@nxgt/janus 0.12.0 → 0.14.0

package/dist/index.js

@@ -7,13 +7,13 @@ import {
   MAX_PAGE_SIZE2,
   pageLimit2,
   invalidCursor2
-} from "./chunks/index-jp2kka6d.js";
+} from "./chunks/index-kj3st57z.js";
 import {
   mintId2,
   isId2,
   mintedAt2,
   createMemoryStores2
-} from "./chunks/index-rd2rddvv.js";
+} from "./chunks/index-baazjyvc.js";
 import {
   JanusError2,
   UserInvalidError2,
@@ -38,7 +38,7 @@ import {
   formatTuple2,
   parseTuple2,
   parseSubject2
-} from "./chunks/index-j2gd8fry.js";
+} from "./chunks/index-hnwggyxs.js";
 
 // src/auth/hashers.ts
 import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
@@ -296,6 +296,28 @@ function resolveSecondFactor(config, where) {
   };
 }
 
+// src/auth/config/resolve-sign-in.ts
+function resolveSignInThrottle(config, where) {
+  if (config !== undefined && (typeof config !== "object" || config === null)) {
+    throw new TypeError(`${where}: signIn must be an object — { throttle }`);
+  }
+  const throttle = config?.throttle ?? {};
+  if (throttle === false)
+    return null;
+  const at = `${where}: signIn.throttle`;
+  if (typeof throttle !== "object" || throttle === null) {
+    throw new TypeError(`${at} must be { attempts, window }, or false to count nothing`);
+  }
+  const attempts = throttle.attempts ?? 10;
+  if (!Number.isSafeInteger(attempts) || attempts < 1) {
+    throw new TypeError(`${at}.attempts must be a whole number above zero`);
+  }
+  return {
+    attempts,
+    windowMs: parseDuration(throttle.window ?? "15m", `${at}.window`)
+  };
+}
+
 // src/auth/config/resolve-type.ts
 function resolveType(name, type, at, schemaKey) {
   if (typeof type?.schema !== "object" || type.schema === null || typeof type.schema["~standard"]?.validate !== "function") {
@@ -342,6 +364,7 @@ function resolveConfig(config, where) {
     types,
     tokenTtlMs: resolveTokenTtls(config, where),
     cookie: resolveCookie(config.cookie ?? {}, where),
+    signInThrottle: resolveSignInThrottle(config.signIn, where),
     secondFactor: resolveSecondFactor(config.secondFactor, where)
   };
 }
@@ -632,7 +655,7 @@ function resolveEvents(events, where) {
   }
   return events;
 }
-async function emit(context, type, user, occurredAt) {
+async function emit(context, type, user, occurredAt, extras = {}) {
   const listener = context.events;
   if (listener === null)
     return;
@@ -641,7 +664,8 @@ async function emit(context, type, user, occurredAt) {
     type,
     occurredAt: new Date(occurredAt.getTime()),
     userId: user.id,
-    userType: user.type
+    userType: user.type,
+    ...extras
   });
   try {
     await listener(event);
@@ -977,9 +1001,87 @@ async function insertOneTime(context, token, code) {
   });
   return { secret, expiresAt };
 }
+// src/auth/one-time/window.ts
+var MAX_LINKS = 32;
+var MAX_PROBES = 64;
+async function countInWindow(context, counting) {
+  const now = context.clock.now().getTime();
+  const window = Math.floor(now / counting.windowMs);
+  const expiresAt = (window + 2) * counting.windowMs;
+  const links = { context, counting, window, now, expiresAt };
+  const counted = counting.spent === "carry" ? await countCarrying(links) : await countRestarting(links);
+  return { ...counted, endsAt: (window + 1) * counting.windowMs };
+}
+async function countCarrying(links) {
+  let carried = 0;
+  for (let link = 0;link < MAX_LINKS; link += 1) {
+    const hash = links.counting.linkHash(links.window, link);
+    const counted = await countLink(links, hash);
+    const attempts = carried + counted.attempts;
+    if (counted.spentAt === null)
+      return { attempts, link: hash };
+    carried = attempts;
+  }
+  return { attempts: Number.POSITIVE_INFINITY, link: null };
+}
+async function countRestarting(links) {
+  const tokens = links.context.store.tokens;
+  let spent = -1;
+  let absent = Number.POSITIVE_INFINITY;
+  for (let probes = 0;probes < MAX_PROBES; probes += 1) {
+    const next = absent === spent + 1;
+    const link = next ? absent : absent === Number.POSITIVE_INFINITY ? 2 * spent + 2 : Math.floor((spent + absent) / 2);
+    const hash = links.counting.linkHash(links.window, link);
+    const counted = next ? await insertLink(links, hash) : await tokens.countAttempt(hash, "secondFactor");
+    if (counted === null)
+      absent = link;
+    else if (counted.spentAt === null) {
+      return { attempts: counted.attempts, link: hash };
+    } else {
+      spent = link;
+      if (absent <= spent)
+        absent = Number.POSITIVE_INFINITY;
+    }
+  }
+  throw links.counting.vanished();
+}
+async function countLink(links, tokenHash) {
+  const tokens = links.context.store.tokens;
+  const counted = await tokens.countAttempt(tokenHash, "secondFactor");
+  return counted ?? insertLink(links, tokenHash);
+}
+async function insertLink(links, tokenHash) {
+  const tokens = links.context.store.tokens;
+  await tokens.insertToken({
+    tokenHash,
+    kind: "secondFactor",
+    userId: links.counting.userId,
+    address: "",
+    codeHash: null,
+    attempts: 0,
+    expiresAt: new Date(links.expiresAt),
+    spentAt: null,
+    createdAt: new Date(links.now)
+  });
+  const inserted = await tokens.countAttempt(tokenHash, "secondFactor");
+  if (inserted !== null)
+    return inserted;
+  throw links.counting.vanished();
+}
 // src/auth/password-written.ts
-async function endSignInsWaiting(context, userId) {
-  await context.store.tokens.spendUserTokens(userId, "secondFactor", context.clock.now());
+async function endWhatThePasswordOpened(context, userId) {
+  const now = context.clock.now();
+  const spent = await Promise.allSettled(["resetPassword", "secondFactor"].map((kind) => context.store.tokens.spendUserTokens(userId, kind, now)));
+  const failed = spent.find((result) => result.status === "rejected");
+  if (failed !== undefined)
+    throw failed.reason;
+}
+async function passwordChanged(context, written) {
+  try {
+    await endWhatThePasswordOpened(context, written.id);
+  } finally {
+    await emit(context, "user.passwordChanged", written, written.updatedAt);
+  }
 }
 async function heldByPassword(context, type, verified, password, result, where) {
   const now = await findRecord(context, verified.id, type.name);
@@ -1031,6 +1133,7 @@ function resetPasswordFlows(context, type, at) {
       if (record === null)
         return null;
       const issued = await issueEmailToken(context, type, "resetPassword", record, where);
+      await context.store.tokens.spendUserTokens(record.id, "resetPassword", context.clock.now(), hashSecret(issued.token));
       return { ...issued, user: toUser(record) };
     },
     async confirm(secret, password) {
@@ -1054,7 +1157,7 @@ async function confirmReset(context, type, secret, password, where) {
   });
   try {
     await context.store.sessions.revokeUserSessions(written.id, context.clock.now());
-    await endSignInsWaiting(context, written.id);
+    await endWhatThePasswordOpened(context, written.id);
   } finally {
     await emit(context, "user.passwordReset", written, written.updatedAt);
     if (newlyVerified) {
@@ -1096,8 +1199,78 @@ function emailFlows(context, type, at) {
     resetPassword: resetPasswordFlows(context, type, at)
   };
 }
+// src/auth/derived-keys.ts
+import { createHmac, hkdfSync } from "node:crypto";
+var derived = new WeakMap;
+function derivedKey(sealer, purpose, keyId = sealer.sealWith) {
+  let keys = derived.get(sealer);
+  if (keys === undefined) {
+    keys = new Map;
+    derived.set(sealer, keys);
+  }
+  const name = `${purpose}\x00${keyId}`;
+  let key = keys.get(name);
+  if (key === undefined) {
+    const secret = sealer.keys.get(keyId);
+    if (secret === undefined)
+      return;
+    key = Buffer.from(hkdfSync("sha256", secret, Buffer.alloc(0), purpose, 32));
+    keys.set(name, key);
+  }
+  return key;
+}
+function keyedHash(key, parts) {
+  return createHmac("sha256", key).update(parts.join("\x00")).digest();
+}
+
+// src/auth/sign-in-attempts.ts
+var PURPOSE = "janus/sign-in/attempts/v1";
+var UNSEALED = Buffer.from(PURPOSE);
+function counterKey(context) {
+  const sealer = context.config.secondFactor?.sealer;
+  return sealer === undefined ? UNSEALED : derivedKey(sealer, PURPOSE);
+}
+var keyed = (key, parts) => keyedHash(key, parts).toString("base64url");
+async function countLogin(context, type, login, where) {
+  const throttle = context.config.signInThrottle;
+  if (throttle === null)
+    return null;
+  const key = counterKey(context);
+  const loginKey = keyed(key, [type.name, login]);
+  return countInWindow(context, {
+    windowMs: throttle.windowMs,
+    spent: "restart",
+    userId: loginKey,
+    linkHash: (window, link) => hashSecret(keyed(key, [loginKey, String(window), String(link)])),
+    vanished: () => new StoreFailure2(`${where}: the store dropped the attempts it had just stored`, { slot: "tokens", operation: "countAttempt" })
+  });
+}
+async function countSignInAttempt(context, type, login, where) {
+  const counted = await countLogin(context, type, login, where);
+  const limit = context.config.signInThrottle?.attempts;
+  if (counted === null || limit === undefined || counted.attempts <= limit) {
+    return;
+  }
+  const now = context.clock.now().getTime();
+  throw new CredentialError2("CREDENTIALS_INVALID", `${where}: too many passwords tried at this login — wait for the next window`, {
+    reason: "throttled",
+    userType: type.name,
+    retryAfter: Math.max(1, Math.ceil((counted.endsAt - now) / 1000))
+  });
+}
+async function restartSignInCount(context, type, record, where) {
+  const rule = type.password;
+  const login = rule === null ? undefined : record.fields[rule.login];
+  if (rule === null || typeof login !== "string")
+    return;
+  const counted = await countLogin(context, type, rule.normalize(login), where);
+  if (counted?.link == null)
+    return;
+  await context.store.tokens.consumeToken(counted.link, "secondFactor", context.clock.now());
+}
+
 // src/auth/totp.ts
-import { createHmac, randomBytes as randomBytes4 } from "node:crypto";
+import { createHmac as createHmac2, randomBytes as randomBytes4 } from "node:crypto";
 var TOTP = { digits: 6, stepMs: 30000, drift: 1 };
 var BASE32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
 function mintTotpSecret() {
@@ -1140,7 +1313,7 @@ var stepAt = (now) => Math.floor(now.getTime() / TOTP.stepMs);
 function codeAt(secret, step) {
   const counter = Buffer.alloc(8);
   counter.writeBigUInt64BE(BigInt(step));
-  const digest = createHmac("sha1", secret).update(counter).digest();
+  const digest = createHmac2("sha1", secret).update(counter).digest();
   const offset = digest[19] & 15;
   const binary = digest.readUInt32BE(offset) & 2147483647;
   return String(binary % 10 ** TOTP.digits).padStart(TOTP.digits, "0");
@@ -1267,6 +1440,7 @@ async function confirmChallenge(context, type, challenge, code, at) {
     return refuseCode(context, type, opened, where);
   const written = await context.store.users.updateUser(record.id, { secondFactor: accepted, updatedAt: now }, record.version);
   await spendChallenge(context, opened.secret, where);
+  await restartSignInCount(context, type, written, where);
   return openSession(context, type, written);
 }
 
@@ -1278,12 +1452,12 @@ async function recoveryCodesLeftOf(context, type, user, where) {
 }
 
 // src/auth/second-factor/recovery-codes.ts
-import { createHmac as createHmac2, hkdfSync, randomInt as randomInt2, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+import { randomInt as randomInt2, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
 var RECOVERY_CODES = 10;
 var ALPHABET = "0123456789abcdefghjkmnpqrstvwxyz";
 var LENGTH = 10;
 var SHAPE = /^[0-9a-hjkmnp-tv-z]{10}$/;
-var PURPOSE = "janus/second-factor/recovery-codes/v1";
+var PURPOSE2 = "janus/second-factor/recovery-codes/v1";
 function mintRecoveryCodes() {
   return Array.from({ length: RECOVERY_CODES }, () => {
     let code = "";
@@ -1297,24 +1471,8 @@ function readRecoveryCode(typed) {
   const code = typed.toLowerCase().replace(/[\s-]/g, "").replace(/o/g, "0").replace(/[il]/g, "1");
   return SHAPE.test(code) ? code : null;
 }
-var derived = new WeakMap;
-function macKey(sealer, keyId) {
-  let keys = derived.get(sealer);
-  if (keys === undefined) {
-    keys = new Map;
-    derived.set(sealer, keys);
-  }
-  let key = keys.get(keyId);
-  if (key === undefined) {
-    const secret = sealer.keys.get(keyId);
-    if (secret === undefined)
-      return;
-    key = Buffer.from(hkdfSync("sha256", secret, Buffer.alloc(0), PURPOSE, 32));
-    keys.set(keyId, key);
-  }
-  return key;
-}
-var mac = (key, userId, code) => createHmac2("sha256", key).update(`${userId}\x00${code}`).digest();
+var macKey = (sealer, keyId) => derivedKey(sealer, PURPOSE2, keyId);
+var mac = (key, userId, code) => keyedHash(key, [userId, code]);
 function hashRecoveryCode(sealer, userId, code) {
   const read = readRecoveryCode(code) ?? code;
   const key = macKey(sealer, sealer.sealWith);
@@ -1422,21 +1580,9 @@ function accountOf(type, record, where) {
 }
 
 // src/auth/second-factor/app-code-attempts.ts
-import { createHmac as createHmac3, hkdfSync as hkdfSync2 } from "node:crypto";
 var APP_CODE_WINDOW_MS = 15 * 60000;
 var WINDOW_MINUTES = APP_CODE_WINDOW_MS / 60000;
-var PURPOSE2 = "janus/second-factor/regenerate-attempts/v1";
-var MAX_LINKS = 32;
-var derived2 = new WeakMap;
-function counterKey(sealer) {
-  let key = derived2.get(sealer);
-  if (key === undefined) {
-    const secret = sealer.keys.get(sealer.sealWith);
-    key = Buffer.from(hkdfSync2("sha256", secret, Buffer.alloc(0), PURPOSE2, 32));
-    derived2.set(sealer, key);
-  }
-  return key;
-}
+var PURPOSE3 = "janus/second-factor/regenerate-attempts/v1";
 function linkHash(sealer, record, window, link) {
   const parts = [
     record.id,
@@ -1444,45 +1590,21 @@ function linkHash(sealer, record, window, link) {
     String(record.secondFactor?.lastStep ?? ""),
     String(link)
   ];
-  return hashSecret(createHmac3("sha256", counterKey(sealer)).update(parts.join("\x00")).digest("base64url"));
+  const key = derivedKey(sealer, PURPOSE3);
+  return hashSecret(keyedHash(key, parts).toString("base64url"));
 }
 async function countAppCodeAttempt(context, sealer, record, where) {
-  const now = context.clock.now().getTime();
-  const window = Math.floor(now / APP_CODE_WINDOW_MS);
-  const times = { now, expiresAt: (window + 2) * APP_CODE_WINDOW_MS };
-  let spent = 0;
-  for (let link = 0;link < MAX_LINKS; link += 1) {
-    const hash = linkHash(sealer, record, window, link);
-    const counted = await countLink(context, hash, record, times, where);
-    const attempts = spent + counted.attempts;
-    if (counted.spentAt === null)
-      return attemptsLeft(attempts, record, where);
-    spent = attempts;
-  }
-  return attemptsLeft(Number.POSITIVE_INFINITY, record, where);
-}
-async function countLink(context, tokenHash, record, times, where) {
-  const tokens = context.store.tokens;
-  const counted = await tokens.countAttempt(tokenHash, "secondFactor");
-  if (counted !== null)
-    return counted;
-  await tokens.insertToken({
-    tokenHash,
-    kind: "secondFactor",
+  const { attempts } = await countInWindow(context, {
+    windowMs: APP_CODE_WINDOW_MS,
+    spent: "carry",
     userId: record.id,
-    address: "",
-    codeHash: null,
-    attempts: 0,
-    expiresAt: new Date(times.expiresAt),
-    spentAt: null,
-    createdAt: new Date(times.now)
+    linkHash: (window, link) => linkHash(sealer, record, window, link),
+    vanished: () => new StoreConflict2("version", `${where}: the user changed while the code was checked — read it again and retry`, {
+      userId: record.id,
+      expectedVersion: record.version,
+      operation: where
+    })
   });
-  const inserted = await tokens.countAttempt(tokenHash, "secondFactor");
-  if (inserted !== null)
-    return inserted;
-  throw new StoreConflict2("version", `${where}: the user changed while the code was checked — read it again and retry`, { userId: record.id, expectedVersion: record.version, operation: where });
-}
-function attemptsLeft(attempts, record, where) {
   if (attempts > CODE_ATTEMPTS) {
     throw new TokenError2("CODE_INVALID", `${where}: too many codes tried — wait for the next ${WINDOW_MINUTES}-minute window`, {
       operation: where,
@@ -1553,6 +1675,7 @@ async function recoverWithCode(context, type, challenge, code, at) {
   }, record.version);
   try {
     await spendChallenge(context, opened.secret, where);
+    await restartSignInCount(context, type, written, where);
     const signedIn = await openSession(context, type, written);
     return { ...signedIn, recoveryCodesLeft: recoveryCodes.length };
   } finally {
@@ -1793,7 +1916,7 @@ async function changePassword(context, type, user, change, options, where) {
       }
     };
   });
-  await endSignInsWaiting(context, written.id);
+  await passwordChanged(context, written);
   return written;
 }
 
@@ -1835,7 +1958,11 @@ async function signIn(context, type, finish, input, where) {
   const hasher = requireHasher(context, where);
   const login = input?.[rule.login];
   const password = input?.password;
-  const record = typeof login === "string" ? await byLogin(context, type, rule.normalize(login)) : null;
+  const normalized = typeof login === "string" ? rule.normalize(login) : null;
+  if (normalized !== null) {
+    await countSignInAttempt(context, type, normalized, where);
+  }
+  const record = normalized === null ? null : await byLogin(context, type, normalized);
   const refuse = (reason) => new CredentialError2("CREDENTIALS_INVALID", `${where}: the login and the password do not match`, { reason, userType: type.name });
   if (record === null || record.password === null) {
     await hasher.verify(String(password), await context.dummyHash());
@@ -1850,6 +1977,9 @@ async function signIn(context, type, finish, input, where) {
       userType: type.name
     });
   }
+  if (!isActive(record.secondFactor)) {
+    await restartSignInCount(context, type, record, where);
+  }
   const verified = await rehashed(context, record, String(password));
   const result = await finish(verified, where);
   if (!await heldByPassword(context, type, verified, String(password), result, where)) {
@@ -1884,7 +2014,7 @@ function passwordFlows(context, type, at, finish) {
       checkPassword(type, password, where);
       const hash = await requireHasher(context, where).hash(password);
       const written = await writeUser(context, user, type, options, where, (_, now) => ({ password: { hash, updatedAt: now } }));
-      await endSignInsWaiting(context, written.id);
+      await passwordChanged(context, written);
       return toUser(written);
     },
     async changePassword(user, change, options) {
@@ -1918,19 +2048,36 @@ async function deleteUser(context, type, user) {
 }
 
 // src/auth/users/fields-patch.ts
+var normalized = (email) => email === null ? null : normalizeEmail(email);
+function emailChanged(type, before, after) {
+  return normalized(emailOf(type, before)) !== normalized(emailOf(type, after));
+}
 async function fieldsPatch(type, record, patch, where) {
   const fields = await validateFields(type, { ...record.fields, ...patch }, where);
-  const before = emailOf(type, record.fields);
-  const after = emailOf(type, fields);
-  const emailChanged = (before === null ? null : normalizeEmail(before)) !== (after === null ? null : normalizeEmail(after));
   return {
     fields,
     logins: loginsOf(type, fields, where),
     schemaVersion: type.schemaVersion,
-    ...emailChanged ? { emailVerifiedAt: null } : {}
+    ...emailChanged(type, record.fields, fields) ? { emailVerifiedAt: null } : {}
   };
 }
 
+// src/auth/users/update.ts
+async function update(context, type, user, patch, options, where) {
+  const seen = { replaced: null };
+  const written = await writeUser(context, user, type, options, where, (record) => {
+    seen.replaced = record;
+    return fieldsPatch(type, record, patch, where);
+  });
+  const { replaced } = seen;
+  if (replaced !== null && emailChanged(type, replaced.fields, written.fields)) {
+    await emit(context, "user.emailChanged", written, written.updatedAt, {
+      formerEmail: emailOf(type, replaced.fields)
+    });
+  }
+  return written;
+}
+
 // src/auth/users/record-flows.ts
 function recordFlows(context, type, at) {
   const { store } = context;
@@ -1958,9 +2105,7 @@ function recordFlows(context, type, at) {
       return { items: answer.items.map(toUser), nextCursor: answer.nextCursor };
     },
     async update(user, patch, options) {
-      const where = at("update");
-      const written = await writeUser(context, user, type, options, where, (record) => fieldsPatch(type, record, patch, where));
-      return toUser(written);
+      return toUser(await update(context, type, user, patch, options, at("update")));
     },
     async setActive(user, active, options) {
       return toUser(await writeUser(context, user, type, options, at("setActive"), () => ({
@@ -2070,5 +2215,5 @@ export {
   systemClock
 };
 
-//# debugId=301D5A6A554F106664756E2164756E21
+//# debugId=7CE655305FF58FDF64756E2164756E21
 //# sourceMappingURL=index.js.map