@syncello/auth 3.1.0 → 3.2.0

package/dist/index.cjs

@@ -32,6 +32,7 @@ var src_exports = {};
 __export(src_exports, {
   AUTH_DEFAULTS: () => AUTH_DEFAULTS,
   CHALLENGE_TTL_MS: () => CHALLENGE_TTL_MS,
+  CloudflareEmailAdapter: () => CloudflareEmailAdapter,
   EmailService: () => EmailService,
   MAX_CHALLENGE_ATTEMPTS: () => MAX_CHALLENGE_ATTEMPTS,
   ProblemTypes: () => ProblemTypes,
@@ -2572,13 +2573,92 @@ var ResendAdapter = class {
   }
 };
 
+// src/lib/email/adapters/cloudflare-adapter.ts
+var CloudflareEmailAdapter = class {
+  constructor(binding, options) {
+    this.binding = binding;
+    this.options = options;
+  }
+  binding;
+  options;
+  providerName = "cloudflare";
+  async send(options) {
+    if (this.options.dryRun) {
+      logger_default.info("Cloudflare: Dry-run, email not sent", {
+        provider: this.providerName,
+        to: options.to,
+        from: options.from,
+        subject: options.subject
+      });
+      return { success: true, emailId: "dry-run" };
+    }
+    try {
+      logger_default.info("Cloudflare: Sending email", {
+        provider: this.providerName,
+        to: options.to,
+        subject: options.subject
+      });
+      const result = await this.binding.send({
+        to: options.to,
+        from: options.from,
+        subject: options.subject,
+        html: options.html,
+        text: options.text,
+        headers: options.tags ? Object.fromEntries(
+          Object.entries(options.tags).map(([name, value]) => [`X-Tag-${name}`, value])
+        ) : void 0
+      });
+      logger_default.info("Cloudflare: Email sent successfully", {
+        provider: this.providerName,
+        emailId: result.messageId,
+        to: options.to
+      });
+      return { success: true, emailId: result.messageId };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      const code = error instanceof Error && "code" in error && typeof error.code === "string" ? error.code : void 0;
+      const errorText = code ? `${code}: ${message}` : message;
+      if (code === "E_RECIPIENT_SUPPRESSED") {
+        logger_default.warn("Cloudflare: Recipient is on the suppression list", {
+          provider: this.providerName,
+          to: options.to
+        });
+      } else {
+        logger_default.error("Cloudflare send error", {
+          provider: this.providerName,
+          error: errorText,
+          to: options.to,
+          subject: options.subject
+        });
+      }
+      return { success: false, error: errorText };
+    }
+  }
+};
+
 // src/lib/email/adapters/factory.ts
 function createEmailAdapter(env) {
-  logger_default.info("Creating email adapter", { provider: "resend" });
-  if (!env.RESEND_API_KEY) {
-    throw new Error("RESEND_API_KEY is required");
+  const provider = env.EMAIL_PROVIDER ?? "resend";
+  logger_default.info("Creating email adapter", { provider });
+  switch (provider) {
+    case "resend":
+      if (!env.RESEND_API_KEY) {
+        throw new Error("RESEND_API_KEY is required");
+      }
+      return new ResendAdapter(env.RESEND_API_KEY);
+    case "cloudflare": {
+      if (!env.EMAIL) {
+        throw new Error(
+          'EMAIL send_email binding is required when EMAIL_PROVIDER=cloudflare - add [[send_email]] name = "EMAIL" to wrangler.toml'
+        );
+      }
+      const environment = env.ENVIRONMENT?.toLowerCase();
+      const dryRun = environment !== "production" && environment !== "staging";
+      return new CloudflareEmailAdapter(env.EMAIL, { dryRun });
+    }
+    default:
+      throw new Error(`Unknown EMAIL_PROVIDER: ${String(provider)}`);
   }
-  return new ResendAdapter(env.RESEND_API_KEY);
 }
 
 // src/lib/email/email-service.ts
@@ -2586,6 +2666,9 @@ var EmailService = class {
   adapter;
   env;
   get fromAddress() {
+    if (this.env.EMAIL_FROM) {
+      return this.env.EMAIL_FROM;
+    }
     const appName = this.env.APP_NAME ?? "Your App";
     const appUrl = this.env.APP_URL ?? "";
     let domain = "example.com";
@@ -3442,7 +3525,8 @@ var signupHandler = async (c) => {
       verificationUrl,
       firstName: newUser.name || void 0
     },
-    database
+    database,
+    schema.users
   );
   const fingerprint = await generateFingerprint(c.req.raw);
   const ipAddress = getClientIp(c.req.raw);
@@ -3916,7 +4000,7 @@ var forgotPasswordRoute = (0, import_zod_openapi7.createRoute)({
 });
 var forgotPasswordHandler = async (c) => {
   const { email, turnstileToken } = c.req.valid("json");
-  const database = c.get("db");
+  const { db: database, schema } = getAuthContext(c);
   const env = c.env;
   const turnstileValid = await verifyTurnstileToken(
     turnstileToken,
@@ -3927,7 +4011,11 @@ var forgotPasswordHandler = async (c) => {
   if (!turnstileValid) {
     return problems.badRequest(c, "Invalid captcha");
   }
-  const resetResult = await createPasswordResetToken(database, email);
+  const resetResult = await createPasswordResetToken(
+    database,
+    { users: schema.users, passwordResetTokens: schema.passwordResetTokens },
+    email
+  );
   if (!resetResult) {
     return c.json({ success: true });
   }
@@ -3939,7 +4027,8 @@ var forgotPasswordHandler = async (c) => {
       token: resetResult.token,
       resetUrl
     },
-    database
+    database,
+    schema.users
   );
   logSecurityEvent("password_reset_requested", "medium", { userId: resetResult.userId });
   return c.json({ success: true });
@@ -4081,7 +4170,7 @@ var changePasswordHandler = async (c) => {
   const userId = c.get("userId");
   if (!userId) return problems.unauthorized(c, "Not authenticated");
   const { currentPassword, newPassword } = c.req.valid("json");
-  const database = c.get("db");
+  const { db: database, schema } = getAuthContext(c);
   const env = c.env;
   const passwordValidation = validatePassword(newPassword);
   if (!passwordValidation.valid) {
@@ -4098,7 +4187,8 @@ var changePasswordHandler = async (c) => {
     newPassword,
     currentSessionId,
     pepper: env.PASSWORD_PEPPER_V1,
-    db: database
+    db: database,
+    tables: { users: schema.users, sessions: schema.sessions }
   });
   if (!result.success) {
     return problems.badRequest(c, result.error || "Failed to change password");
@@ -4177,7 +4267,7 @@ var changeEmailHandler = async (c) => {
   const userId = c.get("userId");
   if (!userId) return problems.unauthorized(c, "Not authenticated");
   const { password, newEmail } = c.req.valid("json");
-  const database = c.get("db");
+  const { db: database, schema } = getAuthContext(c);
   const env = c.env;
   const appUrl = env.APP_URL || "http://localhost:5173";
   const result = await requestEmailChange({
@@ -4185,7 +4275,8 @@ var changeEmailHandler = async (c) => {
     password,
     newEmail,
     pepper: env.PASSWORD_PEPPER_V1,
-    db: database
+    db: database,
+    tables: { users: schema.users, emailChangeTokens: schema.emailChangeTokens }
   });
   if (!result.success) {
     if (result.error === "Incorrect password") {
@@ -4197,7 +4288,8 @@ var changeEmailHandler = async (c) => {
   const confirmUrl = `${appUrl}/confirm-email-change?token=${result.confirmToken}`;
   const confirmResult = await emailService.sendEmailChangeConfirmation(
     { newEmail, confirmUrl },
-    database
+    database,
+    schema.users
   );
   if (!confirmResult.success) {
     return problems.badRequest(
@@ -4208,7 +4300,8 @@ var changeEmailHandler = async (c) => {
   const cancelUrl = `${appUrl}/cancel-email-change?token=${result.cancelToken}`;
   await emailService.sendEmailChangeNotification(
     { oldEmail: result.oldEmail, newEmail, cancelUrl },
-    database
+    database,
+    schema.users
   );
   logSecurityEvent("email_change_requested", "medium", { userId });
   return c.json({ success: true });
@@ -4249,8 +4342,12 @@ var confirmEmailChangeRoute = (0, import_zod_openapi13.createRoute)({
 });
 var confirmEmailChangeHandler = async (c) => {
   const { token } = c.req.valid("json");
-  const database = c.get("db");
-  const result = await confirmEmailChange({ token, db: database });
+  const { db: database, schema } = getAuthContext(c);
+  const result = await confirmEmailChange({
+    token,
+    db: database,
+    tables: { users: schema.users, emailChangeTokens: schema.emailChangeTokens }
+  });
   if (!result.success) {
     return problems.badRequest(c, result.error || "Invalid or expired token");
   }
@@ -4291,8 +4388,12 @@ var cancelEmailChangeRoute = (0, import_zod_openapi15.createRoute)({
 });
 var cancelEmailChangeHandler = async (c) => {
   const { token } = c.req.valid("json");
-  const database = c.get("db");
-  const result = await cancelEmailChange({ token, db: database });
+  const { db: database, schema } = getAuthContext(c);
+  const result = await cancelEmailChange({
+    token,
+    db: database,
+    tables: { emailChangeTokens: schema.emailChangeTokens }
+  });
   if (!result.success) {
     return problems.badRequest(c, result.error || "Invalid or expired token");
   }
@@ -4431,7 +4532,7 @@ var refreshHandler = async (c) => {
   if (!session) {
     return problems.unauthorized(c, "Invalid or expired refresh token");
   }
-  await deleteSession(db, session.id);
+  await deleteSession(db, { sessions: schema.sessions }, session.id);
   const newSessionId = await createSession(
     db,
     { sessions: schema.sessions },
@@ -4522,7 +4623,8 @@ var resendVerificationHandler = async (c) => {
       verificationUrl,
       firstName: user.name || void 0
     },
-    db
+    db,
+    schema.users
   );
   logger_default.info("Verification email resent", { userId: user.id, email: user.email });
   return c.json({
@@ -4848,7 +4950,8 @@ var totpVerifyHandler = async (c) => {
     const firstName = user.name?.split(" ")[0] || null;
     await emailService.send2faEnabledEmail(
       { email: user.email, firstName, method: "totp" },
-      db
+      db,
+      schema.users
     );
   }
   logSecurityEvent("2fa_totp_enrolled", "high", { userId });
@@ -4905,12 +5008,12 @@ var totpDisableHandler = async (c) => {
   if (remaining.length === 0) {
     await db.delete(schema.userBackupCodes).where((0, import_drizzle_orm23.eq)(schema.userBackupCodes.userId, userId));
     await db.delete(schema.userTrustedDevices).where((0, import_drizzle_orm23.eq)(schema.userTrustedDevices.userId, userId));
-    await invalidateAllUserSessions(db, userId);
+    await invalidateAllUserSessions(db, { sessions: schema.sessions, users: schema.users }, userId);
     const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where((0, import_drizzle_orm23.eq)(schema.users.id, userId)).limit(1);
     if (user) {
       const emailService = new EmailService(env);
       const firstName = user.name?.split(" ")[0] || null;
-      await emailService.send2faDisabledEmail({ email: user.email, firstName }, db);
+      await emailService.send2faDisabledEmail({ email: user.email, firstName }, db, schema.users);
     }
     logSecurityEvent("2fa_disabled", "critical", { userId, lastMethod: "totp" });
     return c.json({ success: true, sessionInvalidated: true });
@@ -4966,7 +5069,7 @@ var emailSetupHandler = async (c) => {
   await env.OAUTH_STATES.put(`email_2fa_setup:${userId}`, codeHash, { expirationTtl: 300 });
   const emailService = new EmailService(env);
   const firstName = user.name?.split(" ")[0] || null;
-  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db);
+  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db, schema.users);
   logSecurityEvent("2fa_email_setup_initiated", "low", { userId });
   return c.json({ success: true });
 };
@@ -5047,7 +5150,8 @@ var emailVerifyHandler = async (c) => {
     const firstName = user.name?.split(" ")[0] || null;
     await emailService.send2faEnabledEmail(
       { email: user.email, firstName, method: "email" },
-      db
+      db,
+      schema.users
     );
   }
   logSecurityEvent("2fa_email_enrolled", "high", { userId });
@@ -5101,7 +5205,8 @@ var emailSendCodeHandler = async (c) => {
   const firstName = user.name?.split(" ")[0] || null;
   const emailResult = await emailService.send2faCodeEmail(
     { email: user.email, firstName, code },
-    db
+    db,
+    schema.users
   );
   if (!emailResult.success) {
     return problems.badRequest(
@@ -5163,12 +5268,12 @@ var emailDisableHandler = async (c) => {
   if (remaining.length === 0) {
     await db.delete(schema.userBackupCodes).where((0, import_drizzle_orm27.eq)(schema.userBackupCodes.userId, userId));
     await db.delete(schema.userTrustedDevices).where((0, import_drizzle_orm27.eq)(schema.userTrustedDevices.userId, userId));
-    await invalidateAllUserSessions(db, userId);
+    await invalidateAllUserSessions(db, { sessions: schema.sessions, users: schema.users }, userId);
     const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where((0, import_drizzle_orm27.eq)(schema.users.id, userId)).limit(1);
     if (user) {
       const emailService = new EmailService(env);
       const firstName = user.name?.split(" ")[0] || null;
-      await emailService.send2faDisabledEmail({ email: user.email, firstName }, db);
+      await emailService.send2faDisabledEmail({ email: user.email, firstName }, db, schema.users);
     }
     logSecurityEvent("2fa_disabled", "critical", { userId, lastMethod: "email" });
     return c.json({ success: true, sessionInvalidated: true });
@@ -5489,7 +5594,7 @@ var challengeResendHandler = async (c) => {
   });
   const emailService = new EmailService(c.env);
   const firstName = user.name?.split(" ")[0] || null;
-  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db);
+  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db, schema.users);
   logger_default.info("Email 2FA code resent", { userId: payload.userId });
   return c.json({ success: true });
 };
@@ -6013,6 +6118,7 @@ function verifyWebhookSignature(payload, signature, secret) {
 0 && (module.exports = {
   AUTH_DEFAULTS,
   CHALLENGE_TTL_MS,
+  CloudflareEmailAdapter,
   EmailService,
   MAX_CHALLENGE_ATTEMPTS,
   ProblemTypes,