@spfn/auth 0.3.0-beta.3 → 0.3.0-beta.5

package/dist/server.js

@@ -4521,6 +4521,19 @@ var init_schema3 = __esm({
   }
 });
 
+// src/server/helpers/email.ts
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+function normalizeOptionalEmail(email) {
+  return typeof email === "string" ? normalizeEmail(email) : email;
+}
+var init_email = __esm({
+  "src/server/helpers/email.ts"() {
+    "use strict";
+  }
+});
+
 // src/server/entities/schema.ts
 import { createSchema } from "@spfn/core/db";
 var authSchema;
@@ -5486,7 +5499,7 @@ var init_entities = __esm({
 });
 
 // src/server/repositories/users.repository.ts
-import { eq, and } from "drizzle-orm";
+import { eq, and, sql as sql4 } from "drizzle-orm";
 import { BaseRepository } from "@spfn/core/db";
 import { EntityNotFoundError, NotFoundError } from "@spfn/core/errors";
 var UsersRepository, usersRepository;
@@ -5494,6 +5507,7 @@ var init_users_repository = __esm({
   "src/server/repositories/users.repository.ts"() {
     "use strict";
     init_entities();
+    init_email();
     UsersRepository = class extends BaseRepository {
       /**
        * ID로 사용자 조회
@@ -5519,7 +5533,25 @@ var init_users_repository = __esm({
        * Read replica 사용
        */
       async findByEmail(email) {
-        const result = await this.readDb.select().from(users).where(eq(users.email, email)).limit(1);
+        const result = await this.readDb.select().from(users).where(eq(users.email, normalizeEmail(email))).limit(1);
+        return result[0] ?? null;
+      }
+      /**
+       * 이메일로 사용자 조회 — 저장된 형태와 무관하게 찾는다.
+       *
+       * `findByEmail` asks whether a row holds this exact address; this asks
+       * whether any row *is* this address, whatever form it was written in. The
+       * difference matters to a caller that answers "no" by creating an account:
+       * a lookup that misses a row stored in another form would make a second
+       * account for a person who already has one, and the unique constraint
+       * cannot object because the two stored strings differ.
+       *
+       * Folding in the predicate means no index on `email` applies, so this is for
+       * the few addresses a caller decides about — admin seeding — not for a
+       * request path. Write primary: the answer decides whether to insert.
+       */
+      async findByEmailInAnyStoredForm(email) {
+        const result = await this.db.select().from(users).where(sql4`lower(btrim(${users.email})) = ${normalizeEmail(email)}`).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -5585,14 +5617,69 @@ var init_users_repository = __esm({
        * Write primary 사용
        */
       async create(data) {
-        return await this._create(users, data);
+        return await this._create(users, { ...data, email: normalizeOptionalEmail(data.email) });
+      }
+      /**
+       * User ids grouped by an address two or more rows share once folded.
+       *
+       * The whole comparison happens in the database and only the colliding groups
+       * come back, so the size of the answer is the size of the problem rather
+       * than the size of the table. `users.email` is unique, so a group of more
+       * than one can only be rows that differ by capitalization or padding —
+       * exactly the ones a rewrite cannot decide between.
+       *
+       * Every member id is returned, including a row already holding the
+       * canonical form, because the operator has to compare the accounts against
+       * each other to settle which is real.
+       *
+       * Write primary: the caller is about to rewrite rows and a replica could
+       * still be showing the pre-fix state.
+       */
+      async findEmailConflictGroups() {
+        const rows = await this.db.select({ ids: sql4`array_agg(${users.id} ORDER BY ${users.id})` }).from(users).where(sql4`${users.email} IS NOT NULL`).groupBy(sql4`lower(btrim(${users.email}))`).having(sql4`count(*) > 1`);
+        return rows.map((row) => row.ids.map(Number));
+      }
+      /**
+       * Fold every stored address to canonical form, leaving the given ids alone.
+       *
+       * One statement rather than a row at a time: the rewrite is the same
+       * expression the detection uses, so the database can do it in place. A
+       * legacy install with a large users table therefore pays one update instead
+       * of a round trip per row on the boot path, and no list of addresses is ever
+       * carried through the application.
+       *
+       * The excluded ids travel as a single array parameter, so the count of
+       * conflicts cannot run into the protocol's limit on bind parameters.
+       *
+       * One statement also means all or nothing. `users.email` is unique, so if an
+       * instance still running the old code registers a canonical address in the
+       * moment between the conflict query and this update, the update aborts and
+       * nothing is folded on this boot. The next boot sees that pair as a conflict
+       * and folds everything else, so the repair is deferred rather than lost.
+       *
+       * `lower(btrim(...))` is the SQL spelling of `normalizeEmail`. The two agree
+       * on every address this package's validation accepts (ASCII, no interior
+       * whitespace); an address outside that set — reachable only by an app
+       * writing to the repository directly — may fold differently in a database
+       * whose collation lower-cases non-ASCII letters.
+       *
+       * @param excludedIds - Rows to leave untouched, normally the conflict groups
+       * @returns How many rows were rewritten
+       */
+      async normalizeEmailsExcept(excludedIds) {
+        const keepConflicts = excludedIds.length > 0 ? sql4` AND NOT (${users.id} = ANY(string_to_array(${excludedIds.join(",")}, ',')::bigint[]))` : sql4``;
+        const pending = sql4`${users.email} IS NOT NULL AND ${users.email} <> lower(btrim(${users.email}))${keepConflicts}`;
+        const [counted] = await this.db.select({ rows: sql4`count(*)` }).from(users).where(pending);
+        await this.db.update(users).set({ email: sql4`lower(btrim(${users.email}))` }).where(pending);
+        return Number(counted?.rows ?? 0);
       }
       /**
        * 사용자 정보 업데이트
        * Write primary 사용
        */
       async updateById(id13, data) {
-        const result = await this.db.update(users).set(data).where(eq(users.id, id13)).returning();
+        const patch = "email" in data ? { ...data, email: normalizeOptionalEmail(data.email) } : data;
+        const result = await this.db.update(users).set(patch).where(eq(users.id, id13)).returning();
         return result[0] ?? null;
       }
       /**
@@ -5759,7 +5846,7 @@ var init_users_repository = __esm({
 
 // src/server/repositories/keys.repository.ts
 import { BaseRepository as BaseRepository2 } from "@spfn/core/db";
-import { eq as eq2, and as and2, or, isNull, lt, ne, desc, sql as sql4 } from "drizzle-orm";
+import { eq as eq2, and as and2, or, isNull, lt, ne, desc, sql as sql5 } from "drizzle-orm";
 var LAST_USED_THROTTLE_MS, KeysRepository, keysRepository;
 var init_keys_repository = __esm({
   "src/server/repositories/keys.repository.ts"() {
@@ -6000,19 +6087,19 @@ var init_keys_repository = __esm({
           await this.db.update(userPublicKeys).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(and2(eq2(userPublicKeys.id, id13), lastUsedIsStale));
           return;
         }
-        const identityChanged = sql4`(
+        const identityChanged = sql5`(
             ${userPublicKeys.clientKind} IS DISTINCT FROM ${identity.kind}
             OR ${userPublicKeys.clientVersion} IS DISTINCT FROM ${identity.version}
             OR ${userPublicKeys.clientContractVersion} IS DISTINCT FROM ${identity.contractVersion}
         )`;
         const now = /* @__PURE__ */ new Date();
-        const nowParam = sql4`${now.toISOString()}::timestamptz`;
+        const nowParam = sql5`${now.toISOString()}::timestamptz`;
         await this.db.update(userPublicKeys).set({
           lastUsedAt: now,
           clientKind: identity.kind,
           clientVersion: identity.version,
           clientContractVersion: identity.contractVersion,
-          clientSeenAt: sql4`CASE WHEN ${identityChanged} THEN ${nowParam} ELSE ${userPublicKeys.clientSeenAt} END`
+          clientSeenAt: sql5`CASE WHEN ${identityChanged} THEN ${nowParam} ELSE ${userPublicKeys.clientSeenAt} END`
         }).where(and2(
           eq2(userPublicKeys.id, id13),
           or(lastUsedIsStale, identityChanged)
@@ -6561,7 +6648,7 @@ var init_user_profiles_repository = __esm({
 });
 
 // src/server/repositories/invitations.repository.ts
-import { eq as eq9, and as and6, lt as lt4, desc as desc2, sql as sql5 } from "drizzle-orm";
+import { eq as eq9, and as and6, lt as lt4, desc as desc2, sql as sql6 } from "drizzle-orm";
 import { BaseRepository as BaseRepository9 } from "@spfn/core/db";
 var InvitationsRepository, invitationsRepository;
 var init_invitations_repository = __esm({
@@ -6570,6 +6657,7 @@ var init_invitations_repository = __esm({
     init_users();
     init_roles();
     init_user_invitations();
+    init_email();
     InvitationsRepository = class extends BaseRepository9 {
       /**
        * ID로 초대 조회
@@ -6591,7 +6679,7 @@ var init_invitations_repository = __esm({
       async findPendingByEmail(email) {
         const result = await this.readDb.select().from(userInvitations).where(
           and6(
-            eq9(userInvitations.email, email),
+            eq9(userInvitations.email, normalizeEmail(email)),
             eq9(userInvitations.status, "pending")
           )
         ).limit(1);
@@ -6613,7 +6701,7 @@ var init_invitations_repository = __esm({
        * 초대 생성
        */
       async create(data) {
-        return await this._create(userInvitations, data);
+        return await this._create(userInvitations, { ...data, email: normalizeEmail(data.email) });
       }
       /**
        * 초대 상태 업데이트
@@ -6695,7 +6783,7 @@ var init_invitations_repository = __esm({
           conditions.push(eq9(userInvitations.invitedBy, invitedBy));
         }
         const whereClause = conditions.length > 0 ? and6(...conditions) : void 0;
-        const countResult = await this.readDb.select({ count: sql5`count(*)` }).from(userInvitations).where(whereClause);
+        const countResult = await this.readDb.select({ count: sql6`count(*)` }).from(userInvitations).where(whereClause);
         const total = Number(countResult[0]?.count || 0);
         const results = await this.readDb.select({
           id: userInvitations.id,
@@ -6732,7 +6820,8 @@ var init_invitations_repository = __esm({
        * 초대 업데이트 (일반 업데이트 - 모든 필드 가능)
        */
       async updateById(id13, data) {
-        const result = await this.db.update(userInvitations).set(data).where(eq9(userInvitations.id, id13)).returning();
+        const patch = "email" in data && typeof data.email === "string" ? { ...data, email: normalizeEmail(data.email) } : data;
+        const result = await this.db.update(userInvitations).set(patch).where(eq9(userInvitations.id, id13)).returning();
         return result[0] ?? null;
       }
       /**
@@ -7879,6 +7968,9 @@ import { defineRouter as defineRouter6 } from "@spfn/core/route";
 // src/server/routes/auth/index.ts
 init_schema3();
 
+// src/server/helpers/index.ts
+init_email();
+
 // src/server/helpers/password.ts
 import * as bcrypt from "@node-rs/bcrypt";
 import { env } from "@spfn/auth/config";
@@ -8070,6 +8162,7 @@ import {
 } from "@spfn/auth/errors";
 
 // src/server/lib/config.ts
+init_email();
 import { env as env4 } from "@spfn/auth/config";
 function getCookieSuffix() {
   const port = process.env.SPFN_PORT;
@@ -8135,7 +8228,7 @@ function getAuthConfig() {
 async function runBeforeRegister(context) {
   const { beforeRegister } = globalConfig;
   if (beforeRegister) {
-    await beforeRegister(context);
+    await beforeRegister({ ...context, email: normalizeOptionalEmail(context.email) });
   }
 }
 function getSessionTtl(override) {
@@ -8178,11 +8271,15 @@ var authLogger = {
 };
 
 // src/server/services/verification.service.ts
+init_email();
 init_repositories();
 var ACCOUNT_EXISTS_NOTICE_DEDUPE_MINUTES = 60;
 var VERIFICATION_TOKEN_EXPIRY = "15m";
 var VERIFICATION_CODE_EXPIRY_MINUTES = 5;
 var MAX_VERIFICATION_ATTEMPTS = 5;
+function normalizeVerificationTarget(target, targetType) {
+  return targetType === "email" ? normalizeEmail(target) : target.trim();
+}
 function generateVerificationCode() {
   return crypto4.randomInt(0, 1e6).toString().padStart(6, "0");
 }
@@ -8291,7 +8388,8 @@ async function sendAccountExistsNotice(target, targetType) {
   }
 }
 async function sendVerificationCodeService(params) {
-  const { target, targetType, purpose } = params;
+  const { targetType, purpose } = params;
+  const target = normalizeVerificationTarget(params.target, targetType);
   if (purpose === "registration" && await accountExistsForTarget(target, targetType)) {
     const recentNotice = await verificationCodesRepository.findValidByTargetAndPurpose(target, purpose);
     if (!recentNotice) {
@@ -8325,7 +8423,8 @@ async function sendVerificationCodeService(params) {
   };
 }
 async function verifyCodeService(params) {
-  const { target, targetType, code, purpose } = params;
+  const { targetType, code, purpose } = params;
+  const target = normalizeVerificationTarget(params.target, targetType);
   const validation = await validateVerificationCode(target, code, purpose);
   if (!validation.valid) {
     throw new InvalidVerificationCodeError({ message: validation.error || "Invalid verification code" });
@@ -8923,7 +9022,8 @@ async function sweepDuePurges(now = /* @__PURE__ */ new Date()) {
 
 // src/server/services/auth.service.ts
 async function registerService(params) {
-  const { email, phone, verificationToken, password, publicKey, keyId, fingerprint, algorithm, metadata } = params;
+  const { email, verificationToken, password, publicKey, keyId, fingerprint, algorithm, metadata } = params;
+  const phone = params.phone?.trim();
   const tokenPayload = validateVerificationToken(verificationToken);
   if (!tokenPayload) {
     throw new InvalidVerificationTokenError2();
@@ -8931,7 +9031,7 @@ async function registerService(params) {
   if (tokenPayload.purpose !== "registration") {
     throw new VerificationTokenPurposeMismatchError2({ expected: "registration", actual: tokenPayload.purpose });
   }
-  const providedTarget = email || phone;
+  const providedTarget = email ? normalizeEmail(email) : phone;
   if (tokenPayload.target !== providedTarget) {
     throw new VerificationTokenTargetMismatchError2();
   }
@@ -9210,6 +9310,29 @@ async function syncMappings(allMappings, rolesByName, permsByName) {
   }
 }
 
+// src/server/services/email-normalization.service.ts
+init_repositories();
+var BACKFILL_KEY = "auth:email_normalization";
+async function normalizeStoredEmails() {
+  if (await authMetadataRepository.get(BACKFILL_KEY)) {
+    return { normalized: 0, conflicts: [] };
+  }
+  const conflicts = await usersRepository.findEmailConflictGroups();
+  const normalized = await usersRepository.normalizeEmailsExcept(conflicts.flat());
+  if (normalized > 0) {
+    authLogger.service.info(`\u2709\uFE0F  Normalized ${normalized} stored email address(es)`);
+  }
+  if (conflicts.length > 0) {
+    authLogger.service.error(
+      `${conflicts.length} email group(s) differ only by capitalization and cannot be normalized automatically. The accounts are untouched and the ones stored in mixed case cannot sign in until this is resolved.`,
+      { conflictingUserIds: conflicts }
+    );
+    return { normalized, conflicts };
+  }
+  await authMetadataRepository.set(BACKFILL_KEY, "done");
+  return { normalized, conflicts };
+}
+
 // src/server/services/permission.service.ts
 init_repositories();
 import { ForbiddenError } from "@spfn/core/errors";
@@ -10932,6 +11055,7 @@ import { Transactional } from "@spfn/core/db";
 import { rateLimitPolicy } from "@spfn/core/middleware";
 
 // src/server/lib/rate-limit-keys.ts
+init_email();
 import { createHash as createHash5 } from "crypto";
 import { getClientIp } from "@spfn/core/middleware";
 async function readJsonBody(c) {
@@ -10943,7 +11067,7 @@ async function readJsonBody(c) {
 }
 function accountKey(body) {
   if (typeof body.email === "string" && body.email.trim()) {
-    return `email:${body.email.trim().toLowerCase()}`;
+    return `email:${normalizeEmail(body.email)}`;
   }
   if (typeof body.phone === "string" && body.phone.trim()) {
     return `phone:${body.phone.trim()}`;
@@ -10955,7 +11079,7 @@ function targetKey(body) {
     return void 0;
   }
   const type = typeof body.targetType === "string" ? body.targetType : "target";
-  const value = type === "email" ? body.target.trim().toLowerCase() : body.target.trim();
+  const value = type === "email" ? normalizeEmail(body.target) : body.target.trim();
   return `${type}:${value}`;
 }
 function byIpAndAccount(options = {}) {
@@ -11675,6 +11799,10 @@ function contractViolation(message) {
 
 // src/server/client-proof/contract-bundle.ts
 import { createHash as createHash7 } from "crypto";
+import {
+  CORE_TIME_OPERATION_ID as CORE_TIME_OPERATION_ID2,
+  ServerTimeResponseSchema
+} from "@spfn/core/server";
 init_types();
 
 // src/server/client-proof/proof.ts
@@ -11805,17 +11933,68 @@ function isRequestContentType(value) {
   return value.split(";")[0].trim().toLowerCase() === CLIENT_PROOF_CONTENT_TYPE;
 }
 
+// src/server/client-proof/contract-types.ts
+import {
+  CORE_TIME_OPERATION_ID,
+  CORE_TIME_ROUTE
+} from "@spfn/core/server";
+function importCoreTimeContract() {
+  const { method, path, contract } = CORE_TIME_ROUTE;
+  if (method !== "GET" || typeof path !== "string" || contract?.auth !== "none" || contract.requiresSession !== false || typeof contract.since !== "string") {
+    throw new Error("core.time does not match the clientProofV1 synchronization prerequisite");
+  }
+  return {
+    id: CORE_TIME_OPERATION_ID,
+    method,
+    path,
+    authProfile: contract.auth,
+    requiresSession: contract.requiresSession,
+    sourceSince: contract.since
+  };
+}
+var IMPORTED_CORE_TIME_CONTRACT = importCoreTimeContract();
+var CORE_PREREQUISITE_OPERATIONS = [
+  {
+    id: IMPORTED_CORE_TIME_CONTRACT.id,
+    method: IMPORTED_CORE_TIME_CONTRACT.method,
+    path: IMPORTED_CORE_TIME_CONTRACT.path,
+    authProfile: IMPORTED_CORE_TIME_CONTRACT.authProfile,
+    requiresSession: IMPORTED_CORE_TIME_CONTRACT.requiresSession,
+    responseType: "ServerTimeResponse",
+    summary: "Returns the server epoch used to timestamp clientProofV1 proofs.",
+    since: "0.9.0"
+  }
+];
+
 // src/server/client-proof/contract-bundle.ts
 init_wire_headers();
-var CONTRACT_VERSION = "0.8.0";
-var CONTRACT_SUPPORTED_RANGE = ">=0.8.0 <0.9.0";
+var CONTRACT_VERSION = "0.9.0";
+var CONTRACT_SUPPORTED_RANGE = ">=0.9.0 <0.10.0";
 function required(name, type) {
   return { name, type, optional: false };
 }
 function optional(name, type) {
   return { name, type, optional: true };
 }
+function coreTimeResponseDeclaration() {
+  if (ServerTimeResponseSchema.type !== "object" || ServerTimeResponseSchema.additionalProperties !== false) {
+    throw new Error("core.time response must remain a closed object");
+  }
+  const requiredFields = new Set(ServerTimeResponseSchema.required);
+  const fields = Object.entries(ServerTimeResponseSchema.properties).map(([name, schema]) => {
+    if (schema.type !== "integer") {
+      throw new Error(`core.time response field ${name} is outside the mobile type grammar`);
+    }
+    return {
+      name,
+      type: "integer",
+      optional: !requiredFields.has(name)
+    };
+  });
+  return { name: "ServerTimeResponse", fields };
+}
 var CONTRACT_TYPES = [
+  coreTimeResponseDeclaration(),
   {
     name: "HandshakeRequest",
     fields: [
@@ -13961,7 +14140,7 @@ async function ensureAdminExists() {
   for (const account of accounts) {
     authLogger.setup.info(`Creating ${account.email} admin account(s)...`);
     try {
-      const existing = await usersRepository.findByEmail(account.email);
+      const existing = await usersRepository.findByEmailInAnyStoredForm(account.email);
       if (existing) {
         authLogger.setup.info(`\u26A0\uFE0F  Account already exists: ${account.email} (skipped)`);
         skipped++;
@@ -14013,6 +14192,14 @@ function createAuthLifecycle(options = {}) {
      */
     afterInfrastructure: async () => {
       await initializeAuth(options);
+      try {
+        await normalizeStoredEmails();
+      } catch (error) {
+        authLogger.service.error(
+          "Stored email normalization did not complete. Addresses stay as they are, so an account stored in mixed case cannot sign in until a later boot succeeds.",
+          { error }
+        );
+      }
       await ensureAdminExists();
       initOneTimeTokenManager(options.oneTimeToken);
     }
@@ -14184,6 +14371,9 @@ export {
   logoutService,
   matchOAuthCsrfCookies,
   naverProvider,
+  normalizeEmail,
+  normalizeOptionalEmail,
+  normalizeStoredEmails,
   oauthCallbackService,
   oauthNativeService,
   oauthStartService,