@nxgt/janus 0.14.0 → 0.16.0

package/dist/index.js

@@ -407,6 +407,7 @@ function resolveTokenTtls(config, where) {
     verifyEmail: parseDuration(config.tokens?.verifyEmail ?? "24h", `${where}: tokens.verifyEmail`),
     resetPassword: parseDuration(config.tokens?.resetPassword ?? "1h", `${where}: tokens.resetPassword`),
     signInCode: parseDuration(config.tokens?.signInCode ?? "10m", `${where}: tokens.signInCode`),
+    magicLink: parseDuration(config.tokens?.magicLink ?? "15m", `${where}: tokens.magicLink`),
     stepUp: parseDuration(config.tokens?.stepUp ?? "10m", `${where}: tokens.stepUp`)
   };
 }
@@ -1199,78 +1200,8 @@ function emailFlows(context, type, at) {
     resetPassword: resetPasswordFlows(context, type, at)
   };
 }
-// src/auth/derived-keys.ts
-import { createHmac, hkdfSync } from "node:crypto";
-var derived = new WeakMap;
-function derivedKey(sealer, purpose, keyId = sealer.sealWith) {
-  let keys = derived.get(sealer);
-  if (keys === undefined) {
-    keys = new Map;
-    derived.set(sealer, keys);
-  }
-  const name = `${purpose}\x00${keyId}`;
-  let key = keys.get(name);
-  if (key === undefined) {
-    const secret = sealer.keys.get(keyId);
-    if (secret === undefined)
-      return;
-    key = Buffer.from(hkdfSync("sha256", secret, Buffer.alloc(0), purpose, 32));
-    keys.set(name, key);
-  }
-  return key;
-}
-function keyedHash(key, parts) {
-  return createHmac("sha256", key).update(parts.join("\x00")).digest();
-}
-
-// src/auth/sign-in-attempts.ts
-var PURPOSE = "janus/sign-in/attempts/v1";
-var UNSEALED = Buffer.from(PURPOSE);
-function counterKey(context) {
-  const sealer = context.config.secondFactor?.sealer;
-  return sealer === undefined ? UNSEALED : derivedKey(sealer, PURPOSE);
-}
-var keyed = (key, parts) => keyedHash(key, parts).toString("base64url");
-async function countLogin(context, type, login, where) {
-  const throttle = context.config.signInThrottle;
-  if (throttle === null)
-    return null;
-  const key = counterKey(context);
-  const loginKey = keyed(key, [type.name, login]);
-  return countInWindow(context, {
-    windowMs: throttle.windowMs,
-    spent: "restart",
-    userId: loginKey,
-    linkHash: (window, link) => hashSecret(keyed(key, [loginKey, String(window), String(link)])),
-    vanished: () => new StoreFailure2(`${where}: the store dropped the attempts it had just stored`, { slot: "tokens", operation: "countAttempt" })
-  });
-}
-async function countSignInAttempt(context, type, login, where) {
-  const counted = await countLogin(context, type, login, where);
-  const limit = context.config.signInThrottle?.attempts;
-  if (counted === null || limit === undefined || counted.attempts <= limit) {
-    return;
-  }
-  const now = context.clock.now().getTime();
-  throw new CredentialError2("CREDENTIALS_INVALID", `${where}: too many passwords tried at this login — wait for the next window`, {
-    reason: "throttled",
-    userType: type.name,
-    retryAfter: Math.max(1, Math.ceil((counted.endsAt - now) / 1000))
-  });
-}
-async function restartSignInCount(context, type, record, where) {
-  const rule = type.password;
-  const login = rule === null ? undefined : record.fields[rule.login];
-  if (rule === null || typeof login !== "string")
-    return;
-  const counted = await countLogin(context, type, rule.normalize(login), where);
-  if (counted?.link == null)
-    return;
-  await context.store.tokens.consumeToken(counted.link, "secondFactor", context.clock.now());
-}
-
 // src/auth/totp.ts
-import { createHmac as createHmac2, randomBytes as randomBytes4 } from "node:crypto";
+import { createHmac, randomBytes as randomBytes4 } from "node:crypto";
 var TOTP = { digits: 6, stepMs: 30000, drift: 1 };
 var BASE32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
 function mintTotpSecret() {
@@ -1313,7 +1244,7 @@ var stepAt = (now) => Math.floor(now.getTime() / TOTP.stepMs);
 function codeAt(secret, step) {
   const counter = Buffer.alloc(8);
   counter.writeBigUInt64BE(BigInt(step));
-  const digest = createHmac2("sha1", secret).update(counter).digest();
+  const digest = createHmac("sha1", secret).update(counter).digest();
   const offset = digest[19] & 15;
   const binary = digest.readUInt32BE(offset) & 2147483647;
   return String(binary % 10 ** TOTP.digits).padStart(TOTP.digits, "0");
@@ -1371,6 +1302,165 @@ function acceptCode(configured, record, factor, code, now, where) {
   };
 }
 
+// src/auth/first-proof.ts
+async function proveFirstEmail(context, type, user, where) {
+  await endWhatTheSquatterOpened(context, user.id);
+  let dropped = false;
+  let disabled = false;
+  const proved = await writeUser(context, user.id, type, { ifVersion: user.version }, where, (record, now) => {
+    dropped = record.password !== null;
+    disabled = isActive(record.secondFactor);
+    return {
+      emailVerifiedAt: now,
+      ...dropped ? { password: null } : {},
+      ...record.secondFactor === null ? {} : { secondFactor: null }
+    };
+  });
+  try {
+    await endWhatTheSquatterOpened(context, proved.id);
+  } finally {
+    await emit(context, "user.emailVerified", proved, proved.updatedAt);
+    if (dropped) {
+      await emit(context, "user.passwordChanged", proved, proved.updatedAt);
+    }
+    if (disabled) {
+      await emit(context, "user.secondFactorDisabled", proved, proved.updatedAt);
+    }
+  }
+  return proved;
+}
+async function endWhatTheSquatterOpened(context, userId) {
+  await context.store.sessions.revokeUserSessions(userId, context.clock.now());
+  await endWhatThePasswordOpened(context, userId);
+}
+
+// src/auth/email-sign-in.ts
+async function signInHolder(context, type, email) {
+  const record = await holderOfEmail(context, type, email);
+  return record === null || !record.active ? null : record;
+}
+async function keepOnlyLatest(context, userId, kind, secret) {
+  await context.store.tokens.spendUserTokens(userId, kind, context.clock.now(), hashSecret(secret));
+}
+async function finishEmailSignIn(context, type, finish, signIn) {
+  const { user, token, where, noun } = signIn;
+  refuseStale(type, user, token, where, noun);
+  if (!user.active) {
+    throw new UserInactiveError2(`${where}: the user is inactive`, {
+      userId: user.id,
+      userType: type.name
+    });
+  }
+  if (user.emailVerifiedAt !== null)
+    return finish(user, where);
+  return finish(await proveFirstEmail(context, type, user, where), where);
+}
+
+// src/auth/magic-link.ts
+function magicLinkFlows(context, type, at, finish) {
+  return {
+    async request(email) {
+      return requestLink(context, type, String(email));
+    },
+    async confirm(token) {
+      return confirmLink(context, type, finish, String(token), at("magicLink.confirm"));
+    }
+  };
+}
+async function requestLink(context, type, email) {
+  const record = await signInHolder(context, type, email);
+  if (record === null)
+    return null;
+  const address = String(record.fields[type.email]);
+  const { secret, expiresAt } = await issueOneTime(context, {
+    kind: "magicLink",
+    userId: record.id,
+    address,
+    ttlMs: context.config.tokenTtlMs.magicLink
+  });
+  await keepOnlyLatest(context, record.id, "magicLink", secret);
+  return { token: secret, email: address, expiresAt, user: toUser(record) };
+}
+async function confirmLink(context, type, finish, secret, where) {
+  const { token, user } = await redeemEmailToken(context, type, "magicLink", secret, where);
+  return finishEmailSignIn(context, type, finish, {
+    user,
+    token,
+    where,
+    noun: "token"
+  });
+}
+
+// src/auth/derived-keys.ts
+import { createHmac as createHmac2, hkdfSync } from "node:crypto";
+var derived = new WeakMap;
+function derivedKey(sealer, purpose, keyId = sealer.sealWith) {
+  let keys = derived.get(sealer);
+  if (keys === undefined) {
+    keys = new Map;
+    derived.set(sealer, keys);
+  }
+  const name = `${purpose}\x00${keyId}`;
+  let key = keys.get(name);
+  if (key === undefined) {
+    const secret = sealer.keys.get(keyId);
+    if (secret === undefined)
+      return;
+    key = Buffer.from(hkdfSync("sha256", secret, Buffer.alloc(0), purpose, 32));
+    keys.set(name, key);
+  }
+  return key;
+}
+function keyedHash(key, parts) {
+  return createHmac2("sha256", key).update(parts.join("\x00")).digest();
+}
+
+// src/auth/sign-in-attempts.ts
+var PURPOSE = "janus/sign-in/attempts/v1";
+var UNSEALED = Buffer.from(PURPOSE);
+function counterKey(context) {
+  const sealer = context.config.secondFactor?.sealer;
+  return sealer === undefined ? UNSEALED : derivedKey(sealer, PURPOSE);
+}
+var keyed = (key, parts) => keyedHash(key, parts).toString("base64url");
+async function countLogin(context, type, login, where) {
+  const throttle = context.config.signInThrottle;
+  if (throttle === null)
+    return null;
+  const key = counterKey(context);
+  const loginKey = keyed(key, [type.name, login]);
+  return countInWindow(context, {
+    windowMs: throttle.windowMs,
+    spent: "restart",
+    userId: loginKey,
+    linkHash: (window, link) => hashSecret(keyed(key, [loginKey, String(window), String(link)])),
+    vanished: () => new StoreFailure2(`${where}: the store dropped the attempts it had just stored`, { slot: "tokens", operation: "countAttempt" })
+  });
+}
+async function countSignInAttempt(context, type, login, where) {
+  const counted = await countLogin(context, type, login, where);
+  const limit = context.config.signInThrottle?.attempts;
+  if (counted === null || limit === undefined || counted.attempts <= limit) {
+    return;
+  }
+  const now = context.clock.now().getTime();
+  throw new CredentialError2("CREDENTIALS_INVALID", `${where}: too many passwords tried at this login — wait for the next window`, {
+    reason: "throttled",
+    userType: type.name,
+    retryAfter: Math.max(1, Math.ceil((counted.endsAt - now) / 1000))
+  });
+}
+async function restartSignInCount(context, type, record, where) {
+  const rule = type.password;
+  const login = rule === null ? undefined : record.fields[rule.login];
+  if (rule === null || typeof login !== "string")
+    return;
+  const counted = await countLogin(context, type, rule.normalize(login), where);
+  if (counted?.link == null)
+    return;
+  await context.store.tokens.consumeToken(counted.link, "secondFactor", context.clock.now());
+}
+
 // src/auth/second-factor/redeem.ts
 var spendChallenge = (context, challenge, where) => spendOneTime(context, challenge, "secondFactor", where, "challenge");
 async function openChallenge(context, type, challenge, where) {
@@ -1710,8 +1800,8 @@ function signInCodeFlows(context, type, at, finish) {
   };
 }
 async function requestCode(context, type, email) {
-  const record = await holderOfEmail(context, type, email);
-  if (record === null || !record.active)
+  const record = await signInHolder(context, type, email);
+  if (record === null)
     return null;
   const { secret, code, expiresAt } = await issueCode(context, {
     kind: "signInCode",
@@ -1719,7 +1809,7 @@ async function requestCode(context, type, email) {
     address: String(record.fields[type.email]),
     ttlMs: context.config.tokenTtlMs.signInCode
   });
-  await context.store.tokens.spendUserTokens(record.id, "signInCode", context.clock.now(), hashSecret(secret));
+  await keepOnlyLatest(context, record.id, "signInCode", secret);
   return {
     code,
     challenge: secret,
@@ -1743,18 +1833,12 @@ async function confirmCode(context, type, finish, challenge, code, at) {
     throw codeInvalid(where, user.id, type.name, attemptsLeft);
   }
   await spendOneTime(context, secret, "signInCode", where, "challenge");
-  refuseStale(type, user, token, where, "code");
-  if (!user.active) {
-    throw new UserInactiveError2(`${where}: the user is inactive`, {
-      userId: user.id,
-      userType: type.name
-    });
-  }
-  if (user.emailVerifiedAt !== null)
-    return finish(user, where);
-  const proved = await writeUser(context, user.id, type, { ifVersion: user.version }, where, (_, now) => ({ emailVerifiedAt: now }));
-  await emit(context, "user.emailVerified", proved, proved.updatedAt);
-  return finish(proved, where);
+  return finishEmailSignIn(context, type, finish, {
+    user,
+    token,
+    where,
+    noun: "code"
+  });
 }
 
 // src/auth/step-up/codes.ts
@@ -2128,6 +2212,7 @@ function typeApi(context, type) {
     ...passwordFlows(context, type, at, secondFactor.finish),
     secondFactor: secondFactor.api,
     signInCode,
+    magicLink: magicLinkFlows(context, type, at, secondFactor.finish),
     stepUp: stepUpFlows(context, type, at),
     ...emailFlows(context, type, at)
   };
@@ -2215,5 +2300,5 @@ export {
   systemClock
 };
 
-//# debugId=7CE655305FF58FDF64756E2164756E21
+//# debugId=BC1254710D035B0264756E2164756E21
 //# sourceMappingURL=index.js.map