@nxgt/janus 0.6.0 → 0.7.0

package/dist/index.js

@@ -11,7 +11,7 @@ import {
   isId2,
   mintedAt2,
   createMemoryStores2
-} from "./chunks/index-gbwn2tts.js";
+} from "./chunks/index-c0jajeda.js";
 import {
   JanusError2,
   StoreFailure2,
@@ -514,6 +514,12 @@ function loginsOf(type, fields, where) {
     logins.add(normalizeEmail(email));
   return [...logins];
 }
+function passwordRule(type, where) {
+  if (type.password === null) {
+    throw new TypeError(`${where}: the ${type.name} type does not sign in with a password — add password: { login } to it`);
+  }
+  return type.password;
+}
 function checkPassword(type, password, where) {
   const minLength = type.password?.minLength ?? 8;
   if (typeof password !== "string" || password.length < minLength) {
@@ -607,7 +613,13 @@ var REQUIRED = {
     "revokeUserSessions",
     "deleteUserSessions"
   ],
-  tokens: ["insertToken", "consumeToken", "countAttempt", "deleteUserTokens"]
+  tokens: [
+    "insertToken",
+    "consumeToken",
+    "countAttempt",
+    "spendUserTokens",
+    "deleteUserTokens"
+  ]
 };
 function assertStores(stores, where) {
   if (typeof stores !== "object" || stores === null) {
@@ -833,6 +845,12 @@ function refuseUnusable(token, now, where, noun) {
 var unknownOneTime = (where, noun) => new TokenError2("TOKEN_UNKNOWN", `${where}: no such ${noun}`, {
   operation: where
 });
+async function unknownChallenge(context, token, secret, where) {
+  if (token.attempts === CODE_ATTEMPTS) {
+    await burnOneTime(context, secret, token.kind);
+  }
+  return unknownOneTime(where, "challenge");
+}
 async function spendOneTime(context, secret, kind, where, noun) {
   const now = context.clock.now();
   const token = await context.store.tokens.consumeToken(hashSecret(secret), kind, now);
@@ -875,6 +893,98 @@ async function insertOneTime(context, token, code) {
   return { secret, expiresAt };
 }
 
+// src/auth/password-written.ts
+async function endSignInsWaiting(context, userId) {
+  await context.store.tokens.spendUserTokens(userId, "secondFactor", context.clock.now());
+}
+async function heldByPassword(context, type, verified, password, result, where) {
+  const now = await findRecord(context, verified.id, type.name);
+  const kept = now !== null && now.password !== null && (now.password.hash === verified.password?.hash || await passwordMatches(context, now, password, where));
+  if (kept)
+    return true;
+  if (result.status === "signedIn") {
+    await context.store.sessions.revokeSession(result.session.id, context.clock.now());
+  } else {
+    await burnOneTime(context, result.challenge, "secondFactor");
+  }
+  return false;
+}
+
+// src/auth/email-flows.ts
+function emailFlows(context, type, at) {
+  const { store, clock } = context;
+  const redeem = async (kind, secret, where) => {
+    const token = await spendOneTime(context, secret, kind, where, "token");
+    const user = await findRecord(context, token.userId, type.name);
+    if (user === null)
+      throw unknownOneTime(where, "token");
+    refuseStale(type, user, token, where, "token");
+    return { token, user };
+  };
+  const issue = async (kind, user, where) => {
+    const email = emailOf(type, user.fields);
+    if (email === null) {
+      throw new NotFoundError2(`${where}: the user has no e-mail`, {
+        userId: user.id,
+        userType: type.name,
+        operation: where
+      });
+    }
+    const { secret, expiresAt } = await issueOneTime(context, {
+      kind,
+      userId: user.id,
+      address: email,
+      ttlMs: context.config.tokenTtlMs[kind]
+    });
+    return { token: secret, email, expiresAt };
+  };
+  return {
+    verifyEmail: {
+      async send(user) {
+        const where = at("verifyEmail.send");
+        const record = await getRecord(context, idOf(user), type.name, where);
+        return issue("verifyEmail", record, where);
+      },
+      async confirm(secret) {
+        const where = at("verifyEmail.confirm");
+        const { token, user } = await redeem("verifyEmail", secret, where);
+        return toUser(await writeUser(context, user.id, type, undefined, where, (record, now) => {
+          refuseStale(type, record, token, where, "token");
+          return { emailVerifiedAt: now };
+        }));
+      }
+    },
+    resetPassword: {
+      async request(email) {
+        const where = at("resetPassword.request");
+        passwordRule(type, where);
+        const record = await holderOfEmail(context, type, String(email));
+        if (record === null)
+          return null;
+        const issued = await issue("resetPassword", record, where);
+        return { ...issued, user: toUser(record) };
+      },
+      async confirm(secret, password) {
+        const where = at("resetPassword.confirm");
+        passwordRule(type, where);
+        checkPassword(type, password, where);
+        const hash = await requireHasher(context, where).hash(password);
+        const { token, user } = await redeem("resetPassword", secret, where);
+        const written = await writeUser(context, user.id, type, undefined, where, (record, now) => {
+          refuseStale(type, record, token, where, "token");
+          return {
+            password: { hash, updatedAt: now },
+            ...record.emailVerifiedAt === null ? { emailVerifiedAt: now } : {}
+          };
+        });
+        await store.sessions.revokeUserSessions(written.id, clock.now());
+        await endSignInsWaiting(context, written.id);
+        return toUser(written);
+      }
+    }
+  };
+}
+
 // src/auth/totp.ts
 import { createHmac, randomBytes as randomBytes4 } from "node:crypto";
 var TOTP = { digits: 6, stepMs: 30000, drift: 1 };
@@ -990,7 +1100,12 @@ function challengeFlows(context, type, at) {
         address: "",
         ttlMs: configured.challengeTtlMs
       });
-      return { status: "secondFactor", challenge: secret, expiresAt };
+      return {
+        status: "secondFactor",
+        challenge: secret,
+        expiresAt,
+        userId: record.id
+      };
     },
     async confirm(challenge, code) {
       const where = at("secondFactor.confirm");
@@ -998,8 +1113,9 @@ function challengeFlows(context, type, at) {
       const secret = String(challenge);
       const { token, attemptsLeft } = await countCodeAttempt(context, secret, "secondFactor", where, type.name);
       const record = await findRecord(context, token.userId, type.name);
-      if (record === null)
-        throw unknownOneTime(where, "challenge");
+      if (record === null) {
+        throw await unknownChallenge(context, token, secret, where);
+      }
       if (!record.active) {
         await spend(secret, where);
         throw new UserInactiveError2(`${where}: the user is inactive`, {
@@ -1116,6 +1232,7 @@ function signInCodeFlows(context, type, at, finish) {
         address: String(record.fields[type.email]),
         ttlMs: context.config.tokenTtlMs.signInCode
       });
+      await context.store.tokens.spendUserTokens(record.id, "signInCode", context.clock.now(), hashSecret(secret));
       return {
         code,
         challenge: secret,
@@ -1129,8 +1246,9 @@ function signInCodeFlows(context, type, at, finish) {
       const secret = String(challenge);
       const { token, attemptsLeft } = await countCodeAttempt(context, secret, "signInCode", where, type.name);
       const user = await findRecord(context, token.userId, type.name);
-      if (user === null)
-        throw unknownOneTime(where, "challenge");
+      if (user === null) {
+        throw await unknownChallenge(context, token, secret, where);
+      }
       if (!codeMatches(token, secret, String(code))) {
         if (token.attempts === CODE_ATTEMPTS) {
           await burnOneTime(context, secret, "signInCode");
@@ -1185,37 +1303,6 @@ function typeApi(context, type) {
       updatedAt: now
     });
   };
-  const redeem = async (kind, secret, where) => {
-    const token = await spendOneTime(context, secret, kind, where, "token");
-    const user = await findRecord(context, token.userId, type.name);
-    if (user === null)
-      throw unknownOneTime(where, "token");
-    refuseStale(type, user, token, where, "token");
-    return { token, user };
-  };
-  const issue = async (kind, user, where) => {
-    const email = emailOf(type, user.fields);
-    if (email === null) {
-      throw new NotFoundError2(`${where}: the user has no e-mail`, {
-        userId: user.id,
-        userType: type.name,
-        operation: where
-      });
-    }
-    const { secret, expiresAt } = await issueOneTime(context, {
-      kind,
-      userId: user.id,
-      address: email,
-      ttlMs: context.config.tokenTtlMs[kind]
-    });
-    return { token: secret, email, expiresAt };
-  };
-  const passwordRule = (where) => {
-    if (type.password === null) {
-      throw new TypeError(`${where}: the ${type.name} type does not sign in with a password — add password: { login } to it`);
-    }
-    return type.password;
-  };
   return {
     async create(input) {
       return toUser(await insert(input, at("create")));
@@ -1275,7 +1362,7 @@ function typeApi(context, type) {
     },
     async signUp(input) {
       const where = at("signUp");
-      passwordRule(where);
+      passwordRule(type, where);
       if (input?.password === undefined) {
         checkPassword(type, undefined, where);
       }
@@ -1284,7 +1371,7 @@ function typeApi(context, type) {
     },
     async signIn(input) {
       const where = at("signIn");
-      const rule = passwordRule(where);
+      const rule = passwordRule(type, where);
       const hasher = requireHasher(context, where);
       const login = input?.[rule.login];
       const password = input?.password;
@@ -1303,28 +1390,33 @@ function typeApi(context, type) {
           userType: type.name
         });
       }
-      return secondFactor.finish(await rehashed(context, record, String(password)), where);
+      const verified = await rehashed(context, record, String(password));
+      const result = await secondFactor.finish(verified, where);
+      if (!await heldByPassword(context, type, verified, String(password), result, where)) {
+        throw refuse("wrongPassword");
+      }
+      return result;
     },
     async findByLogin(login) {
-      const rule = passwordRule(at("findByLogin"));
+      const rule = passwordRule(type, at("findByLogin"));
       const record = await byLogin(rule.normalize(login));
       return record === null ? null : toUser(record);
     },
     async setPassword(user, password, options) {
       const where = at("setPassword");
-      passwordRule(where);
+      passwordRule(type, where);
       checkPassword(type, password, where);
       const hash = await requireHasher(context, where).hash(password);
-      return toUser(await writeUser(context, user, type, options, where, (_, now) => ({
-        password: { hash, updatedAt: now }
-      })));
+      const written = await writeUser(context, user, type, options, where, (_, now) => ({ password: { hash, updatedAt: now } }));
+      await endSignInsWaiting(context, written.id);
+      return toUser(written);
     },
     async changePassword(user, change, options) {
       const where = at("changePassword");
-      passwordRule(where);
+      passwordRule(type, where);
       checkPassword(type, change?.next, where);
       const hasher = requireHasher(context, where);
-      return toUser(await writeUser(context, user, type, options, where, async (record, now) => {
+      const written = await writeUser(context, user, type, options, where, async (record, now) => {
         if (record.password === null || !await passwordMatches(context, record, change.current, where)) {
           throw new CredentialError2("CREDENTIALS_INVALID", `${where}: the current password does not match`, {
             reason: record.password === null ? "noPassword" : "wrongPassword",
@@ -1338,48 +1430,13 @@ function typeApi(context, type) {
             updatedAt: now
           }
         };
-      }));
+      });
+      await endSignInsWaiting(context, written.id);
+      return toUser(written);
     },
     secondFactor: secondFactor.api,
     signInCode,
-    verifyEmail: {
-      async send(user) {
-        const where = at("verifyEmail.send");
-        const record = await getRecord(context, idOf(user), type.name, where);
-        return issue("verifyEmail", record, where);
-      },
-      async confirm(secret) {
-        const where = at("verifyEmail.confirm");
-        const { user } = await redeem("verifyEmail", secret, where);
-        return toUser(await writeUser(context, user.id, type, undefined, where, (_, now) => ({
-          emailVerifiedAt: now
-        })));
-      }
-    },
-    resetPassword: {
-      async request(email) {
-        const where = at("resetPassword.request");
-        passwordRule(where);
-        const record = await holderOfEmail(context, type, String(email));
-        if (record === null)
-          return null;
-        const issued = await issue("resetPassword", record, where);
-        return { ...issued, user: toUser(record) };
-      },
-      async confirm(secret, password) {
-        const where = at("resetPassword.confirm");
-        passwordRule(where);
-        checkPassword(type, password, where);
-        const hash = await requireHasher(context, where).hash(password);
-        const { user } = await redeem("resetPassword", secret, where);
-        const written = await writeUser(context, user.id, type, undefined, where, (record, now) => ({
-          password: { hash, updatedAt: now },
-          ...record.emailVerifiedAt === null ? { emailVerifiedAt: now } : {}
-        }));
-        await store.sessions.revokeUserSessions(written.id, clock.now());
-        return toUser(written);
-      }
-    }
+    ...emailFlows(context, type, at)
   };
 }
 
@@ -1455,5 +1512,5 @@ export {
   systemClock
 };
 
-//# debugId=9A2F9DDAD478673A64756E2164756E21
+//# debugId=8A3012761E63D76664756E2164756E21
 //# sourceMappingURL=index.js.map