@syncello/auth 3.1.0 → 3.2.0

package/dist/index.js

@@ -2181,13 +2181,92 @@ var ResendAdapter = class {
   }
 };
 
+// src/lib/email/adapters/cloudflare-adapter.ts
+var CloudflareEmailAdapter = class {
+  constructor(binding, options) {
+    this.binding = binding;
+    this.options = options;
+  }
+  binding;
+  options;
+  providerName = "cloudflare";
+  async send(options) {
+    if (this.options.dryRun) {
+      logger_default.info("Cloudflare: Dry-run, email not sent", {
+        provider: this.providerName,
+        to: options.to,
+        from: options.from,
+        subject: options.subject
+      });
+      return { success: true, emailId: "dry-run" };
+    }
+    try {
+      logger_default.info("Cloudflare: Sending email", {
+        provider: this.providerName,
+        to: options.to,
+        subject: options.subject
+      });
+      const result = await this.binding.send({
+        to: options.to,
+        from: options.from,
+        subject: options.subject,
+        html: options.html,
+        text: options.text,
+        headers: options.tags ? Object.fromEntries(
+          Object.entries(options.tags).map(([name, value]) => [`X-Tag-${name}`, value])
+        ) : void 0
+      });
+      logger_default.info("Cloudflare: Email sent successfully", {
+        provider: this.providerName,
+        emailId: result.messageId,
+        to: options.to
+      });
+      return { success: true, emailId: result.messageId };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      const code = error instanceof Error && "code" in error && typeof error.code === "string" ? error.code : void 0;
+      const errorText = code ? `${code}: ${message}` : message;
+      if (code === "E_RECIPIENT_SUPPRESSED") {
+        logger_default.warn("Cloudflare: Recipient is on the suppression list", {
+          provider: this.providerName,
+          to: options.to
+        });
+      } else {
+        logger_default.error("Cloudflare send error", {
+          provider: this.providerName,
+          error: errorText,
+          to: options.to,
+          subject: options.subject
+        });
+      }
+      return { success: false, error: errorText };
+    }
+  }
+};
+
 // src/lib/email/adapters/factory.ts
 function createEmailAdapter(env) {
-  logger_default.info("Creating email adapter", { provider: "resend" });
-  if (!env.RESEND_API_KEY) {
-    throw new Error("RESEND_API_KEY is required");
+  const provider = env.EMAIL_PROVIDER ?? "resend";
+  logger_default.info("Creating email adapter", { provider });
+  switch (provider) {
+    case "resend":
+      if (!env.RESEND_API_KEY) {
+        throw new Error("RESEND_API_KEY is required");
+      }
+      return new ResendAdapter(env.RESEND_API_KEY);
+    case "cloudflare": {
+      if (!env.EMAIL) {
+        throw new Error(
+          'EMAIL send_email binding is required when EMAIL_PROVIDER=cloudflare - add [[send_email]] name = "EMAIL" to wrangler.toml'
+        );
+      }
+      const environment = env.ENVIRONMENT?.toLowerCase();
+      const dryRun = environment !== "production" && environment !== "staging";
+      return new CloudflareEmailAdapter(env.EMAIL, { dryRun });
+    }
+    default:
+      throw new Error(`Unknown EMAIL_PROVIDER: ${String(provider)}`);
   }
-  return new ResendAdapter(env.RESEND_API_KEY);
 }
 
 // src/lib/email/email-service.ts
@@ -2195,6 +2274,9 @@ var EmailService = class {
   adapter;
   env;
   get fromAddress() {
+    if (this.env.EMAIL_FROM) {
+      return this.env.EMAIL_FROM;
+    }
     const appName = this.env.APP_NAME ?? "Your App";
     const appUrl = this.env.APP_URL ?? "";
     let domain = "example.com";
@@ -3051,7 +3133,8 @@ var signupHandler = async (c) => {
       verificationUrl,
       firstName: newUser.name || void 0
     },
-    database
+    database,
+    schema.users
   );
   const fingerprint = await generateFingerprint(c.req.raw);
   const ipAddress = getClientIp(c.req.raw);
@@ -3525,7 +3608,7 @@ var forgotPasswordRoute = createRoute6({
 });
 var forgotPasswordHandler = async (c) => {
   const { email, turnstileToken } = c.req.valid("json");
-  const database = c.get("db");
+  const { db: database, schema } = getAuthContext(c);
   const env = c.env;
   const turnstileValid = await verifyTurnstileToken(
     turnstileToken,
@@ -3536,7 +3619,11 @@ var forgotPasswordHandler = async (c) => {
   if (!turnstileValid) {
     return problems.badRequest(c, "Invalid captcha");
   }
-  const resetResult = await createPasswordResetToken(database, email);
+  const resetResult = await createPasswordResetToken(
+    database,
+    { users: schema.users, passwordResetTokens: schema.passwordResetTokens },
+    email
+  );
   if (!resetResult) {
     return c.json({ success: true });
   }
@@ -3548,7 +3635,8 @@ var forgotPasswordHandler = async (c) => {
       token: resetResult.token,
       resetUrl
     },
-    database
+    database,
+    schema.users
   );
   logSecurityEvent("password_reset_requested", "medium", { userId: resetResult.userId });
   return c.json({ success: true });
@@ -3690,7 +3778,7 @@ var changePasswordHandler = async (c) => {
   const userId = c.get("userId");
   if (!userId) return problems.unauthorized(c, "Not authenticated");
   const { currentPassword, newPassword } = c.req.valid("json");
-  const database = c.get("db");
+  const { db: database, schema } = getAuthContext(c);
   const env = c.env;
   const passwordValidation = validatePassword(newPassword);
   if (!passwordValidation.valid) {
@@ -3707,7 +3795,8 @@ var changePasswordHandler = async (c) => {
     newPassword,
     currentSessionId,
     pepper: env.PASSWORD_PEPPER_V1,
-    db: database
+    db: database,
+    tables: { users: schema.users, sessions: schema.sessions }
   });
   if (!result.success) {
     return problems.badRequest(c, result.error || "Failed to change password");
@@ -3786,7 +3875,7 @@ var changeEmailHandler = async (c) => {
   const userId = c.get("userId");
   if (!userId) return problems.unauthorized(c, "Not authenticated");
   const { password, newEmail } = c.req.valid("json");
-  const database = c.get("db");
+  const { db: database, schema } = getAuthContext(c);
   const env = c.env;
   const appUrl = env.APP_URL || "http://localhost:5173";
   const result = await requestEmailChange({
@@ -3794,7 +3883,8 @@ var changeEmailHandler = async (c) => {
     password,
     newEmail,
     pepper: env.PASSWORD_PEPPER_V1,
-    db: database
+    db: database,
+    tables: { users: schema.users, emailChangeTokens: schema.emailChangeTokens }
   });
   if (!result.success) {
     if (result.error === "Incorrect password") {
@@ -3806,7 +3896,8 @@ var changeEmailHandler = async (c) => {
   const confirmUrl = `${appUrl}/confirm-email-change?token=${result.confirmToken}`;
   const confirmResult = await emailService.sendEmailChangeConfirmation(
     { newEmail, confirmUrl },
-    database
+    database,
+    schema.users
   );
   if (!confirmResult.success) {
     return problems.badRequest(
@@ -3817,7 +3908,8 @@ var changeEmailHandler = async (c) => {
   const cancelUrl = `${appUrl}/cancel-email-change?token=${result.cancelToken}`;
   await emailService.sendEmailChangeNotification(
     { oldEmail: result.oldEmail, newEmail, cancelUrl },
-    database
+    database,
+    schema.users
   );
   logSecurityEvent("email_change_requested", "medium", { userId });
   return c.json({ success: true });
@@ -3858,8 +3950,12 @@ var confirmEmailChangeRoute = createRoute11({
 });
 var confirmEmailChangeHandler = async (c) => {
   const { token } = c.req.valid("json");
-  const database = c.get("db");
-  const result = await confirmEmailChange({ token, db: database });
+  const { db: database, schema } = getAuthContext(c);
+  const result = await confirmEmailChange({
+    token,
+    db: database,
+    tables: { users: schema.users, emailChangeTokens: schema.emailChangeTokens }
+  });
   if (!result.success) {
     return problems.badRequest(c, result.error || "Invalid or expired token");
   }
@@ -3900,8 +3996,12 @@ var cancelEmailChangeRoute = createRoute12({
 });
 var cancelEmailChangeHandler = async (c) => {
   const { token } = c.req.valid("json");
-  const database = c.get("db");
-  const result = await cancelEmailChange({ token, db: database });
+  const { db: database, schema } = getAuthContext(c);
+  const result = await cancelEmailChange({
+    token,
+    db: database,
+    tables: { emailChangeTokens: schema.emailChangeTokens }
+  });
   if (!result.success) {
     return problems.badRequest(c, result.error || "Invalid or expired token");
   }
@@ -4040,7 +4140,7 @@ var refreshHandler = async (c) => {
   if (!session) {
     return problems.unauthorized(c, "Invalid or expired refresh token");
   }
-  await deleteSession(db, session.id);
+  await deleteSession(db, { sessions: schema.sessions }, session.id);
   const newSessionId = await createSession(
     db,
     { sessions: schema.sessions },
@@ -4131,7 +4231,8 @@ var resendVerificationHandler = async (c) => {
       verificationUrl,
       firstName: user.name || void 0
     },
-    db
+    db,
+    schema.users
   );
   logger_default.info("Verification email resent", { userId: user.id, email: user.email });
   return c.json({
@@ -4457,7 +4558,8 @@ var totpVerifyHandler = async (c) => {
     const firstName = user.name?.split(" ")[0] || null;
     await emailService.send2faEnabledEmail(
       { email: user.email, firstName, method: "totp" },
-      db
+      db,
+      schema.users
     );
   }
   logSecurityEvent("2fa_totp_enrolled", "high", { userId });
@@ -4514,12 +4616,12 @@ var totpDisableHandler = async (c) => {
   if (remaining.length === 0) {
     await db.delete(schema.userBackupCodes).where(eq22(schema.userBackupCodes.userId, userId));
     await db.delete(schema.userTrustedDevices).where(eq22(schema.userTrustedDevices.userId, userId));
-    await invalidateAllUserSessions(db, userId);
+    await invalidateAllUserSessions(db, { sessions: schema.sessions, users: schema.users }, userId);
     const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where(eq22(schema.users.id, userId)).limit(1);
     if (user) {
       const emailService = new EmailService(env);
       const firstName = user.name?.split(" ")[0] || null;
-      await emailService.send2faDisabledEmail({ email: user.email, firstName }, db);
+      await emailService.send2faDisabledEmail({ email: user.email, firstName }, db, schema.users);
     }
     logSecurityEvent("2fa_disabled", "critical", { userId, lastMethod: "totp" });
     return c.json({ success: true, sessionInvalidated: true });
@@ -4575,7 +4677,7 @@ var emailSetupHandler = async (c) => {
   await env.OAUTH_STATES.put(`email_2fa_setup:${userId}`, codeHash, { expirationTtl: 300 });
   const emailService = new EmailService(env);
   const firstName = user.name?.split(" ")[0] || null;
-  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db);
+  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db, schema.users);
   logSecurityEvent("2fa_email_setup_initiated", "low", { userId });
   return c.json({ success: true });
 };
@@ -4656,7 +4758,8 @@ var emailVerifyHandler = async (c) => {
     const firstName = user.name?.split(" ")[0] || null;
     await emailService.send2faEnabledEmail(
       { email: user.email, firstName, method: "email" },
-      db
+      db,
+      schema.users
     );
   }
   logSecurityEvent("2fa_email_enrolled", "high", { userId });
@@ -4710,7 +4813,8 @@ var emailSendCodeHandler = async (c) => {
   const firstName = user.name?.split(" ")[0] || null;
   const emailResult = await emailService.send2faCodeEmail(
     { email: user.email, firstName, code },
-    db
+    db,
+    schema.users
   );
   if (!emailResult.success) {
     return problems.badRequest(
@@ -4772,12 +4876,12 @@ var emailDisableHandler = async (c) => {
   if (remaining.length === 0) {
     await db.delete(schema.userBackupCodes).where(eq26(schema.userBackupCodes.userId, userId));
     await db.delete(schema.userTrustedDevices).where(eq26(schema.userTrustedDevices.userId, userId));
-    await invalidateAllUserSessions(db, userId);
+    await invalidateAllUserSessions(db, { sessions: schema.sessions, users: schema.users }, userId);
     const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where(eq26(schema.users.id, userId)).limit(1);
     if (user) {
       const emailService = new EmailService(env);
       const firstName = user.name?.split(" ")[0] || null;
-      await emailService.send2faDisabledEmail({ email: user.email, firstName }, db);
+      await emailService.send2faDisabledEmail({ email: user.email, firstName }, db, schema.users);
     }
     logSecurityEvent("2fa_disabled", "critical", { userId, lastMethod: "email" });
     return c.json({ success: true, sessionInvalidated: true });
@@ -5098,7 +5202,7 @@ var challengeResendHandler = async (c) => {
   });
   const emailService = new EmailService(c.env);
   const firstName = user.name?.split(" ")[0] || null;
-  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db);
+  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db, schema.users);
   logger_default.info("Email 2FA code resent", { userId: payload.userId });
   return c.json({ success: true });
 };
@@ -5621,6 +5725,7 @@ function verifyWebhookSignature(payload, signature, secret) {
 export {
   AUTH_DEFAULTS,
   CHALLENGE_TTL_MS,
+  CloudflareEmailAdapter,
   EmailService,
   MAX_CHALLENGE_ATTEMPTS,
   ProblemTypes,