@nxgt/janus 0.19.0 → 0.20.0

package/dist/auth/users/any-type-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"any-type-api.d.ts","sourceRoot":"","sources":["../../../src/auth/users/any-type-api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EACX,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,YAAY,EACZ,SAAS,EACT,WAAW,EACX,aAAa,EACb,WAAW,EACX,cAAc,EACd,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAE1C,mGAAmG;AACnG,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,GACnD,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,GAC1D,eAAe,CAAC,OAAO,CAAC,GACxB,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,GAC7C,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,GAC5C,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,GACjE,cAAc,CAAC,OAAO,CAAC,GACvB,gBAAgB,CAAC,OAAO,CAAC,CAAC"}
+{"version":3,"file":"any-type-api.d.ts","sourceRoot":"","sources":["../../../src/auth/users/any-type-api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EACX,YAAY,EACZ,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,YAAY,EACZ,SAAS,EACT,WAAW,EACX,aAAa,EACb,WAAW,EACX,cAAc,EACd,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAE1C,mGAAmG;AACnG,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,GACnD,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,GAC1D,eAAe,CAAC,OAAO,CAAC,GACxB,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,GAC/C,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,GAC7C,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,GAC5C,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,GACjE,cAAc,CAAC,OAAO,CAAC,GACvB,gBAAgB,CAAC,OAAO,CAAC,CAAC"}

package/dist/auth/users/type-api.d.ts

@@ -3,8 +3,8 @@ import type { Context } from '../context';
 import type { AnyTypeApi } from './any-type-api';
 /**
  * Everything one user type answers, gathered from its flows: its records,
- * its password, its second factor, its sign-in code and link, its step-up
- * and its e-mails.
+ * its password, its sign-in on the application's proof, its second factor,
+ * its sign-in code and link, its step-up and its e-mails.
  */
 export declare function typeApi(context: Context, type: ResolvedType): AnyTypeApi;
 //# sourceMappingURL=type-api.d.ts.map

package/dist/auth/users/type-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"type-api.d.ts","sourceRoot":"","sources":["../../../src/auth/users/type-api.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAM1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAIjD;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,GAAG,UAAU,CAiBxE"}
+{"version":3,"file":"type-api.d.ts","sourceRoot":"","sources":["../../../src/auth/users/type-api.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAO1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAIjD;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,GAAG,UAAU,CAkBxE"}

package/dist/index.js

@@ -1153,7 +1153,7 @@ async function issueCode(context, token) {
 }
 async function insertOneTime(context, token, code) {
   const now = context.clock.now();
-  const secret = mintSecret();
+  const secret = token.secret ?? mintSecret();
   const expiresAt = new Date(now.getTime() + token.ttlMs);
   await context.store.tokens.insertToken({
     tokenHash: hashSecret(secret),
@@ -1295,6 +1295,18 @@ async function heldByPassword(context, type, verified, password, result, where)
   return false;
 }
 
+// src/auth/prepared.ts
+function sendOnce(where, issue) {
+  let sent = false;
+  return async () => {
+    if (sent) {
+      throw new TypeError(`${where}(…).send: already called — a prepared request sends once; call ${where} again for another`);
+    }
+    sent = true;
+    return issue();
+  };
+}
+
 // src/auth/email-flows/email-token.ts
 async function redeemEmailToken(context, type, kind, secret, where) {
   const token = await spendOneTime(context, secret, kind, where, "token");
@@ -1327,20 +1339,32 @@ function resetPasswordFlows(context, type, at) {
   return {
     async request(email) {
       const where = at("resetPassword.request");
-      passwordRule(type, where);
-      await countMailByAddress(context, type, "resetPassword", String(email), where);
-      const record = await holderOfEmail(context, type, String(email));
-      if (record === null)
-        return null;
-      const issued = await issueEmailToken(context, type, "resetPassword", record, where);
-      await context.store.tokens.spendUserTokens(record.id, "resetPassword", context.clock.now(), hashSecret(issued.token));
-      return { ...issued, user: toUser(record) };
+      return (await prepareReset(context, type, String(email), where)).send();
+    },
+    async prepare(email) {
+      const where = at("resetPassword.prepare");
+      return prepareReset(context, type, String(email), where);
     },
     async confirm(secret, password) {
       return confirmReset(context, type, secret, password, at("resetPassword.confirm"));
     }
   };
 }
+async function prepareReset(context, type, email, where) {
+  passwordRule(type, where);
+  await countMailByAddress(context, type, "resetPassword", email, where);
+  return Object.freeze({
+    send: sendOnce(where, () => issueReset(context, type, email, where))
+  });
+}
+async function issueReset(context, type, email, where) {
+  const record = await holderOfEmail(context, type, email);
+  if (record === null)
+    return null;
+  const issued = await issueEmailToken(context, type, "resetPassword", record, where);
+  await context.store.tokens.spendUserTokens(record.id, "resetPassword", context.clock.now(), hashSecret(issued.token));
+  return { ...issued, user: toUser(record) };
+}
 async function confirmReset(context, type, secret, password, where) {
   passwordRule(type, where);
   checkPassword(type, password, where);
@@ -1561,7 +1585,12 @@ async function finishEmailSignIn(context, type, finish, signIn) {
 function magicLinkFlows(context, type, at, finish) {
   return {
     async request(email) {
-      return requestLink(context, type, String(email), at("magicLink.request"));
+      const where = at("magicLink.request");
+      return (await prepareLink(context, type, String(email), where)).send();
+    },
+    async prepare(email) {
+      const where = at("magicLink.prepare");
+      return prepareLink(context, type, String(email), where);
     },
     async confirm(token, options) {
       const where = at("magicLink.confirm");
@@ -1570,8 +1599,13 @@ function magicLinkFlows(context, type, at, finish) {
     }
   };
 }
-async function requestLink(context, type, email, where) {
+async function prepareLink(context, type, email, where) {
   await countMailByAddress(context, type, "magicLink", email, where);
+  return Object.freeze({
+    send: sendOnce(where, () => issueLink(context, type, email))
+  });
+}
+async function issueLink(context, type, email) {
   const record = await signInHolder(context, type, email);
   if (record === null)
     return null;
@@ -1596,6 +1630,32 @@ async function confirmLink(context, type, finish, secret, where, device) {
   });
 }
 
+// src/auth/proven-sign-in.ts
+function provenSignInFlows(context, type, at, finish) {
+  return {
+    async signInProven(user, options) {
+      const where = at("signInProven");
+      const device = deviceHint(context, options, where);
+      const record = await getRecord(context, idOf2(user), type.name, where);
+      if (!record.active) {
+        throw new UserInactiveError2(`${where}: the user is inactive`, {
+          userId: record.id,
+          userType: type.name
+        });
+      }
+      const result = await finish(record, where, device);
+      await reportNewDevice(context, result);
+      return result;
+    }
+  };
+}
+function idOf2(user) {
+  if (typeof user === "string")
+    return user;
+  const id = typeof user === "object" && user !== null ? user.id : undefined;
+  return typeof id === "string" ? id : "";
+}
+
 // src/auth/sign-in-attempts.ts
 var PURPOSE3 = "janus/sign-in/attempts/v1";
 async function countLogin(context, type, login, where) {
@@ -1974,29 +2034,43 @@ function secondFactorFlows(context, type, at) {
 function signInCodeFlows(context, type, at, finish) {
   return {
     async request(email) {
-      return requestCode(context, type, String(email), at("signInCode.request"));
+      const where = at("signInCode.request");
+      return (await prepareCode(context, type, String(email), where)).send();
+    },
+    async prepare(email) {
+      const where = at("signInCode.prepare");
+      return prepareCode(context, type, String(email), where);
     },
     async confirm(challenge, code, options) {
       return confirmCode(context, type, finish, { challenge, code, options }, at);
     }
   };
 }
-async function requestCode(context, type, email, where) {
+async function prepareCode(context, type, email, where) {
   await countMailByAddress(context, type, "signInCode", email, where);
+  const challenge = mintSecret();
+  return Object.freeze({
+    challenge,
+    send: sendOnce(where, () => issueSignInCode(context, type, email, challenge))
+  });
+}
+async function issueSignInCode(context, type, email, challenge) {
   const record = await signInHolder(context, type, email);
   if (record === null)
     return null;
+  const address = String(record.fields[type.email]);
   const { secret, code, expiresAt } = await issueCode(context, {
     kind: "signInCode",
     userId: record.id,
-    address: String(record.fields[type.email]),
-    ttlMs: context.config.tokenTtlMs.signInCode
+    address,
+    ttlMs: context.config.tokenTtlMs.signInCode,
+    secret: challenge
   });
   await keepOnlyLatest(context, record.id, "signInCode", secret);
   return {
     code,
     challenge: secret,
-    email: String(record.fields[type.email]),
+    email: address,
     expiresAt,
     user: toUser(record)
   };
@@ -2448,6 +2522,7 @@ function typeApi(context, type) {
   return {
     ...recordFlows(context, type, at),
     ...passwordFlows(context, type, at, secondFactor.finish),
+    ...provenSignInFlows(context, type, at, secondFactor.finish),
     secondFactor: secondFactor.api,
     signInCode,
     magicLink: magicLinkFlows(context, type, at, secondFactor.finish),
@@ -2540,5 +2615,5 @@ export {
   systemClock
 };
 
-//# debugId=22ACDB89AAF4B56564756E2164756E21
+//# debugId=58DD1D230B6CE48B64756E2164756E21
 //# sourceMappingURL=index.js.map