@nxgt/janus 0.6.0 → 0.8.0

package/dist/index.js

@@ -11,7 +11,7 @@ import {
   isId2,
   mintedAt2,
   createMemoryStores2
-} from "./chunks/index-gbwn2tts.js";
+} from "./chunks/index-c0jajeda.js";
 import {
   JanusError2,
   StoreFailure2,
@@ -389,7 +389,7 @@ async function unlessVersionConflict(write) {
 }
 
 // src/auth/context.ts
-function createContext(config, store, relations, capabilities, clock, hasher, verifiers) {
+function createContext(config, store, relations, capabilities, clock, hasher, verifiers, events = null) {
   let dummy = null;
   return {
     config,
@@ -399,6 +399,7 @@ function createContext(config, store, relations, capabilities, clock, hasher, ve
     clock,
     hasher,
     verifiers,
+    events,
     dummyHash: () => {
       if (hasher === null) {
         throw new TypeError("janus: no hasher to compare a dummy hash with");
@@ -514,6 +515,12 @@ function loginsOf(type, fields, where) {
     logins.add(normalizeEmail(email));
   return [...logins];
 }
+function passwordRule(type, where) {
+  if (type.password === null) {
+    throw new TypeError(`${where}: the ${type.name} type does not sign in with a password — add password: { login } to it`);
+  }
+  return type.password;
+}
 function checkPassword(type, password, where) {
   const minLength = type.password?.minLength ?? 8;
   if (typeof password !== "string" || password.length < minLength) {
@@ -589,6 +596,33 @@ async function holderOfEmail(context, type, email) {
   return held !== null && normalizeEmail(held) === wanted ? record : null;
 }
 
+// src/auth/events.ts
+function resolveEvents(events, where) {
+  if (events === undefined)
+    return null;
+  if (typeof events !== "function") {
+    throw new TypeError(`${where}: events must be a function that takes a user event — webhooks({ … }) from @nxgt/janus-webhooks, or your own`);
+  }
+  return events;
+}
+async function emit(context, type, user, occurredAt) {
+  const listener = context.events;
+  if (listener === null)
+    return;
+  const event = Object.freeze({
+    id: mintId2(occurredAt.getTime()),
+    type,
+    occurredAt: new Date(occurredAt.getTime()),
+    userId: user.id,
+    userType: user.type
+  });
+  try {
+    await listener(event);
+  } catch (failure) {
+    process.emitWarning(`janus: the events listener failed on ${type} ${event.id} for user ${user.id}: ${failure instanceof Error ? failure.name : typeof failure}`, { code: "JANUS_EVENT_FAILED" });
+  }
+}
+
 // src/auth/port/assert-stores.ts
 var REQUIRED = {
   users: [
@@ -607,7 +641,13 @@ var REQUIRED = {
     "revokeUserSessions",
     "deleteUserSessions"
   ],
-  tokens: ["insertToken", "consumeToken", "countAttempt", "deleteUserTokens"]
+  tokens: [
+    "insertToken",
+    "consumeToken",
+    "countAttempt",
+    "spendUserTokens",
+    "deleteUserTokens"
+  ]
 };
 function assertStores(stores, where) {
   if (typeof stores !== "object" || stores === null) {
@@ -833,6 +873,12 @@ function refuseUnusable(token, now, where, noun) {
 var unknownOneTime = (where, noun) => new TokenError2("TOKEN_UNKNOWN", `${where}: no such ${noun}`, {
   operation: where
 });
+async function unknownChallenge(context, token, secret, where) {
+  if (token.attempts === CODE_ATTEMPTS) {
+    await burnOneTime(context, secret, token.kind);
+  }
+  return unknownOneTime(where, "challenge");
+}
 async function spendOneTime(context, secret, kind, where, noun) {
   const now = context.clock.now();
   const token = await context.store.tokens.consumeToken(hashSecret(secret), kind, now);
@@ -875,6 +921,113 @@ async function insertOneTime(context, token, code) {
   return { secret, expiresAt };
 }
 
+// src/auth/password-written.ts
+async function endSignInsWaiting(context, userId) {
+  await context.store.tokens.spendUserTokens(userId, "secondFactor", context.clock.now());
+}
+async function heldByPassword(context, type, verified, password, result, where) {
+  const now = await findRecord(context, verified.id, type.name);
+  const kept = now !== null && now.password !== null && (now.password.hash === verified.password?.hash || await passwordMatches(context, now, password, where));
+  if (kept)
+    return true;
+  if (result.status === "signedIn") {
+    await context.store.sessions.revokeSession(result.session.id, context.clock.now());
+  } else {
+    await burnOneTime(context, result.challenge, "secondFactor");
+  }
+  return false;
+}
+
+// src/auth/email-flows.ts
+function emailFlows(context, type, at) {
+  const { store, clock } = context;
+  const redeem = async (kind, secret, where) => {
+    const token = await spendOneTime(context, secret, kind, where, "token");
+    const user = await findRecord(context, token.userId, type.name);
+    if (user === null)
+      throw unknownOneTime(where, "token");
+    refuseStale(type, user, token, where, "token");
+    return { token, user };
+  };
+  const issue = async (kind, user, where) => {
+    const email = emailOf(type, user.fields);
+    if (email === null) {
+      throw new NotFoundError2(`${where}: the user has no e-mail`, {
+        userId: user.id,
+        userType: type.name,
+        operation: where
+      });
+    }
+    const { secret, expiresAt } = await issueOneTime(context, {
+      kind,
+      userId: user.id,
+      address: email,
+      ttlMs: context.config.tokenTtlMs[kind]
+    });
+    return { token: secret, email, expiresAt };
+  };
+  return {
+    verifyEmail: {
+      async send(user) {
+        const where = at("verifyEmail.send");
+        const record = await getRecord(context, idOf(user), type.name, where);
+        return issue("verifyEmail", record, where);
+      },
+      async confirm(secret) {
+        const where = at("verifyEmail.confirm");
+        const { token, user } = await redeem("verifyEmail", secret, where);
+        let newlyVerified = false;
+        const written = await writeUser(context, user.id, type, undefined, where, (record, now) => {
+          refuseStale(type, record, token, where, "token");
+          newlyVerified = record.emailVerifiedAt === null;
+          return { emailVerifiedAt: now };
+        });
+        if (newlyVerified) {
+          await emit(context, "user.emailVerified", written, written.updatedAt);
+        }
+        return toUser(written);
+      }
+    },
+    resetPassword: {
+      async request(email) {
+        const where = at("resetPassword.request");
+        passwordRule(type, where);
+        const record = await holderOfEmail(context, type, String(email));
+        if (record === null)
+          return null;
+        const issued = await issue("resetPassword", record, where);
+        return { ...issued, user: toUser(record) };
+      },
+      async confirm(secret, password) {
+        const where = at("resetPassword.confirm");
+        passwordRule(type, where);
+        checkPassword(type, password, where);
+        const hash = await requireHasher(context, where).hash(password);
+        const { token, user } = await redeem("resetPassword", secret, where);
+        let newlyVerified = false;
+        const written = await writeUser(context, user.id, type, undefined, where, (record, now) => {
+          refuseStale(type, record, token, where, "token");
+          newlyVerified = record.emailVerifiedAt === null;
+          return {
+            password: { hash, updatedAt: now },
+            ...record.emailVerifiedAt === null ? { emailVerifiedAt: now } : {}
+          };
+        });
+        try {
+          await store.sessions.revokeUserSessions(written.id, clock.now());
+          await endSignInsWaiting(context, written.id);
+        } finally {
+          await emit(context, "user.passwordReset", written, written.updatedAt);
+          if (newlyVerified) {
+            await emit(context, "user.emailVerified", written, written.updatedAt);
+          }
+        }
+        return toUser(written);
+      }
+    }
+  };
+}
+
 // src/auth/totp.ts
 import { createHmac, randomBytes as randomBytes4 } from "node:crypto";
 var TOTP = { digits: 6, stepMs: 30000, drift: 1 };
@@ -990,7 +1143,12 @@ function challengeFlows(context, type, at) {
         address: "",
         ttlMs: configured.challengeTtlMs
       });
-      return { status: "secondFactor", challenge: secret, expiresAt };
+      return {
+        status: "secondFactor",
+        challenge: secret,
+        expiresAt,
+        userId: record.id
+      };
     },
     async confirm(challenge, code) {
       const where = at("secondFactor.confirm");
@@ -998,8 +1156,9 @@ function challengeFlows(context, type, at) {
       const secret = String(challenge);
       const { token, attemptsLeft } = await countCodeAttempt(context, secret, "secondFactor", where, type.name);
       const record = await findRecord(context, token.userId, type.name);
-      if (record === null)
-        throw unknownOneTime(where, "challenge");
+      if (record === null) {
+        throw await unknownChallenge(context, token, secret, where);
+      }
       if (!record.active) {
         await spend(secret, where);
         throw new UserInactiveError2(`${where}: the user is inactive`, {
@@ -1116,6 +1275,7 @@ function signInCodeFlows(context, type, at, finish) {
         address: String(record.fields[type.email]),
         ttlMs: context.config.tokenTtlMs.signInCode
       });
+      await context.store.tokens.spendUserTokens(record.id, "signInCode", context.clock.now(), hashSecret(secret));
       return {
         code,
         challenge: secret,
@@ -1129,8 +1289,9 @@ function signInCodeFlows(context, type, at, finish) {
       const secret = String(challenge);
       const { token, attemptsLeft } = await countCodeAttempt(context, secret, "signInCode", where, type.name);
       const user = await findRecord(context, token.userId, type.name);
-      if (user === null)
-        throw unknownOneTime(where, "challenge");
+      if (user === null) {
+        throw await unknownChallenge(context, token, secret, where);
+      }
       if (!codeMatches(token, secret, String(code))) {
         if (token.attempts === CODE_ATTEMPTS) {
           await burnOneTime(context, secret, "signInCode");
@@ -1145,7 +1306,10 @@ function signInCodeFlows(context, type, at, finish) {
           userType: type.name
         });
       }
-      const proved = user.emailVerifiedAt === null ? await writeUser(context, user.id, type, { ifVersion: user.version }, where, (_, now) => ({ emailVerifiedAt: now })) : user;
+      if (user.emailVerifiedAt !== null)
+        return finish(user, where);
+      const proved = await writeUser(context, user.id, type, { ifVersion: user.version }, where, (_, now) => ({ emailVerifiedAt: now }));
+      await emit(context, "user.emailVerified", proved, proved.updatedAt);
       return finish(proved, where);
     }
   };
@@ -1170,7 +1334,7 @@ function typeApi(context, type) {
         updatedAt: now
       };
     }
-    return store.users.insertUser({
+    const inserted = await store.users.insertUser({
       id: mintId2(now.getTime()),
       type: type.name,
       schemaVersion: type.schemaVersion,
@@ -1184,37 +1348,8 @@ function typeApi(context, type) {
       createdAt: now,
       updatedAt: now
     });
-  };
-  const redeem = async (kind, secret, where) => {
-    const token = await spendOneTime(context, secret, kind, where, "token");
-    const user = await findRecord(context, token.userId, type.name);
-    if (user === null)
-      throw unknownOneTime(where, "token");
-    refuseStale(type, user, token, where, "token");
-    return { token, user };
-  };
-  const issue = async (kind, user, where) => {
-    const email = emailOf(type, user.fields);
-    if (email === null) {
-      throw new NotFoundError2(`${where}: the user has no e-mail`, {
-        userId: user.id,
-        userType: type.name,
-        operation: where
-      });
-    }
-    const { secret, expiresAt } = await issueOneTime(context, {
-      kind,
-      userId: user.id,
-      address: email,
-      ttlMs: context.config.tokenTtlMs[kind]
-    });
-    return { token: secret, email, expiresAt };
-  };
-  const passwordRule = (where) => {
-    if (type.password === null) {
-      throw new TypeError(`${where}: the ${type.name} type does not sign in with a password — add password: { login } to it`);
-    }
-    return type.password;
+    await emit(context, "user.created", inserted, inserted.createdAt);
+    return inserted;
   };
   return {
     async create(input) {
@@ -1267,15 +1402,22 @@ function typeApi(context, type) {
       const record = await store.users.findUser(id);
       if (record !== null && record.type !== type.name)
         return false;
+      const deletedAt = clock.now();
       const deleted = record !== null && await store.users.deleteUser(id);
-      await store.sessions.deleteUserSessions(id);
-      await store.tokens.deleteUserTokens(id);
-      await context.relations?.deleteEntity({ type: type.name, id });
+      try {
+        await store.sessions.deleteUserSessions(id);
+        await store.tokens.deleteUserTokens(id);
+        await context.relations?.deleteEntity({ type: type.name, id });
+      } finally {
+        if (deleted) {
+          await emit(context, "user.deleted", { id, type: type.name }, deletedAt);
+        }
+      }
       return deleted;
     },
     async signUp(input) {
       const where = at("signUp");
-      passwordRule(where);
+      passwordRule(type, where);
       if (input?.password === undefined) {
         checkPassword(type, undefined, where);
       }
@@ -1284,7 +1426,7 @@ function typeApi(context, type) {
     },
     async signIn(input) {
       const where = at("signIn");
-      const rule = passwordRule(where);
+      const rule = passwordRule(type, where);
       const hasher = requireHasher(context, where);
       const login = input?.[rule.login];
       const password = input?.password;
@@ -1303,28 +1445,33 @@ function typeApi(context, type) {
           userType: type.name
         });
       }
-      return secondFactor.finish(await rehashed(context, record, String(password)), where);
+      const verified = await rehashed(context, record, String(password));
+      const result = await secondFactor.finish(verified, where);
+      if (!await heldByPassword(context, type, verified, String(password), result, where)) {
+        throw refuse("wrongPassword");
+      }
+      return result;
     },
     async findByLogin(login) {
-      const rule = passwordRule(at("findByLogin"));
+      const rule = passwordRule(type, at("findByLogin"));
       const record = await byLogin(rule.normalize(login));
       return record === null ? null : toUser(record);
     },
     async setPassword(user, password, options) {
       const where = at("setPassword");
-      passwordRule(where);
+      passwordRule(type, where);
       checkPassword(type, password, where);
       const hash = await requireHasher(context, where).hash(password);
-      return toUser(await writeUser(context, user, type, options, where, (_, now) => ({
-        password: { hash, updatedAt: now }
-      })));
+      const written = await writeUser(context, user, type, options, where, (_, now) => ({ password: { hash, updatedAt: now } }));
+      await endSignInsWaiting(context, written.id);
+      return toUser(written);
     },
     async changePassword(user, change, options) {
       const where = at("changePassword");
-      passwordRule(where);
+      passwordRule(type, where);
       checkPassword(type, change?.next, where);
       const hasher = requireHasher(context, where);
-      return toUser(await writeUser(context, user, type, options, where, async (record, now) => {
+      const written = await writeUser(context, user, type, options, where, async (record, now) => {
         if (record.password === null || !await passwordMatches(context, record, change.current, where)) {
           throw new CredentialError2("CREDENTIALS_INVALID", `${where}: the current password does not match`, {
             reason: record.password === null ? "noPassword" : "wrongPassword",
@@ -1338,48 +1485,13 @@ function typeApi(context, type) {
             updatedAt: now
           }
         };
-      }));
+      });
+      await endSignInsWaiting(context, written.id);
+      return toUser(written);
     },
     secondFactor: secondFactor.api,
     signInCode,
-    verifyEmail: {
-      async send(user) {
-        const where = at("verifyEmail.send");
-        const record = await getRecord(context, idOf(user), type.name, where);
-        return issue("verifyEmail", record, where);
-      },
-      async confirm(secret) {
-        const where = at("verifyEmail.confirm");
-        const { user } = await redeem("verifyEmail", secret, where);
-        return toUser(await writeUser(context, user.id, type, undefined, where, (_, now) => ({
-          emailVerifiedAt: now
-        })));
-      }
-    },
-    resetPassword: {
-      async request(email) {
-        const where = at("resetPassword.request");
-        passwordRule(where);
-        const record = await holderOfEmail(context, type, String(email));
-        if (record === null)
-          return null;
-        const issued = await issue("resetPassword", record, where);
-        return { ...issued, user: toUser(record) };
-      },
-      async confirm(secret, password) {
-        const where = at("resetPassword.confirm");
-        passwordRule(where);
-        checkPassword(type, password, where);
-        const hash = await requireHasher(context, where).hash(password);
-        const { user } = await redeem("resetPassword", secret, where);
-        const written = await writeUser(context, user.id, type, undefined, where, (record, now) => ({
-          password: { hash, updatedAt: now },
-          ...record.emailVerifiedAt === null ? { emailVerifiedAt: now } : {}
-        }));
-        await store.sessions.revokeUserSessions(written.id, clock.now());
-        return toUser(written);
-      }
-    }
+    ...emailFlows(context, type, at)
   };
 }
 
@@ -1407,7 +1519,7 @@ function janus(config) {
   if (relations !== null && typeof relations.deleteEntity !== "function") {
     throw new TypeError(`${where}: relations must be a relation store — relations.deleteEntity is missing`);
   }
-  const context = createContext(resolved, guardStores(config.store), relations === null ? null : guardRelations(relations), capabilities, config.clock ?? systemClock, hasher, verifiers);
+  const context = createContext(resolved, guardStores(config.store), relations === null ? null : guardRelations(relations), capabilities, config.clock ?? systemClock, hasher, verifiers, resolveEvents(config.events, where));
   const shared = sharedApi(context);
   const types = Object.fromEntries([...resolved.types.values()].map((type) => [
     type.name,
@@ -1455,5 +1567,5 @@ export {
   systemClock
 };
 
-//# debugId=9A2F9DDAD478673A64756E2164756E21
+//# debugId=52492AAB2CF93D3A64756E2164756E21
 //# sourceMappingURL=index.js.map