@syncello/auth 3.6.0 → 3.6.1

package/dist/index.cjs

@@ -3650,6 +3650,16 @@ function generateEmailOtp() {
   const num = (bytes[0] << 24 | bytes[1] << 16 | bytes[2] << 8 | bytes[3]) >>> 0;
   return String(num % 1e6).padStart(6, "0");
 }
+var EMAIL_CODE_TTL_SECONDS = 300;
+async function sendEmailChallengeCode(env, database, usersTable, user, emailBranding) {
+  const code = generateEmailOtp();
+  await env.OAUTH_STATES.put(`email_2fa_challenge:${user.id}`, await hashToken(code), {
+    expirationTtl: EMAIL_CODE_TTL_SECONDS
+  });
+  const emailService = new EmailService(env, void 0, emailBranding);
+  const firstName = user.name?.split(" ")[0] || null;
+  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, database, usersTable);
+}
 async function verifyAny2faCode(database, env, userId, code, method, tables2) {
   const { user2faMethods: user2faMethodsTable, userBackupCodes: userBackupCodesTable } = tables2;
   if (method === "totp") {
@@ -3734,7 +3744,7 @@ var loginRoute = (0, import_zod_openapi3.createRoute)({
 });
 var loginHandler = async (c) => {
   const { email, password, turnstileToken } = c.req.valid("json");
-  const { db: database, schema } = getAuthContext(c);
+  const { db: database, schema, emailBranding } = getAuthContext(c);
   const env = c.env;
   const turnstileValid = await verifyTurnstileToken(
     turnstileToken,
@@ -3819,6 +3829,10 @@ var loginHandler = async (c) => {
     };
     await storeChallengeToken(env.OAUTH_STATES, challengeToken, challengePayload);
     setChallengeCookie(c, env, challengeToken);
+    const emailMethod = enabled2faMethods.find((m) => m.method === "email");
+    if (emailMethod && (emailMethod.isPrimary || enabled2faMethods.length === 1)) {
+      await sendEmailChallengeCode(env, database, schema.users, user, emailBranding);
+    }
     return c.json({
       requires2fa: true,
       methods: enabled2faMethods.map((m) => m.method)
@@ -5675,14 +5689,7 @@ var challengeResendHandler = async (c) => {
     logger_default.error("User not found during 2FA resend", { userId: payload.userId });
     return problems.notFound(c, "User not found");
   }
-  const code = generateEmailOtp();
-  const codeHash = await hashToken(code);
-  await c.env.OAUTH_STATES.put(`email_2fa_challenge:${payload.userId}`, codeHash, {
-    expirationTtl: 300
-  });
-  const emailService = new EmailService(c.env, void 0, emailBranding);
-  const firstName = user.name?.split(" ")[0] || null;
-  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db, schema.users);
+  await sendEmailChallengeCode(c.env, db, schema.users, { id: payload.userId, ...user }, emailBranding);
   logger_default.info("Email 2FA code resent", { userId: payload.userId });
   return c.json({ success: true });
 };