@zudojs/auth 1.0.0 → 1.2.0

package/dist/authTypes/authAttempt.type.d.ts

@@ -17,9 +17,11 @@ export interface LoginAttemptRecord {
 /**
  * Store backing failed-attempt lockout and login rate limiting.
  *
- * Keys are the *submitted* identifier, not a resolved user id, so unknown
- * and known accounts are throttled identically and the endpoint stays free
- * of an existence oracle. The in-memory implementation
+ * Keys are the *submitted* identifier — trimmed, NFKC-normalised and
+ * lower-cased by `createAuthService()` so that case and whitespace variants
+ * of one email share a budget — not a resolved user id, so unknown and
+ * known accounts are throttled identically and the endpoint stays free of
+ * an existence oracle. The in-memory implementation
  * (`createMemoryLoginAttemptStore`) is per-process; back this with Redis to
  * make limits hold across instances.
  */
@@ -28,7 +30,11 @@ export interface LoginAttemptStore {
     get(identifier: string): Promise<LoginAttemptRecord>;
     /** Count an attempt (before credentials are checked). */
     recordAttempt(identifier: string): Promise<LoginAttemptRecord>;
-    /** Count a failed authentication. */
+    /**
+     * Count a failed authentication. Must be atomic: `createAuthService()`
+     * reserves a failure *before* checking the password and relies on
+     * concurrent calls seeing distinct, increasing counts.
+     */
     recordFailure(identifier: string): Promise<LoginAttemptRecord>;
     /** Lock an identifier until `until` (Unix milliseconds). */
     lock(identifier: string, until: number): Promise<void>;
@@ -50,8 +56,14 @@ export interface LoginThrottleConfig {
     readonly lockoutSeconds?: number;
     /**
      * Attempts allowed per identifier inside the store's rate-limit window
-     * (default: 20). Exceeding it throws `AuthRateLimitError`. This bounds the
-     * scrypt work an attacker can force the server to perform.
+     * (default: 20). Exceeding it throws `AuthRateLimitError`.
+     *
+     * This is a *per-identifier* budget: it bounds the password guesses
+     * against one account, not the scrypt work the server can be made to do.
+     * Every new identifier starts with a fresh budget, and unknown identifiers
+     * still burn a full scrypt verification, so an attacker rotating
+     * identifiers is not limited by it. Put a per-IP limiter (for example
+     * `createRateLimiter` from `@zudojs/security`) in front of `login()`.
      */
     readonly maxAttemptsPerWindow?: number;
     /**

package/dist/authUtils/authUtils.helper.d.ts

@@ -55,6 +55,10 @@ export declare function extractUserId(token: unknown): string | null;
 /**
  * Generate a CSRF token.
  *
+ * @deprecated This returns an unbound random value that nothing in the
+ *   framework can validate. Use `generateCsrfToken` / `validateCsrfToken`
+ *   (or `createCsrfProtection`) from `@zudojs/security`, which produce
+ *   session-bound, HMAC-signed tokens.
  * @returns Random hex string for CSRF protection
  */
 export declare function generateCsrfToken(): string;

package/dist/authUtils/authUtils.helper.js

@@ -115,6 +115,10 @@ export function extractUserId(token) {
 /**
  * Generate a CSRF token.
  *
+ * @deprecated This returns an unbound random value that nothing in the
+ *   framework can validate. Use `generateCsrfToken` / `validateCsrfToken`
+ *   (or `createCsrfProtection`) from `@zudojs/security`, which produce
+ *   session-bound, HMAC-signed tokens.
  * @returns Random hex string for CSRF protection
  */
 export function generateCsrfToken() {

package/package.json

@@ -1,8 +1,12 @@
 {
   "name": "@zudojs/auth",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "Authentication and authorization services for the Zudojs framework — JWT, sessions, RBAC, and password management.",
   "license": "MIT",
+  "author": {
+    "name": "Oluwayemi Oyinlola",
+    "url": "https://github.com/oyinlola-tech"
+  },
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -21,9 +25,10 @@
     "!dist/.tsbuildinfo"
   ],
   "dependencies": {
-    "@zudojs/errors": "1.0.0",
-    "@zudojs/constants": "1.0.0",
-    "@zudojs/permissions": "1.0.0"
+    "@zudojs/constants": "1.1.0",
+    "@zudojs/crypto": "1.2.0",
+    "@zudojs/errors": "1.1.0",
+    "@zudojs/permissions": "1.2.0"
   },
   "engines": {
     "node": ">=24.0.0"