@tachybase/module-auth 1.6.33 → 1.6.34

package/dist/externalVersion.js

@@ -1,6 +1,6 @@
 module.exports = {
   "react": "18.3.1",
-  "@tachybase/client": "1.6.33",
+  "@tachybase/client": "1.6.34",
   "react-router-dom": "6.28.1",
   "@tego/client": "1.6.17",
   "axios": "1.13.0",

package/dist/index.d.ts

@@ -1 +1 @@
-export { AuthModel, BasicAuth, default } from './server';
+export { AuthModel, BasicAuth, default, isAuthenticationSecretKey, redactSensitiveAuthenticationData, serializeAuthenticatedUser, } from './server';

package/dist/index.js

@@ -29,12 +29,18 @@ var index_exports = {};
 __export(index_exports, {
   AuthModel: () => import_server.AuthModel,
   BasicAuth: () => import_server.BasicAuth,
-  default: () => import_server.default
+  default: () => import_server.default,
+  isAuthenticationSecretKey: () => import_server.isAuthenticationSecretKey,
+  redactSensitiveAuthenticationData: () => import_server.redactSensitiveAuthenticationData,
+  serializeAuthenticatedUser: () => import_server.serializeAuthenticatedUser
 });
 module.exports = __toCommonJS(index_exports);
 var import_server = __toESM(require("./server"));
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuthModel,
-  BasicAuth
+  BasicAuth,
+  isAuthenticationSecretKey,
+  redactSensitiveAuthenticationData,
+  serializeAuthenticatedUser
 });

package/dist/node_modules/cron/package.json

@@ -1 +1 @@
-{"name":"cron","description":"Cron jobs for your node","version":"3.3.1","author":"Nick Campbell <nicholas.j.campbell@gmail.com> (https://github.com/ncb000gt)","bugs":{"url":"https://github.com/kelektiv/node-cron/issues"},"repository":{"type":"git","url":"https://github.com/kelektiv/node-cron.git"},"main":"dist/index.js","types":"dist/index.d.ts","scripts":{"build":"tsc -b tsconfig.build.json","lint:eslint":"eslint src/ tests/","lint:prettier":"prettier ./**/*.{json,md,yml} --check","lint":"npm run lint:eslint && npm run lint:prettier","lint:fix":"npm run lint:eslint -- --fix && npm run lint:prettier -- --write","test":"jest --coverage","test:watch":"jest --watch --coverage","test:fuzz":"jest  --testMatch='**/*.fuzz.ts' --coverage=false --testTimeout=120000","prepare":"husky"},"dependencies":{"@types/luxon":"~3.4.0","luxon":"~3.5.0"},"devDependencies":{"@commitlint/cli":"19.6.0","@eslint/js":"^9.14.0","@fast-check/jest":"2.0.3","@insurgent/commitlint-config":"20.0.0","@insurgent/conventional-changelog-preset":"10.0.0","@semantic-release/changelog":"6.0.3","@semantic-release/commit-analyzer":"13.0.0","@semantic-release/git":"10.0.1","@semantic-release/github":"11.0.1","@semantic-release/npm":"12.0.1","@semantic-release/release-notes-generator":"14.0.1","@types/jest":"29.5.14","@types/node":"20.17.9","@types/sinon":"17.0.3","chai":"4.5.0","eslint":"8.57.1","eslint-config-prettier":"9.1.0","eslint-plugin-jest":"27.9.0","eslint-plugin-prettier":"5.2.1","husky":"9.1.7","jest":"29.7.0","lint-staged":"15.2.10","prettier":"3.3.3","semantic-release":"24.2.0","sinon":"17.0.2","ts-jest":"29.2.5","typescript":"5.7.2","typescript-eslint":"^7.2.0"},"keywords":["cron","node cron","node-cron","schedule","scheduler","cronjob","cron job"],"license":"MIT","contributors":["Brandon der Blätter <https://interlucid.com/contact/> (https://github.com/intcreator)","Pierre Cavin <me@sherlox.io> (https://github.com/sheerlox)","Romain Beauxis <toots@rastageeks.org> (https://github.com/toots)","James Padolsey <> (https://github.com/jamespadolsey)","Finn Herpich <fh@three-heads.de> (https://github.com/ErrorProne)","Clifton Cunningham <clifton.cunningham@gmail.com> (https://github.com/cliftonc)","Eric Abouaf <eric.abouaf@gmail.com> (https://github.com/neyric)","humanchimp <morphcham@gmail.com> (https://github.com/humanchimp)","Craig Condon <craig@spiceapps.com> (https://github.com/spiceapps)","Dan Bear <daniel@hulu.com> (https://github.com/danhbear)","Vadim Baryshev <vadimbaryshev@gmail.com> (https://github.com/baryshev)","Leandro Ferrari <lfthomaz@gmail.com> (https://github.com/lfthomaz)","Gregg Zigler <greggzigler@gmail.com> (https://github.com/greggzigler)","Jordan Abderrachid <jabderrachid@gmail.com> (https://github.com/jordanabderrachid)","Masakazu Matsushita <matsukaz@gmail.com> (matsukaz)","Christopher Lunt <me@kirisu.co.uk> (https://github.com/kirisu)"],"files":["dist/**/*.js","dist/**/*.d.ts","CHANGELOG.md","LICENSE","README.md"],"lint-staged":{"*.ts":"eslint src/ tests/ --fix","*.{json,md,yml}":"prettier ./**/*.{json,md,yml} --check --write"},"_lastModified":"2026-08-13T08:16:12.473Z"}
+{"name":"cron","description":"Cron jobs for your node","version":"3.3.1","author":"Nick Campbell <nicholas.j.campbell@gmail.com> (https://github.com/ncb000gt)","bugs":{"url":"https://github.com/kelektiv/node-cron/issues"},"repository":{"type":"git","url":"https://github.com/kelektiv/node-cron.git"},"main":"dist/index.js","types":"dist/index.d.ts","scripts":{"build":"tsc -b tsconfig.build.json","lint:eslint":"eslint src/ tests/","lint:prettier":"prettier ./**/*.{json,md,yml} --check","lint":"npm run lint:eslint && npm run lint:prettier","lint:fix":"npm run lint:eslint -- --fix && npm run lint:prettier -- --write","test":"jest --coverage","test:watch":"jest --watch --coverage","test:fuzz":"jest  --testMatch='**/*.fuzz.ts' --coverage=false --testTimeout=120000","prepare":"husky"},"dependencies":{"@types/luxon":"~3.4.0","luxon":"~3.5.0"},"devDependencies":{"@commitlint/cli":"19.6.0","@eslint/js":"^9.14.0","@fast-check/jest":"2.0.3","@insurgent/commitlint-config":"20.0.0","@insurgent/conventional-changelog-preset":"10.0.0","@semantic-release/changelog":"6.0.3","@semantic-release/commit-analyzer":"13.0.0","@semantic-release/git":"10.0.1","@semantic-release/github":"11.0.1","@semantic-release/npm":"12.0.1","@semantic-release/release-notes-generator":"14.0.1","@types/jest":"29.5.14","@types/node":"20.17.9","@types/sinon":"17.0.3","chai":"4.5.0","eslint":"8.57.1","eslint-config-prettier":"9.1.0","eslint-plugin-jest":"27.9.0","eslint-plugin-prettier":"5.2.1","husky":"9.1.7","jest":"29.7.0","lint-staged":"15.2.10","prettier":"3.3.3","semantic-release":"24.2.0","sinon":"17.0.2","ts-jest":"29.2.5","typescript":"5.7.2","typescript-eslint":"^7.2.0"},"keywords":["cron","node cron","node-cron","schedule","scheduler","cronjob","cron job"],"license":"MIT","contributors":["Brandon der Blätter <https://interlucid.com/contact/> (https://github.com/intcreator)","Pierre Cavin <me@sherlox.io> (https://github.com/sheerlox)","Romain Beauxis <toots@rastageeks.org> (https://github.com/toots)","James Padolsey <> (https://github.com/jamespadolsey)","Finn Herpich <fh@three-heads.de> (https://github.com/ErrorProne)","Clifton Cunningham <clifton.cunningham@gmail.com> (https://github.com/cliftonc)","Eric Abouaf <eric.abouaf@gmail.com> (https://github.com/neyric)","humanchimp <morphcham@gmail.com> (https://github.com/humanchimp)","Craig Condon <craig@spiceapps.com> (https://github.com/spiceapps)","Dan Bear <daniel@hulu.com> (https://github.com/danhbear)","Vadim Baryshev <vadimbaryshev@gmail.com> (https://github.com/baryshev)","Leandro Ferrari <lfthomaz@gmail.com> (https://github.com/lfthomaz)","Gregg Zigler <greggzigler@gmail.com> (https://github.com/greggzigler)","Jordan Abderrachid <jabderrachid@gmail.com> (https://github.com/jordanabderrachid)","Masakazu Matsushita <matsukaz@gmail.com> (matsukaz)","Christopher Lunt <me@kirisu.co.uk> (https://github.com/kirisu)"],"files":["dist/**/*.js","dist/**/*.d.ts","CHANGELOG.md","LICENSE","README.md"],"lint-staged":{"*.ts":"eslint src/ tests/ --fix","*.{json,md,yml}":"prettier ./**/*.{json,md,yml} --check --write"},"_lastModified":"2026-08-13T17:41:37.104Z"}

package/dist/node_modules/ms/package.json

@@ -1 +1 @@
-{"name":"ms","version":"2.1.3","description":"Tiny millisecond conversion utility","repository":"vercel/ms","main":"./index","files":["index.js"],"scripts":{"precommit":"lint-staged","lint":"eslint lib/* bin/*","test":"mocha tests.js"},"eslintConfig":{"extends":"eslint:recommended","env":{"node":true,"es6":true}},"lint-staged":{"*.js":["npm run lint","prettier --single-quote --write","git add"]},"license":"MIT","devDependencies":{"eslint":"4.18.2","expect.js":"0.3.1","husky":"0.14.3","lint-staged":"5.0.0","mocha":"4.0.1","prettier":"2.0.5"},"_lastModified":"2026-08-13T08:16:12.578Z"}
+{"name":"ms","version":"2.1.3","description":"Tiny millisecond conversion utility","repository":"vercel/ms","main":"./index","files":["index.js"],"scripts":{"precommit":"lint-staged","lint":"eslint lib/* bin/*","test":"mocha tests.js"},"eslintConfig":{"extends":"eslint:recommended","env":{"node":true,"es6":true}},"lint-staged":{"*.js":["npm run lint","prettier --single-quote --write","git add"]},"license":"MIT","devDependencies":{"eslint":"4.18.2","expect.js":"0.3.1","husky":"0.14.3","lint-staged":"5.0.0","mocha":"4.0.1","prettier":"2.0.5"},"_lastModified":"2026-08-13T17:41:37.203Z"}

package/dist/server/index.d.ts

@@ -1,3 +1,4 @@
 export { BasicAuth } from './basic-auth';
 export { AuthModel } from './model/authenticator';
+export { isAuthenticationSecretKey, redactSensitiveAuthenticationData, serializeAuthenticatedUser, } from './sensitive-data';
 export { default } from './plugin';

package/dist/server/index.js

@@ -29,14 +29,21 @@ var server_exports = {};
 __export(server_exports, {
   AuthModel: () => import_authenticator.AuthModel,
   BasicAuth: () => import_basic_auth.BasicAuth,
-  default: () => import_plugin.default
+  default: () => import_plugin.default,
+  isAuthenticationSecretKey: () => import_sensitive_data.isAuthenticationSecretKey,
+  redactSensitiveAuthenticationData: () => import_sensitive_data.redactSensitiveAuthenticationData,
+  serializeAuthenticatedUser: () => import_sensitive_data.serializeAuthenticatedUser
 });
 module.exports = __toCommonJS(server_exports);
 var import_basic_auth = require("./basic-auth");
 var import_authenticator = require("./model/authenticator");
+var import_sensitive_data = require("./sensitive-data");
 var import_plugin = __toESM(require("./plugin"));
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuthModel,
-  BasicAuth
+  BasicAuth,
+  isAuthenticationSecretKey,
+  redactSensitiveAuthenticationData,
+  serializeAuthenticatedUser
 });

package/dist/server/plugin.js

@@ -39,6 +39,7 @@ var import_authenticators = __toESM(require("./actions/authenticators"));
 var import_basic_auth = require("./basic-auth");
 var import_locale = require("./locale");
 var import_authenticator = require("./model/authenticator");
+var import_sensitive_data = require("./sensitive-data");
 var import_storer = require("./storer");
 var import_token_blacklist = require("./token-blacklist");
 var import_token_controller = require("./token-controller");
@@ -130,6 +131,40 @@ class PluginAuthServer extends import_server.Plugin {
     Object.entries(import_authenticators.default).forEach(
       ([action, handler]) => this.app.resourcer.registerAction(`authenticators:${action}`, handler)
     );
+    this.app.resourcer.use(
+      async (ctx, next) => {
+        var _a, _b;
+        await next();
+        if (((_a = ctx.action) == null ? void 0 : _a.resourceName) !== "auth") {
+          return;
+        }
+        if (ctx.action.actionName === "check") {
+          const responseUser = (0, import_sensitive_data.serializeAuthenticatedUser)(ctx.body);
+          const userWithPassword = responseUser.id ? await ctx.db.getRepository("users").findOne({
+            filterByTk: responseUser.id,
+            fields: ["id", "password"],
+            raw: true
+          }) : null;
+          ctx.body = {
+            ...responseUser,
+            hasPassword: (0, import_sensitive_data.serializeAuthenticatedUser)(userWithPassword).hasPassword
+          };
+          return;
+        }
+        if (ctx.action.actionName === "signIn" && ((_b = ctx.body) == null ? void 0 : _b.user)) {
+          const response = (0, import_sensitive_data.redactSensitiveAuthenticationData)(ctx.body);
+          ctx.body = {
+            ...response,
+            user: (0, import_sensitive_data.serializeAuthenticatedUser)(ctx.body.user)
+          };
+          return;
+        }
+        if (ctx.body !== void 0) {
+          ctx.body = (0, import_sensitive_data.redactSensitiveAuthenticationData)(ctx.body);
+        }
+      },
+      { tag: "redactAuthenticationSecrets" }
+    );
     ["signIn", "signUp"].forEach((action) => this.app.acl.allow("auth", action));
     ["check", "signOut", "changePassword"].forEach((action) => this.app.acl.allow("auth", action, "loggedIn"));
     this.app.acl.allow("authenticators", "publicList");

package/dist/server/sensitive-data.d.ts

@@ -0,0 +1,3 @@
+export declare function isAuthenticationSecretKey(key: unknown): boolean;
+export declare function redactSensitiveAuthenticationData<T>(value: T): T;
+export declare function serializeAuthenticatedUser(user: any): any;

package/dist/server/sensitive-data.js

@@ -0,0 +1,103 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var sensitive_data_exports = {};
+__export(sensitive_data_exports, {
+  isAuthenticationSecretKey: () => isAuthenticationSecretKey,
+  redactSensitiveAuthenticationData: () => redactSensitiveAuthenticationData,
+  serializeAuthenticatedUser: () => serializeAuthenticatedUser
+});
+module.exports = __toCommonJS(sensitive_data_exports);
+var import_server = require("@tego/server");
+const AUTHENTICATION_SECRET_KEYS = /* @__PURE__ */ new Set(["password", "resetToken"]);
+function isAuthenticationSecretKey(key) {
+  return typeof key === "string" && AUTHENTICATION_SECRET_KEYS.has(key);
+}
+function isSensitiveKeyValueEntry(value) {
+  if (!value || typeof value !== "object" || !Object.prototype.hasOwnProperty.call(value, "value")) {
+    return false;
+  }
+  const key = Reflect.get(value, "key");
+  return typeof key === "string" && key.split(".").some(isAuthenticationSecretKey);
+}
+function redact(value, seen) {
+  if (value === null || typeof value !== "object") {
+    return value;
+  }
+  if (value instanceof Date) {
+    return new Date(value.getTime());
+  }
+  if (seen.has(value)) {
+    return seen.get(value);
+  }
+  let serialized = value;
+  if (value instanceof import_server.Model) {
+    try {
+      serialized = value.get({ plain: true });
+    } catch {
+      serialized = value.dataValues;
+    }
+  }
+  if (serialized === null || typeof serialized !== "object") {
+    seen.set(value, serialized);
+    return serialized;
+  }
+  if (serialized instanceof Date) {
+    const result2 = new Date(serialized.getTime());
+    seen.set(value, result2);
+    return result2;
+  }
+  const result = Array.isArray(serialized) ? [] : {};
+  seen.set(value, result);
+  seen.set(serialized, result);
+  if (Array.isArray(serialized)) {
+    for (const item of serialized) {
+      if (!isSensitiveKeyValueEntry(item)) {
+        result.push(redact(item, seen));
+      }
+    }
+    return result;
+  }
+  for (const key of Reflect.ownKeys(serialized)) {
+    if (isAuthenticationSecretKey(key)) {
+      continue;
+    }
+    if (key === "toJSON" && typeof serialized[key] === "function") {
+      continue;
+    }
+    result[key] = redact(serialized[key], seen);
+  }
+  return result;
+}
+function redactSensitiveAuthenticationData(value) {
+  return redact(value, /* @__PURE__ */ new WeakMap());
+}
+function serializeAuthenticatedUser(user) {
+  var _a, _b;
+  const password = ((_a = user == null ? void 0 : user.get) == null ? void 0 : _a.call(user, "password")) ?? (user == null ? void 0 : user.password);
+  const hasPassword = password === void 0 ? ((_b = user == null ? void 0 : user.get) == null ? void 0 : _b.call(user, "hasPassword")) ?? (user == null ? void 0 : user.hasPassword) ?? false : typeof password === "string" ? password.length > 0 : password != null;
+  return {
+    ...redactSensitiveAuthenticationData(user ?? {}),
+    hasPassword
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  isAuthenticationSecretKey,
+  redactSensitiveAuthenticationData,
+  serializeAuthenticatedUser
+});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tachybase/module-auth",
   "displayName": "Authentication",
-  "version": "1.6.33",
+  "version": "1.6.34",
   "description": "User authentication management, including password, SMS, and support for Single Sign-On (SSO) protocols, with extensibility.",
   "keywords": [
     "Authentication",
@@ -32,7 +32,7 @@
     "react": "18.3.1",
     "react-i18next": "16.2.1",
     "react-router-dom": "6.28.1",
-    "@tachybase/client": "1.6.33"
+    "@tachybase/client": "1.6.34"
   },
   "description.zh-CN": "用户认证管理，包括基础的密码认证、短信认证、SSO 协议的认证等，可扩展。",
   "displayName.zh-CN": "用户认证",