@nxgt/janus 0.19.0 → 0.21.0

package/dist/auth/types/prepared.d.ts

@@ -0,0 +1,41 @@
+/**
+ * What `prepare` answers — `magicLink.prepare`, `signInCode.prepare`,
+ * `resetPassword.prepare`: a request for an e-mail, counted, not yet looked
+ * up.
+ *
+ * Part of what `janus()` hands back; `./index` gathers it.
+ */
+import type { IssuedCode } from './email-flows';
+/**
+ * A request counted by the mail throttle and not yet looked up: `send()`
+ * does the rest of what `request` does — looks the address up, issues, and
+ * spends the earlier tokens — and answers what `request` answers, `null`
+ * for an address nobody (active) holds.
+ *
+ * **`send()` runs once.** A second call is a `TypeError`, and so is a call
+ * after a first one failed: `prepare` again, which counts again.
+ */
+export interface PreparedRequest<Issued> {
+    /**
+     * Looks the address up and issues, without counting again — the count
+     * was `prepare`'s. Send it off the visitor's request: its time tells
+     * whether the address has an account.
+     */
+    send(): Promise<Issued | null>;
+}
+/**
+ * A sign-in code's prepared request: the `challenge` is minted before
+ * anybody is looked up, so it goes to the visitor now, whoever holds the
+ * address — and replaces the decoy an unknown address needs. For an address
+ * nobody holds, `send()` answers `null` and the challenge is
+ * `TOKEN_UNKNOWN`; otherwise it is the `challenge` of what `send()` issues.
+ */
+export interface PreparedCode<U> extends PreparedRequest<IssuedCode<U>> {
+    /**
+     * The secret the code will be checked against. **Keep it with the
+     * visitor** — a short-lived cookie, or the code form's body — never in
+     * the e-mail, a URL or a log.
+     */
+    readonly challenge: string;
+}
+//# sourceMappingURL=prepared.d.ts.map

package/dist/auth/types/prepared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepared.d.ts","sourceRoot":"","sources":["../../../src/auth/types/prepared.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe,CAAC,MAAM;IACtC;;;;OAIG;IACH,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC,CAAE,SAAQ,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtE;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3B"}

package/dist/auth/types/proven-sign-in.d.ts

@@ -0,0 +1,43 @@
+/**
+ * What every user type answers besides: signing in a user the application
+ * proved by its own means, with no credential janus checks.
+ *
+ * Part of what `janus()` hands back; `./index` gathers it.
+ */
+import type { SignedIn, SignInOptions } from './sign-in';
+import type { UserRef } from './user';
+/**
+ * Signing in a user **the application has already proved** — by an
+ * invitation token it issued and the person followed, or a channel of its
+ * own it verified — without a password, a code or a link.
+ *
+ * `Answer` is `SignInResult` when the type may have a second factor: the
+ * application's proof is a first factor, and an active factor is still asked
+ * for.
+ */
+export interface ProvenSignInApi<U, Answer = SignedIn<U>> {
+    /**
+     * Signs in the user of this type with this id, and answers what every
+     * other sign-in answers: a session, or a second-factor challenge when
+     * their factor is active — switch on `status`.
+     *
+     * **Privileged: janus checks no credential here, the application carries
+     * the proof.** Call it only after your server verified one — an
+     * invitation token it issued, a channel of its own — and never with an
+     * id a request supplied: whoever can choose the id signs in as anybody.
+     *
+     * Sends no e-mail, issues no token, counts nothing in the mail or the
+     * sign-in throttle, and **spends nothing**: links and codes already sent
+     * still work. Proves no e-mail either: `emailVerified` stays as it was.
+     *
+     * An inactive user is `USER_INACTIVE`, as for every sign-in. A malformed
+     * id, an unknown one or one of another type is `NOT_FOUND`, as for `get`:
+     * a sign-in that found nobody is never an answer to read past.
+     *
+     * Given a `device`, answers `newDevice` and `deviceToken`, and sends
+     * `user.newDeviceSignedIn` for a device new to the user. A challenge
+     * carries no device: give it again to `secondFactor.confirm`.
+     */
+    signInProven(user: UserRef, options?: SignInOptions): Promise<Answer>;
+}
+//# sourceMappingURL=proven-sign-in.d.ts.map

package/dist/auth/types/proven-sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proven-sign-in.d.ts","sourceRoot":"","sources":["../../../src/auth/types/proven-sign-in.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEtC;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC;IACvD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtE"}

package/dist/auth/types/sign-in.d.ts

@@ -33,8 +33,8 @@ export interface SignedIn<U> {
 }
 /**
  * What a sign-in takes besides its credentials: `signUp`, `signIn`,
- * `secondFactor.confirm`, `secondFactor.recover`, `signInCode.confirm` and
- * `magicLink.confirm`.
+ * `secondFactor.confirm`, `secondFactor.recover`, `signInCode.confirm`,
+ * `magicLink.confirm` and `signInProven`.
  */
 export interface SignInOptions {
     /**

package/dist/auth/users/any-type-api.d.ts

@@ -1,6 +1,6 @@
 import type { AnyUser } from '../context';
-import type { MagicLinkApi, PasswordApi, ResetPasswordApi, SecondFactorApi, SignInCodeApi, SignInResult, StepUpApi, StepUpByApp, StepUpByEmail, UserTypeApi, VerifyEmailApi } from '../types';
+import type { FindByEmailApi, MagicLinkApi, PasswordApi, ProvenSignInApi, ResetPasswordApi, SecondFactorApi, SignInCodeApi, SignInResult, StepUpApi, StepUpByApp, StepUpByEmail, UserTypeApi, VerifyEmailApi } from '../types';
 import type { Input } from './flow-types';
 /** Everything one user type answers. Which flows it has is decided by its types; all are built. */
-export type AnyTypeApi = UserTypeApi<AnyUser, Input> & PasswordApi<AnyUser, Input, string, SignInResult<AnyUser>> & SecondFactorApi<AnyUser> & SignInCodeApi<AnyUser, SignInResult<AnyUser>> & MagicLinkApi<AnyUser, SignInResult<AnyUser>> & StepUpApi<AnyUser, StepUpByEmail<AnyUser> | StepUpByApp<AnyUser>> & VerifyEmailApi<AnyUser> & ResetPasswordApi<AnyUser>;
+export type AnyTypeApi = UserTypeApi<AnyUser, Input> & PasswordApi<AnyUser, Input, string, SignInResult<AnyUser>> & SecondFactorApi<AnyUser> & ProvenSignInApi<AnyUser, SignInResult<AnyUser>> & SignInCodeApi<AnyUser, SignInResult<AnyUser>> & MagicLinkApi<AnyUser, SignInResult<AnyUser>> & StepUpApi<AnyUser, StepUpByEmail<AnyUser> | StepUpByApp<AnyUser>> & VerifyEmailApi<AnyUser> & FindByEmailApi<AnyUser> & ResetPasswordApi<AnyUser>;
 //# sourceMappingURL=any-type-api.d.ts.map

package/dist/auth/users/any-type-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"any-type-api.d.ts","sourceRoot":"","sources":["../../../src/auth/users/any-type-api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EACX,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,YAAY,EACZ,SAAS,EACT,WAAW,EACX,aAAa,EACb,WAAW,EACX,cAAc,EACd,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAE1C,mGAAmG;AACnG,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,GACnD,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,GAC1D,eAAe,CAAC,OAAO,CAAC,GACxB,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,GAC7C,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,GAC5C,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,GACjE,cAAc,CAAC,OAAO,CAAC,GACvB,gBAAgB,CAAC,OAAO,CAAC,CAAC"}
+{"version":3,"file":"any-type-api.d.ts","sourceRoot":"","sources":["../../../src/auth/users/any-type-api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EACX,cAAc,EACd,YAAY,EACZ,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,YAAY,EACZ,SAAS,EACT,WAAW,EACX,aAAa,EACb,WAAW,EACX,cAAc,EACd,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAE1C,mGAAmG;AACnG,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,GACnD,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,GAC1D,eAAe,CAAC,OAAO,CAAC,GACxB,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,GAC/C,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,GAC7C,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,GAC5C,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,GACjE,cAAc,CAAC,OAAO,CAAC,GACvB,cAAc,CAAC,OAAO,CAAC,GACvB,gBAAgB,CAAC,OAAO,CAAC,CAAC"}

package/dist/auth/users/find-by-email.d.ts

@@ -0,0 +1,11 @@
+import type { ResolvedType } from '../config';
+import { type AnyUser, type Context } from '../context';
+import type { FindByEmailApi } from '../types';
+/**
+ * `findByEmail` for one user type: the holder the e-mail flows would find —
+ * the same normalisation, the same comparison with the stored address — with
+ * nothing counted, issued or written. A value that is no address is
+ * nobody's, as a malformed id is for `find`, and the store is not asked.
+ */
+export declare function findByEmailFlows(context: Context, type: ResolvedType): FindByEmailApi<AnyUser>;
+//# sourceMappingURL=find-by-email.d.ts.map

package/dist/auth/users/find-by-email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-by-email.d.ts","sourceRoot":"","sources":["../../../src/auth/users/find-by-email.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,OAAO,EAAyB,MAAM,YAAY,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,GAChB,cAAc,CAAC,OAAO,CAAC,CASzB"}

package/dist/auth/users/type-api.d.ts

@@ -3,8 +3,8 @@ import type { Context } from '../context';
 import type { AnyTypeApi } from './any-type-api';
 /**
  * Everything one user type answers, gathered from its flows: its records,
- * its password, its second factor, its sign-in code and link, its step-up
- * and its e-mails.
+ * its password, its sign-in on the application's proof, its second factor,
+ * its sign-in code and link, its step-up, its e-mails and the lookup by e-mail.
  */
 export declare function typeApi(context: Context, type: ResolvedType): AnyTypeApi;
 //# sourceMappingURL=type-api.d.ts.map

package/dist/auth/users/type-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"type-api.d.ts","sourceRoot":"","sources":["../../../src/auth/users/type-api.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAM1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAIjD;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,GAAG,UAAU,CAiBxE"}
+{"version":3,"file":"type-api.d.ts","sourceRoot":"","sources":["../../../src/auth/users/type-api.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAO1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAKjD;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,GAAG,UAAU,CAmBxE"}

package/dist/index.js

@@ -1153,7 +1153,7 @@ async function issueCode(context, token) {
 }
 async function insertOneTime(context, token, code) {
   const now = context.clock.now();
-  const secret = mintSecret();
+  const secret = token.secret ?? mintSecret();
   const expiresAt = new Date(now.getTime() + token.ttlMs);
   await context.store.tokens.insertToken({
     tokenHash: hashSecret(secret),
@@ -1295,6 +1295,18 @@ async function heldByPassword(context, type, verified, password, result, where)
   return false;
 }
 
+// src/auth/prepared.ts
+function sendOnce(where, issue) {
+  let sent = false;
+  return async () => {
+    if (sent) {
+      throw new TypeError(`${where}(…).send: already called — a prepared request sends once; call ${where} again for another`);
+    }
+    sent = true;
+    return issue();
+  };
+}
+
 // src/auth/email-flows/email-token.ts
 async function redeemEmailToken(context, type, kind, secret, where) {
   const token = await spendOneTime(context, secret, kind, where, "token");
@@ -1327,20 +1339,32 @@ function resetPasswordFlows(context, type, at) {
   return {
     async request(email) {
       const where = at("resetPassword.request");
-      passwordRule(type, where);
-      await countMailByAddress(context, type, "resetPassword", String(email), where);
-      const record = await holderOfEmail(context, type, String(email));
-      if (record === null)
-        return null;
-      const issued = await issueEmailToken(context, type, "resetPassword", record, where);
-      await context.store.tokens.spendUserTokens(record.id, "resetPassword", context.clock.now(), hashSecret(issued.token));
-      return { ...issued, user: toUser(record) };
+      return (await prepareReset(context, type, String(email), where)).send();
+    },
+    async prepare(email) {
+      const where = at("resetPassword.prepare");
+      return prepareReset(context, type, String(email), where);
     },
     async confirm(secret, password) {
       return confirmReset(context, type, secret, password, at("resetPassword.confirm"));
     }
   };
 }
+async function prepareReset(context, type, email, where) {
+  passwordRule(type, where);
+  await countMailByAddress(context, type, "resetPassword", email, where);
+  return Object.freeze({
+    send: sendOnce(where, () => issueReset(context, type, email, where))
+  });
+}
+async function issueReset(context, type, email, where) {
+  const record = await holderOfEmail(context, type, email);
+  if (record === null)
+    return null;
+  const issued = await issueEmailToken(context, type, "resetPassword", record, where);
+  await context.store.tokens.spendUserTokens(record.id, "resetPassword", context.clock.now(), hashSecret(issued.token));
+  return { ...issued, user: toUser(record) };
+}
 async function confirmReset(context, type, secret, password, where) {
   passwordRule(type, where);
   checkPassword(type, password, where);
@@ -1561,7 +1585,12 @@ async function finishEmailSignIn(context, type, finish, signIn) {
 function magicLinkFlows(context, type, at, finish) {
   return {
     async request(email) {
-      return requestLink(context, type, String(email), at("magicLink.request"));
+      const where = at("magicLink.request");
+      return (await prepareLink(context, type, String(email), where)).send();
+    },
+    async prepare(email) {
+      const where = at("magicLink.prepare");
+      return prepareLink(context, type, String(email), where);
     },
     async confirm(token, options) {
       const where = at("magicLink.confirm");
@@ -1570,8 +1599,13 @@ function magicLinkFlows(context, type, at, finish) {
     }
   };
 }
-async function requestLink(context, type, email, where) {
+async function prepareLink(context, type, email, where) {
   await countMailByAddress(context, type, "magicLink", email, where);
+  return Object.freeze({
+    send: sendOnce(where, () => issueLink(context, type, email))
+  });
+}
+async function issueLink(context, type, email) {
   const record = await signInHolder(context, type, email);
   if (record === null)
     return null;
@@ -1596,6 +1630,32 @@ async function confirmLink(context, type, finish, secret, where, device) {
   });
 }
 
+// src/auth/proven-sign-in.ts
+function provenSignInFlows(context, type, at, finish) {
+  return {
+    async signInProven(user, options) {
+      const where = at("signInProven");
+      const device = deviceHint(context, options, where);
+      const record = await getRecord(context, idOf2(user), type.name, where);
+      if (!record.active) {
+        throw new UserInactiveError2(`${where}: the user is inactive`, {
+          userId: record.id,
+          userType: type.name
+        });
+      }
+      const result = await finish(record, where, device);
+      await reportNewDevice(context, result);
+      return result;
+    }
+  };
+}
+function idOf2(user) {
+  if (typeof user === "string")
+    return user;
+  const id = typeof user === "object" && user !== null ? user.id : undefined;
+  return typeof id === "string" ? id : "";
+}
+
 // src/auth/sign-in-attempts.ts
 var PURPOSE3 = "janus/sign-in/attempts/v1";
 async function countLogin(context, type, login, where) {
@@ -1974,29 +2034,43 @@ function secondFactorFlows(context, type, at) {
 function signInCodeFlows(context, type, at, finish) {
   return {
     async request(email) {
-      return requestCode(context, type, String(email), at("signInCode.request"));
+      const where = at("signInCode.request");
+      return (await prepareCode(context, type, String(email), where)).send();
+    },
+    async prepare(email) {
+      const where = at("signInCode.prepare");
+      return prepareCode(context, type, String(email), where);
     },
     async confirm(challenge, code, options) {
       return confirmCode(context, type, finish, { challenge, code, options }, at);
     }
   };
 }
-async function requestCode(context, type, email, where) {
+async function prepareCode(context, type, email, where) {
   await countMailByAddress(context, type, "signInCode", email, where);
+  const challenge = mintSecret();
+  return Object.freeze({
+    challenge,
+    send: sendOnce(where, () => issueSignInCode(context, type, email, challenge))
+  });
+}
+async function issueSignInCode(context, type, email, challenge) {
   const record = await signInHolder(context, type, email);
   if (record === null)
     return null;
+  const address = String(record.fields[type.email]);
   const { secret, code, expiresAt } = await issueCode(context, {
     kind: "signInCode",
     userId: record.id,
-    address: String(record.fields[type.email]),
-    ttlMs: context.config.tokenTtlMs.signInCode
+    address,
+    ttlMs: context.config.tokenTtlMs.signInCode,
+    secret: challenge
   });
   await keepOnlyLatest(context, record.id, "signInCode", secret);
   return {
     code,
     challenge: secret,
-    email: String(record.fields[type.email]),
+    email: address,
     expiresAt,
     user: toUser(record)
   };
@@ -2164,6 +2238,18 @@ async function confirmStepUp(context, type, request, secret, code, where) {
   return toSession(confirmed);
 }
 
+// src/auth/users/find-by-email.ts
+function findByEmailFlows(context, type) {
+  return {
+    async findByEmail(email) {
+      if (typeof email !== "string" || email.trim() === "")
+        return null;
+      const record = await holderOfEmail(context, type, email);
+      return record === null ? null : toUser(record);
+    }
+  };
+}
+
 // src/auth/users/by-login.ts
 var byLogin = async (context, type, login) => isStorable(login) ? context.store.users.findUserByLogin(type.name, login) : null;
 
@@ -2448,10 +2534,12 @@ function typeApi(context, type) {
   return {
     ...recordFlows(context, type, at),
     ...passwordFlows(context, type, at, secondFactor.finish),
+    ...provenSignInFlows(context, type, at, secondFactor.finish),
     secondFactor: secondFactor.api,
     signInCode,
     magicLink: magicLinkFlows(context, type, at, secondFactor.finish),
     stepUp: stepUpFlows(context, type, at),
+    ...findByEmailFlows(context, type),
     ...emailFlows(context, type, at)
   };
 }
@@ -2540,5 +2628,5 @@ export {
   systemClock
 };
 
-//# debugId=22ACDB89AAF4B56564756E2164756E21
+//# debugId=8864B5F285AA35A664756E2164756E21
 //# sourceMappingURL=index.js.map