@starklabs/forge 1.3.25-cors.0 → 2.0.0

package/dist/auth/OtpService.js

@@ -0,0 +1,168 @@
+import { BadRequestError, ErrorCode, NotFoundError, TooManyRequestsError } from "../errors/index.js";
+import { OTP_REQUEST_MODEL } from "../data/internalModels.js";
+import { hmacCode, randomNumericCode, randomToken, safeEqual, sha256 } from "../security/TokenService.js";
+export const OTP_PURPOSES = ["signup", "login", "password_reset"];
+const SUBJECTS = {
+    signup: "Confirm your e-mail address",
+    login: "Your login code",
+    password_reset: "Reset your password",
+};
+/**
+ * One-time codes for sign-up, login and password reset.
+ *
+ * Differences from 1.x: codes expire on their own (TTL index) instead of
+ * blocking the user forever, wrong guesses are counted correctly, resend is
+ * rate limited, codes are stored as keyed hashes, and password reset hands
+ * out a separate single-use token rather than a reusable "verified" flag.
+ */
+export class OtpService {
+    config;
+    data;
+    emails;
+    logger;
+    constructor(config, data, emails, logger) {
+        this.config = config;
+        this.data = data;
+        this.emails = emails;
+        this.logger = logger;
+    }
+    get repo() {
+        return this.data.repository(OTP_REQUEST_MODEL);
+    }
+    key() {
+        return `forge-otp:${this.config.jwtSecret ?? ""}`;
+    }
+    async issue(input) {
+        const { otp } = this.config.auth;
+        const email = input.email.toLowerCase();
+        const existing = await this.repo.findOne({ email, purpose: input.purpose });
+        const now = Date.now();
+        if (existing && new Date(existing.expiresAt).getTime() > now) {
+            const waitMs = new Date(existing.lastSentAt).getTime() + otp.resendCooldown.toMs() - now;
+            if (waitMs > 0) {
+                throw new TooManyRequestsError({
+                    message: "A code was sent recently. Please wait before requesting another.",
+                    code: ErrorCode.OTP_RESEND_COOLDOWN,
+                    headers: { "Retry-After": String(Math.ceil(waitMs / 1000)) },
+                    details: { retryAfterSeconds: Math.ceil(waitMs / 1000) },
+                });
+            }
+            if (existing.resends >= otp.maxResends) {
+                throw new TooManyRequestsError({
+                    message: "Too many codes were requested. Please try again later.",
+                    code: ErrorCode.OTP_RESEND_LIMIT,
+                });
+            }
+        }
+        const code = randomNumericCode(6);
+        const record = {
+            email,
+            purpose: input.purpose,
+            codeHash: hmacCode(code, this.key()),
+            expiresAt: otp.expiresIn.fromNow(now),
+            attempts: 0,
+            lastSentAt: new Date(now),
+            verifiedAt: null,
+            resetTokenHash: null,
+            resetExpiresAt: null,
+        };
+        if (existing) {
+            await this.repo.updateById(existing._id, {
+                ...record,
+                resends: (existing.resends ?? 0) + 1,
+                ...(input.payload ? { payload: input.payload } : {}),
+            });
+        }
+        else {
+            await this.repo.create({ ...record, resends: 0, ...(input.payload ? { payload: input.payload } : {}) });
+        }
+        await this.send(email, code, input);
+    }
+    /** Re-sends a code for a request that is already pending. */
+    async resend(email, purpose, userName) {
+        const existing = await this.repo.findOne({ email: email.toLowerCase(), purpose });
+        if (!existing) {
+            throw new NotFoundError({
+                message: "There is no pending request for this e-mail. Start again.",
+                code: ErrorCode.OTP_NOT_FOUND,
+            });
+        }
+        await this.issue({ email, purpose, userName });
+    }
+    /** Checks a code. On success a signup/login request is consumed and its payload returned. */
+    async verify(email, purpose, code) {
+        const { otp } = this.config.auth;
+        const record = await this.repo.findOne({ email: email.toLowerCase(), purpose }, { withSecrets: ["codeHash"] });
+        if (!record) {
+            throw new NotFoundError({ message: "No pending code was found. Request a new one.", code: ErrorCode.OTP_NOT_FOUND });
+        }
+        if (new Date(record.expiresAt).getTime() <= Date.now()) {
+            await this.repo.deleteById(record._id);
+            throw new BadRequestError({ message: "The code has expired. Request a new one.", code: ErrorCode.OTP_EXPIRED });
+        }
+        if (record.attempts >= otp.maxAttempts) {
+            await this.repo.deleteById(record._id);
+            throw new TooManyRequestsError({
+                message: "Too many wrong attempts. Request a new code.",
+                code: ErrorCode.OTP_ATTEMPTS_EXCEEDED,
+            });
+        }
+        const valid = typeof record.codeHash === "string" && safeEqual(record.codeHash, hmacCode(code, this.key()));
+        if (!valid) {
+            const attempts = record.attempts + 1;
+            await this.repo.updateById(record._id, { attempts });
+            throw new BadRequestError({
+                message: "The code is incorrect.",
+                code: ErrorCode.OTP_INVALID,
+                details: { attemptsLeft: Math.max(0, otp.maxAttempts - attempts) },
+            });
+        }
+        if (purpose !== "password_reset") {
+            await this.repo.deleteById(record._id);
+            return { record };
+        }
+        // Password reset: swap the code for a separate single-use token.
+        const resetToken = randomToken(32);
+        await this.repo.updateById(record._id, {
+            verifiedAt: new Date(),
+            codeHash: sha256(`used:${randomToken(8)}`),
+            resetTokenHash: sha256(resetToken),
+            resetExpiresAt: otp.verifiedWindow.fromNow(),
+        });
+        return { record, resetToken };
+    }
+    /** Validates and burns a password-reset token. */
+    async consumeResetToken(email, resetToken) {
+        const record = await this.repo.findOne({ email: email.toLowerCase(), purpose: "password_reset" }, { withSecrets: ["resetTokenHash"] });
+        const valid = record &&
+            typeof record.resetTokenHash === "string" &&
+            record.resetExpiresAt &&
+            new Date(record.resetExpiresAt).getTime() > Date.now() &&
+            safeEqual(record.resetTokenHash, sha256(resetToken));
+        if (!valid) {
+            throw new BadRequestError({
+                message: "The reset link is invalid or has expired. Start again.",
+                code: ErrorCode.RESET_TOKEN_INVALID,
+            });
+        }
+        await this.repo.deleteById(record._id);
+    }
+    async send(email, code, input) {
+        if (this.config.isOffline) {
+            // Development only (isOffline is rejected in production): nothing is e-mailed, so show the code.
+            this.logger.info(`[offline] ${input.purpose} code for ${email}: ${code}`);
+        }
+        await this.emails.sendTemplate({
+            to: email,
+            subject: SUBJECTS[input.purpose],
+            template: "two-factor-code",
+            placeholders: {
+                otpCode: code,
+                userName: input.userName ?? "there",
+                userEmail: email,
+                expiryMinutes: Math.max(1, Math.round(this.config.auth.otp.expiresIn.toMs() / 60_000)),
+            },
+        });
+    }
+}
+//# sourceMappingURL=OtpService.js.map

package/dist/auth/OtpService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OtpService.js","sourceRoot":"","sources":["../../src/auth/OtpService.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AAI1G,MAAM,CAAC,MAAM,YAAY,GAA0B,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAWzF,MAAM,QAAQ,GAA+B;IAC3C,MAAM,EAAE,6BAA6B;IACrC,KAAK,EAAE,iBAAiB;IACxB,cAAc,EAAE,qBAAqB;CACtC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,OAAO,UAAU;IAEF,MAAM;IACN,IAAI;IACJ,MAAM;IACN,MAAM;IAJzB,YACmB,MAAmB,EACnB,IAAgB,EAChB,MAAoB,EACpB,MAAc;sBAHd,MAAM;oBACN,IAAI;sBACJ,MAAM;sBACN,MAAM;IACtB,CAAC;IAEJ,IAAY,IAAI;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;IACjD,CAAC;IAEO,GAAG;QACT,OAAO,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QACjC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,QAAQ,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;YAC7D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC;YACzF,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;gBACf,MAAM,IAAI,oBAAoB,CAAC;oBAC7B,OAAO,EAAE,kEAAkE;oBAC3E,IAAI,EAAE,SAAS,CAAC,mBAAmB;oBACnC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,EAAE;oBAC5D,OAAO,EAAE,EAAE,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE;iBACzD,CAAC,CAAC;YACL,CAAC;YACD,IAAI,QAAQ,CAAC,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;gBACvC,MAAM,IAAI,oBAAoB,CAAC;oBAC7B,OAAO,EAAE,wDAAwD;oBACjE,IAAI,EAAE,SAAS,CAAC,gBAAgB;iBACjC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG;YACb,KAAK;YACL,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YACpC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC;YACrC,QAAQ,EAAE,CAAC;YACX,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;YACzB,UAAU,EAAE,IAAI;YAChB,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,IAAI;SACrB,CAAC;QAEF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE;gBACvC,GAAG,MAAM;gBACT,OAAO,EAAE,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC;gBACpC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,OAAmB,EAAE,QAAiB;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,aAAa,CAAC;gBACtB,OAAO,EAAE,2DAA2D;gBACpE,IAAI,EAAE,SAAS,CAAC,aAAa;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,6FAA6F;IAC7F,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,OAAmB,EAAE,IAAY;QAC3D,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/G,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,IAAI,EAAE,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC;QACvH,CAAC;QACD,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACvD,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,OAAO,EAAE,8CAA8C;gBACvD,IAAI,EAAE,SAAS,CAAC,qBAAqB;aACtC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC5G,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrD,MAAM,IAAI,eAAe,CAAC;gBACxB,OAAO,EAAE,wBAAwB;gBACjC,IAAI,EAAE,SAAS,CAAC,WAAW;gBAC3B,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,WAAW,GAAG,QAAQ,CAAC,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvC,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC;QAED,iEAAiE;QACjE,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE;YACrC,UAAU,EAAE,IAAI,IAAI,EAAE;YACtB,QAAQ,EAAE,MAAM,CAAC,QAAQ,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC;YAClC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE;SAC7C,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChC,CAAC;IAED,kDAAkD;IAClD,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,UAAkB;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CACpC,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,EACzD,EAAE,WAAW,EAAE,CAAC,gBAAgB,CAAC,EAAE,CACpC,CAAC;QACF,MAAM,KAAK,GACT,MAAM;YACN,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ;YACzC,MAAM,CAAC,cAAc;YACrB,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;YACtD,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAEvD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,eAAe,CAAC;gBACxB,OAAO,EAAE,wDAAwD;gBACjE,IAAI,EAAE,SAAS,CAAC,mBAAmB;aACpC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,IAAY,EAAE,KAAiB;QAC/D,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1B,iGAAiG;YACjG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,OAAO,aAAa,KAAK,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC7B,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;YAChC,QAAQ,EAAE,iBAAiB;YAC3B,YAAY,EAAE;gBACZ,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO;gBACnC,SAAS,EAAE,KAAK;gBAChB,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC;aACvF;SACF,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/auth/SessionResponder.d.ts

@@ -0,0 +1,37 @@
+import type { Response } from "express";
+import type { ForgeConfig } from "../config/ForgeConfig.js";
+import type { ResponseSanitizer } from "../core/ResponseSanitizer.js";
+import type { Doc } from "../data/Repository.js";
+import type { ResponseWriter } from "../http/ResponseWriter.js";
+import type { CookieWriter } from "./CookieWriter.js";
+import type { LoginResult } from "./LoginCompleter.js";
+import type { SessionTokens } from "./SessionService.js";
+export interface SessionResponse {
+    user: Doc;
+    tokens: SessionTokens;
+    created: boolean;
+    message: string;
+    hiddenFields?: readonly string[] | undefined;
+}
+/** Sets the session cookies and writes the "you are signed in" response. Shared by every way of signing in. */
+export declare class SessionResponder {
+    private readonly config;
+    private readonly cookies;
+    private readonly sanitizer;
+    private readonly responses;
+    constructor(config: ForgeConfig, cookies: CookieWriter, sanitizer: ResponseSanitizer, responses: ResponseWriter);
+    /** Answers the outcome of a first-factor sign-in: a session, or "a second factor is needed". */
+    sendLogin(res: Response, result: LoginResult, options: {
+        message: string;
+        hiddenFields?: readonly string[] | undefined;
+    }): void;
+    /** Cookies only (used when the browser is about to be redirected). */
+    establish(res: Response, tokens: SessionTokens): void;
+    send(res: Response, input: SessionResponse): void;
+    /** Tokens are included in the JSON body only when explicitly enabled (for mobile / non-cookie clients). */
+    tokenBody(tokens: {
+        accessToken?: string;
+        refreshToken?: string;
+    }): Record<string, unknown>;
+}
+//# sourceMappingURL=SessionResponder.d.ts.map

package/dist/auth/SessionResponder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionResponder.d.ts","sourceRoot":"","sources":["../../src/auth/SessionResponder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,GAAG,CAAC;IACV,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC9C;AAED,+GAA+G;AAC/G,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAJ5B,YACmB,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,EACrB,SAAS,EAAE,iBAAiB,EAC5B,SAAS,EAAE,cAAc,EACxC;IAEJ,gGAAgG;IAChG,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;KAAE,GAAG,IAAI,CAS9H;IAED,sEAAsE;IACtE,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CAEpD;IAED,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,CAShD;IAED,2GAA2G;IAC3G,SAAS,CAAC,MAAM,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAM1F;CACF"}

package/dist/auth/SessionResponder.js

@@ -0,0 +1,49 @@
+/** Sets the session cookies and writes the "you are signed in" response. Shared by every way of signing in. */
+export class SessionResponder {
+    config;
+    cookies;
+    sanitizer;
+    responses;
+    constructor(config, cookies, sanitizer, responses) {
+        this.config = config;
+        this.cookies = cookies;
+        this.sanitizer = sanitizer;
+        this.responses = responses;
+    }
+    /** Answers the outcome of a first-factor sign-in: a session, or "a second factor is needed". */
+    sendLogin(res, result, options) {
+        if (result.kind === "mfa-required") {
+            this.responses.success(res, {
+                message: "Enter the code from your authenticator app to finish signing in.",
+                extra: { mfaRequired: true, mfaToken: result.mfaToken },
+            });
+            return;
+        }
+        this.send(res, { user: result.user, tokens: result.tokens, created: result.created, ...options });
+    }
+    /** Cookies only (used when the browser is about to be redirected). */
+    establish(res, tokens) {
+        this.cookies.set(res, tokens);
+    }
+    send(res, input) {
+        this.establish(res, input.tokens);
+        const body = {
+            message: input.message,
+            data: this.sanitizer.one(input.user, { hiddenFields: input.hiddenFields }),
+            extra: this.tokenBody(input.tokens),
+        };
+        if (input.created)
+            this.responses.created(res, body);
+        else
+            this.responses.success(res, body);
+    }
+    /** Tokens are included in the JSON body only when explicitly enabled (for mobile / non-cookie clients). */
+    tokenBody(tokens) {
+        const { auth } = this.config;
+        return {
+            ...(auth.returnAccessToken && tokens.accessToken ? { [auth.accessTokenName]: tokens.accessToken } : {}),
+            ...(auth.returnRefreshToken && tokens.refreshToken ? { [auth.refreshTokenName]: tokens.refreshToken } : {}),
+        };
+    }
+}
+//# sourceMappingURL=SessionResponder.js.map

package/dist/auth/SessionResponder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionResponder.js","sourceRoot":"","sources":["../../src/auth/SessionResponder.ts"],"names":[],"mappings":"AAiBA,+GAA+G;AAC/G,MAAM,OAAO,gBAAgB;IAER,MAAM;IACN,OAAO;IACP,SAAS;IACT,SAAS;IAJ5B,YACmB,MAAmB,EACnB,OAAqB,EACrB,SAA4B,EAC5B,SAAyB;sBAHzB,MAAM;uBACN,OAAO;yBACP,SAAS;yBACT,SAAS;IACzB,CAAC;IAEJ,gGAAgG;IAChG,SAAS,CAAC,GAAa,EAAE,MAAmB,EAAE,OAA0E;QACtH,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC1B,OAAO,EAAE,kEAAkE;gBAC3E,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;aACxD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,sEAAsE;IACtE,SAAS,CAAC,GAAa,EAAE,MAAqB;QAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,GAAa,EAAE,KAAsB;QACxC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG;YACX,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;YAC1E,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;SACpC,CAAC;QACF,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;;YAChD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,2GAA2G;IAC3G,SAAS,CAAC,MAAuD;QAC/D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7B,OAAO;YACL,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvG,GAAG,CAAC,IAAI,CAAC,kBAAkB,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5G,CAAC;IACJ,CAAC;CACF"}

package/dist/auth/SessionService.d.ts

@@ -0,0 +1,43 @@
+import type { Request } from "express";
+import type { ForgeConfig } from "../config/ForgeConfig.js";
+import type { DataSource } from "../data/Repository.js";
+import { type TokenService } from "../security/TokenService.js";
+import type { Logger } from "../utils/Logger.js";
+export interface SessionTokens {
+    accessToken: string;
+    refreshToken: string;
+}
+export interface RefreshResult {
+    userId: string;
+    accessToken: string;
+    /** Present only when the refresh token was rotated. */
+    refreshToken?: string;
+}
+/**
+ * Server-side sessions built on refresh tokens.
+ *
+ * - Every login starts a *family* of tokens. Each refresh rotates the token:
+ *   the old one is marked as used and a new one is issued.
+ * - Presenting an already-rotated token after the grace period means it was
+ *   stolen (or replayed): the whole family is revoked.
+ * - Tokens are stored as SHA-256 hashes and compared in constant time.
+ */
+export declare class SessionService {
+    private readonly config;
+    private readonly tokens;
+    private readonly data;
+    private readonly logger;
+    constructor(config: ForgeConfig, tokens: TokenService, data: DataSource, logger: Logger);
+    private get repo();
+    start(userId: string, req?: Request): Promise<SessionTokens>;
+    refresh(rawToken: string | undefined, req?: Request): Promise<RefreshResult>;
+    /** Closes the session a refresh token belongs to. Never throws: logging out twice is fine. */
+    revoke(rawToken: string | undefined): Promise<void>;
+    /** Closes every session of a user (password change, account deletion). */
+    revokeAll(userId: string): Promise<void>;
+    private revokeFamily;
+    private get userModel();
+    private createdAt;
+    private issueRefreshToken;
+}
+//# sourceMappingURL=SessionService.d.ts.map

package/dist/auth/SessionService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionService.d.ts","sourceRoot":"","sources":["../../src/auth/SessionService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAG5D,OAAO,KAAK,EAAE,UAAU,EAAO,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEnF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJzB,YACmB,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,MAAM,EAC7B;IAEJ,OAAO,KAAK,IAAI,GAEf;IAEK,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAIjE;IAEK,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAuDjF;IAED,8FAA8F;IACxF,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAQxD;IAED,0EAA0E;IACpE,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7C;YAEa,YAAY;IAI1B,OAAO,KAAK,SAAS,GAEpB;IAED,OAAO,CAAC,SAAS;YAIH,iBAAiB;CAehC"}

package/dist/auth/SessionService.js

@@ -0,0 +1,122 @@
+import { ErrorCode, UnauthorizedError } from "../errors/index.js";
+import { REFRESH_TOKEN_MODEL } from "../data/internalModels.js";
+import { safeEqual, sha256 } from "../security/TokenService.js";
+import { newObjectId } from "../utils/ids.js";
+/**
+ * Server-side sessions built on refresh tokens.
+ *
+ * - Every login starts a *family* of tokens. Each refresh rotates the token:
+ *   the old one is marked as used and a new one is issued.
+ * - Presenting an already-rotated token after the grace period means it was
+ *   stolen (or replayed): the whole family is revoked.
+ * - Tokens are stored as SHA-256 hashes and compared in constant time.
+ */
+export class SessionService {
+    config;
+    tokens;
+    data;
+    logger;
+    constructor(config, tokens, data, logger) {
+        this.config = config;
+        this.tokens = tokens;
+        this.data = data;
+        this.logger = logger;
+    }
+    get repo() {
+        return this.data.repository(REFRESH_TOKEN_MODEL);
+    }
+    async start(userId, req) {
+        const familyId = newObjectId();
+        const refreshToken = await this.issueRefreshToken(userId, familyId, req);
+        return { accessToken: this.tokens.signAccess(userId, this.config.auth.accessTokenAge), refreshToken };
+    }
+    async refresh(rawToken, req) {
+        const claims = this.tokens.verifyRefresh(rawToken);
+        const record = await this.repo.findById(claims.jti, { withSecrets: ["tokenHash"] });
+        if (!record ||
+            typeof record.tokenHash !== "string" ||
+            !safeEqual(record.tokenHash, sha256(rawToken)) ||
+            record.familyId !== claims.fam ||
+            String(record.owner) !== claims.sub) {
+            throw new UnauthorizedError({ message: "The refresh token is not recognised.", code: ErrorCode.REFRESH_TOKEN_NOT_FOUND });
+        }
+        const now = Date.now();
+        if (record.revokedAt) {
+            throw new UnauthorizedError({ message: "This session has been closed.", code: ErrorCode.REFRESH_TOKEN_REVOKED });
+        }
+        if (record.rotatedAt) {
+            const sinceRotation = now - new Date(record.rotatedAt).getTime();
+            if (sinceRotation <= this.config.auth.refreshReuseGracePeriod.toMs()) {
+                // Two tabs refreshed at the same moment: ask the client to retry with the newest token.
+                throw new UnauthorizedError({ message: "This refresh token was just replaced.", code: ErrorCode.REFRESH_TOKEN_ROTATED });
+            }
+            await this.revokeFamily(claims.fam);
+            this.logger.warn("Refresh token reuse detected; the session family was revoked.", { userId: claims.sub });
+            throw new UnauthorizedError({
+                message: "This session is no longer valid. Please log in again.",
+                code: ErrorCode.REFRESH_TOKEN_REUSED,
+            });
+        }
+        if (new Date(record.expiresAt).getTime() <= now) {
+            throw new UnauthorizedError({ message: "The refresh token has expired.", code: ErrorCode.REFRESH_TOKEN_EXPIRED });
+        }
+        if (this.config.auth.verifyAccessUser && this.userModel && this.data.has(this.userModel)) {
+            const user = await this.data.repository(this.userModel).findById(claims.sub);
+            if (!user) {
+                await this.revokeFamily(claims.fam);
+                throw new UnauthorizedError({ message: "The account no longer exists.", code: ErrorCode.REFRESH_USER_NOT_FOUND });
+            }
+        }
+        const accessToken = this.tokens.signAccess(claims.sub, this.config.auth.accessTokenAge);
+        const age = now - this.createdAt(record);
+        const shouldRotate = this.config.auth.rotateRefreshToken && age >= this.config.auth.refreshTokenRotationInterval.toMs();
+        if (!shouldRotate) {
+            await this.repo.updateById(record._id, { lastUsedAt: new Date(now) });
+            return { userId: claims.sub, accessToken };
+        }
+        const refreshToken = await this.issueRefreshToken(claims.sub, claims.fam, req);
+        await this.repo.updateById(record._id, { rotatedAt: new Date(now), lastUsedAt: new Date(now) });
+        return { userId: claims.sub, accessToken, refreshToken };
+    }
+    /** Closes the session a refresh token belongs to. Never throws: logging out twice is fine. */
+    async revoke(rawToken) {
+        if (!rawToken)
+            return;
+        try {
+            const claims = this.tokens.verifyRefresh(rawToken);
+            await this.revokeFamily(claims.fam);
+        }
+        catch {
+            /* invalid or expired token: nothing left to revoke */
+        }
+    }
+    /** Closes every session of a user (password change, account deletion). */
+    async revokeAll(userId) {
+        await this.repo.deleteMany({ owner: userId });
+    }
+    async revokeFamily(familyId) {
+        await this.repo.updateMany({ familyId }, { revokedAt: new Date() });
+    }
+    get userModel() {
+        return this.config.auth.mongooseConfig?.model ?? this.config.collections.find((c) => c.type === "auth")?.model;
+    }
+    createdAt(record) {
+        return new Date(record.createdAt ?? Date.now()).getTime();
+    }
+    async issueRefreshToken(userId, familyId, req) {
+        const jti = newObjectId();
+        const token = this.tokens.signRefresh({ sub: userId, jti, fam: familyId }, this.config.auth.refreshTokenAge);
+        await this.repo.create({
+            _id: jti,
+            owner: userId,
+            tokenHash: sha256(token),
+            familyId,
+            expiresAt: this.config.auth.refreshTokenAge.fromNow(),
+            lastUsedAt: new Date(),
+            userAgent: req?.get("user-agent")?.slice(0, 512),
+            ip: req?.ip?.slice(0, 64),
+        });
+        return token;
+    }
+}
+//# sourceMappingURL=SessionService.js.map

package/dist/auth/SessionService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionService.js","sourceRoot":"","sources":["../../src/auth/SessionService.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAqB,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAe9C;;;;;;;;GAQG;AACH,MAAM,OAAO,cAAc;IAEN,MAAM;IACN,MAAM;IACN,IAAI;IACJ,MAAM;IAJzB,YACmB,MAAmB,EACnB,MAAoB,EACpB,IAAgB,EAChB,MAAc;sBAHd,MAAM;sBACN,MAAM;oBACN,IAAI;sBACJ,MAAM;IACtB,CAAC;IAEJ,IAAY,IAAI;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAAc,EAAE,GAAa;QACvC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC;IACxG,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAA4B,EAAE,GAAa;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAEpF,IACE,CAAC,MAAM;YACP,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YACpC,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,QAAkB,CAAC,CAAC;YACxD,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,GAAG;YAC9B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,GAAG,EACnC,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,IAAI,EAAE,SAAS,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAC5H,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,SAAS,CAAC,qBAAqB,EAAE,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,aAAa,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACjE,IAAI,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,EAAE,CAAC;gBACrE,wFAAwF;gBACxF,MAAM,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,IAAI,EAAE,SAAS,CAAC,qBAAqB,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1G,MAAM,IAAI,iBAAiB,CAAC;gBAC1B,OAAO,EAAE,uDAAuD;gBAChE,IAAI,EAAE,SAAS,CAAC,oBAAoB;aACrC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC;YAChD,MAAM,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,IAAI,EAAE,SAAS,CAAC,qBAAqB,EAAE,CAAC,CAAC;QACpH,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7E,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACpC,MAAM,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,SAAS,CAAC,sBAAsB,EAAE,CAAC,CAAC;YACpH,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,IAAI,EAAE,CAAC;QAExH,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC;QAC7C,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/E,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChG,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IAC3D,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,MAAM,CAAC,QAA4B;QACvC,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,QAAgB;QACzC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC;IACjH,CAAC;IAEO,SAAS,CAAC,MAAW;QAC3B,OAAO,IAAI,IAAI,CAAE,MAAM,CAAC,SAAuC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3F,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,QAAgB,EAAE,GAAa;QAC7E,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7G,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YACrB,GAAG,EAAE,GAAG;YACR,KAAK,EAAE,MAAM;YACb,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC;YACxB,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE;YACrD,UAAU,EAAE,IAAI,IAAI,EAAE;YACtB,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YAChD,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SAC1B,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/auth/UserProvisioner.d.ts

@@ -0,0 +1,25 @@
+import type { ForgeConfig } from "../config/ForgeConfig.js";
+import type { Doc, Repository } from "../data/Repository.js";
+import type { PasswordHasher } from "../security/PasswordHasher.js";
+export interface NewUserInput {
+    email: string;
+    /** Display name, used when the user schema has a `name` field. Defaults to the e-mail's local part. */
+    name?: string | undefined;
+    /** Additional schema fields (e.g. from `oauth.userFromProfile`). Never allowed to change the e-mail or password. */
+    extra?: Record<string, unknown> | undefined;
+}
+/**
+ * Creates accounts for people who arrive without choosing a password (OAuth, magic link).
+ *
+ * The schema still requires a password, so a random, never-disclosed one is stored: it cannot be guessed,
+ * and the user can set a real one any time through "forgot password".
+ */
+export declare class UserProvisioner {
+    private readonly config;
+    private readonly users;
+    private readonly hasher;
+    private readonly knownFields;
+    constructor(config: ForgeConfig, users: () => Repository, hasher: PasswordHasher, knownFields: ReadonlySet<string>);
+    create(input: NewUserInput): Promise<Doc>;
+}
+//# sourceMappingURL=UserProvisioner.d.ts.map

package/dist/auth/UserProvisioner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserProvisioner.d.ts","sourceRoot":"","sources":["../../src/auth/UserProvisioner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAGpE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,uGAAuG;IACvG,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oHAAoH;IACpH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;GAKG;AACH,qBAAa,eAAe;IAExB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAJ9B,YACmB,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,UAAU,EACvB,MAAM,EAAE,cAAc,EACtB,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,EAC/C;IAEE,MAAM,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,CAS9C;CACF"}

package/dist/auth/UserProvisioner.js

@@ -0,0 +1,30 @@
+import { randomToken } from "../security/TokenService.js";
+/**
+ * Creates accounts for people who arrive without choosing a password (OAuth, magic link).
+ *
+ * The schema still requires a password, so a random, never-disclosed one is stored: it cannot be guessed,
+ * and the user can set a real one any time through "forgot password".
+ */
+export class UserProvisioner {
+    config;
+    users;
+    hasher;
+    knownFields;
+    constructor(config, users, hasher, knownFields) {
+        this.config = config;
+        this.users = users;
+        this.hasher = hasher;
+        this.knownFields = knownFields;
+    }
+    async create(input) {
+        const { fields } = this.config.auth;
+        const name = input.name?.trim() || input.email.split("@")[0];
+        return this.users().create({
+            ...(this.knownFields.has("name") ? { name } : {}),
+            ...input.extra,
+            [fields.email]: input.email,
+            [fields.password]: await this.hasher.hash(randomToken(32)),
+        });
+    }
+}
+//# sourceMappingURL=UserProvisioner.js.map

package/dist/auth/UserProvisioner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserProvisioner.js","sourceRoot":"","sources":["../../src/auth/UserProvisioner.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAU1D;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IAEP,MAAM;IACN,KAAK;IACL,MAAM;IACN,WAAW;IAJ9B,YACmB,MAAmB,EACnB,KAAuB,EACvB,MAAsB,EACtB,WAAgC;sBAHhC,MAAM;qBACN,KAAK;sBACL,MAAM;2BACN,WAAW;IAC3B,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,KAAmB;QAC9B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,KAAK,CAAC,KAAK;YACd,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK;YAC3B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/auth/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./AuthModule.js";
+export * from "./AuthController.js";
+export * from "./AuthService.js";
+export * from "./SessionService.js";
+export * from "./OtpService.js";
+export * from "./CookieWriter.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,7 @@
+export * from "./AuthModule.js";
+export * from "./AuthController.js";
+export * from "./AuthService.js";
+export * from "./SessionService.js";
+export * from "./OtpService.js";
+export * from "./CookieWriter.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC"}

package/dist/config/Duration.d.ts

@@ -0,0 +1,21 @@
+export type DurationUnit = "ms" | "s" | "m" | "h" | "d" | "w" | "mo" | "y";
+/** A human-readable duration such as `"15m"`, `"1d"` or `"2w"`. */
+export type DurationType = `${number}${DurationUnit}`;
+/**
+ * Immutable time span.
+ *
+ * Replaces the 1.x lookup table, which could only express a fixed set of
+ * values and mapped `"0s"` to one second.
+ */
+export declare class Duration {
+    private readonly milliseconds;
+    private constructor();
+    static ofMs(ms: number): Duration;
+    static parse(input: DurationType | string | number | Duration): Duration;
+    toMs(): number;
+    toSeconds(): number;
+    isZero(): boolean;
+    /** The point in time this duration from `from` (default: now). */
+    fromNow(from?: number | Date): Date;
+}
+//# sourceMappingURL=Duration.d.ts.map

package/dist/config/Duration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Duration.d.ts","sourceRoot":"","sources":["../../src/config/Duration.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC;AAE3E,mEAAmE;AACnE,MAAM,MAAM,YAAY,GAAG,GAAG,MAAM,GAAG,YAAY,EAAE,CAAC;AAetD;;;;;GAKG;AACH,qBAAa,QAAQ;IACC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAAjD,OAAO,eAAsD;IAE7D,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,CAQhC;IAED,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAavE;IAED,IAAI,IAAI,MAAM,CAEb;IAED,SAAS,IAAI,MAAM,CAElB;IAED,MAAM,IAAI,OAAO,CAEhB;IAED,kEAAkE;IAClE,OAAO,CAAC,IAAI,GAAE,MAAM,GAAG,IAAiB,GAAG,IAAI,CAG9C;CACF"}

package/dist/config/Duration.js

@@ -0,0 +1,63 @@
+import { ConfigurationError, ErrorCode } from "../errors/index.js";
+const UNIT_MS = {
+    ms: 1,
+    s: 1_000,
+    m: 60_000,
+    h: 3_600_000,
+    d: 86_400_000,
+    w: 604_800_000,
+    mo: 2_592_000_000, // 30 days
+    y: 31_536_000_000, // 365 days
+};
+const PATTERN = /^(\d+(?:\.\d+)?)(ms|s|m|h|d|w|mo|y)$/;
+/**
+ * Immutable time span.
+ *
+ * Replaces the 1.x lookup table, which could only express a fixed set of
+ * values and mapped `"0s"` to one second.
+ */
+export class Duration {
+    milliseconds;
+    constructor(milliseconds) {
+        this.milliseconds = milliseconds;
+    }
+    static ofMs(ms) {
+        if (!Number.isFinite(ms) || ms < 0) {
+            throw new ConfigurationError({
+                message: `Invalid duration: ${ms}`,
+                code: ErrorCode.CONFIGURATION_ERROR,
+            });
+        }
+        return new Duration(Math.round(ms));
+    }
+    static parse(input) {
+        if (input instanceof Duration)
+            return input;
+        if (typeof input === "number")
+            return Duration.ofMs(input);
+        const match = PATTERN.exec(input.trim());
+        if (!match) {
+            throw new ConfigurationError({
+                message: `Invalid duration "${input}".`,
+                hint: 'Write durations like "30s", "15m", "1h", "7d", "2w", "1mo" or "1y".',
+            });
+        }
+        const [, amount, unit] = match;
+        return Duration.ofMs(Number(amount) * UNIT_MS[unit]);
+    }
+    toMs() {
+        return this.milliseconds;
+    }
+    toSeconds() {
+        return Math.floor(this.milliseconds / 1000);
+    }
+    isZero() {
+        return this.milliseconds === 0;
+    }
+    /** The point in time this duration from `from` (default: now). */
+    fromNow(from = Date.now()) {
+        const base = typeof from === "number" ? from : from.getTime();
+        return new Date(base + this.milliseconds);
+    }
+}
+//# sourceMappingURL=Duration.js.map