@supacloud/lite 0.31.3 → 0.32.0

package/dist/index.js

@@ -88,7 +88,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.31.3",
+  version: "0.32.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -147,16 +147,16 @@ var package_default = {
     "@electric-sql/pglite-pgmq": "0.0.8",
     "@electric-sql/pglite-pgvector": "0.0.11",
     "@electric-sql/pglite-postgis": "0.2.10",
-    "@supacloud/db": "0.18.4",
+    "@supacloud/db": "0.19.0",
     "exact-mirror": "1.2.6",
     tar: "^7.5.22",
     typebox: "1.3.37"
   },
   devDependencies: {
-    "@supacloud/app": "0.28.3",
-    "@supacloud/contracts": "0.11.5",
-    "@supacloud/compiler": "0.47.3",
-    "@supacloud/elysia": "0.33.5",
+    "@supacloud/app": "0.29.0",
+    "@supacloud/contracts": "0.12.0",
+    "@supacloud/compiler": "0.48.0",
+    "@supacloud/elysia": "0.34.0",
     "@supabase/supabase-js": "^2.117.3",
     "@types/bun": "^1.4.3",
     effect: "4.0.5",
@@ -165,13 +165,13 @@ var package_default = {
     typescript: "^7.0.2"
   },
   overrides: {
-    "@supacloud/db": "0.18.4",
-    "@supacloud/app": "0.28.3",
-    "@supacloud/compiler": "0.47.3",
-    "@supacloud/elysia": "0.33.5",
-    "@supacloud/contracts": "0.11.5",
-    "@supacloud/commands": "0.9.7",
-    "@supacloud/delivery": "0.19.4",
+    "@supacloud/db": "0.19.0",
+    "@supacloud/app": "0.29.0",
+    "@supacloud/compiler": "0.48.0",
+    "@supacloud/elysia": "0.34.0",
+    "@supacloud/contracts": "0.12.0",
+    "@supacloud/commands": "0.10.0",
+    "@supacloud/delivery": "0.20.0",
     "@graphql-tools/utils": "^12.0.4"
   },
   engines: {
@@ -373,9 +373,8 @@ class OAuthService {
     try {
       const token = await this.exchangeCode(provider, code);
       profile = await this.fetchProfile(provider, token);
-    } catch (e) {
-      const msg = encodeURIComponent(e instanceof Error ? e.message : "oauth_error");
-      return redirect(`${flow.redirect_to}#error=server_error&error_description=${msg}`);
+    } catch {
+      return redirect(`${flow.redirect_to}#error=server_error&error_description=${encodeURIComponent("OAuth provider request failed")}`);
     }
     let userId;
     try {
@@ -384,7 +383,7 @@ class OAuthService {
       if (e instanceof OAuthAccountIneligibleError) {
         return redirect(`${flow.redirect_to}#error=access_denied&error_code=${e.code}`);
       }
-      throw e;
+      return redirect(`${flow.redirect_to}#error=server_error&error_description=${encodeURIComponent("OAuth callback failed")}`);
     }
     if (flow.code_challenge) {
       const authCode = randomToken(24);
@@ -399,13 +398,13 @@ class OAuthService {
       if (e instanceof OAuthAccountIneligibleError) {
         return redirect(`${flow.redirect_to}#error=access_denied&error_code=${e.code}`);
       }
-      throw e;
+      return redirect(`${flow.redirect_to}#error=server_error&error_description=${encodeURIComponent("OAuth callback failed")}`);
     }
     const hash = `#access_token=${session.access_token}&refresh_token=${session.refresh_token}&expires_in=${session.expires_in}&token_type=bearer&provider_token=`;
     return redirect(`${flow.redirect_to}${hash}`);
   }
   async exchangePkce(authCode, verifier) {
-    const res = await this.db.query(`delete from auth.flow_state where auth_code = $1 and expires_at > now() returning *`, [authCode]);
+    const res = await this.db.query(`select * from auth.flow_state where auth_code = $1 and expires_at > now()`, [authCode]);
     const flow = res.rows[0];
     if (!flow || !flow.user_id)
       return null;
@@ -417,7 +416,11 @@ class OAuthService {
     } else if (flow.code_challenge && flow.code_challenge !== verifier) {
       return null;
     }
-    return flow.user_id;
+    const claimed = await this.db.transaction(async (query) => {
+      const consumed = await query(`delete from auth.flow_state where auth_code = $1 and expires_at > now() returning *`, [authCode]);
+      return consumed.rows[0] ?? null;
+    });
+    return claimed?.user_id ?? null;
   }
   async exchangeCode(provider, code) {
     const body = new URLSearchParams({
@@ -466,39 +469,65 @@ class OAuthService {
       return existing.rows[0].user_id;
     }
     let userId;
-    const email = profile.email?.toLowerCase() ?? null;
+    const email = profile.email?.toLowerCase().trim() ?? null;
     const verified = !!profile.email && profile.emailVerified === true;
     if (email && verified) {
-      const byEmail = await query(`select id from auth.users where email = $1`, [email]);
+      const byEmail = await query(`select id from auth.users where lower(email) = $1`, [email]);
       userId = byEmail.rows[0]?.id;
       if (userId)
         await this.assertUserEligible(query, userId);
     }
+    let createdUserId;
     if (!userId) {
       let userEmail = verified ? email : null;
       if (userEmail) {
-        const taken = await query(`select 1 from auth.users where email = $1`, [userEmail]);
+        const taken = await query(`select 1 from auth.users where lower(email) = $1`, [userEmail]);
         if (taken.rows.length > 0)
           userEmail = null;
       }
       const created = await query(`insert into auth.users (aud, role, email, email_confirmed_at, last_sign_in_at, raw_app_meta_data, raw_user_meta_data)
          values ('authenticated','authenticated',$1, $2, now(),
-                 $3::jsonb, $4::jsonb) returning id`, [
+                 $3::jsonb, $4::jsonb)
+         on conflict (email) do nothing
+         returning id`, [
         userEmail,
         userEmail ? new Date().toISOString() : null,
         JSON.stringify({ provider, providers: [provider] }),
         JSON.stringify({ sub: profile.id, email: profile.email, full_name: profile.name, ...profile.metadata })
       ]);
       const user = created.rows[0];
-      if (!user)
+      if (user) {
+        userId = user.id;
+        createdUserId = user.id;
+      } else if (userEmail) {
+        const existingEmail = await query(`select id from auth.users where lower(email) = $1 for update`, [userEmail]);
+        userId = existingEmail.rows[0]?.id;
+        if (!userId)
+          throw new Error("OAuth email conflict has no winner");
+        await this.assertUserEligible(query, userId);
+      } else {
         throw new Error("OAuth user creation returned no row");
-      userId = user.id;
+      }
     }
-    await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
-       values ($1, $2, $3, $4::jsonb)`, [userId, provider, profile.id, JSON.stringify({ sub: profile.id, email: profile.email, ...profile.metadata })]);
-    if (!userId)
-      throw new Error("OAuth identity has no user ID");
-    return userId;
+    const identityData = JSON.stringify({ sub: profile.id, email: profile.email, ...profile.metadata });
+    const linked = await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
+       values ($1, $2, $3, $4::jsonb)
+       on conflict (provider, provider_id) do nothing
+       returning user_id`, [userId, provider, profile.id, identityData]);
+    if (linked.rows[0])
+      return linked.rows[0].user_id;
+    const raced = await query(`select user_id from auth.identities where provider = $1 and provider_id = $2`, [provider, profile.id]);
+    const racedUserId = raced.rows[0]?.user_id;
+    if (!racedUserId)
+      throw new Error("OAuth identity conflict has no winner");
+    if (createdUserId && createdUserId !== racedUserId) {
+      await query(`delete from auth.users where id = $1`, [createdUserId]);
+    }
+    await this.assertUserEligible(query, racedUserId);
+    await query(`update auth.identities set last_sign_in_at = now(), identity_data = $3
+       where provider = $1 and provider_id = $2`, [provider, profile.id, identityData]);
+    await query(`update auth.users set last_sign_in_at = now() where id = $1`, [racedUserId]);
+    return racedUserId;
   }
   async assertUserEligible(query, userId) {
     const users = await query(`select deleted_at is not null as is_deleted,
@@ -1207,6 +1236,12 @@ async function verifyTotp(secretBase32, code, window = 1, atMs = Date.now()) {
 function authError(status, errorCode, msg) {
   return json(status, { code: status, error_code: errorCode, msg });
 }
+function normalizeEmailInput(value) {
+  if (typeof value !== "string")
+    return null;
+  const email = value.trim().toLowerCase();
+  return email || null;
+}
 function randomOtp(length) {
   const n = Math.max(6, Math.min(10, Math.floor(length)));
   let code = "";
@@ -1397,8 +1432,10 @@ class AuthHandler {
     } catch (e) {
       if (e instanceof OAuthAccountIneligibleError)
         return authError(400, e.code, e.message);
-      const msg = e instanceof Error ? e.message : String(e);
-      return authError(500, "unexpected_failure", msg);
+      try {
+        this.config.log?.(`[auth] request_failed code=${databaseDiagnosticCode(e)}`);
+      } catch {}
+      return authError(500, "unexpected_failure", "Unable to complete authentication request");
     }
   }
   async oauthCallbackUrl(req, url) {
@@ -1413,7 +1450,7 @@ class AuthHandler {
   }
   async signup(req) {
     const body = await req.json().catch(() => ({}));
-    if (!body.email && !body.password) {
+    if (!("email" in body) && !("password" in body)) {
       if (!this.settings.anonymousUsers) {
         return authError(422, "anonymous_provider_disabled", "Anonymous sign-ins are disabled");
       }
@@ -1425,29 +1462,34 @@ class AuthHandler {
     if (this.settings.disableSignup) {
       return authError(422, "signup_disabled", "Signups not allowed for this instance");
     }
-    if (!body.email || !body.password) {
+    const email = normalizeEmailInput(body.email);
+    if (!email || !body.password) {
       return authError(400, "validation_failed", "Signup requires a valid email and password");
     }
     if (body.password.length < this.settings.minPasswordLength) {
       return authError(422, "weak_password", `Password should be at least ${this.settings.minPasswordLength} characters.`);
     }
-    const email = body.email.toLowerCase().trim();
-    const existing = await this.db.query(`select id from auth.users where email = $1`, [email]);
-    if (existing.rows.length > 0) {
-      return authError(422, "user_already_exists", "User already registered");
-    }
     const hashed = await hashPassword(body.password);
     const autoconfirm = this.settings.autoconfirm;
-    const res = await this.db.query(`insert into auth.users
-         (aud, role, email, encrypted_password, email_confirmed_at, last_sign_in_at,
-          raw_app_meta_data, raw_user_meta_data)
-       values ('authenticated', 'authenticated', $1, $2, case when $4 then now() else null end, now(),
-               '{"provider":"email","providers":["email"]}', $3)
-       returning *`, [email, hashed, JSON.stringify(body.data ?? {}), autoconfirm]);
-    const newUser = res.rows[0];
-    await this.db.query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
-       values ($1, 'email', $2, $3)
-       on conflict (provider, provider_id) do nothing`, [newUser.id, newUser.id, JSON.stringify({ sub: newUser.id, email: newUser.email })]);
+    const newUser = await this.db.transaction(async (query) => {
+      const res = await query(`insert into auth.users
+           (aud, role, email, encrypted_password, email_confirmed_at, last_sign_in_at,
+            raw_app_meta_data, raw_user_meta_data)
+         values ('authenticated', 'authenticated', $1, $2, case when $4 then now() else null end,
+                 case when $4 then now() else null end,
+                 '{"provider":"email","providers":["email"]}', $3)
+         on conflict (email) do nothing
+         returning *`, [email, hashed, JSON.stringify(body.data ?? {}), autoconfirm]);
+      const user = res.rows[0];
+      if (!user)
+        return null;
+      await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
+         values ($1, 'email', $2, $3)
+         on conflict (provider, provider_id) do nothing`, [user.id, user.id, JSON.stringify({ sub: user.id, email: user.email })]);
+      return user;
+    });
+    if (!newUser)
+      return authError(422, "user_already_exists", "User already registered");
     await this.audit("user_signedup", { actorId: newUser.id, actorEmail: email });
     if (!autoconfirm) {
       await this.issueToken(email, "otp", false, "confirm");
@@ -1461,7 +1503,7 @@ class AuthHandler {
     if (grantType === "password") {
       const email = (body.email ?? "").toLowerCase().trim();
       const res = await this.db.query(`select *, coalesce(banned_until > now(), false) as is_banned
-         from auth.users where email = $1 and deleted_at is null`, [email]);
+         from auth.users where lower(email) = $1 and deleted_at is null`, [email]);
       const user = res.rows[0];
       if (user?.encrypted_password && user.is_banned) {
         return authError(400, "user_banned", "User is banned");
@@ -1474,7 +1516,7 @@ class AuthHandler {
         const currentResult = await query(`select *, coalesce(banned_until > now(), false) as is_banned
            from auth.users where id = $1 for update`, [user.id]);
         const current = currentResult.rows[0];
-        if (!current || current.deleted_at !== null || !current.encrypted_password || current.email !== email) {
+        if (!current || current.deleted_at !== null || !current.encrypted_password || current.email?.toLowerCase().trim() !== email) {
           return authError(400, "invalid_credentials", "Invalid login credentials");
         }
         if (current.is_banned) {
@@ -1529,7 +1571,11 @@ class AuthHandler {
     const body = await req.json().catch(() => ({}));
     const sets = [];
     const params = [];
-    if (body.email && !this.settings.autoconfirm) {
+    const requestedEmail = body.email === undefined ? undefined : normalizeEmailInput(body.email);
+    if (body.email !== undefined && !requestedEmail) {
+      return authError(400, "validation_failed", "email must not be empty");
+    }
+    if (requestedEmail && !this.settings.autoconfirm) {
       return authError(501, "email_change_confirmation_not_supported", "Email changes that require confirmation are not supported by SupaCloud Lite V1");
     }
     if (body.password) {
@@ -1543,40 +1589,48 @@ class AuthHandler {
       params.push(JSON.stringify(body.data));
       sets.push(`raw_user_meta_data = coalesce(raw_user_meta_data, '{}'::jsonb) || $${params.length}::jsonb`);
     }
-    const response = await this.db.transaction(async (query) => {
-      const currentResult = await query(`select * from auth.users where id = $1 and deleted_at is null
-           and (banned_until is null or banned_until <= now()) for update`, [user.id]);
-      const current = currentResult.rows[0];
-      if (!current)
-        return authError(401, "no_authorization", "Invalid or expired token");
-      const transactionSets = [...sets];
-      const transactionParams = [...params];
-      const upgradingAnon = (current.is_anonymous ?? false) && !!body.email;
-      if (body.email) {
-        const email = body.email.toLowerCase().trim();
-        const clash = await query(`select id from auth.users where email = $1 and id <> $2`, [email, current.id]);
-        if (clash.rows.length > 0) {
-          return authError(422, "email_exists", "A user with this email address has already been registered");
+    let response;
+    try {
+      response = await this.db.transaction(async (query) => {
+        const currentResult = await query(`select * from auth.users where id = $1 and deleted_at is null
+             and (banned_until is null or banned_until <= now()) for update`, [user.id]);
+        const current = currentResult.rows[0];
+        if (!current)
+          return authError(401, "no_authorization", "Invalid or expired token");
+        const transactionSets = [...sets];
+        const transactionParams = [...params];
+        const upgradingAnon = (current.is_anonymous ?? false) && requestedEmail !== undefined;
+        if (requestedEmail) {
+          const email = requestedEmail;
+          const clash = await query(`select id from auth.users where lower(email) = $1 and id <> $2`, [email, current.id]);
+          if (clash.rows.length > 0) {
+            return authError(422, "email_exists", "A user with this email address has already been registered");
+          }
+          transactionParams.push(email);
+          transactionSets.push(`email = $${transactionParams.length}, email_confirmed_at = now()`);
         }
-        transactionParams.push(email);
-        transactionSets.push(`email = $${transactionParams.length}, email_confirmed_at = now()`);
-      }
-      if (upgradingAnon) {
-        transactionSets.push(`is_anonymous = false`);
-        transactionSets.push(`raw_app_meta_data = coalesce(raw_app_meta_data, '{}'::jsonb) || '{"provider":"email","providers":["email"]}'::jsonb`);
-      }
-      if (transactionSets.length === 0) {
-        return json(200, await this.userJsonWithRelations(current, query));
+        if (upgradingAnon) {
+          transactionSets.push(`is_anonymous = false`);
+          transactionSets.push(`raw_app_meta_data = coalesce(raw_app_meta_data, '{}'::jsonb) || '{"provider":"email","providers":["email"]}'::jsonb`);
+        }
+        if (transactionSets.length === 0) {
+          return json(200, await this.userJsonWithRelations(current, query));
+        }
+        transactionParams.push(current.id);
+        const updatedResult = await query(`update auth.users set ${transactionSets.join(", ")}, updated_at = now() where id = $${transactionParams.length} returning *`, transactionParams);
+        const updated = updatedResult.rows[0];
+        if (!updated)
+          return authError(401, "no_authorization", "Invalid or expired token");
+        if (requestedEmail)
+          await this.ensureEmailIdentity(updated, query);
+        return json(200, await this.userJsonWithRelations(updated, query));
+      });
+    } catch (error) {
+      if (databaseDiagnosticCode(error) === "23505" && requestedEmail) {
+        return authError(422, "email_exists", "A user with this email address has already been registered");
       }
-      transactionParams.push(current.id);
-      const updatedResult = await query(`update auth.users set ${transactionSets.join(", ")}, updated_at = now() where id = $${transactionParams.length} returning *`, transactionParams);
-      const updated = updatedResult.rows[0];
-      if (!updated)
-        return authError(401, "no_authorization", "Invalid or expired token");
-      if (body.email)
-        await this.ensureEmailIdentity(updated, query);
-      return json(200, await this.userJsonWithRelations(updated, query));
-    });
+      throw error;
+    }
     return response;
   }
   async logout(req, url) {
@@ -1603,24 +1657,39 @@ class AuthHandler {
   }
   async issueToken(email, tokenType, createUser, flavor = "login") {
     const normalized = email.toLowerCase().trim();
-    let res = await this.db.query(`select * from auth.users where email = $1`, [normalized]);
-    let user = res.rows[0];
-    if (!user) {
-      if (!createUser)
-        return json(200, {});
-      if (this.settings.disableSignup)
-        return authError(422, "signup_disabled", "Signups not allowed for this instance");
-      res = await this.db.query(`insert into auth.users (aud, role, email, raw_app_meta_data, raw_user_meta_data)
-         values ('authenticated', 'authenticated', $1, '{"provider":"email","providers":["email"]}', '{}')
-         returning *`, [normalized]);
-      user = res.rows[0];
-    }
-    const code = randomOtp(this.settings.otpLength);
-    const linkToken = randomToken(24);
     const expiry = `${this.settings.otpExpirySeconds} seconds`;
-    await this.db.query(`delete from auth.one_time_tokens where email = $1 and token_type = $2`, [normalized, tokenType]);
-    await this.db.query(`insert into auth.one_time_tokens (user_id, email, token_type, token, expires_at)
-       values ($1, $2, $3, $4, now() + $7::interval), ($1, $2, $5, $6, now() + $7::interval)`, [user.id, normalized, tokenType, code, tokenType === "otp" ? "magiclink" : tokenType, linkToken, expiry]);
+    const prepared = await this.db.transaction(async (query) => {
+      let user = (await query(`select * from auth.users where lower(email) = $1 for update`, [normalized])).rows[0];
+      if (!user) {
+        if (!createUser)
+          return { kind: "unknown" };
+        if (this.settings.disableSignup)
+          return { kind: "signup_disabled" };
+        const inserted = await query(`insert into auth.users (aud, role, email, raw_app_meta_data, raw_user_meta_data)
+           values ('authenticated', 'authenticated', $1, '{"provider":"email","providers":["email"]}', '{}')
+           on conflict (email) do nothing
+           returning *`, [normalized]);
+        user = inserted.rows[0];
+        if (!user) {
+          user = (await query(`select * from auth.users where lower(email) = $1 for update`, [normalized])).rows[0];
+        }
+      }
+      if (!user)
+        return { kind: "unknown" };
+      const code = randomOtp(this.settings.otpLength);
+      const linkToken = randomToken(24);
+      const tokenTypes = tokenType === "otp" ? ["otp", "magiclink"] : [tokenType];
+      await query(`delete from auth.one_time_tokens where lower(email) = $1 and token_type = any($2::text[])`, [normalized, tokenTypes]);
+      await query(`insert into auth.one_time_tokens (user_id, email, token_type, token, expires_at)
+         values ($1, $2, $3, $4, now() + $7::interval), ($1, $2, $5, $6, now() + $7::interval)`, [user.id, normalized, tokenType, code, tokenType === "otp" ? "magiclink" : tokenType, linkToken, expiry]);
+      return { kind: "issued", user, code, linkToken };
+    });
+    if (prepared.kind === "unknown")
+      return json(200, {});
+    if (prepared.kind === "signup_disabled") {
+      return authError(422, "signup_disabled", "Signups not allowed for this instance");
+    }
+    const { user, code, linkToken } = prepared;
     const kind = tokenType === "otp" ? "magiclink" : tokenType;
     const link = `${this.config.apiUrl}/auth/v1/verify?token=${linkToken}&type=${kind}`;
     await this.config.mailer.send({
@@ -1649,9 +1718,10 @@ Or sign in with this link: ${link}`
         return authError(400, "validation_failed", "phone must be a valid E.164 number");
       return this.limit("sms", req) ?? this.issuePhoneToken(phone, body.create_user !== false, recordValue(body.data));
     }
-    if (!body.email)
+    const email = normalizeEmailInput(body.email);
+    if (!email)
       return authError(400, "validation_failed", "email or phone is required");
-    return this.limit("otp", req) ?? this.issueToken(body.email, "otp", body.create_user !== false);
+    return this.limit("otp", req) ?? this.issueToken(email, "otp", body.create_user !== false);
   }
   async issuePhoneToken(phone, createUser, metadata) {
     const sender = this.config.smsSender;
@@ -1805,9 +1875,10 @@ Or sign in with this link: ${link}`
   }
   async sendRecovery(req) {
     const body = await req.json().catch(() => ({}));
-    if (!body.email)
+    const email = normalizeEmailInput(body.email);
+    if (!email)
       return authError(400, "validation_failed", "email is required");
-    return this.issueToken(body.email, "recovery", false);
+    return this.issueToken(email, "recovery", false);
   }
   static MAX_OTP_ATTEMPTS = 5;
   async redeem(token, types, email) {
@@ -1842,15 +1913,19 @@ Or sign in with this link: ${link}`
     return claimedTokens.rows[0] ?? null;
   }
   async confirmEmailTokenUser(query, claimedToken) {
-    await query(`delete from auth.one_time_tokens where email = $1`, [claimedToken.email]);
+    await query(`delete from auth.one_time_tokens where lower(email) = lower($1)`, [claimedToken.email]);
     const users = await query(`update auth.users set email_confirmed_at = coalesce(email_confirmed_at, now()), last_sign_in_at = now()
        where id = $1 returning *`, [claimedToken.user_id]);
-    return users.rows[0] ?? null;
+    const user = users.rows[0];
+    if (!user)
+      return null;
+    await this.ensureEmailIdentity(user, query);
+    return user;
   }
   async findEmailTokenCandidate(query, redemption) {
     const candidates = await query(`select id, user_id, email from auth.one_time_tokens
        where token = $1 and token_type = any($2::text[])
-         and ($3::text is null or email = $3) and expires_at > now()
+         and ($3::text is null or lower(email) = lower($3)) and expires_at > now()
          and attempts < $4`, [redemption.token, redemption.tokenTypes, redemption.email, AuthHandler.MAX_OTP_ATTEMPTS]);
     return candidates.rows[0] ?? null;
   }
@@ -1858,8 +1933,8 @@ Or sign in with this link: ${link}`
     if (!redemption.email)
       return;
     await query(`update auth.one_time_tokens set attempts = attempts + 1
-       where email = $1 and token_type = any($2::text[]) and expires_at > now()`, [redemption.email, redemption.tokenTypes]);
-    await query(`delete from auth.one_time_tokens where email = $1 and attempts >= $2`, [redemption.email, AuthHandler.MAX_OTP_ATTEMPTS]);
+       where lower(email) = lower($1) and token_type = any($2::text[]) and expires_at > now()`, [redemption.email, redemption.tokenTypes]);
+    await query(`delete from auth.one_time_tokens where lower(email) = lower($1) and attempts >= $2`, [redemption.email, AuthHandler.MAX_OTP_ATTEMPTS]);
   }
   async verifyToken(req) {
     const body = await req.json().catch(() => ({}));
@@ -1990,14 +2065,18 @@ Or sign in with this link: ${link}`
     }
     if (path === "admin/users" && method === "POST") {
       const body = await req.json().catch(() => ({}));
-      if (!body.email)
+      const email = normalizeEmailInput(body.email);
+      if (!email)
         return authError(400, "validation_failed", "email is required");
-      const email = body.email;
       const hashed = body.password ? await hashPassword(body.password) : null;
       const created = await this.db.transaction(async (query) => {
+        const existing = await query(`select id from auth.users where lower(email) = $1 for update`, [email.toLowerCase().trim()]);
+        if (existing.rows.length > 0)
+          return null;
         const res = await query(`insert into auth.users
              (aud, role, email, encrypted_password, email_confirmed_at, raw_app_meta_data, raw_user_meta_data)
            values ('authenticated', 'authenticated', $1, $2, case when $3 then now() else null end, $4, $5)
+           on conflict (email) do nothing
            returning *`, [
           email.toLowerCase().trim(),
           hashed,
@@ -2006,9 +2085,13 @@ Or sign in with this link: ${link}`
           JSON.stringify(body.user_metadata ?? {})
         ]);
         const user = res.rows[0];
+        if (!user)
+          return null;
         await this.ensureEmailIdentity(user, query);
         return this.userJsonWithRelations(user, query);
       });
+      if (!created)
+        return authError(422, "email_exists", "A user with this email address has already been registered");
       return json(200, created);
     }
     if (idMatch && method === "GET") {
@@ -2021,8 +2104,11 @@ Or sign in with this link: ${link}`
       const body = await req.json().catch(() => ({}));
       const sets = [];
       const params = [];
-      if (typeof body.email === "string") {
-        params.push(body.email.toLowerCase().trim());
+      const requestedEmail = body.email === undefined ? undefined : normalizeEmailInput(body.email);
+      if (body.email !== undefined && !requestedEmail)
+        return authError(400, "validation_failed", "email must not be empty");
+      if (requestedEmail) {
+        params.push(requestedEmail);
         sets.push(`email = $${params.length}`);
       }
       if (typeof body.password === "string") {
@@ -2042,15 +2128,33 @@ Or sign in with this link: ${link}`
       if (sets.length === 0)
         return authError(400, "validation_failed", "nothing to update");
       params.push(idMatch[1]);
-      const updated = await this.db.transaction(async (query) => {
-        const res = await query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
-        const user = res.rows[0];
-        if (!user)
-          return null;
-        if (typeof body.email === "string")
-          await this.ensureEmailIdentity(user, query);
-        return this.userJsonWithRelations(user, query);
-      });
+      let updated;
+      let emailConflict = false;
+      try {
+        updated = await this.db.transaction(async (query) => {
+          if (requestedEmail) {
+            const clash = await query(`select id from auth.users where lower(email) = $1 and id <> $2`, [requestedEmail, idMatch[1]]);
+            if (clash.rows.length > 0) {
+              emailConflict = true;
+              return null;
+            }
+          }
+          const res = await query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
+          const user = res.rows[0];
+          if (!user)
+            return null;
+          if (requestedEmail)
+            await this.ensureEmailIdentity(user, query);
+          return this.userJsonWithRelations(user, query);
+        });
+      } catch (error) {
+        if (databaseDiagnosticCode(error) === "23505" && requestedEmail) {
+          return authError(422, "email_exists", "A user with this email address has already been registered");
+        }
+        throw error;
+      }
+      if (emailConflict)
+        return authError(422, "email_exists", "A user with this email address has already been registered");
       if (!updated)
         return authError(404, "user_not_found", "User not found");
       return json(200, updated);
@@ -2065,26 +2169,30 @@ Or sign in with this link: ${link}`
     if (body.type !== "magiclink") {
       return authError(422, "unsupported_link_type", "Only magiclink generation is supported");
     }
-    if (!body.email)
+    const email = normalizeEmailInput(body.email);
+    if (!email)
       return authError(400, "validation_failed", "email is required");
-    const email = body.email.toLowerCase().trim();
     const emailOtp = randomOtp(this.settings.otpLength);
     const hashedToken = await sha256Hex(randomToken(32));
     const expiry = `${this.settings.otpExpirySeconds} seconds`;
     const requestUrl = new URL(req.url);
     const redirectTo = resolveRedirect(requestUrl.searchParams.get("redirect_to") ?? body.redirect_to, this.config.siteUrl, this.config.uriAllowList, this.config.enforceRedirectAllowList);
     const user = await this.db.transaction(async (query) => {
-      const result = await query(`insert into auth.users
-           (aud, role, email, raw_app_meta_data, raw_user_meta_data)
-         values ('authenticated', 'authenticated', $1, '{"provider":"email","providers":["email"]}', $2::jsonb)
-         on conflict (email) do update set email = excluded.email
-         returning *`, [email, JSON.stringify(body.data ?? {})]);
-      const linkedUser = result.rows[0];
+      const existing = await query(`select * from auth.users where lower(email) = $1 for update`, [email]);
+      let linkedUser = existing.rows[0];
+      if (!linkedUser) {
+        const result = await query(`insert into auth.users
+             (aud, role, email, raw_app_meta_data, raw_user_meta_data)
+           values ('authenticated', 'authenticated', $1, '{"provider":"email","providers":["email"]}', $2::jsonb)
+           on conflict (email) do update set email = excluded.email
+           returning *`, [email, JSON.stringify(body.data ?? {})]);
+        linkedUser = result.rows[0];
+      }
       await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
          values ($1::uuid, 'email', $1::text, $2::jsonb)
          on conflict (provider, provider_id) do nothing`, [linkedUser.id, JSON.stringify({ sub: linkedUser.id, email })]);
       await query(`delete from auth.one_time_tokens
-         where email = $1 and token_type = any($2::text[])`, [email, "{otp,magiclink}"]);
+         where lower(email) = $1 and token_type = any($2::text[])`, [email, "{otp,magiclink}"]);
       await query(`insert into auth.one_time_tokens (user_id, email, token_type, token, expires_at)
          values ($1, $2, 'otp', $3, now() + $5::interval),
                 ($1, $2, 'magiclink', $4, now() + $5::interval)`, [linkedUser.id, email, emailOtp, hashedToken, expiry]);
@@ -2176,17 +2284,7 @@ Or sign in with this link: ${link}`
     if (!this.settings.totpEnrollEnabled) {
       return authError(422, "mfa_totp_enroll_disabled", "TOTP enrollment is disabled");
     }
-    const enrolled = await this.db.query(`select count(*)::int as n from auth.mfa_factors where user_id = $1`, [user.id]);
-    if (enrolled.rows[0].n >= this.settings.maxEnrolledFactors) {
-      return authError(422, "too_many_enrolled_mfa_factors", "Maximum number of enrolled MFA factors reached");
-    }
     const friendlyName = body.friendly_name ?? null;
-    if (friendlyName) {
-      const dup = await this.db.query(`select 1 from auth.mfa_factors where user_id = $1 and friendly_name = $2`, [user.id, friendlyName]);
-      if (dup.rows.length > 0) {
-        return authError(422, "mfa_factor_name_conflict", "A factor with this friendly name already exists");
-      }
-    }
     const secret = generateTotpSecret();
     let issuer = body.issuer;
     if (!issuer) {
@@ -2196,16 +2294,33 @@ Or sign in with this link: ${link}`
         issuer = "supacloud-lite";
       }
     }
-    const uri = otpauthUri({ secret, account: user.email || user.id, issuer });
-    const ins = await this.db.query(`insert into auth.mfa_factors (user_id, friendly_name, factor_type, status, secret)
-       values ($1, $2, 'totp', 'unverified', $3) returning id`, [user.id, friendlyName, secret]);
-    const id = ins.rows[0].id;
-    return json(200, {
-      id,
-      type: "totp",
-      friendly_name: friendlyName,
-      status: "unverified",
-      totp: { qr_code: qrSvgDataUri(uri), secret, uri }
+    return this.db.transaction(async (query) => {
+      const currentResult = await query(`select * from auth.users where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [user.id]);
+      const current = currentResult.rows[0];
+      if (!current)
+        return authError(401, "no_authorization", "Invalid or expired token");
+      const uri = otpauthUri({ secret, account: current.email || current.id, issuer });
+      const enrolled = await query(`select count(*)::int as n from auth.mfa_factors where user_id = $1`, [current.id]);
+      if (enrolled.rows[0].n >= this.settings.maxEnrolledFactors) {
+        return authError(422, "too_many_enrolled_mfa_factors", "Maximum number of enrolled MFA factors reached");
+      }
+      if (friendlyName) {
+        const dup = await query(`select 1 from auth.mfa_factors where user_id = $1 and friendly_name = $2`, [current.id, friendlyName]);
+        if (dup.rows.length > 0) {
+          return authError(422, "mfa_factor_name_conflict", "A factor with this friendly name already exists");
+        }
+      }
+      const ins = await query(`insert into auth.mfa_factors (user_id, friendly_name, factor_type, status, secret)
+         values ($1, $2, 'totp', 'unverified', $3) returning id`, [current.id, friendlyName, secret]);
+      const id = ins.rows[0].id;
+      return json(200, {
+        id,
+        type: "totp",
+        friendly_name: friendlyName,
+        status: "unverified",
+        totp: { qr_code: qrSvgDataUri(uri), secret, uri }
+      });
     });
   }
   async challengeFactor(req, factorId) {
@@ -2215,16 +2330,22 @@ Or sign in with this link: ${link}`
     if (!this.settings.totpVerifyEnabled) {
       return authError(422, "mfa_totp_verify_disabled", "TOTP verification is disabled");
     }
-    const fr = await this.db.query(`select id from auth.mfa_factors where id = $1 and user_id = $2`, [factorId, user.id]);
-    if (fr.rows.length === 0)
-      return authError(404, "mfa_factor_not_found", "MFA factor not found");
     const expiresAt = new Date(Date.now() + 300000).toISOString();
-    const ins = await this.db.query(`insert into auth.mfa_challenges (factor_id, expires_at) values ($1, $2) returning id, expires_at`, [factorId, expiresAt]);
-    const c = ins.rows[0];
-    return json(200, {
-      id: c.id,
-      type: "totp",
-      expires_at: Math.floor(new Date(c.expires_at).getTime() / 1000)
+    return this.db.transaction(async (query) => {
+      const currentResult = await query(`select * from auth.users where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [user.id]);
+      if (!currentResult.rows[0])
+        return authError(401, "no_authorization", "Invalid or expired token");
+      const fr = await query(`select id from auth.mfa_factors where id = $1 and user_id = $2`, [factorId, user.id]);
+      if (fr.rows.length === 0)
+        return authError(404, "mfa_factor_not_found", "MFA factor not found");
+      const ins = await query(`insert into auth.mfa_challenges (factor_id, expires_at) values ($1, $2) returning id, expires_at`, [factorId, expiresAt]);
+      const c = ins.rows[0];
+      return json(200, {
+        id: c.id,
+        type: "totp",
+        expires_at: Math.floor(new Date(c.expires_at).getTime() / 1000)
+      });
     });
   }
   async verifyFactor(req, factorId) {
@@ -2258,12 +2379,17 @@ Or sign in with this link: ${link}`
       const currentUser = currentUsers.rows[0];
       if (!currentUser)
         return null;
+      const currentFactors = await query(`select id, secret, status from auth.mfa_factors
+         where id = $1 and user_id = $2 for update`, [factorId, user.id]);
+      const currentFactor = currentFactors.rows[0];
+      if (!currentFactor || !await verifyTotp(currentFactor.secret, body.code ?? ""))
+        return null;
       const claimed = await query(`update auth.mfa_challenges set verified_at = now()
          where id = $1 and factor_id = $2 and verified_at is null and expires_at >= now()
          returning id`, [challenge.id, factorId]);
       if (claimed.rows.length === 0)
         return null;
-      if (factor.status !== "verified") {
+      if (currentFactor.status !== "verified") {
         await query(`update auth.mfa_factors set status = 'verified', updated_at = now() where id = $1`, [factorId]);
       }
       return this.sessionFor(currentUser, undefined, {
@@ -2283,10 +2409,16 @@ Or sign in with this link: ${link}`
     const user = await this.userFromBearer(req);
     if (!user)
       return authError(401, "no_authorization", "This endpoint requires a Bearer token");
-    const del = await this.db.query(`delete from auth.mfa_factors where id = $1 and user_id = $2 returning id`, [factorId, user.id]);
-    if (del.rows.length === 0)
-      return authError(404, "mfa_factor_not_found", "MFA factor not found");
-    return json(200, { id: factorId });
+    return this.db.transaction(async (query) => {
+      const currentResult = await query(`select * from auth.users where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [user.id]);
+      if (!currentResult.rows[0])
+        return authError(401, "no_authorization", "Invalid or expired token");
+      const del = await query(`delete from auth.mfa_factors where id = $1 and user_id = $2 returning id`, [factorId, user.id]);
+      if (del.rows.length === 0)
+        return authError(404, "mfa_factor_not_found", "MFA factor not found");
+      return json(200, { id: factorId });
+    });
   }
   async getUserFactors(userId, query = (sql, params) => this.db.query(sql, params)) {
     const res = await query(`select id, friendly_name, factor_type, status, created_at, updated_at