@syncello/auth 3.5.0 → 3.6.0

package/dist/index.cjs

@@ -1341,12 +1341,13 @@ var import_drizzle_orm4 = require("drizzle-orm");
 
 // src/factory.ts
 function createAuth(config) {
-  const { db, schema, getEnv, emailBranding } = config;
+  const { db, schema, getEnv, emailBranding, invitations } = config;
   const getContext = (c) => ({
     db,
     schema,
     env: getEnv(c),
-    emailBranding
+    emailBranding,
+    invitations
   });
   return {
     db,
@@ -3324,7 +3325,10 @@ var signupRequestSchema = import_zod_openapi.z.object({
   name: import_zod_openapi.z.string().min(1).optional().openapi({ example: "John Doe" }),
   turnstileToken: import_zod_openapi.z.string().optional().openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" }),
   // OAuth signup completion token (from /signup?oauth_token=...)
-  oauthToken: import_zod_openapi.z.string().optional().openapi({ example: "a1b2c3d4-..." })
+  oauthToken: import_zod_openapi.z.string().optional().openapi({ example: "a1b2c3d4-..." }),
+  // App invitation token (from /signup?token=...). When it validates for this
+  // email, the account is created already-verified with no verification email.
+  invitationToken: import_zod_openapi.z.string().optional().openapi({ example: "iIB8tDJJ..." })
 }).openapi("SignupRequest");
 var loginRequestSchema = import_zod_openapi.z.object({
   email: import_zod_openapi.z.string().email().openapi({ example: "user@example.com" }),
@@ -3454,8 +3458,8 @@ var signupRoute = (0, import_zod_openapi2.createRoute)({
   }
 });
 var signupHandler = async (c) => {
-  const { email, password, name, turnstileToken, oauthToken } = c.req.valid("json");
-  const { db: database, schema, emailBranding } = getAuthContext(c);
+  const { email, password, name, turnstileToken, oauthToken, invitationToken } = c.req.valid("json");
+  const { db: database, schema, emailBranding, invitations } = getAuthContext(c);
   const env = c.env;
   if (oauthToken) {
     const stored = await env.OAUTH_STATES.get(`oauth:signup:${oauthToken}`);
@@ -3537,40 +3541,74 @@ var signupHandler = async (c) => {
     return problems.badRequest(c, passwordValidation.error || "Invalid password");
   }
   const hashedPassword = await hashPassword(password, env.PASSWORD_PEPPER_V1);
+  let invitedVerified = false;
+  if (invitationToken && invitations) {
+    const match = await invitations.verify({
+      token: invitationToken,
+      email: email.toLowerCase(),
+      db: database,
+      env
+    });
+    if (!match || match.email.toLowerCase() !== email.toLowerCase()) {
+      return problems.badRequest(
+        c,
+        "This invitation is invalid, expired, or for a different email address"
+      );
+    }
+    invitedVerified = true;
+  }
   const [newUser] = await database.insert(schema.users).values({
     email: email.toLowerCase(),
     name: name || null,
     hashedPassword,
     pepperKid: "v1",
-    emailVerified: false,
+    emailVerified: invitedVerified,
     activatedAt: /* @__PURE__ */ new Date()
   }).returning();
-  const emailToken = generateSecureToken(32);
-  const tokenHash = await hashToken(emailToken);
-  const expiresAt = Date.now() + 24 * 60 * 60 * 1e3;
-  await database.insert(schema.emailVerificationTokens).values({
-    tokenHash,
-    userId: newUser.id,
-    email: newUser.email,
-    expiresAt,
-    createdAt: Date.now()
-  });
-  const emailService = new EmailService(env, void 0, emailBranding);
-  const verificationUrl = `${env.APP_URL}/verify-email?token=${emailToken}`;
-  await emailService.sendVerificationEmail(
-    {
+  if (!invitedVerified) {
+    const emailToken = generateSecureToken(32);
+    const tokenHash = await hashToken(emailToken);
+    const expiresAt = Date.now() + 24 * 60 * 60 * 1e3;
+    await database.insert(schema.emailVerificationTokens).values({
+      tokenHash,
+      userId: newUser.id,
       email: newUser.email,
-      token: emailToken,
-      verificationUrl,
-      firstName: newUser.name || void 0
-    },
-    database,
-    schema.users
-  );
+      expiresAt,
+      createdAt: Date.now()
+    });
+    const emailService = new EmailService(env, void 0, emailBranding);
+    const verificationUrl = `${env.APP_URL}/verify-email?token=${emailToken}`;
+    await emailService.sendVerificationEmail(
+      {
+        email: newUser.email,
+        token: emailToken,
+        verificationUrl,
+        firstName: newUser.name || void 0
+      },
+      database,
+      schema.users
+    );
+  }
+  if (invitedVerified && invitationToken && invitations?.onAccepted) {
+    try {
+      await invitations.onAccepted({
+        token: invitationToken,
+        user: { id: newUser.id, email: newUser.email, name: newUser.name },
+        db: database,
+        env
+      });
+    } catch (err) {
+      logError(err, { context: "signup_invitation_onAccepted_failed", userId: newUser.id });
+    }
+  }
   const fingerprint = await generateFingerprint(c.req.raw);
   const ipAddress = getClientIp(c.req.raw);
   const sessionId = await createSession(database, { sessions: schema.sessions }, newUser.id, fingerprint, ipAddress);
-  logSecurityEvent("user_signup", "low", { userId: newUser.id, email: newUser.email });
+  logSecurityEvent("user_signup", "low", {
+    userId: newUser.id,
+    email: newUser.email,
+    invited: invitedVerified
+  });
   c.header("Set-Cookie", setSessionCookie(sessionId, c.env), { append: true });
   return c.json({
     user: {