@stacksjs/auth 0.70.256 → 0.70.258

package/dist/authentication.js

@@ -1,5 +1,5 @@
 import { config } from "@stacksjs/config";
-import { db } from "@stacksjs/database";
+import { db, parseSqlDateTime } from "@stacksjs/database";
 import { HttpError } from "@stacksjs/error-handling";
 import { formatDate, User } from "@stacksjs/orm";
 import { getCurrentRequest, request } from "@stacksjs/router";
@@ -110,7 +110,7 @@ export class Auth {
       name: token.name || "auth-token",
       scopes: parseScopes(token.scopes),
       abilities: parseScopes(token.scopes),
-      expiresAt: token.expires_at ? new Date(String(token.expires_at)) : null,
+      expiresAt: parseSqlDateTime(token.expires_at),
       createdAt: token.created_at ? new Date(String(token.created_at)) : new Date,
       updatedAt: token.updated_at ? new Date(String(token.updated_at)) : new Date,
       revoked: !!token.revoked
@@ -243,7 +243,7 @@ export class Auth {
     if (!accessToken)
       return !1;
     log.debug(`[auth] Token validated for token#${accessToken.id}`);
-    if (accessToken.expires_at && new Date(String(accessToken.expires_at)) < new Date) {
+    if (accessToken.expires_at && (parseSqlDateTime(accessToken.expires_at) ?? new Date(0)) < new Date) {
       await db.deleteFrom("oauth_access_tokens").where("id", "=", accessToken.id).execute();
       return !1;
     }
@@ -258,7 +258,7 @@ export class Auth {
     const hashedPlainToken = hashToken(token), accessToken = await db.selectFrom("oauth_access_tokens").where("token", "=", hashedPlainToken).selectAll().executeTakeFirst();
     if (!accessToken)
       return;
-    if (accessToken.expires_at && new Date(String(accessToken.expires_at)) < new Date) {
+    if (accessToken.expires_at && (parseSqlDateTime(accessToken.expires_at) ?? new Date(0)) < new Date) {
       await db.deleteFrom("oauth_access_tokens").where("id", "=", accessToken.id).execute();
       return;
     }
@@ -331,7 +331,7 @@ export class Auth {
       name: String(token.name || "auth-token"),
       scopes: parseScopes(String(token.scopes ?? "")),
       abilities: parseScopes(String(token.scopes ?? "")),
-      expiresAt: token.expires_at ? new Date(String(token.expires_at)) : null,
+      expiresAt: parseSqlDateTime(token.expires_at),
       createdAt: token.created_at ? new Date(String(token.created_at)) : new Date,
       updatedAt: token.updated_at ? new Date(String(token.updated_at)) : new Date,
       revoked: !!token.revoked

package/dist/email-verification.js

@@ -1,7 +1,7 @@
 import { Buffer } from "node:buffer";
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { config } from "@stacksjs/config";
-import { db } from "@stacksjs/database";
+import { db, sqlDateTime, parseSqlDateTime } from "@stacksjs/database";
 import { mail, template } from "@stacksjs/email";
 import { log } from "@stacksjs/logging";
 function getVerificationKey() {
@@ -42,7 +42,7 @@ export async function sendVerificationEmail(user) {
   await db.insertInto("email_verifications").values({
     user_id: user.id,
     token: hash,
-    expires_at: expiresAt.toISOString()
+    expires_at: sqlDateTime(expiresAt)
   }).executeTakeFirst();
   const verificationUrl = getVerificationUrl(user.id, token), appName = config.app.name || "Stacks";
   try {
@@ -78,14 +78,14 @@ export async function verifyEmail(userId, token) {
   const record = await db.selectFrom("email_verifications").where("user_id", "=", userId).selectAll().executeTakeFirst();
   if (!record)
     return { success: !1, message: "No verification request found. Please request a new verification email." };
-  const expiresAt = new Date(record.expires_at);
+  const expiresAt = parseSqlDateTime(record.expires_at) ?? new Date(Number.NaN);
   if (Number.isNaN(expiresAt.getTime()) || new Date > expiresAt) {
     await db.deleteFrom("email_verifications").where("user_id", "=", userId).execute();
     return { success: !1, message: "Verification link has expired. Please request a new one." };
   }
   if (!verifyToken(userId, token, record.token))
     return { success: !1, message: "Invalid verification link." };
-  await db.updateTable("users").set({ email_verified_at: new Date().toISOString() }).where("id", "=", userId).executeTakeFirst();
+  await db.updateTable("users").set({ email_verified_at: sqlDateTime() }).where("id", "=", userId).executeTakeFirst();
   await db.deleteFrom("email_verifications").where("user_id", "=", userId).execute();
   return { success: !0, message: "Email verified successfully." };
 }

package/dist/passkey.js

@@ -1,5 +1,5 @@
 import { Buffer } from "node:buffer";
-import { db } from "@stacksjs/database";
+import { db, sqlDateTime, parseSqlDateTime } from "@stacksjs/database";
 import { User } from "@stacksjs/orm";
 export {
   generateRegistrationOptions,
@@ -55,7 +55,7 @@ function formatDateTime() {
 }
 const DEFAULT_CHALLENGE_TTL_SECONDS = 300;
 export async function storeWebAuthnChallenge(userId, challenge, purpose, ttlSeconds = DEFAULT_CHALLENGE_TTL_SECONDS) {
-  const expiresAt = new Date(Date.now() + ttlSeconds * 1000).toISOString(), encodedChallenge = typeof challenge === "string" ? challenge : Buffer.from(challenge).toString("base64url");
+  const expiresAt = sqlDateTime(new Date(Date.now() + ttlSeconds * 1000)), encodedChallenge = typeof challenge === "string" ? challenge : Buffer.from(challenge).toString("base64url");
   await db.deleteFrom("webauthn_challenges").where("user_id", "=", userId).where("purpose", "=", purpose).execute();
   await db.insertInto("webauthn_challenges").values({
     user_id: userId,
@@ -69,7 +69,7 @@ export async function consumeWebAuthnChallenge(userId, purpose) {
   if (!row)
     return null;
   await db.deleteFrom("webauthn_challenges").where("user_id", "=", userId).where("purpose", "=", purpose).execute();
-  const expiresAt = row.expires_at ? new Date(String(row.expires_at)).getTime() : 0;
+  const expiresAt = parseSqlDateTime(row.expires_at)?.getTime() ?? 0;
   if (Date.now() > expiresAt)
     return null;
   return Buffer.from(String(row.challenge), "base64url");

package/dist/password/reset.js

@@ -1,6 +1,6 @@
 import { randomBytes } from "node:crypto";
 import { config } from "@stacksjs/config";
-import { db } from "@stacksjs/database";
+import { db, sqlDateTime } from "@stacksjs/database";
 import { mail, template } from "@stacksjs/email";
 import { log } from "@stacksjs/logging";
 import { formatDate } from "@stacksjs/orm";
@@ -57,7 +57,7 @@ export function passwordResets(email) {
     return randomBytes(32).toString("hex");
   }
   async function createResetToken() {
-    const token = generateResetToken(), hashedToken = await makeHash(token, { algorithm: "bcrypt" }), expireMinutes = getTokenExpireMinutes(), expiresAt = new Date(Date.now() + expireMinutes * 60000).toISOString();
+    const token = generateResetToken(), hashedToken = await makeHash(token, { algorithm: "bcrypt" }), expireMinutes = getTokenExpireMinutes(), expiresAt = sqlDateTime(new Date(Date.now() + expireMinutes * 60000));
     await db.deleteFrom("password_resets").where("email", "=", email).execute();
     await db.insertInto("password_resets").values({
       email,

package/dist/session-auth.js

@@ -3,7 +3,7 @@ import { log } from "@stacksjs/logging";
 import { User } from "@stacksjs/orm";
 import { verifyHash } from "@stacksjs/security";
 import { config } from "@stacksjs/config";
-import { db } from "@stacksjs/database";
+import { db, sqlDateTime, parseSqlDateTime } from "@stacksjs/database";
 import { getCurrentRequest } from "@stacksjs/router";
 import { DUMMY_BCRYPT_HASH } from "./internal-constants";
 import { RateLimiter } from "./rate-limiter";
@@ -57,7 +57,7 @@ export async function sessionLogin(email, password, fingerprint) {
       user_agent: userAgent,
       payload: "{}",
       last_activity: Math.floor(Date.now() / 1000),
-      expires_at: expiresAt.toISOString()
+      expires_at: sqlDateTime(expiresAt)
     }).execute();
   } catch (err) {
     log.error(`[auth] Session persistence failed for user#${user.id}: ${err.message}`);
@@ -88,7 +88,7 @@ export async function sessionUser(sessionId) {
     const session = await db.selectFrom("sessions").where("id", "=", sessionId).selectAll().executeTakeFirst();
     if (!session)
       return;
-    const expiresAt = session.expires_at ? new Date(String(session.expires_at)).getTime() : 0;
+    const expiresAt = parseSqlDateTime(session.expires_at)?.getTime() ?? 0;
     if (Date.now() > expiresAt) {
       await db.deleteFrom("sessions").where("id", "=", sessionId).execute();
       return;
@@ -107,7 +107,7 @@ export async function sessionCheck(sessionId) {
     const session = await db.selectFrom("sessions").where("id", "=", sessionId).selectAll().executeTakeFirst();
     if (!session)
       return !1;
-    const expiresAt = session.expires_at ? new Date(String(session.expires_at)).getTime() : 0;
+    const expiresAt = parseSqlDateTime(session.expires_at)?.getTime() ?? 0;
     if (Date.now() > expiresAt) {
       await db.deleteFrom("sessions").where("id", "=", sessionId).execute();
       return !1;
@@ -124,7 +124,7 @@ export async function sessionRefresh(sessionId, ttlMs = 86400000) {
     const session = await db.selectFrom("sessions").where("id", "=", sessionId).selectAll().executeTakeFirst();
     if (!session)
       return !1;
-    const expiresAt = session.expires_at ? new Date(String(session.expires_at)).getTime() : 0;
+    const expiresAt = parseSqlDateTime(session.expires_at)?.getTime() ?? 0;
     if (Date.now() > expiresAt) {
       await db.deleteFrom("sessions").where("id", "=", sessionId).execute();
       return !1;
@@ -133,7 +133,7 @@ export async function sessionRefresh(sessionId, ttlMs = 86400000) {
       return !1;
     const newExpiry = new Date(Date.now() + ttlMs);
     await db.updateTable("sessions").set({
-      expires_at: newExpiry.toISOString(),
+      expires_at: sqlDateTime(newExpiry),
       last_activity: Math.floor(Date.now() / 1000)
     }).where("id", "=", sessionId).execute();
     return !0;

package/dist/tokens.d.ts

@@ -273,7 +273,7 @@ export declare function parseScopes(scopes: string | string[] | null | undefined
 /** Current database driver */
 declare const dbDriver: DatabaseDriver;
 /** Cross-database SQL helpers */
-declare const sql: unknown;
+declare const sql: ReturnType<typeof sqlHelpers>;
 /**
  * Alias for currentAccessToken
  *

package/dist/tokens.js

@@ -4,8 +4,11 @@ import { db } from "@stacksjs/database";
 import { HttpError } from "@stacksjs/error-handling";
 import { getCurrentRequest } from "@stacksjs/router";
 import { env } from "@stacksjs/env";
-import { sqlHelpers } from "@stacksjs/database";
+import { parseSqlDateTime, sqlDateTime, sqlDateTimeLiteral, sqlHelpers } from "@stacksjs/database";
 const dbDriver = env.DB_CONNECTION || "sqlite", sql = sqlHelpers(dbDriver), { isPostgres, isMysql, now, boolTrue, boolFalse } = sql;
+function appNow() {
+  return sqlDateTimeLiteral();
+}
 function param(index) {
   return sql.param(index);
 }
@@ -28,8 +31,7 @@ export async function getPasswordChangedAt(userId, q = db) {
     `, [userId]))[0]?.password_changed_at;
     if (value === null || value === void 0)
       return null;
-    const parsed = new Date(String(value));
-    return Number.isNaN(parsed.getTime()) ? null : parsed;
+    return parseSqlDateTime(value);
   } catch {
     return null;
   }
@@ -39,8 +41,8 @@ export function isIssuedBeforePasswordChange(createdAt, changedAt) {
     return !1;
   if (createdAt === null || createdAt === void 0)
     return !1;
-  const created = new Date(String(createdAt));
-  if (Number.isNaN(created.getTime()))
+  const created = parseSqlDateTime(createdAt);
+  if (!created)
     return !1;
   return created.getTime() < changedAt.getTime();
 }
@@ -69,7 +71,7 @@ export async function findToken(plainTextToken) {
     SELECT * FROM oauth_access_tokens
     WHERE token = ${param(1)}
     AND revoked = ${boolFalse}
-    AND (expires_at IS NULL OR expires_at > ${now})
+    AND (expires_at IS NULL OR expires_at > ${appNow()})
     LIMIT 1
   `, [hashedToken]))[0];
   if (!row)
@@ -149,13 +151,13 @@ export async function createToken(userId, name = "access-token", scopes = ["*"],
   if (isPostgres)
     await db.unsafe(`
       INSERT INTO oauth_access_tokens (user_id, oauth_client_id, token, name, scopes, revoked, expires_at, created_at, updated_at)
-      VALUES ($1, $2, $3, $4, $5, false, $6, NOW(), NOW())
-    `, [userId, client.id, hashedToken, name, JSON.stringify(scopes), expiresAt.toISOString()]);
+      VALUES ($1, $2, $3, $4, $5, false, $6, ${appNow()}, ${appNow()})
+    `, [userId, client.id, hashedToken, name, JSON.stringify(scopes), sqlDateTime(expiresAt)]);
   else
     await db.unsafe(`
       INSERT INTO oauth_access_tokens (user_id, oauth_client_id, token, name, scopes, revoked, expires_at, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, 0, ?, ${now}, ${now})
-    `, [userId, client.id, hashedToken, name, JSON.stringify(scopes), expiresAt.toISOString()]);
+      VALUES (?, ?, ?, ?, ?, 0, ?, ${appNow()}, ${appNow()})
+    `, [userId, client.id, hashedToken, name, JSON.stringify(scopes), sqlDateTime(expiresAt)]);
   const row = (await db.unsafe(`
     SELECT * FROM oauth_access_tokens WHERE token = ${param(1)} LIMIT 1
   `, [hashedToken]))[0];
@@ -180,13 +182,13 @@ export async function createToken(userId, name = "access-token", scopes = ["*"],
     if (isPostgres)
       await db.unsafe(`
         INSERT INTO oauth_refresh_tokens (access_token_id, token, revoked, expires_at, created_at)
-        VALUES ($1, $2, false, $3, NOW())
-      `, [accessToken.id, hashedRefreshToken, refreshExpiresAt.toISOString()]);
+        VALUES ($1, $2, false, $3, ${appNow()})
+      `, [accessToken.id, hashedRefreshToken, sqlDateTime(refreshExpiresAt)]);
     else
       await db.unsafe(`
         INSERT INTO oauth_refresh_tokens (access_token_id, token, revoked, expires_at, created_at)
-        VALUES (?, ?, 0, ?, ${now})
-      `, [accessToken.id, hashedRefreshToken, refreshExpiresAt.toISOString()]);
+        VALUES (?, ?, 0, ?, ${appNow()})
+      `, [accessToken.id, hashedRefreshToken, sqlDateTime(refreshExpiresAt)]);
   }
   return {
     accessToken,
@@ -207,7 +209,7 @@ export async function refreshToken(refreshTokenPlain, options = {}) {
       JOIN oauth_access_tokens t ON r.access_token_id = t.id
       WHERE r.token = ${param(1)}
       AND r.revoked = ${boolFalse}
-      AND (r.expires_at IS NULL OR r.expires_at > ${now})
+      AND (r.expires_at IS NULL OR r.expires_at > ${appNow()})
       LIMIT 1${forUpdate}
     `, [hashedRefreshToken]))[0];
     if (!refreshRow)
@@ -229,13 +231,13 @@ export async function refreshToken(refreshTokenPlain, options = {}) {
     if (isPostgres)
       await trx.unsafe(`
         INSERT INTO oauth_access_tokens (user_id, oauth_client_id, token, name, scopes, revoked, expires_at, created_at, updated_at)
-        VALUES ($1, $2, $3, $4, $5, false, $6, NOW(), NOW())
-      `, [refreshRow.user_id, refreshRow.oauth_client_id, hashedToken, refreshRow.name, refreshRow.scopes, expiresAt.toISOString()]);
+        VALUES ($1, $2, $3, $4, $5, false, $6, ${appNow()}, ${appNow()})
+      `, [refreshRow.user_id, refreshRow.oauth_client_id, hashedToken, refreshRow.name, refreshRow.scopes, sqlDateTime(expiresAt)]);
     else
       await trx.unsafe(`
         INSERT INTO oauth_access_tokens (user_id, oauth_client_id, token, name, scopes, revoked, expires_at, created_at, updated_at)
-        VALUES (?, ?, ?, ?, ?, 0, ?, ${now}, ${now})
-      `, [refreshRow.user_id, refreshRow.oauth_client_id, hashedToken, refreshRow.name, refreshRow.scopes, expiresAt.toISOString()]);
+        VALUES (?, ?, ?, ?, ?, 0, ?, ${appNow()}, ${appNow()})
+      `, [refreshRow.user_id, refreshRow.oauth_client_id, hashedToken, refreshRow.name, refreshRow.scopes, sqlDateTime(expiresAt)]);
     const row = (await trx.unsafe(`
       SELECT * FROM oauth_access_tokens WHERE token = ${param(1)} LIMIT 1
     `, [hashedToken]))[0], accessToken = {
@@ -256,13 +258,13 @@ export async function refreshToken(refreshTokenPlain, options = {}) {
     if (isPostgres)
       await trx.unsafe(`
         INSERT INTO oauth_refresh_tokens (access_token_id, token, revoked, expires_at, created_at)
-        VALUES ($1, $2, false, $3, NOW())
-      `, [accessToken.id, newHashedRefreshToken, refreshExpiresAt.toISOString()]);
+        VALUES ($1, $2, false, $3, ${appNow()})
+      `, [accessToken.id, newHashedRefreshToken, sqlDateTime(refreshExpiresAt)]);
     else
       await trx.unsafe(`
         INSERT INTO oauth_refresh_tokens (access_token_id, token, revoked, expires_at, created_at)
-        VALUES (?, ?, 0, ?, ${now})
-      `, [accessToken.id, newHashedRefreshToken, refreshExpiresAt.toISOString()]);
+        VALUES (?, ?, 0, ?, ${appNow()})
+      `, [accessToken.id, newHashedRefreshToken, sqlDateTime(refreshExpiresAt)]);
     return {
       accessToken,
       plainTextToken,
@@ -277,7 +279,7 @@ export async function validateRefreshToken(refreshTokenPlain) {
     SELECT id FROM oauth_refresh_tokens
     WHERE token = ${param(1)}
     AND revoked = ${boolFalse}
-    AND (expires_at IS NULL OR expires_at > ${now})
+    AND (expires_at IS NULL OR expires_at > ${appNow()})
     LIMIT 1
   `, [hashedRefreshToken])).length > 0;
 }
@@ -301,7 +303,7 @@ export async function revokeAllRefreshTokens(userId) {
 export async function deleteExpiredRefreshTokens() {
   const result = await db.unsafe(`
     DELETE FROM oauth_refresh_tokens
-    WHERE expires_at < ${now}
+    WHERE expires_at < ${appNow()}
   `);
   return result?.changes || result?.rowCount || 0;
 }
@@ -311,7 +313,7 @@ export async function deleteRevokedRefreshTokens(daysOld = 7) {
   const result = await db.unsafe(`
     DELETE FROM oauth_refresh_tokens
     WHERE revoked = ${boolTrue} AND created_at < ${param(1)}
-  `, [cutoffDate.toISOString()]);
+  `, [sqlDateTime(cutoffDate)]);
   return result?.changes || result?.rowCount || 0;
 }
 export async function revokeToken(plainTextToken) {
@@ -325,7 +327,7 @@ export async function revokeToken(plainTextToken) {
   `, [hashedToken]);
   await db.unsafe(`
     UPDATE oauth_access_tokens
-    SET revoked = ${boolTrue}, updated_at = ${now}
+    SET revoked = ${boolTrue}, updated_at = ${appNow()}
     WHERE token = ${param(1)}
   `, [hashedToken]);
 }
@@ -337,7 +339,7 @@ export async function revokeTokenById(tokenId) {
   `, [tokenId]);
   await db.unsafe(`
     UPDATE oauth_access_tokens
-    SET revoked = ${boolTrue}, updated_at = ${now}
+    SET revoked = ${boolTrue}, updated_at = ${appNow()}
     WHERE id = ${param(1)}
   `, [tokenId]);
 }
@@ -345,7 +347,7 @@ export async function revokeAllTokens(userId) {
   await revokeAllRefreshTokens(userId);
   await db.unsafe(`
     UPDATE oauth_access_tokens
-    SET revoked = ${boolTrue}, updated_at = ${now}
+    SET revoked = ${boolTrue}, updated_at = ${appNow()}
     WHERE user_id = ${param(1)}
   `, [userId]);
 }
@@ -363,7 +365,7 @@ export async function revokeOtherTokens(userId) {
     `, [userId, current.id]);
     await db.unsafe(`
       UPDATE oauth_access_tokens
-      SET revoked = true, updated_at = NOW()
+      SET revoked = true, updated_at = ${appNow()}
       WHERE user_id = $1 AND id != $2
     `, [userId, current.id]);
   } else {
@@ -376,7 +378,7 @@ export async function revokeOtherTokens(userId) {
     `, [userId, current.id]);
     await db.unsafe(`
       UPDATE oauth_access_tokens
-      SET revoked = 1, updated_at = ${now}
+      SET revoked = 1, updated_at = ${appNow()}
       WHERE user_id = ? AND id != ?
     `, [userId, current.id]);
   }
@@ -385,12 +387,12 @@ export async function deleteExpiredTokens() {
   await db.unsafe(`
     DELETE FROM oauth_refresh_tokens
     WHERE access_token_id IN (
-      SELECT id FROM oauth_access_tokens WHERE expires_at < ${now}
+      SELECT id FROM oauth_access_tokens WHERE expires_at < ${appNow()}
     )
   `);
   const result = await db.unsafe(`
     DELETE FROM oauth_access_tokens
-    WHERE expires_at < ${now}
+    WHERE expires_at < ${appNow()}
   `);
   return result?.changes || result?.rowCount || 0;
 }
@@ -402,11 +404,11 @@ export async function deleteRevokedTokens(daysOld = 7) {
     WHERE access_token_id IN (
       SELECT id FROM oauth_access_tokens WHERE revoked = ${boolTrue} AND updated_at < ${param(1)}
     )
-  `, [cutoffDate.toISOString()]);
+  `, [sqlDateTime(cutoffDate)]);
   const result = await db.unsafe(`
     DELETE FROM oauth_access_tokens
     WHERE revoked = ${boolTrue} AND updated_at < ${param(1)}
-  `, [cutoffDate.toISOString()]);
+  `, [sqlDateTime(cutoffDate)]);
   return result?.changes || result?.rowCount || 0;
 }
 export async function clients(userId) {
@@ -427,7 +429,7 @@ export async function createClient(options) {
   if (isPostgres)
     await db.unsafe(`
       INSERT INTO oauth_clients (name, secret, provider, redirect, personal_access_client, password_client, revoked, created_at)
-      VALUES ($1, $2, 'local', $3, $4, $5, false, NOW())
+      VALUES ($1, $2, 'local', $3, $4, $5, false, ${appNow()})
     `, [
       options.name,
       secret,
@@ -438,7 +440,7 @@ export async function createClient(options) {
   else
     await db.unsafe(`
       INSERT INTO oauth_clients (name, secret, provider, redirect, personal_access_client, password_client, revoked, created_at)
-      VALUES (?, ?, 'local', ?, ?, ?, 0, ${now})
+      VALUES (?, ?, 'local', ?, ?, ?, 0, ${appNow()})
     `, [
       options.name,
       secret,
@@ -457,7 +459,7 @@ export async function createClient(options) {
 export async function revokeClient(clientId) {
   await db.unsafe(`
     UPDATE oauth_clients
-    SET revoked = ${boolTrue}, updated_at = ${now}
+    SET revoked = ${boolTrue}, updated_at = ${appNow()}
     WHERE id = ${param(1)}
   `, [clientId]);
 }

package/dist/two-factor.js

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { db } from "@stacksjs/database";
+import { db, sqlDateTime, parseSqlDateTime } from "@stacksjs/database";
 import { generateTwoFactorSecret, generateTwoFactorUri, verifyTwoFactorCode } from "./authenticator";
 import { RateLimiter } from "./rate-limiter";
 const DEFAULT_CHALLENGE_TTL_SECONDS = 300, TWO_FACTOR_RATE_LIMIT_PREFIX = "2fa:", TWO_FACTOR_STEP_SECONDS = 30;
@@ -35,7 +35,7 @@ export function generateTwoFactorSetup(email, serviceName) {
 }
 const PENDING_SECRET_TTL_SECONDS = 600;
 export async function stashPendingTwoFactorSecret(userId, secret, ttlSeconds = PENDING_SECRET_TTL_SECONDS) {
-  const expiresAt = new Date(Date.now() + ttlSeconds * 1000).toISOString();
+  const expiresAt = sqlDateTime(new Date(Date.now() + ttlSeconds * 1000));
   await db.deleteFrom("two_factor_pending_secrets").where("user_id", "=", userId).execute();
   await db.insertInto("two_factor_pending_secrets").values({
     user_id: userId,
@@ -48,7 +48,7 @@ export async function consumePendingTwoFactorSecret(userId) {
   if (!row)
     return null;
   await db.deleteFrom("two_factor_pending_secrets").where("user_id", "=", userId).execute();
-  const expiresAt = row.expires_at ? new Date(String(row.expires_at)).getTime() : 0;
+  const expiresAt = parseSqlDateTime(row.expires_at)?.getTime() ?? 0;
   if (Date.now() > expiresAt)
     return null;
   return String(row.secret);
@@ -80,7 +80,7 @@ export async function verifyTwoFactorLoginCode(userId, code) {
   return !0;
 }
 export async function createTwoFactorChallenge(userId, ttlSeconds = DEFAULT_CHALLENGE_TTL_SECONDS) {
-  const id = randomBytes(32).toString("hex"), expiresAt = new Date(Date.now() + ttlSeconds * 1000).toISOString();
+  const id = randomBytes(32).toString("hex"), expiresAt = sqlDateTime(new Date(Date.now() + ttlSeconds * 1000));
   await db.deleteFrom("two_factor_challenges").where("user_id", "=", userId).execute();
   await db.insertInto("two_factor_challenges").values({
     id,
@@ -94,7 +94,7 @@ export async function consumeTwoFactorChallenge(challengeToken) {
   if (!row)
     return null;
   await db.deleteFrom("two_factor_challenges").where("id", "=", challengeToken).execute();
-  const expiresAt = row.expires_at ? new Date(String(row.expires_at)).getTime() : 0;
+  const expiresAt = parseSqlDateTime(row.expires_at)?.getTime() ?? 0;
   if (Date.now() > expiresAt)
     return null;
   return Number(row.user_id);

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/auth",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.256",
+  "version": "0.70.258",
   "description": "A more simplistic way to authenticate.",
   "author": "Chris Breuer",
   "contributors": [
@@ -54,7 +54,7 @@
   },
   "devDependencies": {
     "better-dx": "^0.2.17",
-    "@stacksjs/error-handling": "0.70.256",
-    "@stacksjs/router": "0.70.256"
+    "@stacksjs/error-handling": "0.70.258",
+    "@stacksjs/router": "0.70.258"
   }
 }