@spfn/auth 0.2.0-beta.70 → 0.2.0-beta.71

package/dist/server.js

@@ -5658,6 +5658,25 @@ var init_keys_repository = __esm({
         ).returning();
         return result[0] ?? null;
       }
+      /**
+       * 사용자의 모든 활성 공개키 revoke (비활성화)
+       *
+       * 비번 변경 시 전체 세션 로그아웃에 사용. authenticate는 활성 키만 검증하므로,
+       * revoke된 키로 서명한 기존 세션의 요청은 즉시 401이 된다.
+       * Write primary 사용
+       */
+      async revokeAllActiveByUserId(userId, reason) {
+        return await this.db.update(userPublicKeys).set({
+          isActive: false,
+          revokedAt: /* @__PURE__ */ new Date(),
+          revokedReason: reason
+        }).where(
+          and2(
+            eq2(userPublicKeys.userId, userId),
+            eq2(userPublicKeys.isActive, true)
+          )
+        ).returning();
+      }
       /**
        * 공개키 삭제
        * Write primary 사용
@@ -6936,13 +6955,23 @@ function getPublicKeyObject(publicKeyB64) {
   publicKeyCache.set(publicKeyB64, keyObject);
   return keyObject;
 }
+var INSECURE_JWT_SECRET = "dev-secret-key-change-in-production";
+function getJwtSecret() {
+  const secret = env2.SPFN_AUTH_JWT_SECRET;
+  if ((!secret || secret === INSECURE_JWT_SECRET) && process.env.NODE_ENV === "production") {
+    throw new Error(
+      "SPFN_AUTH_JWT_SECRET must be set to a strong secret in production (the default is public)."
+    );
+  }
+  return secret;
+}
 function generateToken(payload) {
-  return jwt.sign(payload, env2.SPFN_AUTH_JWT_SECRET, {
+  return jwt.sign(payload, getJwtSecret(), {
     expiresIn: env2.SPFN_AUTH_JWT_EXPIRES_IN
   });
 }
 function verifyToken(token) {
-  return jwt.verify(token, env2.SPFN_AUTH_JWT_SECRET, { algorithms: ["HS256"] });
+  return jwt.verify(token, getJwtSecret(), { algorithms: ["HS256"] });
 }
 function verifyClientToken(token, publicKeyB64, algorithm) {
   const publicKeyObject = getPublicKeyObject(publicKeyB64);
@@ -7082,6 +7111,9 @@ async function validateVerificationCode(target, code, purpose) {
   if (!record) {
     return { valid: false, error: "Invalid verification code" };
   }
+  if (record.attempts >= MAX_VERIFICATION_ATTEMPTS) {
+    return { valid: false, error: "Too many attempts, please request a new code" };
+  }
   if (record.code !== code) {
     await verificationCodesRepository.incrementAttempts(record.id);
     return { valid: false, error: "Invalid verification code" };
@@ -7092,9 +7124,6 @@ async function validateVerificationCode(target, code, purpose) {
   if (/* @__PURE__ */ new Date() > new Date(record.expiresAt)) {
     return { valid: false, error: "Verification code expired" };
   }
-  if (record.attempts >= MAX_VERIFICATION_ATTEMPTS) {
-    return { valid: false, error: "Too many attempts, please request a new code" };
-  }
   return { valid: true, codeId: record.id };
 }
 async function markCodeAsUsed(codeId) {
@@ -7549,6 +7578,7 @@ async function changePasswordService(params) {
   }
   const newPasswordHash = await hashPassword(newPassword);
   await usersRepository.updatePassword(userId, newPasswordHash, true);
+  await keysRepository.revokeAllActiveByUserId(userId, "Revoked by password change");
 }
 
 // src/server/services/rbac.service.ts
@@ -9251,7 +9281,8 @@ var acceptInvitation2 = route2.post("/_auth/invitations/accept").input({
     }),
     password: Type.String({
       minLength: 8,
-      description: "User password (minimum 8 characters)"
+      maxLength: 72,
+      description: "User password (8\u201372 characters). bcrypt silently ignores bytes past 72, so longer inputs are rejected rather than truncated."
     })
   })
 }).interceptor({