@nxgt/janus-hono 0.7.3 → 0.7.5

package/README.md

@@ -37,7 +37,7 @@ bun add @nxgt/janus-hono @nxgt/janus hono
 ```
 
 Every peer is required: `@nxgt/janus`, `hono` (4.13.4 or later) and
-`typescript` (6). `@nxgt/janus` is a **peer**, never a dependency: this package
+`typescript` (6 or 7). `@nxgt/janus` is a **peer**, never a dependency: this package
 defines no error class, so the `JanusError` you catch is the one you import.
 Like `@nxgt/janus`, it expects `"moduleResolution": "bundler"`: the
 declarations import without extensions, so `nodenext` is not supported.

package/docs/guide/routes.md

@@ -618,7 +618,13 @@ app.post('/invitation/accept', csrf({ origin: ORIGIN }), async (c) => {
 	const invitation = await invitations.spend(hash(token), new Date()); // yours: once, unexpired
 	if (invitation === null) return c.json({ code: 'INVITATION_INVALID' }, 404);
 
-	const result = await auth.signInProven(invitation.userId, { device: deviceOf(c) });
+	// The invitation reached the inbox: prove it first — on an address never proved, this
+	// drops a password, a second factor and sessions somebody else set on it.
+	const user = await auth.get(invitation.userId);
+	if (user.email !== invitation.email) return c.json({ code: 'INVITATION_INVALID' }, 404);
+	await auth.verifyEmail.proveFirst(user);
+	// Then sign in — last, since proveFirst revokes every session.
+	const result = await auth.signInProven(user, { device: deviceOf(c) });
 	if (result.status === 'secondFactor') {
 		setCookie(c, CHALLENGE, result.challenge, { ...scope, expires: result.expiresAt });
 		return c.redirect('/sign-in/second-factor', 303);
@@ -628,6 +634,11 @@ app.post('/invitation/accept', csrf({ origin: ORIGIN }), async (c) => {
 });
 ```
 
+`verifyEmail.proveFirst` (`@nxgt/janus` 0.22) comes first, and before any
+`setPassword` your form makes: it drops the password and revokes every
+session. The check on `email` keeps it from proving an address the user
+changed since the invitation was sent.
+
 Not `magicLink.request` then `confirm` at once: `request` counts against
 the mail throttle per address, so five anonymous requests for the invitee's
 address would answer this route 429. See [`@nxgt/janus`'s

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@nxgt/janus-hono",
-	"version": "0.7.3",
+	"version": "0.7.5",
 	"description": "Hono middleware for @nxgt/janus: the signed-in user on every request, the session cookie, routes guarded by a permission, and every error as its status",
 	"license": "MIT",
 	"type": "module",
@@ -49,14 +49,14 @@
 		]
 	},
 	"devDependencies": {
-		"@nxgt/janus": "^0.21.0",
+		"@nxgt/janus": "^0.22.1",
 		"@types/bun": "^1.4.2",
 		"hono": "^4.13.9",
 		"zod": "^4.6.5"
 	},
 	"peerDependencies": {
-		"@nxgt/janus": "^0.21.0",
+		"@nxgt/janus": "^0.22.1",
 		"hono": "^4.13.4",
-		"typescript": "^6.0.3"
+		"typescript": "^6.0.3 || ^7.0.0"
 	}
 }