@nxgt/janus 0.11.0 → 0.13.0

package/dist/index.js

@@ -7,13 +7,13 @@ import {
   MAX_PAGE_SIZE2,
   pageLimit2,
   invalidCursor2
-} from "./chunks/index-5tm04t5p.js";
+} from "./chunks/index-jp2kka6d.js";
 import {
   mintId2,
   isId2,
   mintedAt2,
   createMemoryStores2
-} from "./chunks/index-4m49cye4.js";
+} from "./chunks/index-rd2rddvv.js";
 import {
   JanusError2,
   UserInvalidError2,
@@ -21,6 +21,7 @@ import {
   UserInactiveError2,
   TokenError2,
   SecondFactorError2,
+  StepUpRequiredError2,
   InvalidCursorError2,
   UnsupportedError2,
   PermissionDepthError2,
@@ -37,7 +38,7 @@ import {
   formatTuple2,
   parseTuple2,
   parseSubject2
-} from "./chunks/index-5e2fw7he.js";
+} from "./chunks/index-j2gd8fry.js";
 
 // src/auth/hashers.ts
 import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
@@ -382,7 +383,8 @@ function resolveTokenTtls(config, where) {
   return {
     verifyEmail: parseDuration(config.tokens?.verifyEmail ?? "24h", `${where}: tokens.verifyEmail`),
     resetPassword: parseDuration(config.tokens?.resetPassword ?? "1h", `${where}: tokens.resetPassword`),
-    signInCode: parseDuration(config.tokens?.signInCode ?? "10m", `${where}: tokens.signInCode`)
+    signInCode: parseDuration(config.tokens?.signInCode ?? "10m", `${where}: tokens.signInCode`),
+    stepUp: parseDuration(config.tokens?.stepUp ?? "10m", `${where}: tokens.stepUp`)
   };
 }
 // src/auth/context/create-context.ts
@@ -662,6 +664,7 @@ var REQUIRED = {
     "insertSession",
     "findSessionByTokenHash",
     "extendSession",
+    "reauthenticateSession",
     "revokeSession",
     "revokeUserSessions",
     "deleteUserSessions"
@@ -774,17 +777,24 @@ function headersOf(request) {
     return inner;
   return request;
 }
+// src/auth/sessions/standing.ts
+async function standingSession(context, request) {
+  const token = presentedToken(request, context.config.cookie.name);
+  if (token === null)
+    return null;
+  const session = await context.store.sessions.findSessionByTokenHash(hashSecret(token));
+  const now = context.clock.now().getTime();
+  return session === null || session.revokedAt !== null || session.expiresAt.getTime() <= now ? null : { token, session };
+}
+
 // src/auth/sessions/authenticate.ts
 async function authenticate(context, request, options) {
   const { store, clock, config } = context;
-  const token = presentedToken(request, config.cookie.name);
-  if (token === null)
+  const presented = await standingSession(context, request);
+  if (presented === null)
     return null;
-  const session = await store.sessions.findSessionByTokenHash(hashSecret(token));
+  const { token, session } = presented;
   const now = clock.now().getTime();
-  if (session === null || session.revokedAt !== null || session.expiresAt.getTime() <= now) {
-    return null;
-  }
   const user = await store.users.findUser(session.userId);
   if (user === null || !user.active || options?.type !== undefined && user.type !== options.type) {
     return null;
@@ -968,8 +978,12 @@ async function insertOneTime(context, token, code) {
   return { secret, expiresAt };
 }
 // src/auth/password-written.ts
-async function endSignInsWaiting(context, userId) {
-  await context.store.tokens.spendUserTokens(userId, "secondFactor", context.clock.now());
+async function endWhatThePasswordOpened(context, userId) {
+  const now = context.clock.now();
+  const spent = await Promise.allSettled(["resetPassword", "secondFactor"].map((kind) => context.store.tokens.spendUserTokens(userId, kind, now)));
+  const failed = spent.find((result) => result.status === "rejected");
+  if (failed !== undefined)
+    throw failed.reason;
 }
 async function heldByPassword(context, type, verified, password, result, where) {
   const now = await findRecord(context, verified.id, type.name);
@@ -1021,6 +1035,7 @@ function resetPasswordFlows(context, type, at) {
       if (record === null)
         return null;
       const issued = await issueEmailToken(context, type, "resetPassword", record, where);
+      await context.store.tokens.spendUserTokens(record.id, "resetPassword", context.clock.now(), hashSecret(issued.token));
       return { ...issued, user: toUser(record) };
     },
     async confirm(secret, password) {
@@ -1044,7 +1059,7 @@ async function confirmReset(context, type, secret, password, where) {
   });
   try {
     await context.store.sessions.revokeUserSessions(written.id, context.clock.now());
-    await endSignInsWaiting(context, written.id);
+    await endWhatThePasswordOpened(context, written.id);
   } finally {
     await emit(context, "user.passwordReset", written, written.updatedAt);
     if (newlyVerified) {
@@ -1411,10 +1426,10 @@ function accountOf(type, record, where) {
   return String(record.fields[type.password.login]);
 }
 
-// src/auth/second-factor/regenerate-attempts.ts
+// src/auth/second-factor/app-code-attempts.ts
 import { createHmac as createHmac3, hkdfSync as hkdfSync2 } from "node:crypto";
-var REGENERATE_WINDOW_MS = 15 * 60000;
-var WINDOW_MINUTES = REGENERATE_WINDOW_MS / 60000;
+var APP_CODE_WINDOW_MS = 15 * 60000;
+var WINDOW_MINUTES = APP_CODE_WINDOW_MS / 60000;
 var PURPOSE2 = "janus/second-factor/regenerate-attempts/v1";
 var MAX_LINKS = 32;
 var derived2 = new WeakMap;
@@ -1436,10 +1451,10 @@ function linkHash(sealer, record, window, link) {
   ];
   return hashSecret(createHmac3("sha256", counterKey(sealer)).update(parts.join("\x00")).digest("base64url"));
 }
-async function countRegenerateAttempt(context, sealer, record, where) {
+async function countAppCodeAttempt(context, sealer, record, where) {
   const now = context.clock.now().getTime();
-  const window = Math.floor(now / REGENERATE_WINDOW_MS);
-  const times = { now, expiresAt: (window + 2) * REGENERATE_WINDOW_MS };
+  const window = Math.floor(now / APP_CODE_WINDOW_MS);
+  const times = { now, expiresAt: (window + 2) * APP_CODE_WINDOW_MS };
   let spent = 0;
   for (let link = 0;link < MAX_LINKS; link += 1) {
     const hash = linkHash(sealer, record, window, link);
@@ -1493,7 +1508,7 @@ async function regenerateRecoveryCodes(context, type, user, code, options, where
     if (!isActive(factor)) {
       throw refusal(type, "SECOND_FACTOR_NOT_ENROLLED", "the user has no active second factor — recovery codes come with one", where, record);
     }
-    const left = await countRegenerateAttempt(context, configured.sealer, record, where);
+    const left = await countAppCodeAttempt(context, configured.sealer, record, where);
     const accepted = acceptCode(configured, record, factor, String(code), now, where);
     if (accepted === null) {
       throw codeInvalid(where, record.id, type.name, left);
@@ -1624,6 +1639,142 @@ async function confirmCode(context, type, finish, challenge, code, at) {
   return finish(proved, where);
 }
 
+// src/auth/step-up/codes.ts
+var spend = (context, secret, where) => spendOneTime(context, secret, "stepUp", where, "challenge");
+async function checkEmailedCode(context, type, user, counted, code, where) {
+  const { token, secret, attemptsLeft } = counted;
+  if (isActive(user.secondFactor)) {
+    await spend(context, secret, where);
+    throw new SecondFactorError2("SECOND_FACTOR_ACTIVE", `${where}: the user's second factor became active since the code was sent — request a step-up again`, { operation: where, userId: user.id, userType: type.name });
+  }
+  if (!codeMatches(token, secret, code)) {
+    if (attemptsLeft === 0)
+      await burnOneTime(context, secret, "stepUp");
+    throw codeInvalid(where, user.id, type.name, attemptsLeft);
+  }
+  await spend(context, secret, where);
+  refuseStale(type, user, token, where, "code");
+}
+async function checkAppCode(context, type, user, counted, code, where) {
+  const { secret, attemptsLeft } = counted;
+  const factor = user.secondFactor;
+  if (!isActive(factor)) {
+    await spend(context, secret, where);
+    throw new SecondFactorError2("SECOND_FACTOR_NOT_ENROLLED", `${where}: the user no longer has a second factor — request a step-up again`, { operation: where, userId: user.id, userType: type.name });
+  }
+  const configured = requireSettings(context, where, "the user's second factor is active");
+  const windowLeft = await countAppCodeAttempt(context, configured.sealer, user, where);
+  const now = context.clock.now();
+  const accepted = acceptCode(configured, user, factor, code, now, where);
+  if (accepted === null) {
+    if (attemptsLeft === 0)
+      await burnOneTime(context, secret, "stepUp");
+    throw codeInvalid(where, user.id, type.name, Math.min(attemptsLeft, windowLeft));
+  }
+  await context.store.users.updateUser(user.id, { secondFactor: accepted, updatedAt: now }, user.version);
+  await spend(context, secret, where);
+}
+
+// src/auth/step-up/open.ts
+async function openStepUp(context, type, request, token, secret, where) {
+  const session = (await standingSession(context, request))?.session ?? null;
+  if (session === null || session.userId !== token.userId) {
+    throw await unknownChallenge(context, token, secret, where);
+  }
+  const user = await findRecord(context, token.userId, type.name);
+  if (user === null) {
+    throw await unknownChallenge(context, token, secret, where);
+  }
+  if (!user.active) {
+    await spendOneTime(context, secret, "stepUp", where, "challenge");
+    throw new UserInactiveError2(`${where}: the user is inactive`, {
+      userId: user.id,
+      userType: type.name
+    });
+  }
+  return { session, user };
+}
+
+// src/auth/step-up/request.ts
+async function requestStepUp(context, type, user, where) {
+  const record = await getRecord(context, idOf(user), type.name, where);
+  if (!record.active) {
+    throw new UserInactiveError2(`${where}: the user is inactive`, {
+      userId: record.id,
+      userType: type.name
+    });
+  }
+  const issued = isActive(record.secondFactor) ? await byApp(context, record, where) : await byEmail(context, type, record, where);
+  await context.store.tokens.spendUserTokens(record.id, "stepUp", context.clock.now(), hashSecret(issued.challenge));
+  return issued;
+}
+async function byApp(context, record, where) {
+  requireSettings(context, where, "the user's second factor is active");
+  const { secret, expiresAt } = await issueOneTime(context, {
+    kind: "stepUp",
+    userId: record.id,
+    address: "",
+    ttlMs: context.config.tokenTtlMs.stepUp
+  });
+  return {
+    via: "secondFactor",
+    challenge: secret,
+    expiresAt,
+    user: toUser(record)
+  };
+}
+async function byEmail(context, type, record, where) {
+  const email = emailOf(type, record.fields);
+  if (email === null) {
+    throw new NotFoundError2(`${where}: the user has no e-mail`, {
+      userId: record.id,
+      userType: type.name,
+      operation: where
+    });
+  }
+  const { secret, code, expiresAt } = await issueCode(context, {
+    kind: "stepUp",
+    userId: record.id,
+    address: email,
+    ttlMs: context.config.tokenTtlMs.stepUp
+  });
+  return {
+    via: "email",
+    code,
+    challenge: secret,
+    email,
+    expiresAt,
+    user: toUser(record)
+  };
+}
+
+// src/auth/step-up/flows.ts
+function stepUpFlows(context, type, at) {
+  return {
+    async request(user) {
+      return requestStepUp(context, type, user, at("stepUp.request"));
+    },
+    async confirm(request, challenge, code) {
+      return confirmStepUp(context, type, request, String(challenge), String(code), at("stepUp.confirm"));
+    }
+  };
+}
+async function confirmStepUp(context, type, request, secret, code, where) {
+  const { token, attemptsLeft } = await countCodeAttempt(context, secret, "stepUp", where, type.name);
+  const { session, user } = await openStepUp(context, type, request, token, secret, where);
+  const counted = { token, secret, attemptsLeft };
+  if (token.codeHash === null) {
+    await checkAppCode(context, type, user, counted, code, where);
+  } else {
+    await checkEmailedCode(context, type, user, counted, code, where);
+  }
+  const confirmed = await context.store.sessions.reauthenticateSession(session.id, context.clock.now());
+  if (confirmed === null) {
+    throw new TokenError2("TOKEN_UNKNOWN", `${where}: the session was signed out while the code was checked`, { operation: where });
+  }
+  return toSession(confirmed);
+}
+
 // src/auth/users/by-login.ts
 var byLogin = async (context, type, login) => isStorable(login) ? context.store.users.findUserByLogin(type.name, login) : null;
 
@@ -1647,7 +1798,7 @@ async function changePassword(context, type, user, change, options, where) {
       }
     };
   });
-  await endSignInsWaiting(context, written.id);
+  await endWhatThePasswordOpened(context, written.id);
   return written;
 }
 
@@ -1738,7 +1889,7 @@ function passwordFlows(context, type, at, finish) {
       checkPassword(type, password, where);
       const hash = await requireHasher(context, where).hash(password);
       const written = await writeUser(context, user, type, options, where, (_, now) => ({ password: { hash, updatedAt: now } }));
-      await endSignInsWaiting(context, written.id);
+      await endWhatThePasswordOpened(context, written.id);
       return toUser(written);
     },
     async changePassword(user, change, options) {
@@ -1837,6 +1988,7 @@ function typeApi(context, type) {
     ...passwordFlows(context, type, at, secondFactor.finish),
     secondFactor: secondFactor.api,
     signInCode,
+    stepUp: stepUpFlows(context, type, at),
     ...emailFlows(context, type, at)
   };
 }
@@ -1873,6 +2025,14 @@ function janus(config) {
   const surface = resolved.single ? { ...shared, ...types.user } : { ...shared, ...types };
   return surface;
 }
+// src/auth/sessions/fresh.ts
+function assertFresh(session, maxAge, clock = systemClock) {
+  const maxAgeMs = parseDuration(maxAge, "assertFresh: maxAge");
+  const age = clock.now().getTime() - session.authenticatedAt.getTime();
+  if (age >= maxAgeMs) {
+    throw new StepUpRequiredError2("assertFresh: the session proved who it is longer ago than maxAge — confirm with a step-up", { userId: session.userId });
+  }
+}
 export {
   CredentialError2 as CredentialError,
   DEFAULT_PAGE_SIZE2 as DEFAULT_PAGE_SIZE,
@@ -1882,12 +2042,14 @@ export {
   NotFoundError2 as NotFoundError,
   PermissionDepthError2 as PermissionDepthError,
   SecondFactorError2 as SecondFactorError,
+  StepUpRequiredError2 as StepUpRequiredError,
   StoreConflict2 as StoreConflict,
   StoreFailure2 as StoreFailure,
   TokenError2 as TokenError,
   UnsupportedError2 as UnsupportedError,
   UserInactiveError2 as UserInactiveError,
   UserInvalidError2 as UserInvalidError,
+  assertFresh,
   assertStores,
   bunHasher,
   createMemoryStores2 as createMemoryStores,
@@ -1913,5 +2075,5 @@ export {
   systemClock
 };
 
-//# debugId=863D9CAB1F0683FA64756E2164756E21
+//# debugId=D61F9F351D899C2964756E2164756E21
 //# sourceMappingURL=index.js.map