@voltro/plugin-auth 0.37.0 → 0.39.0

package/dist/plugin.js

@@ -1,5 +1,5 @@
 import "./password.js";
 import "./session.js";
-import { n as e, t } from "./plugin-BZm5Semm.js";
+import { n as e, t } from "./plugin-CPcpSSf9.js";
 import "./csrf.js";
 export { t as authRoutesPlugin, e as getAuthSessionStrategy };

package/dist/session.js

@@ -1,6 +1,6 @@
 import { DEFAULT_SESSION_KID as e, buildSetCookie as t, readCookie as n, resolveOptionalSessionSecrets as r, resolveSessionSecret as i, resolveSessionSecrets as a, signSession as o, timingSafeStringEqual as s, verifySessionKeyed as c } from "@voltro/protocol/session";
 //#region src/session.ts
-var l = "voltro:session", u = 3600 * 24 * 7, d = i, f = a, p = (e) => typeof e == "string" ? e : e.current, m = (t) => {
+var l = "voltro:session", u = 604800, d = i, f = a, p = (e) => typeof e == "string" ? e : e.current, m = (t) => {
 	if (typeof t != "string") return t;
 	let n = r(), i = {
 		kid: n && s(n.current.secret, t) ? n.current.kid : e,

package/dist/{strategy-Bty6_XUj.js → strategy-MP_KxNuA.js}

@@ -143,7 +143,7 @@ var s = 3e4, c = 1e4, l = (e, t = {}) => {
 		}),
 		latestToken: (e, t) => n.sync(() => {
 			let n = null;
-			for (let r of o) r.userId !== e || r.purpose !== t || (n === null || r.createdAt.getTime() > n.createdAt.getTime()) && (n = r);
+			for (let r of o) r.userId === e && r.purpose === t && (n === null || r.createdAt.getTime() > n.createdAt.getTime()) && (n = r);
 			return n;
 		}),
 		insertInvitation: (e) => n.sync(() => {
@@ -294,26 +294,26 @@ var s = 3e4, c = 1e4, l = (e, t = {}) => {
 		resolve: (c) => {
 			let l = r(c.headers.cookie, o);
 			if (!l) return { kind: "skip" };
-			let u = a(l, e(t.secret ?? i()));
-			if (!u) return {
+			let u = e(t.secret ?? i()), d = a(l, u);
+			if (!d) return {
 				kind: "failed",
 				reason: "voltro session cookie failed verification"
 			};
-			let d = b(u.subject, "voltro-password");
+			let f = b(d.subject, "voltro-password");
 			if (!s) return {
 				kind: "matched",
-				subject: d
+				subject: f
 			};
-			let f = h(d);
-			return f ? n.runPromise(s.isLive(f)).then((e) => e ? {
+			let p = h(f);
+			return p ? n.runPromise(s.isLive(p)).then((e) => e ? {
 				kind: "matched",
-				subject: d
+				subject: f
 			} : {
 				kind: "failed",
 				reason: "voltro session revoked"
 			}) : {
 				kind: "matched",
-				subject: d
+				subject: f
 			};
 		}
 	};

package/dist/strategy.js

@@ -1,3 +1,3 @@
 import "./session.js";
-import { t as e } from "./strategy-Bty6_XUj.js";
+import { t as e } from "./strategy-MP_KxNuA.js";
 export { e as voltroPasswordStrategy };

package/dist/tokens.js

@@ -1,6 +1,6 @@
 import { createHash as e, randomBytes as t } from "node:crypto";
 //#region src/tokens.ts
-var n = 900, r = 3600, i = 1440 * 60, a = 300, o = {
+var n = 900, r = 3600, i = 86400, a = 300, o = {
 	"magic-link": 900,
 	"password-reset": r,
 	"mfa-pending": 300,

package/dist/web.js

@@ -52,7 +52,7 @@ var i = e(null), a = ({ subject: e, children: t }) => /* @__PURE__ */ r(i.Provid
 			userVerification: "preferred",
 			residentKey: "preferred"
 		},
-		timeout: 300 * 1e3
+		timeout: 3e5
 	} });
 	if (!c) throw Error("credential creation was cancelled");
 	let p = c.response, m = typeof p.getAuthenticatorData == "function" ? p.getAuthenticatorData() : /* @__PURE__ */ new ArrayBuffer(0), h = await f(`${n}/passkey/register/verify`, {
@@ -73,7 +73,7 @@ var i = e(null), a = ({ subject: e, children: t }) => /* @__PURE__ */ r(i.Provid
 			id: u(e.id)
 		})),
 		userVerification: "preferred",
-		timeout: 300 * 1e3
+		timeout: 3e5
 	} });
 	if (!s) throw Error("assertion was cancelled");
 	let c = s.response, p = await f(`${n}/passkey/assert/verify`, {

package/dist/webauthn.js

@@ -287,7 +287,7 @@ var o = (e) => {
 		error: "unsupported-key"
 	};
 	let a = Buffer.concat([n, c(o(e.clientDataJSON))]), s = o(e.signature);
-	return T(i.key, i.alg, a, s) ? !(r.signCount === 0 && e.storedCounter === 0) && r.signCount <= e.storedCounter ? {
+	return T(i.key, i.alg, a, s) ? (r.signCount !== 0 || e.storedCounter !== 0) && r.signCount <= e.storedCounter ? {
 		ok: !1,
 		error: "counter-replay"
 	} : {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-auth",
-  "version": "0.37.0",
+  "version": "0.39.0",
   "description": "Authentication primitives: password hashing, session creation, schema mixin + tables. Pairs with the `auth` app template for the UI; both independently usable. Server-side only (uses node:crypto).",
   "keywords": [
     "voltro",
@@ -79,8 +79,8 @@
   },
   "dependencies": {
     "@effect/sql": "^0.52.0",
-    "@voltro/database": "0.37.0",
-    "@voltro/protocol": "0.37.0"
+    "@voltro/database": "0.39.0",
+    "@voltro/protocol": "0.39.0"
   },
   "peerDependencies": {
     "effect": "^3.22.0",