBACL,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CAAC,6CAA6C,CAAC;4BACvD,QAAQ,EAAE,6CAA6C;yBACxD;qBACF,CAAA;gBACH,CAAC;YACH,CAAC;YAED,2BAA2B;YAC3B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAEvB,QAAQ,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,CAAA;YAEnE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,kCAAkC,CAAC;wBAC5C,QAAQ,EAAE,kCAAkC;qBAC7C;iBACF,CAAA;YACH,CAAC;YAED,qBAAqB;YACrB,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;YAE9E,wCAAwC;YACxC,MAAM,CAAC;gBACL,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ;gBACR,KAAK,EAAE,CAAC,CAAC,4BAA4B,EAAE,SAAS,EAAE;oBAChD,MAAM,EAAI,IAAgC,EAAE,MAAiB,IAAI,IAAI;iBACtE,CAAC;gBACF,QAAQ,EAAE,4BAA4B;gBACtC,IAAI,EAAE,CAAC,CACL,gCAAgC,EAChC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS,EAAE,EAC5C,EAAE,MAAM,EAAI,IAAgC,EAAE,MAAiB,IAAI,IAAI,EAAE,CAC1E;gBACD,OAAO,EAAE,gCAAgC;aAC1C,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAElB,SAAS;iBACN,KAAK,CAAC;gBACL,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,EAAE;aAC7E,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAElB,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAA;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACnB,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,wBAAwB,EAAE;aACjF,CAAA;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA"}

package/dist/handlers/logInOAuth.d.ts

@@ -0,0 +1,66 @@
+import type { MoleculeRequest, MoleculeResponse } from '@molecule/api-resource';
+import type * as types from '../types.js';
+/** Request body for OAuth login, including the OAuth server name, authorization code, and PKCE verifier. */
+export interface LogInOAuthRequest extends MoleculeRequest {
+    body: {
+        server?: string;
+        code?: string;
+        state?: string;
+        codeVerifier?: string;
+        redirect_uri?: string;
+        deviceName?: string;
+    };
+}
+/**
+ * Logs in or creates a user via OAuth. Verifies the authorization code with the bonded OAuth
+ * provider (`get('oauth', serverName)`), then either finds an existing user by oauthServer+oauthId
+ * or creates a new one with a unique username. Sets JWT authorization and creates a session device.
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.name - The resource name.
+ * @param resource.tableName - The database table name for users.
+ * @param resource.schema - The validation schema for user properties.
+ * @returns A request handler that responds with `{ statusCode: 200, body: { props } }` on success.
+ */
+export declare const logInOAuth: ({ name, tableName, schema }: types.Resource) => (req: LogInOAuthRequest, res: MoleculeResponse) => Promise<{
+    statusCode: number;
+    body: {
+        error: string;
+        errorKey: string;
+        twoFactorRequired?: undefined;
+        props?: undefined;
+    };
+} | {
+    statusCode: number;
+    body: {
+        error: string;
+        errorKey: string;
+        twoFactorRequired: boolean;
+        props?: undefined;
+    };
+} | {
+    statusCode: number;
+    body: {
+        props: {
+            id: string;
+            createdAt: string;
+            updatedAt: string;
+            username?: string | undefined;
+            name?: string | undefined;
+            email?: string | null | undefined;
+            emailVerified?: boolean | undefined;
+            avatar?: string | null | undefined;
+            bio?: string | null | undefined;
+            twoFactorEnabled?: boolean | undefined;
+            oauthServer?: string | undefined;
+            oauthId?: string | undefined;
+            oauthData?: Record<string, unknown> | undefined;
+            planKey?: string | undefined;
+            planExpiresAt?: string | undefined;
+            planAutoRenews?: boolean | undefined;
+        };
+        error?: undefined;
+        errorKey?: undefined;
+        twoFactorRequired?: undefined;
+    };
+}>;
+//# sourceMappingURL=logInOAuth.d.ts.map

package/dist/handlers/logInOAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logInOAuth.d.ts","sourceRoot":"","sources":["../../src/handlers/logInOAuth.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAI/E,OAAO,KAAK,KAAK,KAAK,MAAM,aAAa,CAAA;AAuBzC,4GAA4G;AAC5G,MAAM,WAAW,iBAAkB,SAAQ,eAAe;IACxD,IAAI,EAAE;QACJ,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACF;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,GAAI,6BAA6B,KAAK,CAAC,QAAQ,MAOtD,KAAK,iBAAiB,EAAE,KAAK,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAie5D,CAAA"}