@syncello/auth 3.4.0 → 3.5.0

package/dist/index.cjs

@@ -4109,7 +4109,7 @@ var resetPasswordRoute = (0, import_zod_openapi8.createRoute)({
 });
 var resetPasswordHandler = async (c) => {
   const { token, password, turnstileToken } = c.req.valid("json");
-  const database = c.get("db");
+  const { db: database, schema } = getAuthContext(c);
   const env = c.env;
   const turnstileValid = await verifyTurnstileToken(
     turnstileToken,
@@ -4124,7 +4124,18 @@ var resetPasswordHandler = async (c) => {
   if (!passwordValidation.valid) {
     return problems.badRequest(c, passwordValidation.error || "Invalid password");
   }
-  const result = await resetPassword(database, token, password, env.PASSWORD_PEPPER_V1, "v1");
+  const result = await resetPassword(
+    database,
+    {
+      users: schema.users,
+      passwordResetTokens: schema.passwordResetTokens,
+      sessions: schema.sessions
+    },
+    token,
+    password,
+    env.PASSWORD_PEPPER_V1,
+    "v1"
+  );
   if (!result.success) {
     return problems.badRequest(c, result.error || "Invalid or expired reset token");
   }
@@ -5727,9 +5738,10 @@ var PROVIDERS = {
     authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
     tokenUrl: "https://oauth2.googleapis.com/token",
     userinfoUrl: "https://www.googleapis.com/oauth2/v2/userinfo",
-    scopes: ["email"],
+    scopes: ["email", "profile"],
     emailExtractor: (data) => data.email || null,
-    userIdExtractor: (data) => data.id || null
+    userIdExtractor: (data) => data.id || null,
+    nameExtractor: (data) => data.name || null
   },
   microsoft: {
     authorizeUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
@@ -5737,7 +5749,8 @@ var PROVIDERS = {
     userinfoUrl: "https://graph.microsoft.com/v1.0/me",
     scopes: ["openid", "email", "User.Read"],
     emailExtractor: (data) => data.mail || data.userPrincipalName || null,
-    userIdExtractor: (data) => data.id || null
+    userIdExtractor: (data) => data.id || null,
+    nameExtractor: (data) => data.displayName || null
   }
 };
 function getProviderCredentials(provider, env) {
@@ -5974,6 +5987,7 @@ var callbackHandler = async (c) => {
     const userInfo = await userinfoResponse.json();
     const email = providerConfig.emailExtractor(userInfo)?.toLowerCase();
     const providerUserId = providerConfig.userIdExtractor(userInfo);
+    const name = providerConfig.nameExtractor(userInfo);
     if (!email) {
       logger_default.warn("No email returned from OAuth provider", { provider });
       return c.redirect(`${appUrl}/login?error=oauth_no_email`);
@@ -5984,53 +5998,49 @@ var callbackHandler = async (c) => {
     }
     const { db, schema } = getAuthContext(c);
     const [existingUser] = await db.select({ id: schema.users.id, email: schema.users.email }).from(schema.users).where((0, import_drizzle_orm32.eq)(schema.users.email, email)).limit(1);
-    if (existingUser) {
-      const loginCode = crypto.randomUUID();
-      await c.env.OAUTH_STATES.put(
-        `oauth:login:${loginCode}`,
-        JSON.stringify({
-          userId: existingUser.id,
-          email: existingUser.email,
-          provider,
-          providerUserId,
-          redirect: loginRedirect,
-          invitationToken
-        }),
-        { expirationTtl: 60 }
-      );
-      logSecurityEvent("oauth_login_initiated", "low", {
-        userId: existingUser.id,
-        email: existingUser.email,
+    let authUser = existingUser;
+    if (!authUser) {
+      const [createdUser] = await db.insert(schema.users).values({
+        email,
+        name: name || null,
+        hashedPassword: null,
+        pepperKid: null,
+        emailVerified: true,
+        // Provider verified the email
+        activatedAt: /* @__PURE__ */ new Date()
+      }).returning({ id: schema.users.id, email: schema.users.email });
+      authUser = createdUser;
+      logSecurityEvent("user_signup_oauth", "low", {
+        userId: createdUser.id,
+        email: createdUser.email,
         provider
       });
-      if (mobileRedirectUri && isDeepLinkUri(mobileRedirectUri)) {
-        const mobileUrl = new URL(mobileRedirectUri);
-        mobileUrl.searchParams.set("code", loginCode);
-        mobileUrl.searchParams.set("action", "login");
-        return c.redirect(mobileUrl.toString());
-      }
-      return c.redirect(`${appUrl}/auth/callback?code=${loginCode}&action=login`);
-    } else {
-      const signupToken = crypto.randomUUID();
-      await c.env.OAUTH_STATES.put(
-        `oauth:signup:${signupToken}`,
-        JSON.stringify({ email, provider, providerUserId, invitationToken }),
-        { expirationTtl: 600 }
-      );
-      logger_default.info("OAuth signup initiated", { provider, email });
-      if (mobileRedirectUri && isDeepLinkUri(mobileRedirectUri)) {
-        const mobileUrl = new URL(mobileRedirectUri);
-        mobileUrl.searchParams.set("oauth_token", signupToken);
-        mobileUrl.searchParams.set("email", email);
-        if (invitationToken) {
-          mobileUrl.searchParams.set("invitation", invitationToken);
-        }
-        return c.redirect(mobileUrl.toString());
-      }
-      let signupUrl = `${appUrl}/signup?oauth_token=${signupToken}&email=${encodeURIComponent(email)}`;
-      if (invitationToken) signupUrl += `&invitation=${invitationToken}`;
-      return c.redirect(signupUrl);
     }
+    const loginCode = crypto.randomUUID();
+    await c.env.OAUTH_STATES.put(
+      `oauth:login:${loginCode}`,
+      JSON.stringify({
+        userId: authUser.id,
+        email: authUser.email,
+        provider,
+        providerUserId,
+        redirect: loginRedirect,
+        invitationToken
+      }),
+      { expirationTtl: 60 }
+    );
+    logSecurityEvent("oauth_login_initiated", "low", {
+      userId: authUser.id,
+      email: authUser.email,
+      provider
+    });
+    if (mobileRedirectUri && isDeepLinkUri(mobileRedirectUri)) {
+      const mobileUrl = new URL(mobileRedirectUri);
+      mobileUrl.searchParams.set("code", loginCode);
+      mobileUrl.searchParams.set("action", "login");
+      return c.redirect(mobileUrl.toString());
+    }
+    return c.redirect(`${appUrl}/auth/callback?code=${loginCode}&action=login`);
   } catch (err) {
     logError(err, { context: "oauth_callback", provider });
     return c.redirect(`${appUrl}/login?error=oauth_failed`);