@syncello/auth 4.0.0 → 4.1.0

package/README.md

@@ -319,6 +319,16 @@ import {
 
 ## Release Notes
 
+### 4.1.0
+
+- `emailBranding.marketingUrl`: the site the email footer's Privacy Policy (`/privacy`) and Get
+  in Touch (`/contact`) links point at. Without it the footer has no links; they used to point
+  at the app, where those pages don't exist.
+- Emails state each link's or code's real lifetime from `AUTH_DEFAULTS`: the password reset
+  email said 1 hour for a 15-minute token, and the verification email 48 hours for a 24-hour
+  one. `AUTH_DEFAULTS` gains `EMAIL_VERIFICATION_TTL_HOURS`, `EMAIL_CHANGE_TTL_HOURS` and
+  `TWO_FACTOR_EMAIL_CODE_TTL_MINUTES`, which the token code now reads too (values unchanged).
+
 ### 4.0.0
 
 **Breaking:** `verifyWebhookSignature` takes all three svix headers. Svix signs

package/dist/index.cjs

@@ -680,6 +680,9 @@ var AUTH_DEFAULTS = {
   LOCKOUT_DURATION_MINUTES: 30,
   LOCKOUT_MAX_ATTEMPTS: 5,
   PASSWORD_RESET_TTL_MINUTES: 15,
+  EMAIL_VERIFICATION_TTL_HOURS: 24,
+  EMAIL_CHANGE_TTL_HOURS: 24,
+  TWO_FACTOR_EMAIL_CODE_TTL_MINUTES: 5,
   TWO_FACTOR_CHALLENGE_TTL_SECONDS: 300,
   // 5 minutes
   APP_NAME: "App"
@@ -1169,7 +1172,7 @@ async function verifyTurnstileToken(token, secretKey, remoteIp, environment) {
 
 // src/core/email-change.ts
 var import_drizzle_orm3 = require("drizzle-orm");
-var TOKEN_EXPIRY_MS = 24 * 60 * 60 * 1e3;
+var TOKEN_EXPIRY_MS = AUTH_DEFAULTS.EMAIL_CHANGE_TTL_HOURS * 60 * 60 * 1e3;
 async function requestEmailChange(params) {
   const { userId, password, newEmail, pepper, db, tables: tables2 } = params;
   const { users, emailChangeTokens } = tables2;
@@ -1424,8 +1427,7 @@ function generateEmailTemplate(options) {
     securityWarning,
     footerNote,
     appUrl,
-    marketingUrl = appUrl,
-    // Default to appUrl if no marketing site
+    marketingUrl,
     appName = "App",
     buttonBgColor = "#00fe9a",
     buttonTextColor = "#000004",
@@ -1438,7 +1440,7 @@ function generateEmailTemplate(options) {
   const safeAppName = escapeHtml(appName);
   const safeButtonUrl = buttonUrl ? sanitizeEmailUrl(buttonUrl, appUrl) : "";
   const safeAppUrl = appUrl ? sanitizeEmailUrl(appUrl, appUrl) : "";
-  const safeMarketingUrl = marketingUrl ? sanitizeEmailUrl(marketingUrl, appUrl) : "";
+  const safeMarketingUrl = marketingUrl ? sanitizeEmailUrl(marketingUrl, marketingUrl).replace(/\/$/, "") : "";
   const safeLogoUrl = logoUrl ? sanitizeEmailUrl(logoUrl, appUrl) : `${safeAppUrl.replace(/\/$/, "")}/email-header-image.png`;
   return `
     <!DOCTYPE html>
@@ -1732,6 +1734,7 @@ function generateEmailTemplate(options) {
                           <tr>
                             <td class="column column-1" width="100%" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-weight: 400; text-align: left; vertical-align: top; padding: 20px;">
 
+                              ${safeMarketingUrl ? `
                               <!-- Policy Links -->
                               <table class="paragraph_block" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
                                 <tr>
@@ -1744,6 +1747,7 @@ function generateEmailTemplate(options) {
                                   </td>
                                 </tr>
                               </table>
+                              ` : ""}
 
                               <!-- Copyright & Disclaimer -->
                               <table class="paragraph_block block-1" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
@@ -1870,13 +1874,13 @@ async function cleanupExpiredPasswordlessChallenges(db, tables2) {
 function passwordlessEmail(input) {
   const { appName, appUrl, linkUrl, code } = input;
   const minutes = Math.max(1, Math.round((input.ttlMs ?? PASSWORDLESS_TTL_MS) / 6e4));
-  const lifetime = `${minutes} ${minutes === 1 ? "minute" : "minutes"}`;
+  const lifetime2 = `${minutes} ${minutes === 1 ? "minute" : "minutes"}`;
   const safeLink = sanitizeEmailUrl(linkUrl, appUrl);
   const html = generateEmailTemplate({
     heading: `Sign in to ${escapeHtml(appName)}`,
     body: `<p>Use this code, or the button below, to sign in:</p>
 			<p style="font-size: 32px; font-weight: bold; letter-spacing: 4px; text-align: center; margin: 24px 0; font-family: monospace;">${escapeHtml(code)}</p>
-			<p>The code and the link expire in ${lifetime}.</p>`,
+			<p>The code and the link expire in ${lifetime2}.</p>`,
     buttonText: "Sign in",
     buttonUrl: safeLink,
     footerNote: "If you didn't ask to sign in, you can ignore this email.",
@@ -1891,7 +1895,7 @@ function passwordlessEmail(input) {
 Or sign in with this link:
 ${safeLink}
 
-The code and the link expire in ${lifetime}.
+The code and the link expire in ${lifetime2}.
 
 If you didn't ask to sign in, you can ignore this email.`
   };
@@ -2441,6 +2445,15 @@ var import_drizzle_orm10 = require("drizzle-orm");
 var import_drizzle_orm7 = require("drizzle-orm");
 
 // src/lib/email/templates.ts
+function lifetime(minutes) {
+  if (minutes % 60 !== 0) return `${minutes} ${minutes === 1 ? "minute" : "minutes"}`;
+  const hours = minutes / 60;
+  return `${hours} ${hours === 1 ? "hour" : "hours"}`;
+}
+var VERIFICATION_LIFETIME = lifetime(AUTH_DEFAULTS.EMAIL_VERIFICATION_TTL_HOURS * 60);
+var PASSWORD_RESET_LIFETIME = lifetime(AUTH_DEFAULTS.PASSWORD_RESET_TTL_MINUTES);
+var EMAIL_CHANGE_LIFETIME = lifetime(AUTH_DEFAULTS.EMAIL_CHANGE_TTL_HOURS * 60);
+var TWO_FACTOR_CODE_LIFETIME = lifetime(AUTH_DEFAULTS.TWO_FACTOR_EMAIL_CODE_TTL_MINUTES);
 function extractAppUrl(url) {
   try {
     const parsed = new URL(url);
@@ -2456,7 +2469,7 @@ function generateVerificationEmail(data, appName = "Your App", configuredAppUrl
   const safeFirstName = firstName ? escapeHtml(firstName) : null;
   const html = generateEmailTemplate({
     heading: "",
-    body: `Please verify that your email address is <strong>${escapeHtml(email)}</strong>, and that you entered it when signing up for ${escapeHtml(appName)}.`,
+    body: `Please verify that your email address is <strong>${escapeHtml(email)}</strong>, and that you entered it when signing up for ${escapeHtml(appName)}. This link expires in ${VERIFICATION_LIFETIME}.`,
     buttonText: "Verify Email",
     buttonUrl: safeUrl,
     welcomeMessage: safeFirstName ? `Hi ${safeFirstName}, Welcome to ${escapeHtml(appName)}!` : void 0,
@@ -2475,7 +2488,7 @@ Thank you for signing up for ${appName}! Please verify your email address by cli
 
 ${safeUrl}
 
-This link expires in 48 hours.
+This link expires in ${VERIFICATION_LIFETIME}.
 
 If you didn't create an account with ${appName}, you can safely ignore this email.`,
     tags: {
@@ -2493,7 +2506,7 @@ function generatePasswordResetEmail(data, appName = "Your App", configuredAppUrl
     buttonText: "Reset Password",
     buttonUrl: safeUrl,
     securityWarning: `
-			<strong>Link expires in 1 hour.</strong><br>
+			<strong>Link expires in ${PASSWORD_RESET_LIFETIME}.</strong><br>
 			For security, this link can only be used once.
 		`,
     footerNote: "If you didn't request this change, no action is needed. Your password will remain unchanged.",
@@ -2511,7 +2524,7 @@ We received a request to reset your password. Click the link below to create a n
 
 ${safeUrl}
 
-This link will expire in 1 hour.
+This link expires in ${PASSWORD_RESET_LIFETIME}.
 
 If you didn't request a password reset, you can safely ignore this email.`,
     tags: {
@@ -2529,7 +2542,7 @@ function generateEmailChangeConfirmation(data, appName = "Your App", configuredA
     buttonText: "Confirm Email Change",
     buttonUrl: safeUrl,
     securityWarning: `
-			<strong>This link expires in 24 hours.</strong><br>
+			<strong>This link expires in ${EMAIL_CHANGE_LIFETIME}.</strong><br>
 			For security, this link can only be used once.
 		`,
     footerNote: "If you didn't request this change, you can safely ignore this email.",
@@ -2549,7 +2562,7 @@ Click the link below to confirm this change:
 
 ${safeUrl}
 
-This link expires in 24 hours.
+This link expires in ${EMAIL_CHANGE_LIFETIME}.
 
 If you didn't request this change, you can safely ignore this email.`,
     tags: {
@@ -2603,7 +2616,7 @@ function generate2faCodeEmail(data, appName = "Your App", appUrl = "", branding)
 			<p>Hi ${safeFirstName},</p>
 			<p>Your verification code is:</p>
 			<p style="font-size: 32px; font-weight: bold; letter-spacing: 4px; text-align: center; margin: 24px 0; font-family: monospace;">${escapeHtml(code)}</p>
-			<p>This code expires in 5 minutes.</p>
+			<p>This code expires in ${TWO_FACTOR_CODE_LIFETIME}.</p>
 			<p>If you didn't request this code, you can safely ignore this email.</p>
 		`,
     buttonText: "",
@@ -2623,7 +2636,7 @@ Your verification code is:
 
 ${code}
 
-This code expires in 5 minutes.
+This code expires in ${TWO_FACTOR_CODE_LIFETIME}.
 
 If you didn't request this code, you can safely ignore this email.
 
@@ -3702,7 +3715,7 @@ var signupHandler = async (c) => {
   if (!invitedVerified) {
     const emailToken = generateSecureToken(32);
     const tokenHash = await hashToken(emailToken);
-    const expiresAt = Date.now() + 24 * 60 * 60 * 1e3;
+    const expiresAt = Date.now() + AUTH_DEFAULTS.EMAIL_VERIFICATION_TTL_HOURS * 60 * 60 * 1e3;
     await database.insert(schema.emailVerificationTokens).values({
       tokenHash,
       userId: newUser.id,
@@ -3781,7 +3794,7 @@ function generateEmailOtp() {
   const num = (bytes[0] << 24 | bytes[1] << 16 | bytes[2] << 8 | bytes[3]) >>> 0;
   return String(num % 1e6).padStart(6, "0");
 }
-var EMAIL_CODE_TTL_SECONDS = 300;
+var EMAIL_CODE_TTL_SECONDS = AUTH_DEFAULTS.TWO_FACTOR_EMAIL_CODE_TTL_MINUTES * 60;
 async function sendEmailChallengeCode(env, database, usersTable, user, emailBranding) {
   const code = generateEmailOtp();
   await env.OAUTH_STATES.put(`email_2fa_challenge:${user.id}`, await hashToken(code), {
@@ -4839,7 +4852,7 @@ var resendVerificationHandler = async (c) => {
   await db.delete(schema.emailVerificationTokens).where((0, import_drizzle_orm20.eq)(schema.emailVerificationTokens.userId, userId));
   const emailToken = generateSecureToken(32);
   const tokenHash = await hashToken(emailToken);
-  const expiresAt = Date.now() + 24 * 60 * 60 * 1e3;
+  const expiresAt = Date.now() + AUTH_DEFAULTS.EMAIL_VERIFICATION_TTL_HOURS * 60 * 60 * 1e3;
   await db.insert(schema.emailVerificationTokens).values({
     tokenHash,
     userId: user.id,