@udibo/oauth2 0.43.0 → 0.44.0

package/dist/identity/service.d.ts

@@ -45,7 +45,14 @@ export interface IdentityUserStore<User extends IdentityUser> {
     create(profile: Record<string, unknown>, credential: PasswordCredential): Promise<User>;
     /** Find a user by a sign-in identifier (email/username/phone). */
     findByIdentifier(identifier: string): Promise<User | undefined>;
-    /** Find a user by email (password-reset / re-verification requests). */
+    /**
+     * Find a user by email (password-reset / sign-in-link requests).
+     *
+     * Also called when a mailed reset, sign-in or account-unlock link is
+     * redeemed: the link works only while this still resolves the address it
+     * was sent to to the same user. Normalize as at write time; a lookup that
+     * case-folds lets a link requested with different casing still redeem.
+     */
     findByEmail(email: string): Promise<User | undefined>;
     /**
      * The user's stored password credential, or `undefined`.
@@ -482,7 +489,10 @@ export declare class IdentityService<User extends IdentityUser> {
      * was configured) revoke **all** of the user's sessions via
      * `revokeAllByUser`. Clears any failed-attempt lockout — the emailed token
      * proves the same account ownership the unlock flow does. Returns
-     * `{ userId }`, or `null` for an invalid/expired/used token.
+     * `{ userId }`, or `null` for an invalid/expired/used token — including one
+     * whose address no longer finds this user through
+     * {@link IdentityUserStore.findByEmail}, because the account's email moved
+     * after the link was mailed. That refusal leaves the token unspent.
      *
      * A reset is the user's "lock everyone else out" action, so the outstanding
      * passwordless credentials for the same account are voided too: sign-in links
@@ -558,7 +568,10 @@ export declare class IdentityService<User extends IdentityUser> {
      * Mint + deliver a single-use account-unlock link after a lockout. Call it
      * with the locked account's email (typically from your `lockout` event
      * handler — the service only knows opaque user ids). Requires `tokens` and
-     * a `delivery.sendAccountUnlock` hook to actually send. With a `rateLimiter`
+     * a `delivery.sendAccountUnlock` hook to actually send. `email` must be an
+     * address {@link IdentityUserStore.findByEmail} resolves to `userId`:
+     * {@link IdentityService.unlockAccount} refuses the link once it does not.
+     * With a `rateLimiter`
      * (or a tighter `rateLimiters.accountUnlock`), requests throttle per user and
      * throw {@link IdentityError} `rate_limited` when exceeded.
      */
@@ -568,7 +581,9 @@ export declare class IdentityService<User extends IdentityUser> {
     }): Promise<void>;
     /**
      * Consume an unlock token and clear the account's lockout state (failures
-     * and lock). The self-service unlock path: the emailed link lands here.
+     * and lock). The self-service unlock path: the emailed link lands here. A
+     * link whose address no longer finds this user through
+     * {@link IdentityUserStore.findByEmail} reports `invalid` and stays unspent.
      */
     unlockAccount(token: string): Promise<UnlockAccountResult>;
     /**
@@ -598,7 +613,9 @@ export declare class IdentityService<User extends IdentityUser> {
      * stays your app's job. So does re-resolving the user: a user deleted or
      * disabled since the link was minted must be treated as `invalid` by your
      * user store, not signed in. `expired` and `invalid` are distinguished so
-     * the UI can offer a fresh link.
+     * the UI can offer a fresh link. A link whose address no longer finds this
+     * user through {@link IdentityUserStore.findByEmail} — the account's email
+     * moved after it was mailed — reports `invalid` and stays unspent.
      */
     consumeSignInLink(token: string): Promise<ConsumeSignInLinkResult>;
     /**

package/dist/identity/service.js

@@ -236,7 +236,6 @@ export class IdentityService {
             hook: "sendPasswordReset",
             to: normalized,
             subject: user.id,
-            data: { email: normalized },
             ttlMs: this.#ttl.passwordReset,
             requested: {
                 type: "password_reset.requested",
@@ -250,7 +249,10 @@ export class IdentityService {
      * was configured) revoke **all** of the user's sessions via
      * `revokeAllByUser`. Clears any failed-attempt lockout — the emailed token
      * proves the same account ownership the unlock flow does. Returns
-     * `{ userId }`, or `null` for an invalid/expired/used token.
+     * `{ userId }`, or `null` for an invalid/expired/used token — including one
+     * whose address no longer finds this user through
+     * {@link IdentityUserStore.findByEmail}, because the account's email moved
+     * after the link was mailed. That refusal leaves the token unspent.
      *
      * A reset is the user's "lock everyone else out" action, so the outstanding
      * passwordless credentials for the same account are voided too: sign-in links
@@ -298,6 +300,7 @@ export class IdentityService {
                 type: "password_reset.failed",
                 reason: "invalid_token",
             }),
+            addressBound: true,
         });
         if (consumed.status !== "success")
             return null;
@@ -371,7 +374,6 @@ export class IdentityService {
             to: input.email,
             subject: input.userId,
             ttlMs: this.#ttl.emailVerification,
-            data: { email: input.email },
             requested: {
                 type: "email_verification.requested",
                 userId: input.userId,
@@ -421,7 +423,10 @@ export class IdentityService {
      * Mint + deliver a single-use account-unlock link after a lockout. Call it
      * with the locked account's email (typically from your `lockout` event
      * handler — the service only knows opaque user ids). Requires `tokens` and
-     * a `delivery.sendAccountUnlock` hook to actually send. With a `rateLimiter`
+     * a `delivery.sendAccountUnlock` hook to actually send. `email` must be an
+     * address {@link IdentityUserStore.findByEmail} resolves to `userId`:
+     * {@link IdentityService.unlockAccount} refuses the link once it does not.
+     * With a `rateLimiter`
      * (or a tighter `rateLimiters.accountUnlock`), requests throttle per user and
      * throw {@link IdentityError} `rate_limited` when exceeded.
      */
@@ -446,7 +451,9 @@ export class IdentityService {
     }
     /**
      * Consume an unlock token and clear the account's lockout state (failures
-     * and lock). The self-service unlock path: the emailed link lands here.
+     * and lock). The self-service unlock path: the emailed link lands here. A
+     * link whose address no longer finds this user through
+     * {@link IdentityUserStore.findByEmail} reports `invalid` and stays unspent.
      */
     async unlockAccount(token) {
         const tokens = this.#requireTokens("unlockAccount");
@@ -455,6 +462,7 @@ export class IdentityService {
             purpose: TokenPurpose.AccountUnlock,
             token,
             failed: (reason) => ({ type: "account_unlock.failed", reason }),
+            addressBound: true,
         });
         if (result.status !== "success")
             return result;
@@ -527,7 +535,9 @@ export class IdentityService {
      * stays your app's job. So does re-resolving the user: a user deleted or
      * disabled since the link was minted must be treated as `invalid` by your
      * user store, not signed in. `expired` and `invalid` are distinguished so
-     * the UI can offer a fresh link.
+     * the UI can offer a fresh link. A link whose address no longer finds this
+     * user through {@link IdentityUserStore.findByEmail} — the account's email
+     * moved after it was mailed — reports `invalid` and stays unspent.
      */
     async consumeSignInLink(token) {
         const tokens = this.#requireTokens("consumeSignInLink");
@@ -536,6 +546,7 @@ export class IdentityService {
             purpose: TokenPurpose.SignIn,
             token,
             failed: (reason) => ({ type: "signin_link.failed", reason }),
+            addressBound: true,
         });
         if (result.status !== "success")
             return result;
@@ -783,7 +794,7 @@ export class IdentityService {
         const { token, expiresAt } = await tokens.create({
             purpose: DELIVERY_PURPOSES[request.hook],
             subject: request.subject,
-            data: request.data,
+            data: { email: request.to },
             ttlMs: request.ttlMs,
             invalidateExisting: true,
         });
@@ -797,7 +808,9 @@ export class IdentityService {
             await this.#emit(input.failed("expired"));
             return { status: "expired" };
         }
-        if (status.status !== "valid") {
+        if (status.status !== "valid" ||
+            (input.addressBound &&
+                !(await this.#stillAddressedTo(status.subject, status.data)))) {
             await this.#emit(input.failed("invalid"));
             return { status: "invalid" };
         }
@@ -809,6 +822,12 @@ export class IdentityService {
         }
         return { status: "success", resolved };
     }
+    async #stillAddressedTo(subject, data) {
+        const email = emailFromData(data);
+        if (email === undefined)
+            return true;
+        return (await this.#users.findByEmail(email))?.id === subject;
+    }
     #emit(event) {
         return dispatchIdentityEvent(this.#onEvent, "identity", event);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "keywords": [
     "authorization-server",