@nxgt/janus 0.23.1 → 0.25.0

package/dist/index.js

@@ -7,13 +7,13 @@ import {
   MAX_PAGE_SIZE2,
   pageLimit2,
   invalidCursor2
-} from "./chunks/index-4khsm7mw.js";
+} from "./chunks/index-y9b327j8.js";
 import {
   mintId2,
   isId2,
   mintedAt2,
   createMemoryStores2
-} from "./chunks/index-6bjfv4xv.js";
+} from "./chunks/index-q3w3vr69.js";
 import {
   JanusError2,
   UserInvalidError2,
@@ -39,7 +39,7 @@ import {
   formatTuple2,
   parseTuple2,
   parseSubject2
-} from "./chunks/index-kppkcbn5.js";
+} from "./chunks/index-spwh8b9z.js";
 
 // src/auth/hashers.ts
 import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
@@ -550,6 +550,15 @@ async function unlessVersionConflict(write) {
     throw error;
   }
 }
+async function unlessLoginTaken(write) {
+  try {
+    return await write;
+  } catch (error) {
+    if (error instanceof StoreConflict2 && error.on === "login")
+      return error;
+    throw error;
+  }
+}
 
 // src/auth/context/password.ts
 function passwordRule(type, where) {
@@ -785,6 +794,7 @@ function assertStores(stores, where) {
   const slots = stores;
   return {
     collectExpired: optional(slots, "sessions", "deleteExpiredSessions", where),
+    collectExpiredTokens: optional(slots, "tokens", "deleteExpiredTokens", where),
     findUsers: optional(slots, "users", "findUsers", where)
   };
 }
@@ -1014,6 +1024,19 @@ function renewalDue(type, session, now) {
   return type.renewAfterMs !== null && type.lifespanMs - (session.expiresAt.getTime() - now) >= type.renewAfterMs;
 }
 
+// src/auth/sessions/collect-expired.ts
+async function collectExpired(context) {
+  const { store, clock, capabilities } = context;
+  const sessions = capabilities.collectExpired ? store.sessions.deleteExpiredSessions : undefined;
+  const tokens = capabilities.collectExpiredTokens ? store.tokens.deleteExpiredTokens : undefined;
+  if (sessions === undefined && tokens === undefined) {
+    throw new UnsupportedError2("collectExpired: store.sessions does not implement deleteExpiredSessions, nor store.tokens deleteExpiredTokens — their stores expire records on their own, or implement the methods", { slot: "sessions", operation: "deleteExpiredSessions" });
+  }
+  const before = clock.now();
+  const collected = sessions === undefined ? 0 : await sessions(before);
+  return collected + (tokens === undefined ? 0 : await tokens(before));
+}
+
 // src/auth/sessions/cookie.ts
 function cookieOf(context) {
   const { name, domain, path, sameSite, secure } = context.config.cookie;
@@ -1062,11 +1085,7 @@ function sharedApi(context) {
     },
     cookie: cookieOf(context),
     async collectExpired() {
-      const collect = store.sessions.deleteExpiredSessions;
-      if (!context.capabilities.collectExpired || collect === undefined) {
-        throw new UnsupportedError2("collectExpired: store.sessions does not implement deleteExpiredSessions — its store expires sessions on its own, or implement the method", { slot: "sessions", operation: "deleteExpiredSessions" });
-      }
-      return collect(clock.now());
+      return collectExpired(context);
     },
     types: [...config.types.keys()]
   };
@@ -1648,19 +1667,69 @@ async function endWhatTheSquatterOpened(context, userId) {
 function proveFirstFlow(context, type, at) {
   return async (user) => {
     const where = at("verifyEmail.proveFirst");
-    const record = await getRecord(context, refId(user), type.name, where);
-    if (!record.active) {
-      throw new UserInactiveError2(`${where}: the user is inactive`, {
-        userId: record.id,
-        userType: type.name
+    const id = refId(user);
+    const claimed = claimedEmail(type, user);
+    const first = await readActive(context, type, id, where);
+    assertClaimed(type, claimed, first, user, where);
+    const answer = await unlessVersionConflict(proveOrAnswer(context, type, first, where));
+    if (answer !== null)
+      return answer;
+    const again = await readActive(context, type, id, where);
+    assertClaimed(type, claimed, again, user, where);
+    if (!sameEmail(type, first, again)) {
+      throw new StoreConflict2("version", `${where}: the e-mail changed since it was read`, {
+        userId: first.id,
+        expectedVersion: first.version,
+        actualVersion: again.version,
+        operation: where
       });
     }
-    if (record.emailVerifiedAt !== null) {
-      return { user: toUser(record), proved: false };
-    }
-    const proved = await proveFirstEmail(context, type, record, where);
-    return { user: toUser(proved), proved: true };
+    return proveOrAnswer(context, type, again, where);
+  };
+}
+async function readActive(context, type, id, where) {
+  const record = await getRecord(context, id, type.name, where);
+  if (!record.active) {
+    throw new UserInactiveError2(`${where}: the user is inactive`, {
+      userId: record.id,
+      userType: type.name
+    });
+  }
+  return record;
+}
+async function proveOrAnswer(context, type, record, where) {
+  if (record.emailVerifiedAt !== null) {
+    return { user: toUser(record), proved: false };
+  }
+  const proved = await proveFirstEmail(context, type, record, where);
+  return { user: toUser(proved), proved: true };
+}
+function sameEmail(type, a, b) {
+  const held = (record) => {
+    const email = emailOf(type, record.fields);
+    return email === null ? null : normalizeEmail(email);
   };
+  return held(a) === held(b);
+}
+function claimedEmail(type, user) {
+  if (typeof user !== "object" || user === null)
+    return null;
+  const value = user[type.email];
+  return typeof value === "string" ? normalizeEmail(value) : null;
+}
+function assertClaimed(type, claimed, record, user, where) {
+  if (claimed === null)
+    return;
+  const email = emailOf(type, record.fields);
+  if (email !== null && normalizeEmail(email) === claimed)
+    return;
+  const held = user.version;
+  throw new StoreConflict2("version", `${where}: the e-mail changed since the user was read`, {
+    userId: record.id,
+    ...typeof held === "number" ? { expectedVersion: held } : {},
+    actualVersion: record.version,
+    operation: where
+  });
 }
 
 // src/auth/email-flows/verify-email.ts
@@ -2387,36 +2456,13 @@ function findByEmailFlows(context, type) {
 // src/auth/users/by-login.ts
 var byLogin = async (context, type, login) => isStorable(login) ? context.store.users.findUserByLogin(type.name, login) : null;
 
-// src/auth/users/change-password.ts
-async function changePassword(context, type, user, change, options, where) {
-  passwordRule(type, where);
-  checkPassword(type, change?.next, where);
-  const hasher = requireHasher(context, where);
-  const written = await writeUser(context, user, type, options, where, async (record, now) => {
-    if (record.password === null || !await passwordMatches(context, record, change.current, where)) {
-      throw new CredentialError2("CREDENTIALS_INVALID", `${where}: the current password does not match`, {
-        reason: record.password === null ? "noPassword" : "wrongPassword",
-        userId: record.id,
-        userType: type.name
-      });
-    }
-    return {
-      password: {
-        hash: await hasher.hash(change.next),
-        updatedAt: now
-      }
-    };
-  });
-  await passwordChanged(context, written);
-  return written;
-}
-
 // src/auth/users/insert.ts
-async function insert(context, type, input, where) {
+async function insert(context, type, input, where, accept) {
   const { store, clock } = context;
   const { password, active, ...rest } = input ?? {};
   const now = clock.now();
   const fields = await validateFields(type, rest, where);
+  accept?.(fields);
   let hash = null;
   if (password !== undefined) {
     checkPassword(type, password, where);
@@ -2443,6 +2489,82 @@ async function insert(context, type, input, where) {
   return inserted;
 }
 
+// src/auth/users/find-or-create.ts
+async function holder(context, type, key) {
+  if (type.password !== null) {
+    return byLogin(context, type, type.password.normalize(key));
+  }
+  return key.trim() === "" ? null : holderOfEmail(context, type, key);
+}
+function refusal2(type, where, field) {
+  return new UserInvalidError2(`${where}: the fields do not match the ${type.name} schema (1 issue, at ${field})`, {
+    issues: [
+      { path: [field], message: "is not the key findOrCreate was given" }
+    ],
+    userType: type.name
+  });
+}
+function mustNameKey(type, key, where) {
+  return (fields) => {
+    const field = type.password === null ? type.email : type.password.login;
+    const value = fields[field];
+    const named = typeof value !== "string" ? null : type.password === null ? normalizeEmail(value) : type.password.normalize(value);
+    const wanted = type.password === null ? normalizeEmail(key) : type.password.normalize(key);
+    if (named === null || named !== wanted) {
+      throw refusal2(type, where, field);
+    }
+  };
+}
+function findOrCreateFlows(context, type, at) {
+  return {
+    async findOrCreate(key, input) {
+      const where = at("findOrCreate");
+      if (typeof key !== "string") {
+        throw new UserInvalidError2(`${where}: the key must be a string`, {
+          issues: [{ path: [], message: "is not a string" }],
+          userType: type.name
+        });
+      }
+      const found = await holder(context, type, key);
+      if (found !== null)
+        return { user: toUser(found), created: false };
+      const record = await input();
+      const written = await unlessLoginTaken(insert(context, type, record, where, mustNameKey(type, key, where)));
+      if (!(written instanceof StoreConflict2)) {
+        return { user: toUser(written), created: true };
+      }
+      const winner = await holder(context, type, key);
+      if (winner === null)
+        throw written;
+      return { user: toUser(winner), created: false };
+    }
+  };
+}
+
+// src/auth/users/change-password.ts
+async function changePassword(context, type, user, change, options, where) {
+  passwordRule(type, where);
+  checkPassword(type, change?.next, where);
+  const hasher = requireHasher(context, where);
+  const written = await writeUser(context, user, type, options, where, async (record, now) => {
+    if (record.password === null || !await passwordMatches(context, record, change.current, where)) {
+      throw new CredentialError2("CREDENTIALS_INVALID", `${where}: the current password does not match`, {
+        reason: record.password === null ? "noPassword" : "wrongPassword",
+        userId: record.id,
+        userType: type.name
+      });
+    }
+    return {
+      password: {
+        hash: await hasher.hash(change.next),
+        updatedAt: now
+      }
+    };
+  });
+  await passwordChanged(context, written);
+  return written;
+}
+
 // src/auth/users/sign-in.ts
 async function signIn(context, type, finish, input, call) {
   const { where, device } = call;
@@ -2663,6 +2785,7 @@ function typeApi(context, type) {
     magicLink: magicLinkFlows(context, type, at, secondFactor.finish),
     stepUp: stepUpFlows(context, type, at),
     ...findByEmailFlows(context, type),
+    ...findOrCreateFlows(context, type, at),
     ...emailFlows(context, type, at)
   };
 }
@@ -2751,5 +2874,5 @@ export {
   systemClock
 };
 
-//# debugId=33064E7A9A36409664756E2164756E21
+//# debugId=D10ED7160A09120864756E2164756E21
 //# sourceMappingURL=index.js.map