@voltro/plugin-auth 0.22.1 → 0.24.0

package/dist/{strategy-D345j4df.js → strategy-Ce4FlGi4.js}

@@ -35,9 +35,9 @@ var s = 3e4, c = 1e4, l = (e, t = {}) => {
 	kind: "typeid",
 	prefix: e
 }, e), p = (e = []) => {
-	let t = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), i = [], a = [], o = [], s = [], c = [];
+	let t = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), i = [], a = [], o = [], s = [], c = [], l = /* @__PURE__ */ new Map();
 	for (let n of e) t.set(n.id, n), r.set(n.email.toLowerCase(), n);
-	let l = (e, i) => n.gen(function* () {
+	let p = (e, i) => n.gen(function* () {
 		let a = t.get(e);
 		if (!a) return yield* n.fail(new d({ userId: e }));
 		let o = i(a);
@@ -56,20 +56,20 @@ var s = 3e4, c = 1e4, l = (e, t = {}) => {
 			};
 			return t.set(a.id, a), r.set(i, a), a;
 		}),
-		updatePassword: (e, t) => l(e, (e) => ({
+		updatePassword: (e, t) => p(e, (e) => ({
 			...e,
 			passwordHash: t
 		})),
-		setMfaSecret: (e, t) => l(e, (e) => ({
+		setMfaSecret: (e, t) => p(e, (e) => ({
 			...e,
 			mfaSecret: t,
 			mfaEnrolledAt: null
 		})),
-		markMfaEnrolled: (e) => l(e, (e) => ({
+		markMfaEnrolled: (e) => p(e, (e) => ({
 			...e,
 			mfaEnrolledAt: /* @__PURE__ */ new Date()
 		})),
-		clearMfa: (e) => l(e, (e) => ({
+		clearMfa: (e) => p(e, (e) => ({
 			...e,
 			mfaSecret: null,
 			mfaEnrolledAt: null
@@ -173,6 +173,27 @@ var s = 3e4, c = 1e4, l = (e, t = {}) => {
 				counter: t,
 				lastUsedAt: /* @__PURE__ */ new Date()
 			}, !0);
+		}),
+		isLockedOut: (e, t) => n.sync(() => {
+			let n = l.get(e.toLowerCase());
+			return n?.lockedUntil != null && t < n.lockedUntil ? {
+				locked: !0,
+				retryAfterSeconds: Math.ceil((n.lockedUntil - t) / 1e3)
+			} : {
+				locked: !1,
+				retryAfterSeconds: 0
+			};
+		}),
+		recordLoginFailure: (e, t, r) => n.sync(() => {
+			let n = e.toLowerCase(), i = l.get(n), a = i?.windowStartedAt == null || t - i.windowStartedAt >= r.windowMs, o = i?.lockedUntil != null && t >= i.lockedUntil, s = !i || a || o, c = s ? 1 : i.failedCount + 1, u = s ? t : i.windowStartedAt, d = c >= r.maxAttempts ? t + r.lockMs : null;
+			l.set(n, {
+				failedCount: c,
+				windowStartedAt: u,
+				lockedUntil: d
+			});
+		}),
+		clearLoginFailures: (e) => n.sync(() => {
+			l.delete(e.toLowerCase());
 		})
 	};
 }, m = (e, t = {}) => {

package/dist/strategy.d.ts

@@ -4,6 +4,26 @@ import { SessionSecrets } from '@voltro/protocol/session';
 import { VoidIfEmpty } from 'effect/Types';
 import { YieldableError } from 'effect/Cause';
 
+/**
+ * Brute-force lockout policy, resolved from `AuthConfig.lockout` and passed
+ * INTO the store on each failure so the store itself stays policy-free.
+ * Times in milliseconds; `now` everywhere is epoch-ms so tests can inject a
+ * clock. Kept keyed by EMAIL (not user id) on purpose — a locked account must
+ * not read differently from an unknown one, or the lock becomes an existence
+ * oracle. See `loginAttemptsTable`.
+ */
+declare interface LockoutPolicy {
+    readonly maxAttempts: number;
+    readonly windowMs: number;
+    readonly lockMs: number;
+}
+
+declare interface LockoutState {
+    readonly locked: boolean;
+    /** Seconds until the lock lifts; 0 when not locked. */
+    readonly retryAfterSeconds: number;
+}
+
 /** One tenant a user belongs to. The active tenant lives on the Subject;
  *  the full set drives the switch-tenant menu + the switch-tenant guard. */
 declare interface MembershipRecord {
@@ -217,6 +237,16 @@ declare interface UserStore {
      *  the write are ONE atomic statement at the store, so two replicas
      *  racing the same counter can't both succeed. */
     readonly advancePasskeyCounter: (credentialId: string, newCounter: number) => Effect.Effect<boolean>;
+    /** Is this email currently locked out? Reads only — never mutates. Returns
+     *  the remaining cooldown so the handler can surface a retry-after. */
+    readonly isLockedOut: (email: string, now: number) => Effect.Effect<LockoutState>;
+    /** Record one failed credential attempt for `email`. Opens a fresh window
+     *  when the previous one (or a prior lock) has expired, otherwise increments;
+     *  sets the lock once `failedCount` reaches `policy.maxAttempts`. Called only
+     *  for a NOT-currently-locked email (the handler checks `isLockedOut` first). */
+    readonly recordLoginFailure: (email: string, now: number, policy: LockoutPolicy) => Effect.Effect<void>;
+    /** Clear the counter for `email` on a completed login. */
+    readonly clearLoginFailures: (email: string) => Effect.Effect<void>;
 }
 
 export declare const voltroPasswordStrategy: (options?: VoltroPasswordStrategyOptions) => AuthStrategy;

package/dist/strategy.js

@@ -1,3 +1,3 @@
 import "./session.js";
-import { t as e } from "./strategy-D345j4df.js";
+import { t as e } from "./strategy-Ce4FlGi4.js";
 export { e as voltroPasswordStrategy };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-auth",
-  "version": "0.22.1",
+  "version": "0.24.0",
   "description": "Authentication primitives: password hashing, session creation, schema mixin + tables. Pairs with the `auth` app template for the UI; both independently usable. Server-side only (uses node:crypto).",
   "keywords": [
     "voltro",
@@ -78,8 +78,8 @@
   },
   "dependencies": {
     "@effect/sql": "^0.52.0",
-    "@voltro/database": "0.22.1",
-    "@voltro/protocol": "0.22.1"
+    "@voltro/database": "0.24.0",
+    "@voltro/protocol": "0.24.0"
   },
   "peerDependencies": {
     "effect": "^3.22.0",