@syncello/auth 3.4.1 → 3.6.0

package/dist/index.cjs

@@ -1341,12 +1341,13 @@ var import_drizzle_orm4 = require("drizzle-orm");
 
 // src/factory.ts
 function createAuth(config) {
-  const { db, schema, getEnv, emailBranding } = config;
+  const { db, schema, getEnv, emailBranding, invitations } = config;
   const getContext = (c) => ({
     db,
     schema,
     env: getEnv(c),
-    emailBranding
+    emailBranding,
+    invitations
   });
   return {
     db,
@@ -3324,7 +3325,10 @@ var signupRequestSchema = import_zod_openapi.z.object({
   name: import_zod_openapi.z.string().min(1).optional().openapi({ example: "John Doe" }),
   turnstileToken: import_zod_openapi.z.string().optional().openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" }),
   // OAuth signup completion token (from /signup?oauth_token=...)
-  oauthToken: import_zod_openapi.z.string().optional().openapi({ example: "a1b2c3d4-..." })
+  oauthToken: import_zod_openapi.z.string().optional().openapi({ example: "a1b2c3d4-..." }),
+  // App invitation token (from /signup?token=...). When it validates for this
+  // email, the account is created already-verified with no verification email.
+  invitationToken: import_zod_openapi.z.string().optional().openapi({ example: "iIB8tDJJ..." })
 }).openapi("SignupRequest");
 var loginRequestSchema = import_zod_openapi.z.object({
   email: import_zod_openapi.z.string().email().openapi({ example: "user@example.com" }),
@@ -3454,8 +3458,8 @@ var signupRoute = (0, import_zod_openapi2.createRoute)({
   }
 });
 var signupHandler = async (c) => {
-  const { email, password, name, turnstileToken, oauthToken } = c.req.valid("json");
-  const { db: database, schema, emailBranding } = getAuthContext(c);
+  const { email, password, name, turnstileToken, oauthToken, invitationToken } = c.req.valid("json");
+  const { db: database, schema, emailBranding, invitations } = getAuthContext(c);
   const env = c.env;
   if (oauthToken) {
     const stored = await env.OAUTH_STATES.get(`oauth:signup:${oauthToken}`);
@@ -3537,40 +3541,74 @@ var signupHandler = async (c) => {
     return problems.badRequest(c, passwordValidation.error || "Invalid password");
   }
   const hashedPassword = await hashPassword(password, env.PASSWORD_PEPPER_V1);
+  let invitedVerified = false;
+  if (invitationToken && invitations) {
+    const match = await invitations.verify({
+      token: invitationToken,
+      email: email.toLowerCase(),
+      db: database,
+      env
+    });
+    if (!match || match.email.toLowerCase() !== email.toLowerCase()) {
+      return problems.badRequest(
+        c,
+        "This invitation is invalid, expired, or for a different email address"
+      );
+    }
+    invitedVerified = true;
+  }
   const [newUser] = await database.insert(schema.users).values({
     email: email.toLowerCase(),
     name: name || null,
     hashedPassword,
     pepperKid: "v1",
-    emailVerified: false,
+    emailVerified: invitedVerified,
     activatedAt: /* @__PURE__ */ new Date()
   }).returning();
-  const emailToken = generateSecureToken(32);
-  const tokenHash = await hashToken(emailToken);
-  const expiresAt = Date.now() + 24 * 60 * 60 * 1e3;
-  await database.insert(schema.emailVerificationTokens).values({
-    tokenHash,
-    userId: newUser.id,
-    email: newUser.email,
-    expiresAt,
-    createdAt: Date.now()
-  });
-  const emailService = new EmailService(env, void 0, emailBranding);
-  const verificationUrl = `${env.APP_URL}/verify-email?token=${emailToken}`;
-  await emailService.sendVerificationEmail(
-    {
+  if (!invitedVerified) {
+    const emailToken = generateSecureToken(32);
+    const tokenHash = await hashToken(emailToken);
+    const expiresAt = Date.now() + 24 * 60 * 60 * 1e3;
+    await database.insert(schema.emailVerificationTokens).values({
+      tokenHash,
+      userId: newUser.id,
       email: newUser.email,
-      token: emailToken,
-      verificationUrl,
-      firstName: newUser.name || void 0
-    },
-    database,
-    schema.users
-  );
+      expiresAt,
+      createdAt: Date.now()
+    });
+    const emailService = new EmailService(env, void 0, emailBranding);
+    const verificationUrl = `${env.APP_URL}/verify-email?token=${emailToken}`;
+    await emailService.sendVerificationEmail(
+      {
+        email: newUser.email,
+        token: emailToken,
+        verificationUrl,
+        firstName: newUser.name || void 0
+      },
+      database,
+      schema.users
+    );
+  }
+  if (invitedVerified && invitationToken && invitations?.onAccepted) {
+    try {
+      await invitations.onAccepted({
+        token: invitationToken,
+        user: { id: newUser.id, email: newUser.email, name: newUser.name },
+        db: database,
+        env
+      });
+    } catch (err) {
+      logError(err, { context: "signup_invitation_onAccepted_failed", userId: newUser.id });
+    }
+  }
   const fingerprint = await generateFingerprint(c.req.raw);
   const ipAddress = getClientIp(c.req.raw);
   const sessionId = await createSession(database, { sessions: schema.sessions }, newUser.id, fingerprint, ipAddress);
-  logSecurityEvent("user_signup", "low", { userId: newUser.id, email: newUser.email });
+  logSecurityEvent("user_signup", "low", {
+    userId: newUser.id,
+    email: newUser.email,
+    invited: invitedVerified
+  });
   c.header("Set-Cookie", setSessionCookie(sessionId, c.env), { append: true });
   return c.json({
     user: {
@@ -5738,9 +5776,10 @@ var PROVIDERS = {
     authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
     tokenUrl: "https://oauth2.googleapis.com/token",
     userinfoUrl: "https://www.googleapis.com/oauth2/v2/userinfo",
-    scopes: ["email"],
+    scopes: ["email", "profile"],
     emailExtractor: (data) => data.email || null,
-    userIdExtractor: (data) => data.id || null
+    userIdExtractor: (data) => data.id || null,
+    nameExtractor: (data) => data.name || null
   },
   microsoft: {
     authorizeUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
@@ -5748,7 +5787,8 @@ var PROVIDERS = {
     userinfoUrl: "https://graph.microsoft.com/v1.0/me",
     scopes: ["openid", "email", "User.Read"],
     emailExtractor: (data) => data.mail || data.userPrincipalName || null,
-    userIdExtractor: (data) => data.id || null
+    userIdExtractor: (data) => data.id || null,
+    nameExtractor: (data) => data.displayName || null
   }
 };
 function getProviderCredentials(provider, env) {
@@ -5985,6 +6025,7 @@ var callbackHandler = async (c) => {
     const userInfo = await userinfoResponse.json();
     const email = providerConfig.emailExtractor(userInfo)?.toLowerCase();
     const providerUserId = providerConfig.userIdExtractor(userInfo);
+    const name = providerConfig.nameExtractor(userInfo);
     if (!email) {
       logger_default.warn("No email returned from OAuth provider", { provider });
       return c.redirect(`${appUrl}/login?error=oauth_no_email`);
@@ -5995,53 +6036,49 @@ var callbackHandler = async (c) => {
     }
     const { db, schema } = getAuthContext(c);
     const [existingUser] = await db.select({ id: schema.users.id, email: schema.users.email }).from(schema.users).where((0, import_drizzle_orm32.eq)(schema.users.email, email)).limit(1);
-    if (existingUser) {
-      const loginCode = crypto.randomUUID();
-      await c.env.OAUTH_STATES.put(
-        `oauth:login:${loginCode}`,
-        JSON.stringify({
-          userId: existingUser.id,
-          email: existingUser.email,
-          provider,
-          providerUserId,
-          redirect: loginRedirect,
-          invitationToken
-        }),
-        { expirationTtl: 60 }
-      );
-      logSecurityEvent("oauth_login_initiated", "low", {
-        userId: existingUser.id,
-        email: existingUser.email,
+    let authUser = existingUser;
+    if (!authUser) {
+      const [createdUser] = await db.insert(schema.users).values({
+        email,
+        name: name || null,
+        hashedPassword: null,
+        pepperKid: null,
+        emailVerified: true,
+        // Provider verified the email
+        activatedAt: /* @__PURE__ */ new Date()
+      }).returning({ id: schema.users.id, email: schema.users.email });
+      authUser = createdUser;
+      logSecurityEvent("user_signup_oauth", "low", {
+        userId: createdUser.id,
+        email: createdUser.email,
         provider
       });
-      if (mobileRedirectUri && isDeepLinkUri(mobileRedirectUri)) {
-        const mobileUrl = new URL(mobileRedirectUri);
-        mobileUrl.searchParams.set("code", loginCode);
-        mobileUrl.searchParams.set("action", "login");
-        return c.redirect(mobileUrl.toString());
-      }
-      return c.redirect(`${appUrl}/auth/callback?code=${loginCode}&action=login`);
-    } else {
-      const signupToken = crypto.randomUUID();
-      await c.env.OAUTH_STATES.put(
-        `oauth:signup:${signupToken}`,
-        JSON.stringify({ email, provider, providerUserId, invitationToken }),
-        { expirationTtl: 600 }
-      );
-      logger_default.info("OAuth signup initiated", { provider, email });
-      if (mobileRedirectUri && isDeepLinkUri(mobileRedirectUri)) {
-        const mobileUrl = new URL(mobileRedirectUri);
-        mobileUrl.searchParams.set("oauth_token", signupToken);
-        mobileUrl.searchParams.set("email", email);
-        if (invitationToken) {
-          mobileUrl.searchParams.set("invitation", invitationToken);
-        }
-        return c.redirect(mobileUrl.toString());
-      }
-      let signupUrl = `${appUrl}/signup?oauth_token=${signupToken}&email=${encodeURIComponent(email)}`;
-      if (invitationToken) signupUrl += `&invitation=${invitationToken}`;
-      return c.redirect(signupUrl);
     }
+    const loginCode = crypto.randomUUID();
+    await c.env.OAUTH_STATES.put(
+      `oauth:login:${loginCode}`,
+      JSON.stringify({
+        userId: authUser.id,
+        email: authUser.email,
+        provider,
+        providerUserId,
+        redirect: loginRedirect,
+        invitationToken
+      }),
+      { expirationTtl: 60 }
+    );
+    logSecurityEvent("oauth_login_initiated", "low", {
+      userId: authUser.id,
+      email: authUser.email,
+      provider
+    });
+    if (mobileRedirectUri && isDeepLinkUri(mobileRedirectUri)) {
+      const mobileUrl = new URL(mobileRedirectUri);
+      mobileUrl.searchParams.set("code", loginCode);
+      mobileUrl.searchParams.set("action", "login");
+      return c.redirect(mobileUrl.toString());
+    }
+    return c.redirect(`${appUrl}/auth/callback?code=${loginCode}&action=login`);
   } catch (err) {
     logError(err, { context: "oauth_callback", provider });
     return c.redirect(`${appUrl}/login?error=oauth_failed`);