@spfn/auth 0.2.0-beta.72 → 0.2.0-beta.74

package/dist/server.js

@@ -8777,7 +8777,56 @@ async function persistNativeLogin(identity, params) {
 // src/server/routes/auth/index.ts
 init_esm();
 import { Transactional } from "@spfn/core/db";
-import { rateLimit } from "@spfn/core/middleware";
+import { rateLimitPolicy } from "@spfn/core/middleware";
+
+// src/server/lib/rate-limit-keys.ts
+import { getClientIp } from "@spfn/core/middleware";
+async function readJsonBody(c) {
+  try {
+    return await c.req.json();
+  } catch {
+    return {};
+  }
+}
+function accountKey(body) {
+  if (typeof body.email === "string" && body.email.trim()) {
+    return `email:${body.email.trim().toLowerCase()}`;
+  }
+  if (typeof body.phone === "string" && body.phone.trim()) {
+    return `phone:${body.phone.trim()}`;
+  }
+  return void 0;
+}
+function targetKey(body) {
+  if (typeof body.target !== "string" || !body.target.trim()) {
+    return void 0;
+  }
+  const type = typeof body.targetType === "string" ? body.targetType : "target";
+  const value = type === "email" ? body.target.trim().toLowerCase() : body.target.trim();
+  return `${type}:${value}`;
+}
+function byIpAndAccount(options = {}) {
+  return async (c) => {
+    const body = await readJsonBody(c);
+    const account = accountKey(body);
+    return [
+      { key: `ip:${getClientIp(c)}`, limit: options.ipLimit },
+      account ? `acct:${account}` : void 0
+    ];
+  };
+}
+function byIpAndTarget(options = {}) {
+  return async (c) => {
+    const body = await readJsonBody(c);
+    const target = targetKey(body);
+    return [
+      { key: `ip:${getClientIp(c)}`, limit: options.ipLimit },
+      target ? `tgt:${target}` : void 0
+    ];
+  };
+}
+
+// src/server/routes/auth/index.ts
 import { defineRouter, route } from "@spfn/core/route";
 var sendVerificationCode = route.post("/_auth/codes").input({
   body: Type.Object({
@@ -8787,7 +8836,7 @@ var sendVerificationCode = route.post("/_auth/codes").input({
     targetType: TargetTypeSchema,
     purpose: VerificationPurposeSchema
   })
-}).use([rateLimit({ limit: 5, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy("auth-code-send", { limit: 5, windowMs: 6e4, by: byIpAndTarget({ ipLimit: 20 }) })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   return await sendVerificationCodeService(body);
 });
@@ -8805,7 +8854,7 @@ var verifyCode = route.post("/_auth/codes/verify").input({
     }),
     purpose: VerificationPurposeSchema
   })
-}).use([rateLimit({ limit: 10, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy("auth-code-verify", { limit: 10, windowMs: 6e4, by: byIpAndTarget({ ipLimit: 50 }) })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   return await verifyCodeService(body);
 });
@@ -8832,7 +8881,7 @@ var register = route.post("/_auth/register").input({
     fingerprint: Type.String({ description: "Key fingerprint" }),
     algorithm: Type.Union(KEY_ALGORITHM.map((algo) => Type.Literal(algo)), { description: "Signature algorithm" })
   })
-}).use([Transactional()]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy("auth-register", { limit: 10, windowMs: 6e4, by: byIpAndAccount({ ipLimit: 100 }) }), Transactional()]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   return await registerService(body);
 });
@@ -8857,7 +8906,7 @@ var login = route.post("/_auth/login").input({
     algorithm: Type.Union(KEY_ALGORITHM.map((algo) => Type.Literal(algo)), { description: "Signature algorithm" }),
     oldKeyId: Type.Optional(Type.String({ description: "Previous key ID for rotation" }))
   })
-}).use([rateLimit({ limit: 10, windowMs: 6e4 }), Transactional()]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy("auth-login", { limit: 10, windowMs: 6e4, by: byIpAndAccount({ ipLimit: 100 }) }), Transactional()]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   return await loginService(body);
 });
@@ -8897,7 +8946,7 @@ var changePassword = route.put("/_auth/password").input({
     })),
     newPassword: PasswordSchema
   })
-}).handler(async (c) => {
+}).use([rateLimitPolicy("auth-password-change", { limit: 10, windowMs: 6e4 })]).handler(async (c) => {
   const { body } = await c.data();
   const user = getUser(c);
   await changePasswordService({
@@ -9257,6 +9306,7 @@ function extractOTTHeader(header) {
 init_types();
 init_esm();
 import { Transactional as Transactional2 } from "@spfn/core/db";
+import { rateLimitPolicy as rateLimitPolicy2 } from "@spfn/core/middleware";
 import { defineRouter as defineRouter2, route as route2 } from "@spfn/core/route";
 var INVITATION_STATUSES2 = ["pending", "accepted", "expired", "cancelled"];
 var getInvitation = route2.get("/_auth/invitations/:token").input({
@@ -9266,7 +9316,7 @@ var getInvitation = route2.get("/_auth/invitations/:token").input({
       description: "Invitation token (UUID v4)"
     })
   })
-}).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy2("auth-invitation-lookup", { limit: 30, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { params } = await c.data();
   const token = params.token;
   const validation = await validateInvitation(token);
@@ -9305,7 +9355,7 @@ var acceptInvitation2 = route2.post("/_auth/invitations/accept").input({
     fingerprint: Type.String({ description: "Key fingerprint" }),
     algorithm: Type.Union(KEY_ALGORITHM.map((algo) => Type.Literal(algo)), { description: "Signature algorithm" })
   })
-}).use([Transactional2()]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy2("auth-invitation-accept", { limit: 10, windowMs: 6e4 }), Transactional2()]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   return await acceptInvitation({
     token: body.token,
@@ -9455,6 +9505,7 @@ var invitationRouter = defineRouter2({
 
 // src/server/routes/users/index.ts
 init_esm();
+import { rateLimitPolicy as rateLimitPolicy3 } from "@spfn/core/middleware";
 import { defineRouter as defineRouter3, route as route3 } from "@spfn/core/route";
 var getUserProfile = route3.get("/_auth/users/profile").handler(async (c) => {
   const { userId } = getAuth(c);
@@ -9486,7 +9537,7 @@ var checkUsername = route3.get("/_auth/users/username/check").input({
   query: Type.Object({
     username: Type.String({ minLength: 1 })
   })
-}).handler(async (c) => {
+}).use([rateLimitPolicy3("auth-username-check", { limit: 30, windowMs: 6e4 })]).handler(async (c) => {
   const { query } = await c.data();
   return { available: await checkUsernameAvailableService(query.username) };
 });
@@ -9711,7 +9762,7 @@ var deleteCookie = (c, name, opt) => {
 init_types();
 import { Transactional as Transactional3 } from "@spfn/core/db";
 import { ValidationError as ValidationError7 } from "@spfn/core/errors";
-import { rateLimit as rateLimit2 } from "@spfn/core/middleware";
+import { rateLimitPolicy as rateLimitPolicy4 } from "@spfn/core/middleware";
 import { defineRouter as defineRouter4, route as route4 } from "@spfn/core/route";
 var providerParams = Type.Object({
   provider: Type.Union(SOCIAL_PROVIDERS.map((p) => Type.Literal(p)), {
@@ -9724,7 +9775,7 @@ var oauthGoogleStart = route4.get("/_auth/oauth/google").input({
       description: "Encrypted OAuth state (returnUrl, publicKey, keyId, fingerprint, algorithm)"
     })
   })
-}).use([rateLimit2({ limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy4("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { query } = await c.data();
   if (!isGoogleOAuthEnabled()) {
     return c.redirect(buildOAuthErrorUrl("Google OAuth is not configured"));
@@ -9747,7 +9798,7 @@ var oauthGoogleCallback = route4.get("/_auth/oauth/google/callback").input({
       description: "Error description from Google"
     }))
   })
-}).use([Transactional3()]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy4("oauth-callback", { limit: 30, windowMs: 6e4 }), Transactional3()]).skip(["auth"]).handler(async (c) => {
   const { query } = await c.data();
   if (query.error) {
     const errorMessage = query.error_description || query.error;
@@ -9795,7 +9846,7 @@ var oauthStart = route4.post("/_auth/oauth/start").input({
       description: "Custom metadata passed to authRegisterEvent (e.g. referral code, UTM params)"
     }))
   })
-}).use([rateLimit2({ limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy4("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   const nonce = generateOAuthNonce();
   setCookie(c.raw, COOKIE_NAMES.OAUTH_CSRF, nonce, {
@@ -9822,7 +9873,7 @@ var getGoogleOAuthUrl = route4.post("/_auth/oauth/google/url").input({
       description: "Encrypted OAuth state (injected by interceptor)"
     }))
   })
-}).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy4("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   if (!isGoogleOAuthEnabled()) {
     throw new ValidationError7({ message: "Google OAuth is not configured" });
@@ -9840,7 +9891,7 @@ var oauthFinalize = route4.post("/_auth/oauth/finalize").input({
     keyId: Type.String({ description: "Key ID from OAuth state" }),
     returnUrl: Type.Optional(Type.String({ description: "URL to redirect after login" }))
   })
-}).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy4("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   return {
     success: true,
@@ -9856,7 +9907,7 @@ var oauthProviderStart = route4.get("/_auth/oauth/:provider").input({
       description: "Encrypted OAuth state (returnUrl, publicKey, keyId, fingerprint, algorithm)"
     })
   })
-}).use([rateLimit2({ limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy4("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { params, query } = await c.data();
   const provider = getOAuthProvider(params.provider);
   if (!provider?.isEnabled()) {
@@ -9880,7 +9931,7 @@ var oauthProviderCallback = route4.get("/_auth/oauth/:provider/callback").input(
       description: "Error description from provider"
     }))
   })
-}).use([Transactional3()]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy4("oauth-callback", { limit: 30, windowMs: 6e4 }), Transactional3()]).skip(["auth"]).handler(async (c) => {
   const { params, query } = await c.data();
   if (query.error) {
     const errorMessage = query.error_description || query.error;
@@ -9914,7 +9965,7 @@ var getProviderOAuthUrl = route4.post("/_auth/oauth/:provider/url").input({
       description: "Encrypted OAuth state (injected by interceptor)"
     }))
   })
-}).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy4("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { params, body } = await c.data();
   const provider = requireEnabledProvider(params.provider);
   if (!body.state) {
@@ -9944,7 +9995,7 @@ var oauthNative = route4.post("/_auth/oauth/:provider/native").input({
       description: "Custom metadata passed to auth events (e.g. referral code, UTM params)"
     }))
   })
-}).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy4("oauth-native", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { params, body } = await c.data();
   return await oauthNativeService({ provider: params.provider, ...body });
 });