@stacksjs/auth 0.75.408 → 0.75.417

package/README.md

@@ -99,3 +99,16 @@ For casual chit-chat with others using this package:
 The MIT License (MIT). Please see [LICENSE](https://github.com/stacksjs/stacks/tree/main/LICENSE.md) for more information.
 
 Made with 💙
+
+### Indexed recovery credentials
+
+`mintPasswordResetToken()` returns a random credential and its SHA-256 digest. Store only
+`digest` in `password_resets.token`. Token-only recovery endpoints use
+`consumePasswordResetToken(token, async claim => { ... })` to change the account and
+revoke its credentials in one transaction. `claim` contains `userId`, `email` and
+`hasExplicitExpiry`. The result is `{ consumed: false }` or
+`{ consumed: true, value }`, with the callback's value. Unknown, expired, replaced
+and already consumed tokens never invoke the callback. A failed callback rolls
+everything back, leaving recovery retryable. Notifications belong after commit.
+This API is for high-entropy digest tokens; `passwordResets(email)` continues to
+serve existing email-based bcrypt recovery credentials.

package/dist/index.d.ts

@@ -33,6 +33,7 @@ export * from './magic-link';
 export * from './passkey';
 export * from './passkeys';
 export * from './password/reset';
+export * from './password/reset-token';
 export * from './register';
 export * from './user';
 // Token management (Laravel Passport-style)

package/dist/index.js

@@ -1 +1 @@
-export*from"./authentication";export*from"./impersonation";export{requestImpersonation}from"./impersonation-auth";export*from"./impersonation-store";export*from"./authenticator";export*from"./client";export*from"./credential-user";export*from"./middleware";export*from"./oauth-authorization";export*from"./oauth-authorization-endpoint";export*from"./oauth-authorization-requests";export*from"./oauth-authorization-response";export*from"./oauth-authorization-codes";export*from"./oauth-browser-session";export*from"./oauth-client-registration";export*from"./oauth-consent";export*from"./oauth-delegated-access";export*from"./oauth-grants";export*from"./oauth-introspection";export*from"./oauth-metadata";export*from"./oauth-provider";export*from"./oauth-pruning";export*from"./oauth-pkce";export*from"./oauth-revocation";export*from"./oauth-token-exchange";export*from"./oauth-token-endpoint";export*from"./oauth-token-request";export*from"./oauth-token-response";export*from"./rate-limiter";export*from"./magic-link";export*from"./passkey";export*from"./passkeys";export*from"./password/reset";export*from"./register";export*from"./user";export*from"./tokens";export*from"./gate";export*from"./policy";export*from"./authorizable";export*from"./permissions";export*from"./rbac";export{createBqbRbacStore}from"./rbac-store-bqb";export{DEFAULT_ROLE_PACKS,seedDefaultRoles}from"./rbac-seed";export*from"./email-verification";export*from"./session-auth";export*from"./cookie-auth";export*from"./browser-session";export*from"./request-token";export*from"./page-gate";export*from"./socials";export*from"./session-handoff";export{generateTOTP,verifyTOTP,generateTOTPSecret,totpKeyUri}from"@stacksjs/ts-auth";export*from"./two-factor";export*from"./team";export*from"./referrals";export*from"./oauth-dynamic-registration";export*from"./oauth-protected-resource";export*from"./oauth-server";
+export*from"./authentication";export*from"./impersonation";export{requestImpersonation}from"./impersonation-auth";export*from"./impersonation-store";export*from"./authenticator";export*from"./client";export*from"./credential-user";export*from"./middleware";export*from"./oauth-authorization";export*from"./oauth-authorization-endpoint";export*from"./oauth-authorization-requests";export*from"./oauth-authorization-response";export*from"./oauth-authorization-codes";export*from"./oauth-browser-session";export*from"./oauth-client-registration";export*from"./oauth-consent";export*from"./oauth-delegated-access";export*from"./oauth-grants";export*from"./oauth-introspection";export*from"./oauth-metadata";export*from"./oauth-provider";export*from"./oauth-pruning";export*from"./oauth-pkce";export*from"./oauth-revocation";export*from"./oauth-token-exchange";export*from"./oauth-token-endpoint";export*from"./oauth-token-request";export*from"./oauth-token-response";export*from"./rate-limiter";export*from"./magic-link";export*from"./passkey";export*from"./passkeys";export*from"./password/reset";export*from"./password/reset-token";export*from"./register";export*from"./user";export*from"./tokens";export*from"./gate";export*from"./policy";export*from"./authorizable";export*from"./permissions";export*from"./rbac";export{createBqbRbacStore}from"./rbac-store-bqb";export{DEFAULT_ROLE_PACKS,seedDefaultRoles}from"./rbac-seed";export*from"./email-verification";export*from"./session-auth";export*from"./cookie-auth";export*from"./browser-session";export*from"./request-token";export*from"./page-gate";export*from"./socials";export*from"./session-handoff";export{generateTOTP,verifyTOTP,generateTOTPSecret,totpKeyUri}from"@stacksjs/ts-auth";export*from"./two-factor";export*from"./team";export*from"./referrals";export*from"./oauth-dynamic-registration";export*from"./oauth-protected-resource";export*from"./oauth-server";

package/dist/password/reset-token.d.ts

@@ -0,0 +1,15 @@
+/** High-entropy reset credentials support indexed lookup without storing a usable token. */
+export declare function passwordResetTokenDigest(token: string): string;
+export declare function mintPasswordResetToken(): { token: string, digest: string };
+/**
+ * Redeem a SHA-256 reset credential and apply account changes in one transaction.
+ * Issuance stores mintPasswordResetToken().digest in password_resets.token.
+ * The callback must contain database work only; notify the person after commit.
+ * A callback failure restores the token, and competing redeemers cannot both win.
+ */
+export declare function consumePasswordResetToken<T>(token: string, apply: (claim: PasswordResetClaim) => Promise<T>, options?: { ttlMs?: number }): Promise<{ consumed: false } | { consumed: true, value: T }>;
+export declare interface PasswordResetClaim {
+  userId: number
+  email: string
+  hasExplicitExpiry: boolean
+}

package/dist/password/reset-token.js

@@ -0,0 +1 @@
+import{createHash,randomBytes}from"node:crypto";import{config}from"@stacksjs/config";import{db,lockRow,mutationCount,parseSqlDateTime}from"@stacksjs/database/runtime";export function passwordResetTokenDigest(token){return createHash("sha256").update(token).digest("hex")}export function mintPasswordResetToken(){const token=randomBytes(32).toString("hex");return{token,digest:passwordResetTokenDigest(token)}}export async function consumePasswordResetToken(token,apply,options={}){if(!token||token.length>1024)return{consumed:!1};const digest=passwordResetTokenDigest(token),observed=await db.primary.selectFrom("password_resets").select(["email"]).where("token","=",digest).executeTakeFirst();if(!observed)return{consumed:!1};const email=String(observed.email),owner=await db.primary.selectFrom("users").select("id").where("email","=",email).executeTakeFirst();if(!owner)return{consumed:!1};const ttlMs=options.ttlMs??Number(config.auth.passwordReset?.expire??60)*60000;if(!Number.isFinite(ttlMs)||ttlMs<=0)throw RangeError("Reset lifetime must be positive");return db.transaction(async(tx)=>{const user=await lockRow(tx,"users",{id:Number(owner.id)});if(!user||String(user.email)!==email)return{consumed:!1};const reset=await lockRow(tx,"password_resets",{email});if(!reset||reset.token!==digest)return{consumed:!1};if(!((reset.expires_at==null?(parseSqlDateTime(reset.created_at)?.getTime()??0)+ttlMs:parseSqlDateTime(reset.expires_at)?.getTime()??0)>Date.now())){await db.deleteFrom("password_resets").where("email","=",email).where("token","=",digest).execute();return{consumed:!1}}const value=await apply({userId:Number(owner.id),email,hasExplicitExpiry:reset.expires_at!=null}),deleted=await db.deleteFrom("password_resets").where("email","=",email).where("token","=",digest).execute();if(mutationCount(deleted)!==1)throw Error("Password reset token could not be consumed");return{consumed:!0,value}})}

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/auth",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.408",
+  "version": "0.75.417",
   "description": "A more simplistic way to authenticate.",
   "author": "Chris Breuer",
   "contributors": [
@@ -59,19 +59,19 @@
   },
   "dependencies": {
     "@stacksjs/bun-router": "^0.1.24",
-    "@stacksjs/cache": "0.75.408",
-    "@stacksjs/config": "0.75.408",
-    "@stacksjs/database": "0.75.408",
-    "@stacksjs/email": "0.75.408",
-    "@stacksjs/env": "0.75.408",
-    "@stacksjs/error-handling": "0.75.408",
-    "@stacksjs/logging": "0.75.408",
-    "@stacksjs/orm": "0.75.408",
-    "@stacksjs/path": "0.75.408",
-    "@stacksjs/router": "0.75.408",
-    "@stacksjs/security": "0.75.408",
-    "@stacksjs/socials": "0.75.408",
-    "@stacksjs/storage": "0.75.408",
+    "@stacksjs/cache": "0.75.417",
+    "@stacksjs/config": "0.75.417",
+    "@stacksjs/database": "0.75.417",
+    "@stacksjs/email": "0.75.417",
+    "@stacksjs/env": "0.75.417",
+    "@stacksjs/error-handling": "0.75.417",
+    "@stacksjs/logging": "0.75.417",
+    "@stacksjs/orm": "0.75.417",
+    "@stacksjs/path": "0.75.417",
+    "@stacksjs/router": "0.75.417",
+    "@stacksjs/security": "0.75.417",
+    "@stacksjs/socials": "0.75.417",
+    "@stacksjs/storage": "0.75.417",
     "@stacksjs/ts-auth": "^0.4.7",
     "ts-qr-codes": "^0.1.8"
   },