@webtypen/webframez-core 0.3.73 → 0.3.75

package/auth-client.js

@@ -8,6 +8,7 @@ function csrfCookie(name) {
 exports.createAuthFetch = function createAuthFetch(options = {}, originalFetch = window.fetch.bind(window)) {
     const base = (options.basePath || "/api/auth").replace(/\/+$/, "");
     const loginPaths = options.loginPaths || [`${base}/login`];
+    let refreshing;
     return async (input, init) => {
         const url = new URL(input instanceof Request ? input.url : String(input), window.location.href);
         const method = String(init?.method || (input instanceof Request ? input.method : "GET")).toUpperCase();
@@ -21,7 +22,23 @@ exports.createAuthFetch = function createAuthFetch(options = {}, originalFetch =
         } else token = csrfCookie(options.cookieName);
         const headers = new Headers(init?.headers || (input instanceof Request ? input.headers : undefined));
         if (typeof token === "string" && token) headers.set("X-CSRF-Token", token);
-        return originalFetch(input, { ...init, headers });
+        const retryInput = input instanceof Request ? input.clone() : input;
+        const response = await originalFetch(input, { ...init, headers });
+        if (loginPaths.includes(url.pathname) || url.pathname.startsWith(`${base}/`)
+            || ![401, 403].includes(response.status)) return response;
+        const failure = await response.clone().json().catch(() => null);
+        if (!["unauthorized", "invalid_csrf"].includes(failure?.code)) return response;
+        if (!refreshing) {
+            const refreshHeaders = new Headers();
+            const csrf = csrfCookie(options.cookieName);
+            if (csrf) refreshHeaders.set("X-CSRF-Token", csrf);
+            refreshing = originalFetch(`${base}/refresh`, { method: "POST", credentials: "same-origin", headers: refreshHeaders })
+                .then(result => result.ok, () => false).finally(() => { refreshing = undefined; });
+        }
+        if (!await refreshing) return response;
+        const nextCsrf = csrfCookie(options.cookieName);
+        if (nextCsrf) headers.set("X-CSRF-Token", nextCsrf);
+        return originalFetch(retryInput, { ...init, headers });
     };
 };
 

package/dist/Auth/Auth.d.ts

@@ -0,0 +1,21 @@
+import { Model } from "../Database/Model";
+import type { Request } from "../Router/Request";
+import type { Response } from "../Router/Response";
+import { AuthScope, AuthScopeOptions, AuthOperation, AuthRouteOptions } from "./ModelAuth";
+export type AuthConfig = {
+    /** Disable automatic main creation; explicitly configured scopes remain available. */
+    main?: boolean;
+    defaults?: Partial<AuthScopeOptions>;
+    scopes?: Record<string, AuthScopeOptions>;
+};
+/** Application-wide registry of named browser-authentication scopes. */
+export declare class AuthFacade {
+    private readonly scopes;
+    private initialized;
+    init(): void;
+    scope(key?: string): AuthScope;
+    revokeUserSessions(model: typeof Model, subject: string): Promise<void>;
+    registerScope(key: string, config: Partial<AuthScopeOptions>): AuthScope;
+}
+export declare const Auth: AuthFacade;
+export declare function authRoute(operation: AuthOperation, options: AuthRouteOptions): (req: Request, res: Response) => Promise<Response>;

package/dist/Auth/Auth.js

@@ -0,0 +1,72 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authRoute = exports.Auth = exports.AuthFacade = void 0;
+const Config_1 = require("../Config");
+const Model_1 = require("../Database/Model");
+const ModelAuth_1 = require("./ModelAuth");
+function mergeOptions(base, config) {
+    return Object.assign(Object.assign(Object.assign({ model: Model_1.Model }, base), config), { fields: Object.assign(Object.assign({}, base.fields), config.fields), session: Object.assign(Object.assign({}, base.session), config.session), passwordReset: config.passwordReset === false ? false : config.passwordReset === undefined && base.passwordReset === false ? false
+            : Object.assign(Object.assign({}, (base.passwordReset || {})), (config.passwordReset || {})), messages: Object.assign(Object.assign({}, base.messages), config.messages) });
+}
+/** Application-wide registry of named browser-authentication scopes. */
+class AuthFacade {
+    constructor() {
+        this.scopes = new Map();
+        this.initialized = false;
+    }
+    init() {
+        if (this.initialized)
+            return;
+        const config = Config_1.Config.get("auth") || {};
+        const configured = new Map();
+        for (const [key, options] of Object.entries(config.scopes || {})) {
+            configured.set(key, new ModelAuth_1.AuthScope(Object.assign(Object.assign({}, mergeOptions(config.defaults || {}, options)), { key })));
+        }
+        if (config.main !== false && !configured.has("main")) {
+            configured.set("main", new ModelAuth_1.AuthScope(Object.assign(Object.assign({}, mergeOptions(config.defaults || {}, {})), { key: "main" })));
+        }
+        for (const [key, scope] of configured)
+            this.scopes.set(key, scope);
+        this.initialized = true;
+    }
+    scope(key = "main") {
+        this.init();
+        const scope = this.scopes.get(key);
+        if (!scope)
+            throw new Error(`Auth scope "${key}" is not registered.`);
+        return scope;
+    }
+    revokeUserSessions(model, subject) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.init();
+            for (const scope of this.scopes.values()) {
+                if (scope.configuration.model === model)
+                    yield scope.sessions.revokeAll(subject);
+            }
+        });
+    }
+    registerScope(key, config) {
+        var _a;
+        this.init();
+        const defaults = Config_1.Config.get("auth.defaults") || {};
+        const base = ((_a = this.scopes.get(key)) === null || _a === void 0 ? void 0 : _a.configuration) || defaults;
+        const scope = new ModelAuth_1.AuthScope(Object.assign(Object.assign({}, mergeOptions(base, config)), { key }));
+        this.scopes.set(key, scope);
+        return scope;
+    }
+}
+exports.AuthFacade = AuthFacade;
+exports.Auth = new AuthFacade();
+function authRoute(operation, options) {
+    return (req, res) => exports.Auth.scope(options.auth || "main").handle(operation, req, res, options.loginResponse);
+}
+exports.authRoute = authRoute;

package/dist/Auth/ModelAuth.d.ts

@@ -1,6 +1,7 @@
 import { Model } from "../Database/Model";
 import { Request } from "../Router/Request";
 import type { Response } from "../Router/Response";
+import { PasswordReset, PasswordResetOptions } from "./PasswordReset";
 import { AuthSession, SessionAuthOptions } from "./SessionAuth";
 import { WebAuth, WebAuthError, WebAuthOptions } from "./WebAuth";
 export type AuthContext<TUser extends Model = Model> = {
@@ -11,18 +12,20 @@ export type AuthSnapshot<TUser = Record<string, unknown>> = {
     user: TUser;
     session: AuthSession;
 };
-export type AuthErrorCode = "missing_login" | "invalid_login" | "inactive_user" | "invalid_origin" | "invalid_csrf" | "unauthorized" | "server_error";
+export type AuthErrorCode = "missing_login" | "invalid_login" | "inactive_user" | "invalid_origin" | "invalid_csrf" | "unauthorized" | "server_error" | "login_blocked" | "logout_blocked";
 export declare class AuthLoginError extends WebAuthError {
     readonly code: AuthErrorCode;
     constructor(code: AuthErrorCode, status: 401 | 403, message: string);
 }
 export type ModelAuthOptions = Partial<WebAuthOptions> & {
     model: typeof Model;
+    key?: string;
     /** Takes precedence over session.audience; defaults to the configured origin. */
     audience?: string;
     locale?: "en" | "de";
     /** Record browser metadata and update activity at most once per minute. */
     trackActivity?: boolean;
+    passwordReset?: PasswordResetOptions | false;
     fields?: {
         identifier?: string;
         password?: string;
@@ -33,33 +36,49 @@ export type ModelAuthOptions = Partial<WebAuthOptions> & {
     csrfDisabled?: false;
     verifyPassword?: (password: string, storedHash: string) => boolean | Promise<boolean>;
     isUserAllowed?: (user: Model) => boolean | Promise<boolean>;
+    beforeLogin?: AuthActionHook;
+    afterLogin?: AuthActionHook;
+    beforeLogout?: AuthActionHook;
+    afterLogout?: AuthActionHook;
     onLogin?: (session: AuthSession, req: Request) => void | Promise<void>;
     publicUserFields?: readonly string[];
     onAuthenticate?: (auth: AuthContext, req: Request) => void | Promise<void>;
     messages?: Partial<Record<AuthErrorCode, string>>;
 };
+export type AuthActionHook = (req: Request, user: Model, scope: AuthScope) => void | Promise<void>;
 export type AuthOperation = "csrf" | "login" | "logout" | "refresh";
 export type AuthRouteOptions = Partial<ModelAuthOptions> & {
-    auth?: ModelAuth | (() => ModelAuth);
+    auth?: string;
     loginPath?: string;
     loginResponse?: (req: Request, session: AuthSession) => object | Promise<object>;
     middleware?: string[];
     domains?: string[];
 };
 /** Model-backed browser authentication with secure default routes and revocable sessions. */
-export declare class ModelAuth extends WebAuth {
+export declare class AuthScope extends WebAuth {
     private readonly modelOptions;
+    readonly key: string;
+    readonly passwordReset: PasswordReset | null;
     private readonly model;
+    private authPaths;
     private readonly sessionUsers;
     private readonly fields;
     constructor(modelOptions: ModelAuthOptions);
+    configureRoutes(basePath: string, loginPath?: string): void;
+    get browserConfiguration(): {
+        basePath: string;
+        loginPaths: string[];
+        cookieName: string;
+    };
+    get configuration(): ModelAuthOptions;
     private message;
     /** Use this when creating users; existing bcrypt hashes are supported without migration. */
     static hashPassword(password: string): Promise<string>;
     verifyCredentials(req: Request): Promise<string>;
     login(req: Request, res: Response, verifyCredentials?: () => Promise<string | null>): Promise<AuthSession>;
+    logout(req: Request, res: Response): Promise<void>;
     /** Resolve a fresh validated session and its model; never trusts a client-supplied req.auth. */
-    resolve<TUser extends Model = Model>(req: Request): Promise<AuthContext<TUser> | null>;
+    resolve<TUser extends Model = Model>(req: Request, res?: Response): Promise<AuthContext<TUser> | null>;
     resolveCookies<TUser extends Model = Model>(cookies: Record<string, string | undefined>): Promise<AuthContext<TUser> | null>;
     /** Only explicit public fields are sent to browsers; Model instances remain on the server. */
     snapshot(auth: AuthContext | null | undefined): AuthSnapshot | null;
@@ -69,4 +88,6 @@ export declare class ModelAuth extends WebAuth {
     }): (next: Function, reject: Function, req: Request, res: Response) => Promise<any>;
     handle(operation: AuthOperation, req: Request, res: Response, loginResponse?: AuthRouteOptions["loginResponse"]): Promise<Response>;
 }
-export declare function authRoute(operation: AuthOperation, options: AuthRouteOptions): (req: Request, res: Response) => Promise<Response>;
+/** Compatibility name for existing integrations. Prefer Auth.scope(). */
+export { AuthScope as ModelAuth };
+export type AuthScopeOptions = ModelAuthOptions;

package/dist/Auth/ModelAuth.js

@@ -9,10 +9,13 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.authRoute = exports.ModelAuth = exports.AuthLoginError = void 0;
+exports.ModelAuth = exports.AuthScope = exports.AuthLoginError = void 0;
 const bcryptjs_1 = require("bcryptjs");
+const routing_1 = require("../routing");
 const Config_1 = require("../Config");
 const Request_1 = require("../Router/Request");
+const Auth_1 = require("./Auth");
+const PasswordReset_1 = require("./PasswordReset");
 const AuthSecurity_1 = require("./AuthSecurity");
 const SessionAuth_1 = require("./SessionAuth");
 const WebAuth_1 = require("./WebAuth");
@@ -23,6 +26,11 @@ class AuthLoginError extends WebAuth_1.WebAuthError {
     }
 }
 exports.AuthLoginError = AuthLoginError;
+class AuthHookError extends AuthLoginError {
+    constructor(code, error) {
+        super(code, error instanceof WebAuth_1.WebAuthError ? error.status : 403, error instanceof Error ? error.message : typeof error === "string" ? error : "Authentication action was blocked.");
+    }
+}
 const defaultMessages = {
     en: {
         missing_login: "Please provide your login and password.",
@@ -32,6 +40,8 @@ const defaultMessages = {
         invalid_csrf: "Please reload the page and try logging in again.",
         unauthorized: "Please log in.",
         server_error: "Authentication could not be processed.",
+        login_blocked: "Login was blocked.",
+        logout_blocked: "Logout was blocked.",
     },
     de: {
         missing_login: "Bitte gib E-Mail-Adresse und Passwort an.",
@@ -41,19 +51,24 @@ const defaultMessages = {
         invalid_csrf: "Der Login konnte gerade nicht verarbeitet werden. Bitte lade die Seite neu.",
         unauthorized: "Bitte melde dich an.",
         server_error: "Die Anmeldung konnte gerade nicht verarbeitet werden.",
+        login_blocked: "Die Anmeldung wurde abgelehnt.",
+        logout_blocked: "Die Abmeldung wurde abgelehnt.",
     },
 };
 // Verify a dummy password hash for unknown accounts as well.
 let dummyHash;
 /** Model-backed browser authentication with secure default routes and revocable sessions. */
-class ModelAuth extends WebAuth_1.WebAuth {
+class AuthScope extends WebAuth_1.WebAuth {
     constructor(modelOptions) {
-        var _a, _b, _c, _d, _e;
+        var _a, _b, _c, _d, _e, _f, _g, _h;
         if (modelOptions.csrfDisabled)
             throw new Error("Browser auth routes require CSRF protection.");
         if (!modelOptions.model)
             throw new Error("Route.auth requires a Model class.");
         const origin = new URL(modelOptions.origin || Config_1.Config.get("auth.origin") || Config_1.Config.get("website.baseUrl") || Config_1.Config.get("application.website.baseUrl") || process.env.WEBSITE_URL || process.env.PUBLIC_BASE_URL || `http://localhost:${process.env.PORT || 3035}`).origin;
+        const key = (_a = modelOptions.key) !== null && _a !== void 0 ? _a : "main";
+        if (!/^[A-Za-z0-9_-]+$/.test(key))
+            throw new Error("Invalid auth scope key.");
         const model = modelOptions.model;
         const fields = Object.assign({ identifier: "email", password: "password", active: "is_active", primaryKey: new model().__primaryKey || "_id" }, modelOptions.fields);
         const allowed = (user) => __awaiter(this, void 0, void 0, function* () {
@@ -61,7 +76,7 @@ class ModelAuth extends WebAuth_1.WebAuth {
                 && (!modelOptions.isUserAllowed || (yield modelOptions.isUserAllowed(user))));
         });
         const sessionUsers = new WeakMap();
-        const sessions = new SessionAuth_1.SessionAuth(Object.assign(Object.assign({ accessTokenSeconds: 30 * 86400, sessionSeconds: 30 * 86400 }, modelOptions.session), { issuer: origin, audience: (_c = (_a = modelOptions.audience) !== null && _a !== void 0 ? _a : (_b = modelOptions.session) === null || _b === void 0 ? void 0 : _b.audience) !== null && _c !== void 0 ? _c : origin, connection: ((_d = modelOptions.session) === null || _d === void 0 ? void 0 : _d.connection) || new model().__connection, isSessionAllowed: (session) => __awaiter(this, void 0, void 0, function* () {
+        const sessions = new SessionAuth_1.SessionAuth(Object.assign(Object.assign({ accessTokenSeconds: 15 * 60, sessionSeconds: 30 * 86400, idleTimeoutSeconds: 7 * 86400 }, modelOptions.session), { issuer: origin, scope: key, audience: (_d = (_b = modelOptions.audience) !== null && _b !== void 0 ? _b : (_c = modelOptions.session) === null || _c === void 0 ? void 0 : _c.audience) !== null && _d !== void 0 ? _d : origin, connection: ((_e = modelOptions.session) === null || _e === void 0 ? void 0 : _e.connection) || new model().__connection, isSessionAllowed: (session) => __awaiter(this, void 0, void 0, function* () {
                 const id = fields.primaryKey === "_id" ? yield model.objectId(session.subject, { noExceptions: true }) : session.subject;
                 const user = id !== null && id !== undefined ? yield model.where(fields.primaryKey, "=", id).first() : null;
                 if (!(yield allowed(user)))
@@ -69,11 +84,28 @@ class ModelAuth extends WebAuth_1.WebAuth {
                 sessionUsers.set(session, user);
                 return true;
             }) }));
-        super(sessions, Object.assign(Object.assign({}, modelOptions), { origin, allowInsecureLocalhost: (_e = modelOptions.allowInsecureLocalhost) !== null && _e !== void 0 ? _e : true }));
+        super(sessions, Object.assign(Object.assign({}, modelOptions), { origin, cookiePrefix: (_f = modelOptions.cookiePrefix) !== null && _f !== void 0 ? _f : (key === "main" ? undefined : `${origin.startsWith("https:") ? "__Host-wf_" : "wf_dev_"}${key}_`), allowInsecureLocalhost: (_g = modelOptions.allowInsecureLocalhost) !== null && _g !== void 0 ? _g : true }));
         this.modelOptions = modelOptions;
+        this.authPaths = { basePath: "/api/auth", loginPath: "/api/auth/login" };
+        this.key = key;
         this.sessionUsers = sessionUsers;
         this.model = model;
         this.fields = fields;
+        this.passwordReset = modelOptions.passwordReset === false ? null : new PasswordReset_1.PasswordReset(model, key, fields, modelOptions.passwordReset || {}, (user) => __awaiter(this, void 0, void 0, function* () { return allowed(user); }), (user, mode) => __awaiter(this, void 0, void 0, function* () {
+            const subject = String(user[fields.primaryKey]);
+            yield this.sessions.revokeAll(subject);
+            if (mode === "all")
+                yield Auth_1.Auth.revokeUserSessions(model, subject);
+        }), (_h = modelOptions.session) === null || _h === void 0 ? void 0 : _h.database);
+    }
+    configureRoutes(basePath, loginPath) {
+        this.authPaths = { basePath, loginPath: loginPath || `${basePath}/login` };
+    }
+    get browserConfiguration() {
+        return { basePath: (0, routing_1.appPath)(this.authPaths.basePath), loginPaths: [(0, routing_1.appPath)(this.authPaths.loginPath)], cookieName: this.cookies.prefix + "csrf" };
+    }
+    get configuration() {
+        return this.modelOptions;
     }
     message(code) {
         var _a, _b;
@@ -112,22 +144,63 @@ class ModelAuth extends WebAuth_1.WebAuth {
             login: { get: () => super.login }
         });
         return __awaiter(this, void 0, void 0, function* () {
-            const session = yield _super.login.call(this, req, res, verifyCredentials);
+            let user = null;
+            const session = yield _super.login.call(this, req, res, () => __awaiter(this, void 0, void 0, function* () {
+                const subject = yield verifyCredentials();
+                if (subject && (this.modelOptions.beforeLogin || this.modelOptions.afterLogin)) {
+                    const id = this.fields.primaryKey === "_id" ? yield this.model.objectId(subject, { noExceptions: true }) : subject;
+                    user = id == null ? null : yield this.model.where(this.fields.primaryKey, "=", id).first();
+                    if (!user)
+                        throw new AuthLoginError("invalid_login", 401, this.message("invalid_login"));
+                    if (this.modelOptions.beforeLogin) {
+                        try {
+                            yield this.modelOptions.beforeLogin(req, user, this);
+                        }
+                        catch (error) {
+                            throw new AuthHookError("login_blocked", error);
+                        }
+                    }
+                }
+                return subject;
+            }));
             if (this.modelOptions.trackActivity !== false)
                 yield this.sessions.recordLogin(session, (0, AuthSecurity_1.authHeader)(req, "user-agent"));
             if (this.modelOptions.onLogin)
                 yield this.modelOptions.onLogin(session, req);
+            if (this.modelOptions.afterLogin)
+                yield this.modelOptions.afterLogin(req, user, this);
             return session;
         });
     }
+    logout(req, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const session = yield this.logoutSession(req);
+            const user = this.sessionUsers.get(session);
+            if (!user)
+                throw new AuthLoginError("unauthorized", 401, this.message("unauthorized"));
+            if (this.modelOptions.beforeLogout) {
+                try {
+                    yield this.modelOptions.beforeLogout(req, user, this);
+                }
+                catch (error) {
+                    throw new AuthHookError("logout_blocked", error);
+                }
+            }
+            yield this.finishLogout(session, res);
+            if (this.modelOptions.afterLogout)
+                yield this.modelOptions.afterLogout(req, user, this);
+        });
+    }
     /** Resolve a fresh validated session and its model; never trusts a client-supplied req.auth. */
-    resolve(req) {
+    resolve(req, res) {
         const _super = Object.create(null, {
-            authenticate: { get: () => super.authenticate }
+            authenticate: { get: () => super.authenticate },
+            resume: { get: () => super.resume }
         });
         return __awaiter(this, void 0, void 0, function* () {
+            res === null || res === void 0 ? void 0 : res.header("Cache-Control", "no-store");
             Object.defineProperty(req, "auth", { value: null, writable: true, configurable: true, enumerable: false });
-            const session = yield _super.authenticate.call(this, req);
+            const session = (yield _super.authenticate.call(this, req)) || (res ? yield _super.resume.call(this, req, res) : null);
             if (!session)
                 return null;
             const user = this.sessionUsers.get(session);
@@ -157,7 +230,7 @@ class ModelAuth extends WebAuth_1.WebAuth {
         const user = {};
         for (const field of fields) {
             if (field.startsWith("__") || field === this.fields.password || ((_a = auth.user.__hidden) === null || _a === void 0 ? void 0 : _a.includes(field))
-                || ["constructor", "prototype"].includes(field))
+                || field.startsWith("auth_reset_") || ["constructor", "prototype"].includes(field))
                 continue;
             const value = auth.user[field];
             if (value !== undefined)
@@ -169,7 +242,7 @@ class ModelAuth extends WebAuth_1.WebAuth {
     middleware(options = {}) {
         return (next, reject, req, res) => __awaiter(this, void 0, void 0, function* () {
             try {
-                const auth = yield this.resolve(req);
+                const auth = yield this.resolve(req, res);
                 res.header("Cache-Control", "no-store");
                 if (!auth && options.required) {
                     res.status(401).send({ status: "error", code: "unauthorized" });
@@ -188,6 +261,7 @@ class ModelAuth extends WebAuth_1.WebAuth {
         });
     }
     handle(operation, req, res, loginResponse) {
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
             res.header("Cache-Control", "no-store");
             try {
@@ -210,17 +284,10 @@ class ModelAuth extends WebAuth_1.WebAuth {
                 if (!(error instanceof WebAuth_1.WebAuthError))
                     console.error(error);
                 return res.status(error instanceof WebAuth_1.WebAuthError ? error.status : 500).send({ status: "error", code,
-                    message: this.message(code) });
+                    message: error instanceof AuthHookError ? (_b = (_a = this.modelOptions.messages) === null || _a === void 0 ? void 0 : _a[code]) !== null && _b !== void 0 ? _b : error.message : this.message(code) });
             }
         });
     }
 }
-exports.ModelAuth = ModelAuth;
-function authRoute(operation, options) {
-    let auth;
-    return (req, res) => {
-        auth || (auth = typeof options.auth === "function" ? options.auth() : options.auth || new ModelAuth(options));
-        return auth.handle(operation, req, res, options.loginResponse);
-    };
-}
-exports.authRoute = authRoute;
+exports.AuthScope = AuthScope;
+exports.ModelAuth = AuthScope;

package/dist/Auth/PasswordReset.d.ts

@@ -0,0 +1,40 @@
+import type { DocumentDatabase } from "../Database/DatabaseAdapter";
+import { Model } from "../Database/Model";
+export type PasswordResetOptions = {
+    tokenSeconds?: number;
+    cooldownSeconds?: number;
+    /** Revoke registered scopes using the same model, only this scope, or leave sessions intact. */
+    revokeSessions?: "all" | "scope" | false;
+};
+export type PasswordResetDelivery = (user: Model, token: string, expiresAt: number) => void | Promise<void>;
+/** Framework adapter: the password change and token consumption are one conditional database update. */
+export declare class PasswordReset {
+    private readonly model;
+    private readonly key;
+    private readonly fields;
+    private readonly options;
+    private readonly allowed;
+    private readonly invalidate;
+    private readonly database?;
+    readonly tokenSeconds: number;
+    readonly cooldownSeconds: number;
+    readonly revokeSessions: "all" | "scope" | false;
+    readonly hiddenFields: string[];
+    private readonly hashField;
+    private readonly expiresField;
+    private readonly requestedField;
+    constructor(model: typeof Model, key: string, fields: {
+        identifier: string;
+        password: string;
+        primaryKey: string;
+        active: string | false;
+    }, options: PasswordResetOptions, allowed: (user: Model) => boolean | Promise<boolean>, invalidate: (user: Model, mode: "all" | "scope") => Promise<void>, database?: (() => Promise<DocumentDatabase>) | undefined);
+    private rows;
+    private digest;
+    private userForToken;
+    /** No account-existence result is returned. Deliver the raw token only through a trusted server callback. */
+    request(identifier: string, deliver: PasswordResetDelivery): Promise<void>;
+    /** A non-consuming check for the reset form; reset() always checks again atomically. */
+    validate(token: string): Promise<Model | null>;
+    reset(token: string, password: string): Promise<Model | null>;
+}

package/dist/Auth/PasswordReset.js

@@ -0,0 +1,111 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordReset = void 0;
+const bcryptjs_1 = require("bcryptjs");
+const DBConnection_1 = require("../Database/DBConnection");
+const AuthSecurity_1 = require("./AuthSecurity");
+/** Framework adapter: the password change and token consumption are one conditional database update. */
+class PasswordReset {
+    constructor(model, key, fields, options, allowed, invalidate, database) {
+        var _a;
+        this.model = model;
+        this.key = key;
+        this.fields = fields;
+        this.options = options;
+        this.allowed = allowed;
+        this.invalidate = invalidate;
+        this.database = database;
+        this.tokenSeconds = (0, AuthSecurity_1.authLifetime)(options.tokenSeconds, 15 * 60);
+        this.cooldownSeconds = (0, AuthSecurity_1.authLifetime)(options.cooldownSeconds, 3 * 60);
+        this.revokeSessions = (_a = options.revokeSessions) !== null && _a !== void 0 ? _a : "all";
+        if (!["all", "scope", false].includes(this.revokeSessions))
+            throw new Error("Invalid password reset session policy.");
+        const prefix = `auth_reset_${key}_`;
+        this.hashField = prefix + "hash";
+        this.expiresField = prefix + "expires_at";
+        this.requestedField = prefix + "requested_at";
+        this.hiddenFields = [this.hashField, this.expiresField, this.requestedField];
+    }
+    rows() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const instance = new this.model();
+            const db = yield (this.database ? this.database() : DBConnection_1.DBConnection.getDocumentStore(instance.__connection));
+            return db.collection(instance.__table);
+        });
+    }
+    digest(token, user) {
+        // Bind reset tokens to the scope and current password: a later password change invalidates them.
+        return (0, AuthSecurity_1.hashAuthToken)(`${this.key}\0${token}\0${user[this.fields.password]}`);
+    }
+    userForToken(token) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (typeof token !== "string" || !/^[A-Za-z0-9_-]{1,128}\.[A-Za-z0-9_-]{43}$/.test(token))
+                return null;
+            const subject = token.split(".")[0];
+            const id = this.fields.primaryKey === "_id" ? yield this.model.objectId(subject, { noExceptions: true }) : subject;
+            if (id == null)
+                return null;
+            const user = yield this.model.where(this.fields.primaryKey, "=", id).first();
+            if (!user || typeof user[this.fields.password] !== "string" || !(yield this.allowed(user)))
+                return null;
+            return user;
+        });
+    }
+    /** No account-existence result is returned. Deliver the raw token only through a trusted server callback. */
+    request(identifier, deliver) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (typeof identifier !== "string" || !identifier.trim() || identifier.length > 320)
+                return;
+            const user = yield this.model.where(this.fields.identifier, "=", identifier.trim().toLowerCase()).first();
+            if (!user || typeof user[this.fields.password] !== "string" || !(yield this.allowed(user)))
+                return;
+            const now = Date.now(), expiresAt = now + this.tokenSeconds * 1000;
+            const token = `${user[this.fields.primaryKey]}.${(0, AuthSecurity_1.randomAuthToken)()}`;
+            const filter = { [this.fields.primaryKey]: user[this.fields.primaryKey],
+                [this.fields.password]: user[this.fields.password],
+                $or: [{ [this.requestedField]: { $exists: false } }, { [this.requestedField]: { $lte: now - this.cooldownSeconds * 1000 } }] };
+            const updated = yield (yield this.rows()).findOneAndUpdate(filter, { $set: { [this.hashField]: this.digest(token, user), [this.expiresField]: expiresAt, [this.requestedField]: now } }, { returnDocument: "after" });
+            if (updated)
+                yield deliver(user, token, expiresAt);
+        });
+    }
+    /** A non-consuming check for the reset form; reset() always checks again atomically. */
+    validate(token) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const user = yield this.userForToken(token);
+            if (!user)
+                return null;
+            const row = yield (yield this.rows()).findOne({ [this.fields.primaryKey]: user[this.fields.primaryKey],
+                [this.fields.password]: user[this.fields.password], [this.hashField]: this.digest(token, user), [this.expiresField]: { $gt: Date.now() } });
+            return row ? user : null;
+        });
+    }
+    reset(token, password) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (typeof password !== "string" || !password || password.length > 1024)
+                throw new Error("Invalid password.");
+            const user = yield this.validate(token);
+            if (!user)
+                return null;
+            const stored = user[this.fields.password];
+            const nextPassword = yield (0, bcryptjs_1.hash)(password, 12);
+            const row = yield (yield this.rows()).findOneAndUpdate(Object.assign({ [this.fields.primaryKey]: user[this.fields.primaryKey], [this.fields.password]: stored, [this.hashField]: this.digest(token, user), [this.expiresField]: { $gt: Date.now() } }, (this.fields.active === false ? {} : { [this.fields.active]: { $ne: false } })), { $set: { [this.fields.password]: nextPassword }, $unset: { [this.hashField]: "", [this.expiresField]: "" } }, { returnDocument: "after" });
+            if (!row)
+                return null;
+            user[this.fields.password] = nextPassword;
+            if (this.revokeSessions !== false)
+                yield this.invalidate(user, this.revokeSessions);
+            return user;
+        });
+    }
+}
+exports.PasswordReset = PasswordReset;

package/dist/Auth/SessionAuth.d.ts

@@ -1,9 +1,10 @@
-import type { DocumentDatabase } from "../Database/DatabaseAdapter";
+import type { DatabaseIdAdapter, DocumentDatabase } from "../Database/DatabaseAdapter";
 export type AuthSession = {
     id: string;
     subject: string;
     issuer: string;
     audience: string;
+    scope: string;
     environment: string | null;
     userAgent?: string;
     lastActiveAt?: number;
@@ -27,16 +28,21 @@ export type CreatedAuthSession = SessionTokenPair & {
 export type SessionAuthOptions = {
     issuer: string;
     audience: string;
+    scope?: string;
     environment?: string;
     connection?: string;
     collection?: string;
     accessTokenSeconds?: number;
     sessionSeconds?: number;
+    /** Maximum inactivity; false disables the idle limit. */
+    idleTimeoutSeconds?: number | false;
     /** Called on creation, authentication and refresh. Check account status and tenant membership here.
      * For federated sessions this can also introspect the parent authority session. Failures fail closed. */
     isSessionAllowed: (session: AuthSession) => boolean | Promise<boolean>;
     /** Dependency injection for a document-capable driver. Atomic findOneAndUpdate is required. */
     database?: () => Promise<DocumentDatabase>;
+    /** ID handling for an injected document store; otherwise the selected driver owns IDs. */
+    idAdapter?: DatabaseIdAdapter;
 };
 /** Revocable, hashed, independently addressable device sessions. Legacy UserAuth is unaffected. */
 export declare class SessionAuth {
@@ -44,8 +50,12 @@ export declare class SessionAuth {
     private readonly scope;
     private readonly accessSeconds;
     private readonly sessionSeconds;
+    private readonly idleSeconds;
     constructor(options: SessionAuthOptions);
+    private ids;
+    private sessionId;
     private rows;
+    private liveFilter;
     private allowed;
     private pair;
     create(subject: string, parent?: AuthSession["parent"]): Promise<CreatedAuthSession>;
@@ -55,6 +65,8 @@ export declare class SessionAuth {
     verifyCsrf(token: string, csrf: string, kind?: "access" | "refresh"): Promise<boolean>;
     /** One winner under concurrency. A previously consumed refresh token revokes its device session. */
     refresh(token: string): Promise<SessionTokenPair | null>;
+    /** Trusted browser GET resumption: renew access without consuming or replaying refresh rotation. */
+    renewAccess(token: string): Promise<SessionTokenPair | null>;
     /** Browser login metadata; arbitrary request data and token hashes are never exposed. */
     recordLogin(session: AuthSession, userAgent: string): Promise<void>;
     /** Persist activity with a one-minute throttle; authorization does not depend on this timestamp. */