@nxgt/janus 0.5.0 → 0.6.0

package/dist/index.js

@@ -278,7 +278,8 @@ function resolveConfig(config, where) {
     types,
     tokenTtlMs: {
       verifyEmail: parseDuration(config.tokens?.verifyEmail ?? "24h", `${where}: tokens.verifyEmail`),
-      resetPassword: parseDuration(config.tokens?.resetPassword ?? "1h", `${where}: tokens.resetPassword`)
+      resetPassword: parseDuration(config.tokens?.resetPassword ?? "1h", `${where}: tokens.resetPassword`),
+      signInCode: parseDuration(config.tokens?.signInCode ?? "10m", `${where}: tokens.signInCode`)
     },
     cookie: resolveCookie(config.cookie ?? {}, where),
     secondFactor: resolveSecondFactor(config.secondFactor, where)
@@ -579,6 +580,14 @@ async function writeUser(context, user, type, options, where, patchOf) {
   const patch = await patchOf(record, now);
   return context.store.users.updateUser(record.id, { ...patch, updatedAt: now }, record.version);
 }
+async function holderOfEmail(context, type, email) {
+  const wanted = normalizeEmail(email);
+  if (!isStorable(wanted))
+    return null;
+  const record = await context.store.users.findUserByLogin(type.name, wanted);
+  const held = record === null ? null : emailOf(type, record.fields);
+  return held !== null && normalizeEmail(held) === wanted ? record : null;
+}
 
 // src/auth/port/assert-stores.ts
 var REQUIRED = {
@@ -782,6 +791,30 @@ function headersOf(request) {
 }
 
 // src/auth/one-time.ts
+import { randomInt, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+var CODE_ATTEMPTS = 5;
+async function countCodeAttempt(context, secret, kind, where, userType) {
+  const token = await context.store.tokens.countAttempt(hashSecret(secret), kind);
+  refuseUnusable(token, context.clock.now(), where, "challenge");
+  if (token.attempts > CODE_ATTEMPTS) {
+    throw codeInvalid(where, token.userId, userType, 0);
+  }
+  return { token, attemptsLeft: CODE_ATTEMPTS - token.attempts };
+}
+function codeInvalid(where, userId, userType, attemptsLeft) {
+  return new TokenError2("CODE_INVALID", `${where}: the code does not match, or was already used`, {
+    operation: where,
+    userId,
+    userType,
+    ...attemptsLeft === undefined ? {} : { attemptsLeft }
+  });
+}
+function refuseStale(type, user, token, where, noun) {
+  const email = emailOf(type, user.fields);
+  if (email === null || normalizeEmail(email) !== normalizeEmail(token.address)) {
+    throw new TokenError2("TOKEN_STALE", `${where}: the ${noun} was sent to an e-mail the user no longer has`, { operation: where, userId: user.id, userType: type.name });
+  }
+}
 function refuseUnusable(token, now, where, noun) {
   if (token === null) {
     throw new TokenError2("TOKEN_UNKNOWN", `${where}: no such ${noun}`, {
@@ -806,7 +839,25 @@ async function spendOneTime(context, secret, kind, where, noun) {
   refuseUnusable(token, now, where, noun);
   return token;
 }
+async function burnOneTime(context, secret, kind) {
+  await context.store.tokens.consumeToken(hashSecret(secret), kind, context.clock.now());
+}
+var hashCode = (challenge, code) => hashSecret(`${challenge}${code}`);
+function codeMatches(token, challenge, code) {
+  if (token.codeHash === null || !/^\d{6}$/.test(code))
+    return false;
+  const given = Buffer.from(hashCode(challenge, code));
+  const held = Buffer.from(token.codeHash);
+  return given.length === held.length && timingSafeEqual2(given, held);
+}
 async function issueOneTime(context, token) {
+  return insertOneTime(context, token, null);
+}
+async function issueCode(context, token) {
+  const code = String(randomInt(1e6)).padStart(6, "0");
+  return { ...await insertOneTime(context, token, code), code };
+}
+async function insertOneTime(context, token, code) {
   const now = context.clock.now();
   const secret = mintSecret();
   const expiresAt = new Date(now.getTime() + token.ttlMs);
@@ -815,7 +866,7 @@ async function issueOneTime(context, token) {
     kind: token.kind,
     userId: token.userId,
     address: token.address,
-    codeHash: null,
+    codeHash: code === null ? null : hashCode(secret, code),
     attempts: 0,
     expiresAt,
     spentAt: null,
@@ -925,17 +976,8 @@ function acceptCode(configured, record, factor, code, now, where) {
     secret: keyId === configured.sealer.sealWith ? factor.secret : seal(configured.sealer, plain, record.id)
   };
 }
-function codeInvalid(type, where, userId, attemptsLeft) {
-  return new TokenError2("CODE_INVALID", `${where}: the code does not match, or was already used`, {
-    operation: where,
-    userId,
-    userType: type.name,
-    ...attemptsLeft === undefined ? {} : { attemptsLeft }
-  });
-}
 
 // src/auth/second-factor/challenge.ts
-var CHALLENGE_ATTEMPTS = 5;
 function challengeFlows(context, type, at) {
   const { store, clock } = context;
   const spend = (challenge, where) => spendOneTime(context, challenge, "secondFactor", where, "challenge");
@@ -954,12 +996,7 @@ function challengeFlows(context, type, at) {
       const where = at("secondFactor.confirm");
       const configured = requireSettings(context, where, "a second factor is being confirmed");
       const secret = String(challenge);
-      const token = await store.tokens.countAttempt(hashSecret(secret), "secondFactor");
-      refuseUnusable(token, clock.now(), where, "challenge");
-      if (token.attempts > CHALLENGE_ATTEMPTS) {
-        throw codeInvalid(type, where, token.userId, 0);
-      }
-      const attemptsLeft = CHALLENGE_ATTEMPTS - token.attempts;
+      const { token, attemptsLeft } = await countCodeAttempt(context, secret, "secondFactor", where, type.name);
       const record = await findRecord(context, token.userId, type.name);
       if (record === null)
         throw unknownOneTime(where, "challenge");
@@ -977,9 +1014,10 @@ function challengeFlows(context, type, at) {
       const now = clock.now();
       const accepted = acceptCode(configured, record, record.secondFactor, String(code), now, where);
       if (accepted === null) {
-        if (attemptsLeft === 0)
-          await spend(secret, where);
-        throw codeInvalid(type, where, record.id, attemptsLeft);
+        if (attemptsLeft === 0) {
+          await burnOneTime(context, secret, "secondFactor");
+        }
+        throw codeInvalid(where, record.id, type.name, attemptsLeft);
       }
       const written = await store.users.updateUser(record.id, { secondFactor: accepted, updatedAt: now }, record.version);
       await spend(secret, where);
@@ -1038,7 +1076,7 @@ function lifecycleFlows(context, type, at) {
         }
         const accepted = acceptCode(configured, record, factor, String(code), now, where);
         if (accepted === null)
-          throw codeInvalid(type, where, record.id);
+          throw codeInvalid(where, record.id, type.name);
         return { secondFactor: { ...accepted, confirmedAt: now } };
       });
       return toUser(written);
@@ -1061,8 +1099,55 @@ function secondFactorFlows(context, type, at) {
   };
   return {
     api,
-    challenge: challenges.issue,
-    required: (record) => isActive(record.secondFactor)
+    finish: (record, where) => isActive(record.secondFactor) ? challenges.issue(record, where) : openSession(context, type, record)
+  };
+}
+
+// src/auth/sign-in-code.ts
+function signInCodeFlows(context, type, at, finish) {
+  return {
+    async request(email) {
+      const record = await holderOfEmail(context, type, String(email));
+      if (record === null || !record.active)
+        return null;
+      const { secret, code, expiresAt } = await issueCode(context, {
+        kind: "signInCode",
+        userId: record.id,
+        address: String(record.fields[type.email]),
+        ttlMs: context.config.tokenTtlMs.signInCode
+      });
+      return {
+        code,
+        challenge: secret,
+        email: String(record.fields[type.email]),
+        expiresAt,
+        user: toUser(record)
+      };
+    },
+    async confirm(challenge, code) {
+      const where = at("signInCode.confirm");
+      const secret = String(challenge);
+      const { token, attemptsLeft } = await countCodeAttempt(context, secret, "signInCode", where, type.name);
+      const user = await findRecord(context, token.userId, type.name);
+      if (user === null)
+        throw unknownOneTime(where, "challenge");
+      if (!codeMatches(token, secret, String(code))) {
+        if (token.attempts === CODE_ATTEMPTS) {
+          await burnOneTime(context, secret, "signInCode");
+        }
+        throw codeInvalid(where, user.id, type.name, attemptsLeft);
+      }
+      await spendOneTime(context, secret, "signInCode", where, "challenge");
+      refuseStale(type, user, token, where, "code");
+      if (!user.active) {
+        throw new UserInactiveError2(`${where}: the user is inactive`, {
+          userId: user.id,
+          userType: type.name
+        });
+      }
+      const proved = user.emailVerifiedAt === null ? await writeUser(context, user.id, type, { ifVersion: user.version }, where, (_, now) => ({ emailVerifiedAt: now })) : user;
+      return finish(proved, where);
+    }
   };
 }
 
@@ -1071,6 +1156,7 @@ function typeApi(context, type) {
   const { store, clock } = context;
   const at = (operation) => context.config.single ? operation : `${type.name}.${operation}`;
   const secondFactor = secondFactorFlows(context, type, at);
+  const signInCode = signInCodeFlows(context, type, at, secondFactor.finish);
   const byLogin = async (login) => isStorable(login) ? store.users.findUserByLogin(type.name, login) : null;
   const insert = async (input, where) => {
     const { password, active, ...rest } = input ?? {};
@@ -1104,10 +1190,7 @@ function typeApi(context, type) {
     const user = await findRecord(context, token.userId, type.name);
     if (user === null)
       throw unknownOneTime(where, "token");
-    const email = emailOf(type, user.fields);
-    if (email === null || normalizeEmail(email) !== normalizeEmail(token.address)) {
-      throw new TokenError2("TOKEN_STALE", `${where}: the token was sent to an e-mail the user no longer has`, { operation: where, userId: user.id, userType: type.name });
-    }
+    refuseStale(type, user, token, where, "token");
     return { token, user };
   };
   const issue = async (kind, user, where) => {
@@ -1220,8 +1303,7 @@ function typeApi(context, type) {
           userType: type.name
         });
       }
-      const signedIn = await rehashed(context, record, String(password));
-      return secondFactor.required(signedIn) ? secondFactor.challenge(signedIn, where) : openSession(context, type, signedIn);
+      return secondFactor.finish(await rehashed(context, record, String(password)), where);
     },
     async findByLogin(login) {
       const rule = passwordRule(at("findByLogin"));
@@ -1259,6 +1341,7 @@ function typeApi(context, type) {
       }));
     },
     secondFactor: secondFactor.api,
+    signInCode,
     verifyEmail: {
       async send(user) {
         const where = at("verifyEmail.send");
@@ -1277,12 +1360,9 @@ function typeApi(context, type) {
       async request(email) {
         const where = at("resetPassword.request");
         passwordRule(where);
-        const wanted = normalizeEmail(String(email));
-        const record = await byLogin(wanted);
-        const held = record === null ? null : emailOf(type, record.fields);
-        if (record === null || held === null || normalizeEmail(held) !== wanted) {
+        const record = await holderOfEmail(context, type, String(email));
+        if (record === null)
           return null;
-        }
         const issued = await issue("resetPassword", record, where);
         return { ...issued, user: toUser(record) };
       },
@@ -1375,5 +1455,5 @@ export {
   systemClock
 };
 
-//# debugId=FA6925B96B6EEFD664756E2164756E21
+//# debugId=9A2F9DDAD478673A64756E2164756E21
 //# sourceMappingURL=index.js.map