@nxgt/janus 0.22.1 → 0.23.1

package/dist/index.js

@@ -425,7 +425,8 @@ function resolveTokenTtls(config, where) {
     resetPassword: parseDuration(config.tokens?.resetPassword ?? "1h", `${where}: tokens.resetPassword`),
     signInCode: parseDuration(config.tokens?.signInCode ?? "10m", `${where}: tokens.signInCode`),
     magicLink: parseDuration(config.tokens?.magicLink ?? "15m", `${where}: tokens.magicLink`),
-    stepUp: parseDuration(config.tokens?.stepUp ?? "10m", `${where}: tokens.stepUp`)
+    stepUp: parseDuration(config.tokens?.stepUp ?? "10m", `${where}: tokens.stepUp`),
+    changeEmail: parseDuration(config.tokens?.changeEmail ?? "1h", `${where}: tokens.changeEmail`)
   };
 }
 // src/auth/config/warn-throttle-window.ts
@@ -434,7 +435,8 @@ var FLOWS = [
   "signInCode",
   "resetPassword",
   "verifyEmail",
-  "stepUp"
+  "stepUp",
+  "changeEmail"
 ];
 var UNITS2 = [
   ["d", 86400000],
@@ -1151,13 +1153,13 @@ function codeMatches(token, challenge, code) {
 // src/auth/one-time/issue.ts
 import { randomInt } from "node:crypto";
 async function issueOneTime(context, token) {
-  return insertOneTime(context, token, null);
+  return insertOneTime(context, token, null, token.boundHash ?? null);
 }
 async function issueCode(context, token) {
   const code = String(randomInt(1e6)).padStart(6, "0");
-  return { ...await insertOneTime(context, token, code), code };
+  return { ...await insertOneTime(context, token, code, null), code };
 }
-async function insertOneTime(context, token, code) {
+async function insertOneTime(context, token, code, boundHash) {
   const now = context.clock.now();
   const secret = token.secret ?? mintSecret();
   const expiresAt = new Date(now.getTime() + token.ttlMs);
@@ -1166,7 +1168,7 @@ async function insertOneTime(context, token, code) {
     kind: token.kind,
     userId: token.userId,
     address: token.address,
-    codeHash: code === null ? null : hashCode(secret, code),
+    codeHash: code === null ? boundHash : hashCode(secret, code),
     attempts: 0,
     expiresAt,
     spentAt: null,
@@ -1243,8 +1245,11 @@ async function insertLink(links, tokenHash) {
 }
 // src/auth/mail-requests.ts
 var PURPOSE2 = "janus/mail/requests/v1";
-async function countMailByAddress(context, type, flow, email, where) {
-  await countMail(context, type, flow, { address: normalizeEmail(email) }, where);
+async function countMailByAddress(context, type, flow, email, where, userId) {
+  await countMail(context, type, flow, {
+    address: normalizeEmail(email),
+    ...userId === undefined ? {} : { userId }
+  }, where);
 }
 async function countMailByUser(context, type, flow, userId, where) {
   await countMail(context, type, flow, { userId }, where);
@@ -1265,14 +1270,122 @@ async function countMail(context, type, flow, counted, where) {
   if (attempts <= throttle.attempts)
     return;
   const now = context.clock.now().getTime();
-  const byUser = "userId" in counted;
-  throw new MailThrottledError2(`${where}: too many e-mails asked for this ${byUser ? "user" : "address"} — the last one sent still works; use it, or wait for the next window`, {
+  throw new MailThrottledError2(`${where}: too many e-mails asked for this ${"address" in counted ? "address" : "user"} — the last one sent still works; use it, or wait for the next window`, {
     userType: type.name,
-    ...byUser ? { userId: counted.userId } : {},
+    ...counted.userId === undefined ? {} : { userId: counted.userId },
     retryAfter: Math.max(1, Math.ceil((endsAt - now) / 1000))
   });
 }
 
+// src/auth/users/fields-patch.ts
+var normalized = (email) => email === null ? null : normalizeEmail(email);
+function emailChanged(type, before, after) {
+  return normalized(emailOf(type, before)) !== normalized(emailOf(type, after));
+}
+async function fieldsPatch(type, record, patch, where) {
+  const fields = await validateFields(type, { ...record.fields, ...patch }, where);
+  return {
+    fields,
+    logins: loginsOf(type, fields, where),
+    schemaVersion: type.schemaVersion,
+    ...emailChanged(type, record.fields, fields) ? { emailVerifiedAt: null } : {}
+  };
+}
+
+// src/auth/email-flows/change-email-token.ts
+var formerHash = (secret, former) => hashSecret(`janus/changeEmail/former\x00${secret}\x00${normalizeEmail(former ?? "")}`);
+async function newAddressOf(type, user, email, where) {
+  const fields = await validateFields(type, { ...user.fields, [type.email]: email }, where);
+  const address = emailOf(type, fields);
+  if (address === null) {
+    throw new TypeError(`janus: email "${type.email}" did not name a string in validated ${type.name} fields — the schema must keep the e-mail field a required string`);
+  }
+  if (normalizeEmail(address) === normalizeEmail(emailOf(type, user.fields) ?? "")) {
+    throw new UserInvalidError2(`${where}: the new e-mail is the user's current one — a change moves to another address; verifyEmail proves the current one`, {
+      issues: [
+        { path: [type.email], message: "is the current e-mail of the user" }
+      ],
+      userType: type.name
+    });
+  }
+  return address;
+}
+async function issueChangeEmailToken(context, type, user, address) {
+  const secret = mintSecret();
+  const { expiresAt } = await issueOneTime(context, {
+    kind: "changeEmail",
+    userId: user.id,
+    address,
+    ttlMs: context.config.tokenTtlMs.changeEmail,
+    secret,
+    boundHash: formerHash(secret, emailOf(type, user.fields))
+  });
+  await context.store.tokens.spendUserTokens(user.id, "changeEmail", context.clock.now(), hashSecret(secret));
+  return { token: secret, email: address, expiresAt };
+}
+function refuseMoved(type, user, token, secret, where) {
+  if (token.codeHash !== formerHash(secret, emailOf(type, user.fields))) {
+    throw new TokenError2("TOKEN_STALE", `${where}: the token was asked from an e-mail the user no longer has`, { operation: where, userId: user.id, userType: type.name });
+  }
+}
+async function redeemChangeEmailToken(context, type, secret, where) {
+  const token = await spendOneTime(context, secret, "changeEmail", where, "token");
+  const user = await findRecord(context, token.userId, type.name);
+  if (user === null)
+    throw unknownOneTime(where, "token");
+  refuseMoved(type, user, token, secret, where);
+  return { token, user };
+}
+
+// src/auth/email-flows/change-email.ts
+var inactive = (type, user, where) => new UserInactiveError2(`${where}: the user is inactive`, {
+  userId: user.id,
+  userType: type.name
+});
+function changeEmailFlows(context, type, at) {
+  return {
+    async send(user, email) {
+      const where = at("changeEmail.send");
+      const record = await getRecord(context, idOf(user), type.name, where);
+      if (!record.active)
+        throw inactive(type, record, where);
+      const address = await newAddressOf(type, record, email, where);
+      await countMailByUser(context, type, "changeEmail", record.id, where);
+      await countMailByAddress(context, type, "changeEmail", address, where, record.id);
+      return issueChangeEmailToken(context, type, record, address);
+    },
+    async confirm(secret) {
+      return confirmChange(context, type, secret, at("changeEmail.confirm"));
+    }
+  };
+}
+async function confirmChange(context, type, secret, where) {
+  const { token, user } = await redeemChangeEmailToken(context, type, secret, where);
+  if (!user.active)
+    throw inactive(type, user, where);
+  const seen = { replaced: null };
+  const written = await writeUser(context, user.id, type, undefined, where, async (record, now) => {
+    if (!record.active)
+      throw inactive(type, record, where);
+    refuseMoved(type, record, token, secret, where);
+    seen.replaced = record;
+    const patch = await fieldsPatch(type, record, { [type.email]: token.address }, where);
+    const proved = record.emailVerifiedAt === null || emailChanged(type, record.fields, patch.fields);
+    return proved ? { ...patch, emailVerifiedAt: now } : patch;
+  });
+  const { replaced } = seen;
+  const moved = replaced !== null && emailChanged(type, replaced.fields, written.fields);
+  if (replaced !== null && moved) {
+    await emit(context, "user.emailChanged", written, written.updatedAt, {
+      formerEmail: emailOf(type, replaced.fields)
+    });
+  }
+  if (moved || replaced?.emailVerifiedAt === null) {
+    await emit(context, "user.emailVerified", written, written.updatedAt);
+  }
+  return toUser(written);
+}
+
 // src/auth/password-written.ts
 async function endWhatThePasswordOpened(context, userId) {
   const now = context.clock.now();
@@ -1581,7 +1694,8 @@ function verifyEmailFlows(context, type, at) {
 function emailFlows(context, type, at) {
   return {
     verifyEmail: verifyEmailFlows(context, type, at),
-    resetPassword: resetPasswordFlows(context, type, at)
+    resetPassword: resetPasswordFlows(context, type, at),
+    changeEmail: changeEmailFlows(context, type, at)
   };
 }
 // src/auth/email-sign-in.ts
@@ -2471,21 +2585,6 @@ async function readBatch(context, ids) {
   return records;
 }
 
-// src/auth/users/fields-patch.ts
-var normalized = (email) => email === null ? null : normalizeEmail(email);
-function emailChanged(type, before, after) {
-  return normalized(emailOf(type, before)) !== normalized(emailOf(type, after));
-}
-async function fieldsPatch(type, record, patch, where) {
-  const fields = await validateFields(type, { ...record.fields, ...patch }, where);
-  return {
-    fields,
-    logins: loginsOf(type, fields, where),
-    schemaVersion: type.schemaVersion,
-    ...emailChanged(type, record.fields, fields) ? { emailVerifiedAt: null } : {}
-  };
-}
-
 // src/auth/users/update.ts
 async function update(context, type, user, patch, options, where) {
   const seen = { replaced: null };
@@ -2495,9 +2594,13 @@ async function update(context, type, user, patch, options, where) {
   });
   const { replaced } = seen;
   if (replaced !== null && emailChanged(type, replaced.fields, written.fields)) {
-    await emit(context, "user.emailChanged", written, written.updatedAt, {
-      formerEmail: emailOf(type, replaced.fields)
-    });
+    try {
+      await context.store.tokens.spendUserTokens(written.id, "changeEmail", context.clock.now());
+    } finally {
+      await emit(context, "user.emailChanged", written, written.updatedAt, {
+        formerEmail: emailOf(type, replaced.fields)
+      });
+    }
   }
   return written;
 }
@@ -2648,5 +2751,5 @@ export {
   systemClock
 };
 
-//# debugId=D104C8FB67042A0864756E2164756E21
+//# debugId=33064E7A9A36409664756E2164756E21
 //# sourceMappingURL=index.js.map