@syncello/auth 4.0.0 → 4.1.0

package/dist/index.d.cts

@@ -169,6 +169,9 @@ declare const AUTH_DEFAULTS: {
     readonly LOCKOUT_DURATION_MINUTES: 30;
     readonly LOCKOUT_MAX_ATTEMPTS: 5;
     readonly PASSWORD_RESET_TTL_MINUTES: 15;
+    readonly EMAIL_VERIFICATION_TTL_HOURS: 24;
+    readonly EMAIL_CHANGE_TTL_HOURS: 24;
+    readonly TWO_FACTOR_EMAIL_CODE_TTL_MINUTES: 5;
     readonly TWO_FACTOR_CHALLENGE_TTL_SECONDS: 300;
     readonly APP_NAME: "App";
 };
@@ -260,6 +263,11 @@ interface EmailBranding {
     footerColor?: string;
     /** Heading and welcome-line color. Default: '#1e1b4b' */
     headingColor?: string;
+    /**
+     * Marketing site the footer's Privacy Policy (`/privacy`) and Get in Touch (`/contact`)
+     * links point at. Default: unset, and the footer has no links.
+     */
+    marketingUrl?: string;
 }
 
 /**

package/dist/index.d.ts

@@ -169,6 +169,9 @@ declare const AUTH_DEFAULTS: {
     readonly LOCKOUT_DURATION_MINUTES: 30;
     readonly LOCKOUT_MAX_ATTEMPTS: 5;
     readonly PASSWORD_RESET_TTL_MINUTES: 15;
+    readonly EMAIL_VERIFICATION_TTL_HOURS: 24;
+    readonly EMAIL_CHANGE_TTL_HOURS: 24;
+    readonly TWO_FACTOR_EMAIL_CODE_TTL_MINUTES: 5;
     readonly TWO_FACTOR_CHALLENGE_TTL_SECONDS: 300;
     readonly APP_NAME: "App";
 };
@@ -260,6 +263,11 @@ interface EmailBranding {
     footerColor?: string;
     /** Heading and welcome-line color. Default: '#1e1b4b' */
     headingColor?: string;
+    /**
+     * Marketing site the footer's Privacy Policy (`/privacy`) and Get in Touch (`/contact`)
+     * links point at. Default: unset, and the footer has no links.
+     */
+    marketingUrl?: string;
 }
 
 /**

package/dist/index.js

@@ -260,6 +260,9 @@ var AUTH_DEFAULTS = {
   LOCKOUT_DURATION_MINUTES: 30,
   LOCKOUT_MAX_ATTEMPTS: 5,
   PASSWORD_RESET_TTL_MINUTES: 15,
+  EMAIL_VERIFICATION_TTL_HOURS: 24,
+  EMAIL_CHANGE_TTL_HOURS: 24,
+  TWO_FACTOR_EMAIL_CODE_TTL_MINUTES: 5,
   TWO_FACTOR_CHALLENGE_TTL_SECONDS: 300,
   // 5 minutes
   APP_NAME: "App"
@@ -749,7 +752,7 @@ async function verifyTurnstileToken(token, secretKey, remoteIp, environment) {
 
 // src/core/email-change.ts
 import { eq as eq3 } from "drizzle-orm";
-var TOKEN_EXPIRY_MS = 24 * 60 * 60 * 1e3;
+var TOKEN_EXPIRY_MS = AUTH_DEFAULTS.EMAIL_CHANGE_TTL_HOURS * 60 * 60 * 1e3;
 async function requestEmailChange(params) {
   const { userId, password, newEmail, pepper, db, tables: tables2 } = params;
   const { users, emailChangeTokens } = tables2;
@@ -1004,8 +1007,7 @@ function generateEmailTemplate(options) {
     securityWarning,
     footerNote,
     appUrl,
-    marketingUrl = appUrl,
-    // Default to appUrl if no marketing site
+    marketingUrl,
     appName = "App",
     buttonBgColor = "#00fe9a",
     buttonTextColor = "#000004",
@@ -1018,7 +1020,7 @@ function generateEmailTemplate(options) {
   const safeAppName = escapeHtml(appName);
   const safeButtonUrl = buttonUrl ? sanitizeEmailUrl(buttonUrl, appUrl) : "";
   const safeAppUrl = appUrl ? sanitizeEmailUrl(appUrl, appUrl) : "";
-  const safeMarketingUrl = marketingUrl ? sanitizeEmailUrl(marketingUrl, appUrl) : "";
+  const safeMarketingUrl = marketingUrl ? sanitizeEmailUrl(marketingUrl, marketingUrl).replace(/\/$/, "") : "";
   const safeLogoUrl = logoUrl ? sanitizeEmailUrl(logoUrl, appUrl) : `${safeAppUrl.replace(/\/$/, "")}/email-header-image.png`;
   return `
     <!DOCTYPE html>
@@ -1312,6 +1314,7 @@ function generateEmailTemplate(options) {
                           <tr>
                             <td class="column column-1" width="100%" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-weight: 400; text-align: left; vertical-align: top; padding: 20px;">
 
+                              ${safeMarketingUrl ? `
                               <!-- Policy Links -->
                               <table class="paragraph_block" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
                                 <tr>
@@ -1324,6 +1327,7 @@ function generateEmailTemplate(options) {
                                   </td>
                                 </tr>
                               </table>
+                              ` : ""}
 
                               <!-- Copyright & Disclaimer -->
                               <table class="paragraph_block block-1" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
@@ -1450,13 +1454,13 @@ async function cleanupExpiredPasswordlessChallenges(db, tables2) {
 function passwordlessEmail(input) {
   const { appName, appUrl, linkUrl, code } = input;
   const minutes = Math.max(1, Math.round((input.ttlMs ?? PASSWORDLESS_TTL_MS) / 6e4));
-  const lifetime = `${minutes} ${minutes === 1 ? "minute" : "minutes"}`;
+  const lifetime2 = `${minutes} ${minutes === 1 ? "minute" : "minutes"}`;
   const safeLink = sanitizeEmailUrl(linkUrl, appUrl);
   const html = generateEmailTemplate({
     heading: `Sign in to ${escapeHtml(appName)}`,
     body: `<p>Use this code, or the button below, to sign in:</p>
 			<p style="font-size: 32px; font-weight: bold; letter-spacing: 4px; text-align: center; margin: 24px 0; font-family: monospace;">${escapeHtml(code)}</p>
-			<p>The code and the link expire in ${lifetime}.</p>`,
+			<p>The code and the link expire in ${lifetime2}.</p>`,
     buttonText: "Sign in",
     buttonUrl: safeLink,
     footerNote: "If you didn't ask to sign in, you can ignore this email.",
@@ -1471,7 +1475,7 @@ function passwordlessEmail(input) {
 Or sign in with this link:
 ${safeLink}
 
-The code and the link expire in ${lifetime}.
+The code and the link expire in ${lifetime2}.
 
 If you didn't ask to sign in, you can ignore this email.`
   };
@@ -2021,6 +2025,15 @@ import { eq as eq9 } from "drizzle-orm";
 import { eq as eq7 } from "drizzle-orm";
 
 // src/lib/email/templates.ts
+function lifetime(minutes) {
+  if (minutes % 60 !== 0) return `${minutes} ${minutes === 1 ? "minute" : "minutes"}`;
+  const hours = minutes / 60;
+  return `${hours} ${hours === 1 ? "hour" : "hours"}`;
+}
+var VERIFICATION_LIFETIME = lifetime(AUTH_DEFAULTS.EMAIL_VERIFICATION_TTL_HOURS * 60);
+var PASSWORD_RESET_LIFETIME = lifetime(AUTH_DEFAULTS.PASSWORD_RESET_TTL_MINUTES);
+var EMAIL_CHANGE_LIFETIME = lifetime(AUTH_DEFAULTS.EMAIL_CHANGE_TTL_HOURS * 60);
+var TWO_FACTOR_CODE_LIFETIME = lifetime(AUTH_DEFAULTS.TWO_FACTOR_EMAIL_CODE_TTL_MINUTES);
 function extractAppUrl(url) {
   try {
     const parsed = new URL(url);
@@ -2036,7 +2049,7 @@ function generateVerificationEmail(data, appName = "Your App", configuredAppUrl
   const safeFirstName = firstName ? escapeHtml(firstName) : null;
   const html = generateEmailTemplate({
     heading: "",
-    body: `Please verify that your email address is <strong>${escapeHtml(email)}</strong>, and that you entered it when signing up for ${escapeHtml(appName)}.`,
+    body: `Please verify that your email address is <strong>${escapeHtml(email)}</strong>, and that you entered it when signing up for ${escapeHtml(appName)}. This link expires in ${VERIFICATION_LIFETIME}.`,
     buttonText: "Verify Email",
     buttonUrl: safeUrl,
     welcomeMessage: safeFirstName ? `Hi ${safeFirstName}, Welcome to ${escapeHtml(appName)}!` : void 0,
@@ -2055,7 +2068,7 @@ Thank you for signing up for ${appName}! Please verify your email address by cli
 
 ${safeUrl}
 
-This link expires in 48 hours.
+This link expires in ${VERIFICATION_LIFETIME}.
 
 If you didn't create an account with ${appName}, you can safely ignore this email.`,
     tags: {
@@ -2073,7 +2086,7 @@ function generatePasswordResetEmail(data, appName = "Your App", configuredAppUrl
     buttonText: "Reset Password",
     buttonUrl: safeUrl,
     securityWarning: `
-			<strong>Link expires in 1 hour.</strong><br>
+			<strong>Link expires in ${PASSWORD_RESET_LIFETIME}.</strong><br>
 			For security, this link can only be used once.
 		`,
     footerNote: "If you didn't request this change, no action is needed. Your password will remain unchanged.",
@@ -2091,7 +2104,7 @@ We received a request to reset your password. Click the link below to create a n
 
 ${safeUrl}
 
-This link will expire in 1 hour.
+This link expires in ${PASSWORD_RESET_LIFETIME}.
 
 If you didn't request a password reset, you can safely ignore this email.`,
     tags: {
@@ -2109,7 +2122,7 @@ function generateEmailChangeConfirmation(data, appName = "Your App", configuredA
     buttonText: "Confirm Email Change",
     buttonUrl: safeUrl,
     securityWarning: `
-			<strong>This link expires in 24 hours.</strong><br>
+			<strong>This link expires in ${EMAIL_CHANGE_LIFETIME}.</strong><br>
 			For security, this link can only be used once.
 		`,
     footerNote: "If you didn't request this change, you can safely ignore this email.",
@@ -2129,7 +2142,7 @@ Click the link below to confirm this change:
 
 ${safeUrl}
 
-This link expires in 24 hours.
+This link expires in ${EMAIL_CHANGE_LIFETIME}.
 
 If you didn't request this change, you can safely ignore this email.`,
     tags: {
@@ -2183,7 +2196,7 @@ function generate2faCodeEmail(data, appName = "Your App", appUrl = "", branding)
 			<p>Hi ${safeFirstName},</p>
 			<p>Your verification code is:</p>
 			<p style="font-size: 32px; font-weight: bold; letter-spacing: 4px; text-align: center; margin: 24px 0; font-family: monospace;">${escapeHtml(code)}</p>
-			<p>This code expires in 5 minutes.</p>
+			<p>This code expires in ${TWO_FACTOR_CODE_LIFETIME}.</p>
 			<p>If you didn't request this code, you can safely ignore this email.</p>
 		`,
     buttonText: "",
@@ -2203,7 +2216,7 @@ Your verification code is:
 
 ${code}
 
-This code expires in 5 minutes.
+This code expires in ${TWO_FACTOR_CODE_LIFETIME}.
 
 If you didn't request this code, you can safely ignore this email.
 
@@ -3282,7 +3295,7 @@ var signupHandler = async (c) => {
   if (!invitedVerified) {
     const emailToken = generateSecureToken(32);
     const tokenHash = await hashToken(emailToken);
-    const expiresAt = Date.now() + 24 * 60 * 60 * 1e3;
+    const expiresAt = Date.now() + AUTH_DEFAULTS.EMAIL_VERIFICATION_TTL_HOURS * 60 * 60 * 1e3;
     await database.insert(schema.emailVerificationTokens).values({
       tokenHash,
       userId: newUser.id,
@@ -3361,7 +3374,7 @@ function generateEmailOtp() {
   const num = (bytes[0] << 24 | bytes[1] << 16 | bytes[2] << 8 | bytes[3]) >>> 0;
   return String(num % 1e6).padStart(6, "0");
 }
-var EMAIL_CODE_TTL_SECONDS = 300;
+var EMAIL_CODE_TTL_SECONDS = AUTH_DEFAULTS.TWO_FACTOR_EMAIL_CODE_TTL_MINUTES * 60;
 async function sendEmailChallengeCode(env, database, usersTable, user, emailBranding) {
   const code = generateEmailOtp();
   await env.OAUTH_STATES.put(`email_2fa_challenge:${user.id}`, await hashToken(code), {
@@ -4419,7 +4432,7 @@ var resendVerificationHandler = async (c) => {
   await db.delete(schema.emailVerificationTokens).where(eq19(schema.emailVerificationTokens.userId, userId));
   const emailToken = generateSecureToken(32);
   const tokenHash = await hashToken(emailToken);
-  const expiresAt = Date.now() + 24 * 60 * 60 * 1e3;
+  const expiresAt = Date.now() + AUTH_DEFAULTS.EMAIL_VERIFICATION_TTL_HOURS * 60 * 60 * 1e3;
   await db.insert(schema.emailVerificationTokens).values({
     tokenHash,
     userId: user.id,