@nxgt/janus 0.5.0 → 0.7.0

package/dist/index.js

@@ -11,7 +11,7 @@ import {
   isId2,
   mintedAt2,
   createMemoryStores2
-} from "./chunks/index-gbwn2tts.js";
+} from "./chunks/index-c0jajeda.js";
 import {
   JanusError2,
   StoreFailure2,
@@ -278,7 +278,8 @@ function resolveConfig(config, where) {
     types,
     tokenTtlMs: {
       verifyEmail: parseDuration(config.tokens?.verifyEmail ?? "24h", `${where}: tokens.verifyEmail`),
-      resetPassword: parseDuration(config.tokens?.resetPassword ?? "1h", `${where}: tokens.resetPassword`)
+      resetPassword: parseDuration(config.tokens?.resetPassword ?? "1h", `${where}: tokens.resetPassword`),
+      signInCode: parseDuration(config.tokens?.signInCode ?? "10m", `${where}: tokens.signInCode`)
     },
     cookie: resolveCookie(config.cookie ?? {}, where),
     secondFactor: resolveSecondFactor(config.secondFactor, where)
@@ -513,6 +514,12 @@ function loginsOf(type, fields, where) {
     logins.add(normalizeEmail(email));
   return [...logins];
 }
+function passwordRule(type, where) {
+  if (type.password === null) {
+    throw new TypeError(`${where}: the ${type.name} type does not sign in with a password — add password: { login } to it`);
+  }
+  return type.password;
+}
 function checkPassword(type, password, where) {
   const minLength = type.password?.minLength ?? 8;
   if (typeof password !== "string" || password.length < minLength) {
@@ -579,6 +586,14 @@ async function writeUser(context, user, type, options, where, patchOf) {
   const patch = await patchOf(record, now);
   return context.store.users.updateUser(record.id, { ...patch, updatedAt: now }, record.version);
 }
+async function holderOfEmail(context, type, email) {
+  const wanted = normalizeEmail(email);
+  if (!isStorable(wanted))
+    return null;
+  const record = await context.store.users.findUserByLogin(type.name, wanted);
+  const held = record === null ? null : emailOf(type, record.fields);
+  return held !== null && normalizeEmail(held) === wanted ? record : null;
+}
 
 // src/auth/port/assert-stores.ts
 var REQUIRED = {
@@ -598,7 +613,13 @@ var REQUIRED = {
     "revokeUserSessions",
     "deleteUserSessions"
   ],
-  tokens: ["insertToken", "consumeToken", "countAttempt", "deleteUserTokens"]
+  tokens: [
+    "insertToken",
+    "consumeToken",
+    "countAttempt",
+    "spendUserTokens",
+    "deleteUserTokens"
+  ]
 };
 function assertStores(stores, where) {
   if (typeof stores !== "object" || stores === null) {
@@ -782,6 +803,30 @@ function headersOf(request) {
 }
 
 // src/auth/one-time.ts
+import { randomInt, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+var CODE_ATTEMPTS = 5;
+async function countCodeAttempt(context, secret, kind, where, userType) {
+  const token = await context.store.tokens.countAttempt(hashSecret(secret), kind);
+  refuseUnusable(token, context.clock.now(), where, "challenge");
+  if (token.attempts > CODE_ATTEMPTS) {
+    throw codeInvalid(where, token.userId, userType, 0);
+  }
+  return { token, attemptsLeft: CODE_ATTEMPTS - token.attempts };
+}
+function codeInvalid(where, userId, userType, attemptsLeft) {
+  return new TokenError2("CODE_INVALID", `${where}: the code does not match, or was already used`, {
+    operation: where,
+    userId,
+    userType,
+    ...attemptsLeft === undefined ? {} : { attemptsLeft }
+  });
+}
+function refuseStale(type, user, token, where, noun) {
+  const email = emailOf(type, user.fields);
+  if (email === null || normalizeEmail(email) !== normalizeEmail(token.address)) {
+    throw new TokenError2("TOKEN_STALE", `${where}: the ${noun} was sent to an e-mail the user no longer has`, { operation: where, userId: user.id, userType: type.name });
+  }
+}
 function refuseUnusable(token, now, where, noun) {
   if (token === null) {
     throw new TokenError2("TOKEN_UNKNOWN", `${where}: no such ${noun}`, {
@@ -800,13 +845,37 @@ function refuseUnusable(token, now, where, noun) {
 var unknownOneTime = (where, noun) => new TokenError2("TOKEN_UNKNOWN", `${where}: no such ${noun}`, {
   operation: where
 });
+async function unknownChallenge(context, token, secret, where) {
+  if (token.attempts === CODE_ATTEMPTS) {
+    await burnOneTime(context, secret, token.kind);
+  }
+  return unknownOneTime(where, "challenge");
+}
 async function spendOneTime(context, secret, kind, where, noun) {
   const now = context.clock.now();
   const token = await context.store.tokens.consumeToken(hashSecret(secret), kind, now);
   refuseUnusable(token, now, where, noun);
   return token;
 }
+async function burnOneTime(context, secret, kind) {
+  await context.store.tokens.consumeToken(hashSecret(secret), kind, context.clock.now());
+}
+var hashCode = (challenge, code) => hashSecret(`${challenge}${code}`);
+function codeMatches(token, challenge, code) {
+  if (token.codeHash === null || !/^\d{6}$/.test(code))
+    return false;
+  const given = Buffer.from(hashCode(challenge, code));
+  const held = Buffer.from(token.codeHash);
+  return given.length === held.length && timingSafeEqual2(given, held);
+}
 async function issueOneTime(context, token) {
+  return insertOneTime(context, token, null);
+}
+async function issueCode(context, token) {
+  const code = String(randomInt(1e6)).padStart(6, "0");
+  return { ...await insertOneTime(context, token, code), code };
+}
+async function insertOneTime(context, token, code) {
   const now = context.clock.now();
   const secret = mintSecret();
   const expiresAt = new Date(now.getTime() + token.ttlMs);
@@ -815,7 +884,7 @@ async function issueOneTime(context, token) {
     kind: token.kind,
     userId: token.userId,
     address: token.address,
-    codeHash: null,
+    codeHash: code === null ? null : hashCode(secret, code),
     attempts: 0,
     expiresAt,
     spentAt: null,
@@ -824,6 +893,98 @@ async function issueOneTime(context, token) {
   return { secret, expiresAt };
 }
 
+// src/auth/password-written.ts
+async function endSignInsWaiting(context, userId) {
+  await context.store.tokens.spendUserTokens(userId, "secondFactor", context.clock.now());
+}
+async function heldByPassword(context, type, verified, password, result, where) {
+  const now = await findRecord(context, verified.id, type.name);
+  const kept = now !== null && now.password !== null && (now.password.hash === verified.password?.hash || await passwordMatches(context, now, password, where));
+  if (kept)
+    return true;
+  if (result.status === "signedIn") {
+    await context.store.sessions.revokeSession(result.session.id, context.clock.now());
+  } else {
+    await burnOneTime(context, result.challenge, "secondFactor");
+  }
+  return false;
+}
+
+// src/auth/email-flows.ts
+function emailFlows(context, type, at) {
+  const { store, clock } = context;
+  const redeem = async (kind, secret, where) => {
+    const token = await spendOneTime(context, secret, kind, where, "token");
+    const user = await findRecord(context, token.userId, type.name);
+    if (user === null)
+      throw unknownOneTime(where, "token");
+    refuseStale(type, user, token, where, "token");
+    return { token, user };
+  };
+  const issue = async (kind, user, where) => {
+    const email = emailOf(type, user.fields);
+    if (email === null) {
+      throw new NotFoundError2(`${where}: the user has no e-mail`, {
+        userId: user.id,
+        userType: type.name,
+        operation: where
+      });
+    }
+    const { secret, expiresAt } = await issueOneTime(context, {
+      kind,
+      userId: user.id,
+      address: email,
+      ttlMs: context.config.tokenTtlMs[kind]
+    });
+    return { token: secret, email, expiresAt };
+  };
+  return {
+    verifyEmail: {
+      async send(user) {
+        const where = at("verifyEmail.send");
+        const record = await getRecord(context, idOf(user), type.name, where);
+        return issue("verifyEmail", record, where);
+      },
+      async confirm(secret) {
+        const where = at("verifyEmail.confirm");
+        const { token, user } = await redeem("verifyEmail", secret, where);
+        return toUser(await writeUser(context, user.id, type, undefined, where, (record, now) => {
+          refuseStale(type, record, token, where, "token");
+          return { emailVerifiedAt: now };
+        }));
+      }
+    },
+    resetPassword: {
+      async request(email) {
+        const where = at("resetPassword.request");
+        passwordRule(type, where);
+        const record = await holderOfEmail(context, type, String(email));
+        if (record === null)
+          return null;
+        const issued = await issue("resetPassword", record, where);
+        return { ...issued, user: toUser(record) };
+      },
+      async confirm(secret, password) {
+        const where = at("resetPassword.confirm");
+        passwordRule(type, where);
+        checkPassword(type, password, where);
+        const hash = await requireHasher(context, where).hash(password);
+        const { token, user } = await redeem("resetPassword", secret, where);
+        const written = await writeUser(context, user.id, type, undefined, where, (record, now) => {
+          refuseStale(type, record, token, where, "token");
+          return {
+            password: { hash, updatedAt: now },
+            ...record.emailVerifiedAt === null ? { emailVerifiedAt: now } : {}
+          };
+        });
+        await store.sessions.revokeUserSessions(written.id, clock.now());
+        await endSignInsWaiting(context, written.id);
+        return toUser(written);
+      }
+    }
+  };
+}
+
 // src/auth/totp.ts
 import { createHmac, randomBytes as randomBytes4 } from "node:crypto";
 var TOTP = { digits: 6, stepMs: 30000, drift: 1 };
@@ -925,17 +1086,8 @@ function acceptCode(configured, record, factor, code, now, where) {
     secret: keyId === configured.sealer.sealWith ? factor.secret : seal(configured.sealer, plain, record.id)
   };
 }
-function codeInvalid(type, where, userId, attemptsLeft) {
-  return new TokenError2("CODE_INVALID", `${where}: the code does not match, or was already used`, {
-    operation: where,
-    userId,
-    userType: type.name,
-    ...attemptsLeft === undefined ? {} : { attemptsLeft }
-  });
-}
 
 // src/auth/second-factor/challenge.ts
-var CHALLENGE_ATTEMPTS = 5;
 function challengeFlows(context, type, at) {
   const { store, clock } = context;
   const spend = (challenge, where) => spendOneTime(context, challenge, "secondFactor", where, "challenge");
@@ -948,21 +1100,22 @@ function challengeFlows(context, type, at) {
         address: "",
         ttlMs: configured.challengeTtlMs
       });
-      return { status: "secondFactor", challenge: secret, expiresAt };
+      return {
+        status: "secondFactor",
+        challenge: secret,
+        expiresAt,
+        userId: record.id
+      };
     },
     async confirm(challenge, code) {
       const where = at("secondFactor.confirm");
       const configured = requireSettings(context, where, "a second factor is being confirmed");
       const secret = String(challenge);
-      const token = await store.tokens.countAttempt(hashSecret(secret), "secondFactor");
-      refuseUnusable(token, clock.now(), where, "challenge");
-      if (token.attempts > CHALLENGE_ATTEMPTS) {
-        throw codeInvalid(type, where, token.userId, 0);
-      }
-      const attemptsLeft = CHALLENGE_ATTEMPTS - token.attempts;
+      const { token, attemptsLeft } = await countCodeAttempt(context, secret, "secondFactor", where, type.name);
       const record = await findRecord(context, token.userId, type.name);
-      if (record === null)
-        throw unknownOneTime(where, "challenge");
+      if (record === null) {
+        throw await unknownChallenge(context, token, secret, where);
+      }
       if (!record.active) {
         await spend(secret, where);
         throw new UserInactiveError2(`${where}: the user is inactive`, {
@@ -977,9 +1130,10 @@ function challengeFlows(context, type, at) {
       const now = clock.now();
       const accepted = acceptCode(configured, record, record.secondFactor, String(code), now, where);
       if (accepted === null) {
-        if (attemptsLeft === 0)
-          await spend(secret, where);
-        throw codeInvalid(type, where, record.id, attemptsLeft);
+        if (attemptsLeft === 0) {
+          await burnOneTime(context, secret, "secondFactor");
+        }
+        throw codeInvalid(where, record.id, type.name, attemptsLeft);
       }
       const written = await store.users.updateUser(record.id, { secondFactor: accepted, updatedAt: now }, record.version);
       await spend(secret, where);
@@ -1038,7 +1192,7 @@ function lifecycleFlows(context, type, at) {
         }
         const accepted = acceptCode(configured, record, factor, String(code), now, where);
         if (accepted === null)
-          throw codeInvalid(type, where, record.id);
+          throw codeInvalid(where, record.id, type.name);
         return { secondFactor: { ...accepted, confirmedAt: now } };
       });
       return toUser(written);
@@ -1061,8 +1215,57 @@ function secondFactorFlows(context, type, at) {
   };
   return {
     api,
-    challenge: challenges.issue,
-    required: (record) => isActive(record.secondFactor)
+    finish: (record, where) => isActive(record.secondFactor) ? challenges.issue(record, where) : openSession(context, type, record)
+  };
+}
+
+// src/auth/sign-in-code.ts
+function signInCodeFlows(context, type, at, finish) {
+  return {
+    async request(email) {
+      const record = await holderOfEmail(context, type, String(email));
+      if (record === null || !record.active)
+        return null;
+      const { secret, code, expiresAt } = await issueCode(context, {
+        kind: "signInCode",
+        userId: record.id,
+        address: String(record.fields[type.email]),
+        ttlMs: context.config.tokenTtlMs.signInCode
+      });
+      await context.store.tokens.spendUserTokens(record.id, "signInCode", context.clock.now(), hashSecret(secret));
+      return {
+        code,
+        challenge: secret,
+        email: String(record.fields[type.email]),
+        expiresAt,
+        user: toUser(record)
+      };
+    },
+    async confirm(challenge, code) {
+      const where = at("signInCode.confirm");
+      const secret = String(challenge);
+      const { token, attemptsLeft } = await countCodeAttempt(context, secret, "signInCode", where, type.name);
+      const user = await findRecord(context, token.userId, type.name);
+      if (user === null) {
+        throw await unknownChallenge(context, token, secret, where);
+      }
+      if (!codeMatches(token, secret, String(code))) {
+        if (token.attempts === CODE_ATTEMPTS) {
+          await burnOneTime(context, secret, "signInCode");
+        }
+        throw codeInvalid(where, user.id, type.name, attemptsLeft);
+      }
+      await spendOneTime(context, secret, "signInCode", where, "challenge");
+      refuseStale(type, user, token, where, "code");
+      if (!user.active) {
+        throw new UserInactiveError2(`${where}: the user is inactive`, {
+          userId: user.id,
+          userType: type.name
+        });
+      }
+      const proved = user.emailVerifiedAt === null ? await writeUser(context, user.id, type, { ifVersion: user.version }, where, (_, now) => ({ emailVerifiedAt: now })) : user;
+      return finish(proved, where);
+    }
   };
 }
 
@@ -1071,6 +1274,7 @@ function typeApi(context, type) {
   const { store, clock } = context;
   const at = (operation) => context.config.single ? operation : `${type.name}.${operation}`;
   const secondFactor = secondFactorFlows(context, type, at);
+  const signInCode = signInCodeFlows(context, type, at, secondFactor.finish);
   const byLogin = async (login) => isStorable(login) ? store.users.findUserByLogin(type.name, login) : null;
   const insert = async (input, where) => {
     const { password, active, ...rest } = input ?? {};
@@ -1099,40 +1303,6 @@ function typeApi(context, type) {
       updatedAt: now
     });
   };
-  const redeem = async (kind, secret, where) => {
-    const token = await spendOneTime(context, secret, kind, where, "token");
-    const user = await findRecord(context, token.userId, type.name);
-    if (user === null)
-      throw unknownOneTime(where, "token");
-    const email = emailOf(type, user.fields);
-    if (email === null || normalizeEmail(email) !== normalizeEmail(token.address)) {
-      throw new TokenError2("TOKEN_STALE", `${where}: the token was sent to an e-mail the user no longer has`, { operation: where, userId: user.id, userType: type.name });
-    }
-    return { token, user };
-  };
-  const issue = async (kind, user, where) => {
-    const email = emailOf(type, user.fields);
-    if (email === null) {
-      throw new NotFoundError2(`${where}: the user has no e-mail`, {
-        userId: user.id,
-        userType: type.name,
-        operation: where
-      });
-    }
-    const { secret, expiresAt } = await issueOneTime(context, {
-      kind,
-      userId: user.id,
-      address: email,
-      ttlMs: context.config.tokenTtlMs[kind]
-    });
-    return { token: secret, email, expiresAt };
-  };
-  const passwordRule = (where) => {
-    if (type.password === null) {
-      throw new TypeError(`${where}: the ${type.name} type does not sign in with a password — add password: { login } to it`);
-    }
-    return type.password;
-  };
   return {
     async create(input) {
       return toUser(await insert(input, at("create")));
@@ -1192,7 +1362,7 @@ function typeApi(context, type) {
     },
     async signUp(input) {
       const where = at("signUp");
-      passwordRule(where);
+      passwordRule(type, where);
       if (input?.password === undefined) {
         checkPassword(type, undefined, where);
       }
@@ -1201,7 +1371,7 @@ function typeApi(context, type) {
     },
     async signIn(input) {
       const where = at("signIn");
-      const rule = passwordRule(where);
+      const rule = passwordRule(type, where);
       const hasher = requireHasher(context, where);
       const login = input?.[rule.login];
       const password = input?.password;
@@ -1220,29 +1390,33 @@ function typeApi(context, type) {
           userType: type.name
         });
       }
-      const signedIn = await rehashed(context, record, String(password));
-      return secondFactor.required(signedIn) ? secondFactor.challenge(signedIn, where) : openSession(context, type, signedIn);
+      const verified = await rehashed(context, record, String(password));
+      const result = await secondFactor.finish(verified, where);
+      if (!await heldByPassword(context, type, verified, String(password), result, where)) {
+        throw refuse("wrongPassword");
+      }
+      return result;
     },
     async findByLogin(login) {
-      const rule = passwordRule(at("findByLogin"));
+      const rule = passwordRule(type, at("findByLogin"));
       const record = await byLogin(rule.normalize(login));
       return record === null ? null : toUser(record);
     },
     async setPassword(user, password, options) {
       const where = at("setPassword");
-      passwordRule(where);
+      passwordRule(type, where);
       checkPassword(type, password, where);
       const hash = await requireHasher(context, where).hash(password);
-      return toUser(await writeUser(context, user, type, options, where, (_, now) => ({
-        password: { hash, updatedAt: now }
-      })));
+      const written = await writeUser(context, user, type, options, where, (_, now) => ({ password: { hash, updatedAt: now } }));
+      await endSignInsWaiting(context, written.id);
+      return toUser(written);
     },
     async changePassword(user, change, options) {
       const where = at("changePassword");
-      passwordRule(where);
+      passwordRule(type, where);
       checkPassword(type, change?.next, where);
       const hasher = requireHasher(context, where);
-      return toUser(await writeUser(context, user, type, options, where, async (record, now) => {
+      const written = await writeUser(context, user, type, options, where, async (record, now) => {
         if (record.password === null || !await passwordMatches(context, record, change.current, where)) {
           throw new CredentialError2("CREDENTIALS_INVALID", `${where}: the current password does not match`, {
             reason: record.password === null ? "noPassword" : "wrongPassword",
@@ -1256,50 +1430,13 @@ function typeApi(context, type) {
             updatedAt: now
           }
         };
-      }));
+      });
+      await endSignInsWaiting(context, written.id);
+      return toUser(written);
     },
     secondFactor: secondFactor.api,
-    verifyEmail: {
-      async send(user) {
-        const where = at("verifyEmail.send");
-        const record = await getRecord(context, idOf(user), type.name, where);
-        return issue("verifyEmail", record, where);
-      },
-      async confirm(secret) {
-        const where = at("verifyEmail.confirm");
-        const { user } = await redeem("verifyEmail", secret, where);
-        return toUser(await writeUser(context, user.id, type, undefined, where, (_, now) => ({
-          emailVerifiedAt: now
-        })));
-      }
-    },
-    resetPassword: {
-      async request(email) {
-        const where = at("resetPassword.request");
-        passwordRule(where);
-        const wanted = normalizeEmail(String(email));
-        const record = await byLogin(wanted);
-        const held = record === null ? null : emailOf(type, record.fields);
-        if (record === null || held === null || normalizeEmail(held) !== wanted) {
-          return null;
-        }
-        const issued = await issue("resetPassword", record, where);
-        return { ...issued, user: toUser(record) };
-      },
-      async confirm(secret, password) {
-        const where = at("resetPassword.confirm");
-        passwordRule(where);
-        checkPassword(type, password, where);
-        const hash = await requireHasher(context, where).hash(password);
-        const { user } = await redeem("resetPassword", secret, where);
-        const written = await writeUser(context, user.id, type, undefined, where, (record, now) => ({
-          password: { hash, updatedAt: now },
-          ...record.emailVerifiedAt === null ? { emailVerifiedAt: now } : {}
-        }));
-        await store.sessions.revokeUserSessions(written.id, clock.now());
-        return toUser(written);
-      }
-    }
+    signInCode,
+    ...emailFlows(context, type, at)
   };
 }
 
@@ -1375,5 +1512,5 @@ export {
   systemClock
 };
 
-//# debugId=FA6925B96B6EEFD664756E2164756E21
+//# debugId=8A3012761E63D76664756E2164756E21
 //# sourceMappingURL=index.js.map