@voltro/plugin-auth 0.33.0 → 0.34.0

package/dist/index.js

@@ -1,28 +1,28 @@
 import { PasswordEmptyError as e, PasswordHashError as t, hashPassword as n, needsRehash as r, parseScryptParams as i, verifyPassword as a, verifyPasswordWithRehash as o } from "./password.js";
 import { SESSION_COOKIE_NAME as s, clearSessionCookie as c, issueSession as l, readSession as u, readSessionKeyed as d, resolveSessionSecret as f, resolveSessionSecrets as p, sessionSecretsOf as m } from "./session.js";
-import { a as h, c as g, i as _, l as v, n as y, o as b, r as x, s as S, t as C } from "./strategy-Ce4FlGi4.js";
-import { A as w, C as T, D as E, E as D, F as O, I as k, L as A, M as ee, N as te, O as j, P as M, S as N, T as P, _ as F, a as I, b as L, c as R, d as z, f as B, g as V, h as H, i as U, j as W, k as G, l as K, m as q, n as J, o as Y, p as X, r as ne, s as Z, t as re, u as ie, v as ae, w as oe, x as se, y as ce } from "./plugin-ZXs8LFn0.js";
-import { MAGIC_LINK_TTL_S as le, PASSWORD_RESET_TTL_S as ue, hashToken as de, mintToken as fe } from "./tokens.js";
-import { CSRF_COOKIE_NAME as pe, CSRF_HEADER_NAME as me, isCsrfTokenWellFormed as Q, issueCsrfToken as he, verifyCsrf as ge } from "./csrf.js";
-import { generateChallenge as _e, verifyAssertion as ve, verifyRegistration as ye } from "./webauthn.js";
+import { a as h, c as g, i as _, l as v, n as y, o as b, r as x, s as S, t as C } from "./strategy-Bty6_XUj.js";
+import { $ as w, A as T, B as E, C as D, D as O, E as k, F as A, G as j, H as M, I as N, J as P, K as F, L as I, M as L, N as R, O as z, P as B, Q as V, R as H, S as ee, T as te, U as ne, V as U, W, X as G, Y as K, Z as q, _ as J, a as Y, at as X, b as Z, c as re, ct as ie, d as ae, dt as oe, et as se, f as ce, g as le, h as ue, i as de, it as fe, j as pe, k as me, l as he, lt as ge, m as _e, n as ve, nt as ye, o as be, ot as xe, p as Se, q as Ce, r as we, rt as Te, s as Ee, st as De, t as Oe, tt as ke, u as Ae, ut as je, v as Me, w as Ne, x as Pe, y as Fe, z as Ie } from "./plugin-BZm5Semm.js";
+import { EMAIL_VERIFY_TTL_S as Le, MAGIC_LINK_TTL_S as Re, MFA_PENDING_TTL_S as ze, PASSWORD_RESET_TTL_S as Be, hashToken as Ve, mintSecret as He, mintToken as Q } from "./tokens.js";
+import { CSRF_COOKIE_NAME as Ue, CSRF_HEADER_NAME as We, isCsrfTokenWellFormed as Ge, issueCsrfToken as Ke, verifyCsrf as qe } from "./csrf.js";
+import { generateChallenge as Je, verifyAssertion as Ye, verifyRegistration as Xe } from "./webauthn.js";
 import { Effect as $ } from "effect";
 //#region src/postgresUserStore.ts
-var be = (e) => {
+var Ze = (e) => {
 	let t = e?.code;
 	if (typeof t == "string") return t;
 	let n = e?.cause?.code;
 	return typeof n == "string" ? n : void 0;
-}, xe = (e) => {
+}, Qe = (e) => {
 	let t = (t) => $.gen(function* () {
 		return (yield* e`
-        SELECT id, email, "passwordHash", "tenantId", "createdAt", "mfaSecret", "mfaEnrolledAt"
+        SELECT id, email, "passwordHash", "tenantId", "createdAt", "mfaSecret", "mfaEnrolledAt", "emailVerifiedAt"
         FROM users
         WHERE email = ${t.toLowerCase()}
         LIMIT 1
       `)[0] ?? null;
 	}).pipe($.orElseSucceed(() => null)), n = (t) => $.gen(function* () {
 		return (yield* e`
-        SELECT id, email, "passwordHash", "tenantId", "createdAt", "mfaSecret", "mfaEnrolledAt"
+        SELECT id, email, "passwordHash", "tenantId", "createdAt", "mfaSecret", "mfaEnrolledAt", "emailVerifiedAt"
         FROM users
         WHERE id = ${t}
         LIMIT 1
@@ -36,10 +36,10 @@ var be = (e) => {
 			...t,
 			email: n,
 			createdAt: r
-		})), $.catchAll((e) => be(e) === "23505" ? $.fail(new y({ email: n })) : $.die(e)));
+		})), $.catchAll((e) => Ze(e) === "23505" ? $.fail(new y({ email: n })) : $.die(e)));
 	}), i = (t) => $.gen(function* () {
 		return (yield* e`
-        SELECT id, email, "passwordHash", "tenantId", "createdAt", "mfaSecret", "mfaEnrolledAt"
+        SELECT id, email, "passwordHash", "tenantId", "createdAt", "mfaSecret", "mfaEnrolledAt", "emailVerifiedAt"
         FROM users WHERE id = ${t} LIMIT 1
       `)[0] || (yield* $.fail(new x({ userId: t })));
 	}).pipe($.catchTag("SqlError", (e) => $.die(e))), a = (t, n) => $.gen(function* () {
@@ -66,12 +66,18 @@ var be = (e) => {
          WHERE id = ${t}
       `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* i(t);
 	}), l = (t) => $.gen(function* () {
+		return yield* e`
+        UPDATE users
+           SET "emailVerifiedAt" = ${/* @__PURE__ */ new Date()}, "updatedAt" = ${/* @__PURE__ */ new Date()}
+         WHERE id = ${t} AND "emailVerifiedAt" IS NULL
+      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* i(t);
+	}), u = (t) => $.gen(function* () {
 		return (yield* e`
         SELECT "userId", "tenantId", role, "joinedAt"
           FROM memberships WHERE "userId" = ${t}
           ORDER BY "joinedAt" ASC
       `).map((e) => ({ ...e }));
-	}).pipe($.orElseSucceed(() => [])), u = (t) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => [])), d = (t) => $.gen(function* () {
 		let n = /* @__PURE__ */ new Date();
 		yield* e`
         UPDATE memberships SET role = ${t.role}
@@ -93,18 +99,18 @@ var be = (e) => {
 	}).pipe($.catchAll(() => $.succeed({
 		...t,
 		joinedAt: /* @__PURE__ */ new Date()
-	}))), d = (t, n) => $.gen(function* () {
+	}))), f = (t, n) => $.gen(function* () {
 		return (yield* e`
         SELECT role FROM memberships
          WHERE "userId" = ${t} AND "tenantId" = ${n} LIMIT 1
       `)[0]?.role ?? null;
-	}).pipe($.orElseSucceed(() => null)), f = (t) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => null)), p = (t) => $.gen(function* () {
 		return (yield* e`
         SELECT id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt"
           FROM sessions WHERE "userId" = ${t}
           ORDER BY "createdAt" DESC
       `).map((e) => ({ ...e }));
-	}).pipe($.orElseSucceed(() => [])), p = (t) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => [])), m = (t) => $.gen(function* () {
 		let n = /* @__PURE__ */ new Date();
 		return yield* e`
         INSERT INTO sessions (id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt")
@@ -121,28 +127,28 @@ var be = (e) => {
 		...t,
 		createdAt: /* @__PURE__ */ new Date(),
 		lastSeenAt: /* @__PURE__ */ new Date()
-	}))), m = (t) => $.gen(function* () {
+	}))), g = (t) => $.gen(function* () {
 		let n = yield* e`
         SELECT id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt"
           FROM sessions WHERE id = ${t} LIMIT 1
       `;
 		return n[0] ? { ...n[0] } : null;
-	}).pipe($.orElseSucceed(() => null)), g = (t, n) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => null)), _ = (t, n) => $.gen(function* () {
 		yield* e`
         UPDATE sessions SET "expiresAt" = ${n}, "lastSeenAt" = ${/* @__PURE__ */ new Date()}
          WHERE id = ${t}
       `;
-	}).pipe($.asVoid, $.orElseSucceed(() => void 0)), _ = (t, n) => $.gen(function* () {
+	}).pipe($.asVoid, $.orElseSucceed(() => void 0)), v = (t, n) => $.gen(function* () {
 		return (yield* e`
         DELETE FROM sessions WHERE id = ${n} AND "userId" = ${t}
         RETURNING id
       `).length > 0;
-	}).pipe($.orElseSucceed(() => !1)), v = (t, n) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => !1)), b = (t, n) => $.gen(function* () {
 		return (yield* e`
         DELETE FROM sessions WHERE "userId" = ${t} AND id <> ${n}
         RETURNING id
       `).length;
-	}).pipe($.orElseSucceed(() => 0)), b = (t) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => 0)), S = (t) => $.gen(function* () {
 		let n = /* @__PURE__ */ new Date();
 		return yield* e`
         INSERT INTO "authTokens" (id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt")
@@ -156,7 +162,7 @@ var be = (e) => {
 		...t,
 		consumedAt: null,
 		createdAt: /* @__PURE__ */ new Date()
-	}))), S = (t, n) => $.gen(function* () {
+	}))), C = (t, n) => $.gen(function* () {
 		let r = yield* e`
         UPDATE "authTokens"
            SET "consumedAt" = ${/* @__PURE__ */ new Date()}
@@ -167,18 +173,130 @@ var be = (e) => {
         RETURNING id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt"
       `;
 		return r[0] ? { ...r[0] } : null;
-	}).pipe($.orElseSucceed(() => null)), C = (t) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => null)), w = (t, n) => $.gen(function* () {
+		let r = yield* e`
+        SELECT id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt"
+          FROM "authTokens"
+         WHERE "userId" = ${t} AND purpose = ${n}
+         ORDER BY "createdAt" DESC
+         LIMIT 1
+      `;
+		return r[0] ? { ...r[0] } : null;
+	}).pipe($.orElseSucceed(() => null)), T = (t) => $.gen(function* () {
+		let n = /* @__PURE__ */ new Date(), r = t.email.toLowerCase();
+		return yield* e`
+        INSERT INTO invitations (
+          id, "tokenHash", email, "tenantId", role, "invitedByUserId",
+          "expiresAt", "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
+        ) VALUES (
+          ${t.id}, ${t.tokenHash}, ${r}, ${t.tenantId},
+          ${t.role}, ${t.invitedByUserId}, ${t.expiresAt},
+          ${null}, ${null}, ${null}, ${null}, ${n}
+        )
+      `, {
+			...t,
+			email: r,
+			acceptedAt: null,
+			acceptedByUserId: null,
+			revokedAt: null,
+			revokedByUserId: null,
+			createdAt: n
+		};
+	}).pipe($.catchAll((e) => $.die(e))), E = (t) => $.gen(function* () {
+		let n = yield* e`
+        SELECT id, "tokenHash", email, "tenantId", role, "invitedByUserId", "expiresAt",
+               "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
+          FROM invitations WHERE "tokenHash" = ${t} LIMIT 1
+      `;
+		return n[0] ? { ...n[0] } : null;
+	}).pipe($.orElseSucceed(() => null)), D = (t, n, r) => $.gen(function* () {
+		let i = yield* e`
+        UPDATE invitations
+           SET "acceptedAt" = ${r}, "acceptedByUserId" = ${n}
+         WHERE "tokenHash" = ${t}
+           AND "acceptedAt" IS NULL
+           AND "revokedAt" IS NULL
+           AND "expiresAt" > ${r}
+        RETURNING id, "tokenHash", email, "tenantId", role, "invitedByUserId", "expiresAt",
+                  "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
+      `;
+		return i[0] ? { ...i[0] } : null;
+	}).pipe($.catchAll((e) => $.die(e))), O = (t, n, r, i) => $.gen(function* () {
+		return (yield* e`
+        UPDATE invitations
+           SET "revokedAt" = ${i}, "revokedByUserId" = ${r}
+         WHERE id = ${t}
+           AND "tenantId" = ${n}
+           AND "acceptedAt" IS NULL
+           AND "revokedAt" IS NULL
+        RETURNING id
+      `).length > 0;
+	}).pipe($.catchAll((e) => $.die(e))), k = (t) => $.gen(function* () {
+		return (yield* e`
+        SELECT id, "tokenHash", email, "tenantId", role, "invitedByUserId", "expiresAt",
+               "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
+          FROM invitations WHERE "tenantId" = ${t}
+          ORDER BY "createdAt" DESC
+      `).map((e) => ({ ...e }));
+	}).pipe($.orElseSucceed(() => [])), A = (t, n) => $.gen(function* () {
+		return (yield* e`
+        SELECT COUNT(*)::int AS n FROM invitations
+         WHERE "tenantId" = ${t}
+           AND "acceptedAt" IS NULL AND "revokedAt" IS NULL AND "expiresAt" > ${n}
+      `)[0]?.n ?? 0;
+	}).pipe($.catchAll((e) => $.die(e))), j = (t, n, r, i) => $.gen(function* () {
+		return (yield* e`
+        UPDATE invitations
+           SET "revokedAt" = ${i}, "revokedByUserId" = ${r}
+         WHERE "tenantId" = ${t}
+           AND email = ${n.toLowerCase()}
+           AND "acceptedAt" IS NULL
+           AND "revokedAt" IS NULL
+        RETURNING id
+      `).length;
+	}).pipe($.catchAll((e) => $.die(e))), M = (t) => $.gen(function* () {
+		let n = /* @__PURE__ */ new Date();
+		return yield* e`
+        INSERT INTO "impersonationGrants" (
+          id, "sessionId", "actorUserId", "actorSessionId", "targetUserId", "tenantId",
+          reason, "startedAt", "expiresAt", "endedAt", "endedReason", "ipAddress", "userAgent"
+        ) VALUES (
+          ${t.id}, ${t.sessionId}, ${t.actorUserId}, ${t.actorSessionId},
+          ${t.targetUserId}, ${t.tenantId}, ${t.reason ?? null}, ${n},
+          ${t.expiresAt}, ${null}, ${null}, ${t.ipAddress ?? null}, ${t.userAgent ?? null}
+        )
+      `, {
+			...t,
+			startedAt: n,
+			endedAt: null,
+			endedReason: null
+		};
+	}).pipe($.catchAll((e) => $.die(e))), N = (t) => $.gen(function* () {
+		let n = yield* e`
+        SELECT id, "sessionId", "actorUserId", "actorSessionId", "targetUserId", "tenantId",
+               reason, "startedAt", "expiresAt", "endedAt", "endedReason", "ipAddress", "userAgent"
+          FROM "impersonationGrants" WHERE "sessionId" = ${t} LIMIT 1
+      `;
+		return n[0] ? { ...n[0] } : null;
+	}).pipe($.orElseSucceed(() => null)), P = (t, n, r) => $.gen(function* () {
+		return (yield* e`
+        UPDATE "impersonationGrants"
+           SET "endedAt" = ${r}, "endedReason" = ${n}
+         WHERE "sessionId" = ${t} AND "endedAt" IS NULL
+        RETURNING id
+      `).length > 0;
+	}).pipe($.catchAll((e) => $.die(e))), F = (t) => $.gen(function* () {
 		return (yield* e`
         SELECT id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt"
           FROM passkeys WHERE "userId" = ${t}
       `).map((e) => ({ ...e }));
-	}).pipe($.orElseSucceed(() => [])), w = (t) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => [])), I = (t) => $.gen(function* () {
 		let n = yield* e`
         SELECT id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt"
           FROM passkeys WHERE "credentialId" = ${t} LIMIT 1
       `;
 		return n[0] ? { ...n[0] } : null;
-	}).pipe($.orElseSucceed(() => null)), T = (t) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => null)), L = (t) => $.gen(function* () {
 		let n = /* @__PURE__ */ new Date();
 		return yield* e`
         INSERT INTO passkeys (id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt")
@@ -195,7 +313,7 @@ var be = (e) => {
 		...t,
 		createdAt: /* @__PURE__ */ new Date(),
 		lastUsedAt: null
-	}))), E = (t, n) => $.gen(function* () {
+	}))), R = (t, n) => $.gen(function* () {
 		return (yield* e`
         UPDATE passkeys
            SET counter = ${n}, "lastUsedAt" = ${/* @__PURE__ */ new Date()}
@@ -203,14 +321,14 @@ var be = (e) => {
            AND counter < ${n}
         RETURNING id
       `).length > 0;
-	}).pipe($.orElseSucceed(() => !1)), D = (t, n) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => !1)), z = (t, n) => $.gen(function* () {
 		let r = /* @__PURE__ */ new Date();
 		yield* e`DELETE FROM "recoveryCodes" WHERE "userId" = ${t}`;
 		for (let i of n) yield* e`
           INSERT INTO "recoveryCodes" (id, "userId", "codeHash", "consumedAt", "createdAt")
           VALUES (${h("rc")}, ${t}, ${i}, ${null}, ${r})
         `;
-	}).pipe($.asVoid, $.orElseSucceed(() => void 0)), O = (t, n) => $.gen(function* () {
+	}).pipe($.asVoid, $.orElseSucceed(() => void 0)), B = (t, n) => $.gen(function* () {
 		return (yield* e`
         UPDATE "recoveryCodes"
            SET "consumedAt" = ${/* @__PURE__ */ new Date()}
@@ -219,12 +337,12 @@ var be = (e) => {
            AND "consumedAt" IS NULL
         RETURNING id
       `).length > 0;
-	}).pipe($.orElseSucceed(() => !1)), k = (t) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => !1)), V = (t) => $.gen(function* () {
 		return (yield* e`
         SELECT COUNT(*)::int AS n FROM "recoveryCodes"
          WHERE "userId" = ${t} AND "consumedAt" IS NULL
       `)[0]?.n ?? 0;
-	}).pipe($.orElseSucceed(() => 0)), A = (e, t) => $.catchAll((n) => $.logWarning(`[auth] lockout ${e} failed — brute-force protection is not counting`).pipe($.annotateLogs("cause", String(n)), $.as(t)));
+	}).pipe($.orElseSucceed(() => 0)), H = (e, t) => $.catchAll((n) => $.logWarning(`[auth] lockout ${e} failed — brute-force protection is not counting`).pipe($.annotateLogs("cause", String(n)), $.as(t)));
 	return {
 		findByEmail: t,
 		findById: n,
@@ -233,24 +351,36 @@ var be = (e) => {
 		setMfaSecret: o,
 		markMfaEnrolled: s,
 		clearMfa: c,
-		listMemberships: l,
-		addMembership: u,
-		membershipRole: d,
-		listSessions: f,
-		insertSession: p,
-		findSession: m,
-		touchSession: g,
-		revokeSession: _,
-		revokeAllOtherSessions: v,
-		insertToken: b,
-		consumeToken: S,
-		replaceRecoveryCodes: D,
-		consumeRecoveryCode: O,
-		countRecoveryCodes: k,
-		listPasskeys: C,
-		findPasskey: w,
-		insertPasskey: T,
-		advancePasskeyCounter: E,
+		markEmailVerified: l,
+		listMemberships: u,
+		addMembership: d,
+		membershipRole: f,
+		listSessions: p,
+		insertSession: m,
+		findSession: g,
+		touchSession: _,
+		revokeSession: v,
+		revokeAllOtherSessions: b,
+		insertToken: S,
+		consumeToken: C,
+		latestToken: w,
+		insertInvitation: T,
+		findInvitationByHash: E,
+		acceptInvitation: D,
+		revokeInvitation: O,
+		listInvitations: k,
+		countPendingInvitations: A,
+		supersedePendingInvitations: j,
+		insertImpersonationGrant: M,
+		findImpersonationGrantBySession: N,
+		endImpersonationGrant: P,
+		replaceRecoveryCodes: z,
+		consumeRecoveryCode: B,
+		countRecoveryCodes: V,
+		listPasskeys: F,
+		findPasskey: I,
+		insertPasskey: L,
+		advancePasskeyCounter: R,
 		isLockedOut: (t, n) => $.gen(function* () {
 			let r = (yield* e`
         SELECT "lockedUntil" FROM "loginAttempts"
@@ -263,7 +393,7 @@ var be = (e) => {
 				locked: !1,
 				retryAfterSeconds: 0
 			};
-		}).pipe(A("read", {
+		}).pipe(H("read", {
 			locked: !1,
 			retryAfterSeconds: 0
 		})),
@@ -281,16 +411,16 @@ var be = (e) => {
           "lockedUntil" = ${f},
           "updatedAt" = ${p}
       `;
-		}).pipe($.asVoid, A("record", void 0)),
+		}).pipe($.asVoid, H("record", void 0)),
 		clearLoginFailures: (t) => $.gen(function* () {
 			yield* e`DELETE FROM "loginAttempts" WHERE email = ${t.toLowerCase()}`;
-		}).pipe($.asVoid, A("clear", void 0))
+		}).pipe($.asVoid, H("clear", void 0))
 	};
-}, Se = (e) => (t) => $.runPromise(e.send({
+}, $e = (e) => (t) => $.runPromise(e.send({
 	to: t.to,
 	subject: t.subject,
 	html: t.html,
 	text: t.text
 }).pipe($.asVoid, $.orElseSucceed(() => void 0)));
 //#endregion
-export { pe as CSRF_COOKIE_NAME, me as CSRF_HEADER_NAME, le as MAGIC_LINK_TTL_S, K as MFA_PENDING_TTL_S, ue as PASSWORD_RESET_TTL_S, e as PasswordEmptyError, t as PasswordHashError, s as SESSION_COOKIE_NAME, W as TotpVerifyError, y as UserAlreadyExistsError, x as UserNotFoundError, re as authRoutesPlugin, c as clearSessionCookie, ie as configSessionSecrets, ne as dataStoreChallengeStore, _e as generateChallenge, ee as generateRecoveryCodes, te as generateTotpCode, M as generateTotpSecret, J as getAuthSessionStrategy, z as guardSubject, B as handleCsrf, X as handleListMemberships, q as handleListSessions, H as handleMagicLinkConsume, V as handleMagicLinkRequest, F as handleMfaEnrollStart, ae as handleMfaEnrollVerify, ce as handleMfaRegenerateRecoveryCodes, L as handleMfaUnenroll, se as handleMfaVerify, U as handlePasskeyAssertOptions, I as handlePasskeyAssertVerify, Y as handlePasskeyRegisterOptions, Z as handlePasskeyRegisterVerify, N as handlePasswordResetConfirm, T as handlePasswordResetRequest, oe as handleRevokeAllOtherSessions, P as handleRevokeSession, D as handleSignIn, E as handleSignOut, j as handleSignUp, G as handleSwitchTenant, n as hashPassword, de as hashToken, Q as isCsrfTokenWellFormed, he as issueCsrfToken, l as issueSession, w as issueUserSession, Se as mailSender, v as makeSessionRevocationChecker, R as memoryChallengeStore, _ as memoryUserStore, fe as mintToken, r as needsRehash, h as newAuthId, O as otpauthUrl, i as parseScryptParams, xe as postgresUserStore, u as readSession, d as readSessionKeyed, f as resolveSessionSecret, p as resolveSessionSecrets, A as runSubjectGuards, b as sessionIdOfSubject, m as sessionSecretsOf, S as subjectFromUser, g as subjectMemberships, ve as verifyAssertion, ge as verifyCsrf, a as verifyPassword, o as verifyPasswordWithRehash, ye as verifyRegistration, k as verifyTotpCode, C as voltroPasswordStrategy };
+export { Ue as CSRF_COOKIE_NAME, We as CSRF_HEADER_NAME, ae as DEFAULT_INVITER_ROLES, ce as DEFAULT_ROLE_RANK, K as EMAIL_NOT_VERIFIED_CODE, G as EMAIL_VERIFIED_METADATA_KEY, q as EMAIL_VERIFY_RESEND_COOLDOWN_S, Le as EMAIL_VERIFY_TTL_S, we as IMPERSONATION_DEFAULT_DURATION_S, de as IMPERSONATION_FORBIDDEN_SUBPATHS, Y as IMPERSONATION_METADATA_KEY, Se as INVITATION_MAX_PENDING, _e as INVITATION_TTL_S, Re as MAGIC_LINK_TTL_S, ze as MFA_PENDING_TTL_S, Be as PASSWORD_RESET_TTL_S, e as PasswordEmptyError, t as PasswordHashError, s as SESSION_COOKIE_NAME, X as TotpVerifyError, y as UserAlreadyExistsError, x as UserNotFoundError, Oe as authRoutesPlugin, c as clearSessionCookie, z as configSessionSecrets, ee as dataStoreChallengeStore, ue as defaultCanGrantRole, V as emailVerificationActive, w as emailVerificationGuard, Je as generateChallenge, xe as generateRecoveryCodes, De as generateTotpCode, ie as generateTotpSecret, ve as getAuthSessionStrategy, me as guardSubject, le as handleAcceptInvitation, J as handleAcceptInvitationWithSignUp, Me as handleCreateInvitation, T as handleCsrf, se as handleEmailVerifyConfirm, ke as handleEmailVerifyRequest, be as handleImpersonationStart, Ee as handleImpersonationStop, Fe as handleListInvitations, pe as handleListMemberships, L as handleListSessions, R as handleMagicLinkConsume, B as handleMagicLinkRequest, A as handleMfaEnrollStart, N as handleMfaEnrollVerify, I as handleMfaRegenerateRecoveryCodes, H as handleMfaUnenroll, Ie as handleMfaVerify, D as handlePasskeyAssertOptions, Ne as handlePasskeyAssertVerify, te as handlePasskeyRegisterOptions, k as handlePasskeyRegisterVerify, E as handlePasswordResetConfirm, U as handlePasswordResetRequest, Z as handlePreviewInvitation, M as handleRevokeAllOtherSessions, Pe as handleRevokeInvitation, ne as handleRevokeSession, W as handleSignIn, j as handleSignOut, F as handleSignUp, Ce as handleSwitchTenant, n as hashPassword, Ve as hashToken, re as impersonationAuditRedactor, he as impersonationOf, Ge as isCsrfTokenWellFormed, ye as isEmailVerified, Ae as isImpersonated, Ke as issueCsrfToken, l as issueSession, P as issueUserSession, $e as mailSender, v as makeSessionRevocationChecker, O as memoryChallengeStore, _ as memoryUserStore, He as mintSecret, Q as mintToken, r as needsRehash, h as newAuthId, ge as otpauthUrl, i as parseScryptParams, Qe as postgresUserStore, u as readSession, d as readSessionKeyed, f as resolveSessionSecret, p as resolveSessionSecrets, oe as runSubjectGuards, Te as sendEmailVerification, b as sessionIdOfSubject, m as sessionSecretsOf, S as subjectFromUser, g as subjectMemberships, fe as userEmailVerified, Ye as verifyAssertion, qe as verifyCsrf, a as verifyPassword, o as verifyPasswordWithRehash, Xe as verifyRegistration, je as verifyTotpCode, C as voltroPasswordStrategy };

package/dist/password.d.ts

@@ -24,7 +24,8 @@ declare interface ParsedHash {
 }
 
 /** Parse the scrypt parameters out of a stored hash. Returns null when the
- *  string isn't a well-formed `scrypt$N$r$p$salt$derived`. */
+ *  string isn't a well-formed `scrypt$N$r$p$salt$derived`, or when its
+ *  parameters exceed the derivation ceiling. */
 export declare const parseScryptParams: (stored: string) => ParsedHash | null;
 
 export declare class PasswordEmptyError extends PasswordEmptyError_base<{

package/dist/password.js

@@ -1,16 +1,19 @@
 import { randomBytes as e, scrypt as t, timingSafeEqual as n } from "node:crypto";
 import { Data as r, Effect as i } from "effect";
 //#region src/password.ts
-var a = 16384, o = 8, s = 1, c = 32, l = 16, u = class extends r.TaggedError("PasswordEmptyError") {}, d = class extends r.TaggedError("PasswordHashError") {}, f = (e, n, r, a) => i.async((o) => {
-	t(e, n, r, a, (e, t) => {
-		o(e ? i.fail(new d({
+var a = 32768, o = 8, s = 1, c = 32, l = 16, u = (e, t) => 128 * e * t * 2, d = 256 * 1024 * 1024, f = class extends r.TaggedError("PasswordEmptyError") {}, p = class extends r.TaggedError("PasswordHashError") {}, m = (e, n, r, a) => i.async((o) => {
+	t(e, n, r, {
+		...a,
+		maxmem: u(a.N, a.r)
+	}, (e, t) => {
+		o(e ? i.fail(new p({
 			message: e.message,
 			cause: e
 		})) : i.succeed(t));
 	});
-}), p = (t) => i.gen(function* () {
-	if (t.length === 0) return yield* i.fail(new u({ message: "password must be non-empty" }));
-	let n = e(l), r = yield* f(t, n, c, {
+}), h = (t) => i.gen(function* () {
+	if (t.length === 0) return yield* i.fail(new f({ message: "password must be non-empty" }));
+	let n = e(l), r = yield* m(t, n, c, {
 		N: a,
 		r: o,
 		p: s
@@ -23,44 +26,50 @@ var a = 16384, o = 8, s = 1, c = 32, l = 16, u = class extends r.TaggedError("Pa
 		n.toString("base64"),
 		r.toString("base64")
 	].join("$");
-}), m = (e, t) => i.gen(function* () {
-	let r = t.split("$");
-	if (r.length !== 6) return !1;
-	let [i, a, o, s, c, l] = r;
-	if (i !== "scrypt") return !1;
-	let u = Number(a), d = Number(o), p = Number(s);
-	if (!Number.isFinite(u) || !Number.isFinite(d) || !Number.isFinite(p)) return !1;
-	let m = Buffer.from(c, "base64"), h = Buffer.from(l, "base64"), g = yield* f(e, m, h.length, {
-		N: u,
-		r: d,
-		p
+}), g = (e, t) => i.gen(function* () {
+	let r = _(t);
+	if (!r) return !1;
+	let { N: i, r: a, p: o, salt: s, expected: c } = r, l = yield* m(e, s, c.length, {
+		N: i,
+		r: a,
+		p: o
 	});
-	return g.length === h.length && n(g, h);
-}).pipe(i.catchAll(() => i.succeed(!1))), h = (e) => {
+	return l.length === c.length && n(l, c);
+}).pipe(i.catchAll(() => i.succeed(!1))), _ = (e) => {
 	let t = e.split("$");
 	if (t.length !== 6) return null;
-	let [n, r, i, a, , o] = t;
+	let [n, r, i, a, o, s] = t;
 	if (n !== "scrypt") return null;
-	let s = Number(r), c = Number(i), l = Number(a);
-	if (!Number.isFinite(s) || !Number.isFinite(c) || !Number.isFinite(l)) return null;
-	let u = Buffer.from(o, "base64").length;
-	return u === 0 ? null : {
-		N: s,
-		r: c,
-		p: l,
-		keyLen: u
+	let c = Number(r), l = Number(i), u = Number(a);
+	if (!Number.isInteger(c) || !Number.isInteger(l) || !Number.isInteger(u) || c < 2 || l < 1 || u < 1 || 128 * c * l > d) return null;
+	let f = Buffer.from(s, "base64");
+	return f.length === 0 ? null : {
+		N: c,
+		r: l,
+		p: u,
+		keyLen: f.length,
+		salt: Buffer.from(o, "base64"),
+		expected: f
 	};
-}, g = (e) => {
-	let t = h(e);
+}, v = (e) => {
+	let t = _(e);
+	return t ? {
+		N: t.N,
+		r: t.r,
+		p: t.p,
+		keyLen: t.keyLen
+	} : null;
+}, y = (e) => {
+	let t = v(e);
 	return !t || t.N !== a || t.r !== o || t.p !== s || t.keyLen !== c;
-}, _ = (e, t) => i.gen(function* () {
-	if (!(yield* m(e, t))) return { valid: !1 };
-	if (!g(t)) return { valid: !0 };
-	let n = yield* p(e).pipe(i.orElseSucceed(() => ""));
+}, b = (e, t) => i.gen(function* () {
+	if (!(yield* g(e, t))) return { valid: !1 };
+	if (!y(t)) return { valid: !0 };
+	let n = yield* h(e).pipe(i.orElseSucceed(() => ""));
 	return n ? {
 		valid: !0,
 		rehash: n
 	} : { valid: !0 };
 });
 //#endregion
-export { u as PasswordEmptyError, d as PasswordHashError, p as hashPassword, g as needsRehash, h as parseScryptParams, m as verifyPassword, _ as verifyPasswordWithRehash };
+export { f as PasswordEmptyError, p as PasswordHashError, h as hashPassword, y as needsRehash, v as parseScryptParams, g as verifyPassword, b as verifyPasswordWithRehash };