@nxgt/janus 0.18.0 → 0.20.0

package/dist/index.js

@@ -13,7 +13,7 @@ import {
   isId2,
   mintedAt2,
   createMemoryStores2
-} from "./chunks/index-kvjj5xkp.js";
+} from "./chunks/index-6bjfv4xv.js";
 import {
   JanusError2,
   UserInvalidError2,
@@ -774,12 +774,18 @@ function assertStores(stores, where) {
       }
     }
   }
-  const sessions = stores.sessions;
-  const collect = sessions["deleteExpiredSessions"];
-  if (collect !== undefined && typeof collect !== "function") {
-    throw new TypeError(`${where}: store.sessions.deleteExpiredSessions must be a function or absent`);
+  const slots = stores;
+  return {
+    collectExpired: optional(slots, "sessions", "deleteExpiredSessions", where),
+    findUsers: optional(slots, "users", "findUsers", where)
+  };
+}
+function optional(stores, slot, method, where) {
+  const found = stores[slot][method];
+  if (found !== undefined && typeof found !== "function") {
+    throw new TypeError(`${where}: store.${slot}.${method} must be a function or absent`);
   }
-  return { collectExpired: collect !== undefined };
+  return found !== undefined;
 }
 
 // src/auth/devices/token.ts
@@ -1147,7 +1153,7 @@ async function issueCode(context, token) {
 }
 async function insertOneTime(context, token, code) {
   const now = context.clock.now();
-  const secret = mintSecret();
+  const secret = token.secret ?? mintSecret();
   const expiresAt = new Date(now.getTime() + token.ttlMs);
   await context.store.tokens.insertToken({
     tokenHash: hashSecret(secret),
@@ -1289,6 +1295,18 @@ async function heldByPassword(context, type, verified, password, result, where)
   return false;
 }
 
+// src/auth/prepared.ts
+function sendOnce(where, issue) {
+  let sent = false;
+  return async () => {
+    if (sent) {
+      throw new TypeError(`${where}(…).send: already called — a prepared request sends once; call ${where} again for another`);
+    }
+    sent = true;
+    return issue();
+  };
+}
+
 // src/auth/email-flows/email-token.ts
 async function redeemEmailToken(context, type, kind, secret, where) {
   const token = await spendOneTime(context, secret, kind, where, "token");
@@ -1321,20 +1339,32 @@ function resetPasswordFlows(context, type, at) {
   return {
     async request(email) {
       const where = at("resetPassword.request");
-      passwordRule(type, where);
-      await countMailByAddress(context, type, "resetPassword", String(email), where);
-      const record = await holderOfEmail(context, type, String(email));
-      if (record === null)
-        return null;
-      const issued = await issueEmailToken(context, type, "resetPassword", record, where);
-      await context.store.tokens.spendUserTokens(record.id, "resetPassword", context.clock.now(), hashSecret(issued.token));
-      return { ...issued, user: toUser(record) };
+      return (await prepareReset(context, type, String(email), where)).send();
+    },
+    async prepare(email) {
+      const where = at("resetPassword.prepare");
+      return prepareReset(context, type, String(email), where);
     },
     async confirm(secret, password) {
       return confirmReset(context, type, secret, password, at("resetPassword.confirm"));
     }
   };
 }
+async function prepareReset(context, type, email, where) {
+  passwordRule(type, where);
+  await countMailByAddress(context, type, "resetPassword", email, where);
+  return Object.freeze({
+    send: sendOnce(where, () => issueReset(context, type, email, where))
+  });
+}
+async function issueReset(context, type, email, where) {
+  const record = await holderOfEmail(context, type, email);
+  if (record === null)
+    return null;
+  const issued = await issueEmailToken(context, type, "resetPassword", record, where);
+  await context.store.tokens.spendUserTokens(record.id, "resetPassword", context.clock.now(), hashSecret(issued.token));
+  return { ...issued, user: toUser(record) };
+}
 async function confirmReset(context, type, secret, password, where) {
   passwordRule(type, where);
   checkPassword(type, password, where);
@@ -1555,7 +1585,12 @@ async function finishEmailSignIn(context, type, finish, signIn) {
 function magicLinkFlows(context, type, at, finish) {
   return {
     async request(email) {
-      return requestLink(context, type, String(email), at("magicLink.request"));
+      const where = at("magicLink.request");
+      return (await prepareLink(context, type, String(email), where)).send();
+    },
+    async prepare(email) {
+      const where = at("magicLink.prepare");
+      return prepareLink(context, type, String(email), where);
     },
     async confirm(token, options) {
       const where = at("magicLink.confirm");
@@ -1564,8 +1599,13 @@ function magicLinkFlows(context, type, at, finish) {
     }
   };
 }
-async function requestLink(context, type, email, where) {
+async function prepareLink(context, type, email, where) {
   await countMailByAddress(context, type, "magicLink", email, where);
+  return Object.freeze({
+    send: sendOnce(where, () => issueLink(context, type, email))
+  });
+}
+async function issueLink(context, type, email) {
   const record = await signInHolder(context, type, email);
   if (record === null)
     return null;
@@ -1590,6 +1630,32 @@ async function confirmLink(context, type, finish, secret, where, device) {
   });
 }
 
+// src/auth/proven-sign-in.ts
+function provenSignInFlows(context, type, at, finish) {
+  return {
+    async signInProven(user, options) {
+      const where = at("signInProven");
+      const device = deviceHint(context, options, where);
+      const record = await getRecord(context, idOf2(user), type.name, where);
+      if (!record.active) {
+        throw new UserInactiveError2(`${where}: the user is inactive`, {
+          userId: record.id,
+          userType: type.name
+        });
+      }
+      const result = await finish(record, where, device);
+      await reportNewDevice(context, result);
+      return result;
+    }
+  };
+}
+function idOf2(user) {
+  if (typeof user === "string")
+    return user;
+  const id = typeof user === "object" && user !== null ? user.id : undefined;
+  return typeof id === "string" ? id : "";
+}
+
 // src/auth/sign-in-attempts.ts
 var PURPOSE3 = "janus/sign-in/attempts/v1";
 async function countLogin(context, type, login, where) {
@@ -1968,29 +2034,43 @@ function secondFactorFlows(context, type, at) {
 function signInCodeFlows(context, type, at, finish) {
   return {
     async request(email) {
-      return requestCode(context, type, String(email), at("signInCode.request"));
+      const where = at("signInCode.request");
+      return (await prepareCode(context, type, String(email), where)).send();
+    },
+    async prepare(email) {
+      const where = at("signInCode.prepare");
+      return prepareCode(context, type, String(email), where);
     },
     async confirm(challenge, code, options) {
       return confirmCode(context, type, finish, { challenge, code, options }, at);
     }
   };
 }
-async function requestCode(context, type, email, where) {
+async function prepareCode(context, type, email, where) {
   await countMailByAddress(context, type, "signInCode", email, where);
+  const challenge = mintSecret();
+  return Object.freeze({
+    challenge,
+    send: sendOnce(where, () => issueSignInCode(context, type, email, challenge))
+  });
+}
+async function issueSignInCode(context, type, email, challenge) {
   const record = await signInHolder(context, type, email);
   if (record === null)
     return null;
+  const address = String(record.fields[type.email]);
   const { secret, code, expiresAt } = await issueCode(context, {
     kind: "signInCode",
     userId: record.id,
-    address: String(record.fields[type.email]),
-    ttlMs: context.config.tokenTtlMs.signInCode
+    address,
+    ttlMs: context.config.tokenTtlMs.signInCode,
+    secret: challenge
   });
   await keepOnlyLatest(context, record.id, "signInCode", secret);
   return {
     code,
     challenge: secret,
-    email: String(record.fields[type.email]),
+    email: address,
     expiresAt,
     user: toUser(record)
   };
@@ -2317,6 +2397,48 @@ async function deleteUser(context, type, user) {
   return deleted;
 }
 
+// src/auth/users/find-many.ts
+var FIND_MANY_BATCH = 100;
+var FIND_MANY_CONCURRENCY = 10;
+async function findManyRecords(context, ids, type, where) {
+  if (!Array.isArray(ids)) {
+    throw new TypeError(`${where}: ids must be an array of user ids`);
+  }
+  const wanted = [
+    ...new Set(ids.filter((id) => typeof id === "string" && isId2(id)))
+  ];
+  const found = new Map;
+  for (let start = 0;start < wanted.length; start += FIND_MANY_BATCH) {
+    const batch = wanted.slice(start, start + FIND_MANY_BATCH);
+    for (const record of await readBatch(context, batch)) {
+      if (record.type === type)
+        found.set(record.id, record);
+    }
+  }
+  return wanted.flatMap((id) => {
+    const record = found.get(id);
+    return record === undefined ? [] : [record];
+  });
+}
+async function readBatch(context, ids) {
+  const { users } = context.store;
+  if (context.capabilities.findUsers && users.findUsers !== undefined) {
+    const answer = await users.findUsers(ids);
+    if (!Array.isArray(answer)) {
+      throw new StoreFailure2("users.findUsers answered no list: an absence is a shorter list, so this store forgot to answer", { slot: "users", operation: "findUsers" });
+    }
+    return answer;
+  }
+  const records = [];
+  for (let start = 0;start < ids.length; start += FIND_MANY_CONCURRENCY) {
+    const answers = await Promise.all(ids.slice(start, start + FIND_MANY_CONCURRENCY).map((id) => users.findUser(id)));
+    for (const record of answers)
+      if (record !== null)
+        records.push(record);
+  }
+  return records;
+}
+
 // src/auth/users/fields-patch.ts
 var normalized = (email) => email === null ? null : normalizeEmail(email);
 function emailChanged(type, before, after) {
@@ -2359,6 +2481,10 @@ function recordFlows(context, type, at) {
       const record = await findRecord(context, id, type.name);
       return record === null ? null : toUser(record);
     },
+    async findMany(ids) {
+      const records = await findManyRecords(context, ids, type.name, at("findMany"));
+      return records.map(toUser);
+    },
     async get(id) {
       return toUser(await getRecord(context, id, type.name, at("get")));
     },
@@ -2396,6 +2522,7 @@ function typeApi(context, type) {
   return {
     ...recordFlows(context, type, at),
     ...passwordFlows(context, type, at, secondFactor.finish),
+    ...provenSignInFlows(context, type, at, secondFactor.finish),
     secondFactor: secondFactor.api,
     signInCode,
     magicLink: magicLinkFlows(context, type, at, secondFactor.finish),
@@ -2488,5 +2615,5 @@ export {
   systemClock
 };
 
-//# debugId=ACD85BEBE6A087E464756E2164756E21
+//# debugId=58DD1D230B6CE48B64756E2164756E21
 //# sourceMappingURL=index.js.map