@syncello/auth 3.5.0 → 3.6.1

package/dist/index.cjs

@@ -1341,12 +1341,13 @@ var import_drizzle_orm4 = require("drizzle-orm");
 
 // src/factory.ts
 function createAuth(config) {
-  const { db, schema, getEnv, emailBranding } = config;
+  const { db, schema, getEnv, emailBranding, invitations } = config;
   const getContext = (c) => ({
     db,
     schema,
     env: getEnv(c),
-    emailBranding
+    emailBranding,
+    invitations
   });
   return {
     db,
@@ -3324,7 +3325,10 @@ var signupRequestSchema = import_zod_openapi.z.object({
   name: import_zod_openapi.z.string().min(1).optional().openapi({ example: "John Doe" }),
   turnstileToken: import_zod_openapi.z.string().optional().openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" }),
   // OAuth signup completion token (from /signup?oauth_token=...)
-  oauthToken: import_zod_openapi.z.string().optional().openapi({ example: "a1b2c3d4-..." })
+  oauthToken: import_zod_openapi.z.string().optional().openapi({ example: "a1b2c3d4-..." }),
+  // App invitation token (from /signup?token=...). When it validates for this
+  // email, the account is created already-verified with no verification email.
+  invitationToken: import_zod_openapi.z.string().optional().openapi({ example: "iIB8tDJJ..." })
 }).openapi("SignupRequest");
 var loginRequestSchema = import_zod_openapi.z.object({
   email: import_zod_openapi.z.string().email().openapi({ example: "user@example.com" }),
@@ -3454,8 +3458,8 @@ var signupRoute = (0, import_zod_openapi2.createRoute)({
   }
 });
 var signupHandler = async (c) => {
-  const { email, password, name, turnstileToken, oauthToken } = c.req.valid("json");
-  const { db: database, schema, emailBranding } = getAuthContext(c);
+  const { email, password, name, turnstileToken, oauthToken, invitationToken } = c.req.valid("json");
+  const { db: database, schema, emailBranding, invitations } = getAuthContext(c);
   const env = c.env;
   if (oauthToken) {
     const stored = await env.OAUTH_STATES.get(`oauth:signup:${oauthToken}`);
@@ -3537,40 +3541,74 @@ var signupHandler = async (c) => {
     return problems.badRequest(c, passwordValidation.error || "Invalid password");
   }
   const hashedPassword = await hashPassword(password, env.PASSWORD_PEPPER_V1);
+  let invitedVerified = false;
+  if (invitationToken && invitations) {
+    const match = await invitations.verify({
+      token: invitationToken,
+      email: email.toLowerCase(),
+      db: database,
+      env
+    });
+    if (!match || match.email.toLowerCase() !== email.toLowerCase()) {
+      return problems.badRequest(
+        c,
+        "This invitation is invalid, expired, or for a different email address"
+      );
+    }
+    invitedVerified = true;
+  }
   const [newUser] = await database.insert(schema.users).values({
     email: email.toLowerCase(),
     name: name || null,
     hashedPassword,
     pepperKid: "v1",
-    emailVerified: false,
+    emailVerified: invitedVerified,
     activatedAt: /* @__PURE__ */ new Date()
   }).returning();
-  const emailToken = generateSecureToken(32);
-  const tokenHash = await hashToken(emailToken);
-  const expiresAt = Date.now() + 24 * 60 * 60 * 1e3;
-  await database.insert(schema.emailVerificationTokens).values({
-    tokenHash,
-    userId: newUser.id,
-    email: newUser.email,
-    expiresAt,
-    createdAt: Date.now()
-  });
-  const emailService = new EmailService(env, void 0, emailBranding);
-  const verificationUrl = `${env.APP_URL}/verify-email?token=${emailToken}`;
-  await emailService.sendVerificationEmail(
-    {
+  if (!invitedVerified) {
+    const emailToken = generateSecureToken(32);
+    const tokenHash = await hashToken(emailToken);
+    const expiresAt = Date.now() + 24 * 60 * 60 * 1e3;
+    await database.insert(schema.emailVerificationTokens).values({
+      tokenHash,
+      userId: newUser.id,
       email: newUser.email,
-      token: emailToken,
-      verificationUrl,
-      firstName: newUser.name || void 0
-    },
-    database,
-    schema.users
-  );
+      expiresAt,
+      createdAt: Date.now()
+    });
+    const emailService = new EmailService(env, void 0, emailBranding);
+    const verificationUrl = `${env.APP_URL}/verify-email?token=${emailToken}`;
+    await emailService.sendVerificationEmail(
+      {
+        email: newUser.email,
+        token: emailToken,
+        verificationUrl,
+        firstName: newUser.name || void 0
+      },
+      database,
+      schema.users
+    );
+  }
+  if (invitedVerified && invitationToken && invitations?.onAccepted) {
+    try {
+      await invitations.onAccepted({
+        token: invitationToken,
+        user: { id: newUser.id, email: newUser.email, name: newUser.name },
+        db: database,
+        env
+      });
+    } catch (err) {
+      logError(err, { context: "signup_invitation_onAccepted_failed", userId: newUser.id });
+    }
+  }
   const fingerprint = await generateFingerprint(c.req.raw);
   const ipAddress = getClientIp(c.req.raw);
   const sessionId = await createSession(database, { sessions: schema.sessions }, newUser.id, fingerprint, ipAddress);
-  logSecurityEvent("user_signup", "low", { userId: newUser.id, email: newUser.email });
+  logSecurityEvent("user_signup", "low", {
+    userId: newUser.id,
+    email: newUser.email,
+    invited: invitedVerified
+  });
   c.header("Set-Cookie", setSessionCookie(sessionId, c.env), { append: true });
   return c.json({
     user: {
@@ -3612,6 +3650,16 @@ function generateEmailOtp() {
   const num = (bytes[0] << 24 | bytes[1] << 16 | bytes[2] << 8 | bytes[3]) >>> 0;
   return String(num % 1e6).padStart(6, "0");
 }
+var EMAIL_CODE_TTL_SECONDS = 300;
+async function sendEmailChallengeCode(env, database, usersTable, user, emailBranding) {
+  const code = generateEmailOtp();
+  await env.OAUTH_STATES.put(`email_2fa_challenge:${user.id}`, await hashToken(code), {
+    expirationTtl: EMAIL_CODE_TTL_SECONDS
+  });
+  const emailService = new EmailService(env, void 0, emailBranding);
+  const firstName = user.name?.split(" ")[0] || null;
+  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, database, usersTable);
+}
 async function verifyAny2faCode(database, env, userId, code, method, tables2) {
   const { user2faMethods: user2faMethodsTable, userBackupCodes: userBackupCodesTable } = tables2;
   if (method === "totp") {
@@ -3696,7 +3744,7 @@ var loginRoute = (0, import_zod_openapi3.createRoute)({
 });
 var loginHandler = async (c) => {
   const { email, password, turnstileToken } = c.req.valid("json");
-  const { db: database, schema } = getAuthContext(c);
+  const { db: database, schema, emailBranding } = getAuthContext(c);
   const env = c.env;
   const turnstileValid = await verifyTurnstileToken(
     turnstileToken,
@@ -3781,6 +3829,10 @@ var loginHandler = async (c) => {
     };
     await storeChallengeToken(env.OAUTH_STATES, challengeToken, challengePayload);
     setChallengeCookie(c, env, challengeToken);
+    const emailMethod = enabled2faMethods.find((m) => m.method === "email");
+    if (emailMethod && (emailMethod.isPrimary || enabled2faMethods.length === 1)) {
+      await sendEmailChallengeCode(env, database, schema.users, user, emailBranding);
+    }
     return c.json({
       requires2fa: true,
       methods: enabled2faMethods.map((m) => m.method)
@@ -5637,14 +5689,7 @@ var challengeResendHandler = async (c) => {
     logger_default.error("User not found during 2FA resend", { userId: payload.userId });
     return problems.notFound(c, "User not found");
   }
-  const code = generateEmailOtp();
-  const codeHash = await hashToken(code);
-  await c.env.OAUTH_STATES.put(`email_2fa_challenge:${payload.userId}`, codeHash, {
-    expirationTtl: 300
-  });
-  const emailService = new EmailService(c.env, void 0, emailBranding);
-  const firstName = user.name?.split(" ")[0] || null;
-  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db, schema.users);
+  await sendEmailChallengeCode(c.env, db, schema.users, { id: payload.userId, ...user }, emailBranding);
   logger_default.info("Email 2FA code resent", { userId: payload.userId });
   return c.json({ success: true });
 };