najm-auth 2.0.9 → 2.0.11

package/dist/client/edge.js

@@ -185,7 +185,12 @@ async function requestSessionRecovery(options) {
   } catch (error) {
     reportFailure(options, {
       reason: "fetch-error",
-      error: safeErrorDetails(error)
+      error: safeErrorDetails(error, [
+        options.refreshCookieValue,
+        options.sessionSecret,
+        endpoint,
+        options.requestOrigin
+      ])
     });
     return { status: "unavailable" };
   }
@@ -289,33 +294,37 @@ function reportFailure(options, failure) {
   }
 }
 __name(reportFailure, "reportFailure");
-function safeErrorDetails(value) {
+function safeErrorDetails(value, sensitiveValues) {
   const error = isRecord2(value) ? value : {};
   const details = {
-    name: safeText(error.name, "Error"),
-    message: safeText(error.message, "Session recovery fetch failed")
+    name: safeText(error.name, "Error", sensitiveValues),
+    message: safeText(error.message, "Session recovery fetch failed", sensitiveValues)
   };
-  const code = safeOptionalText(error.code);
+  const code = safeOptionalText(error.code, sensitiveValues);
   if (code) details.code = code;
   if (isRecord2(error.cause)) {
-    const causeCode = safeOptionalText(error.cause.code);
+    const causeCode = safeOptionalText(error.cause.code, sensitiveValues);
     details.cause = {
-      name: safeText(error.cause.name, "Error"),
-      message: safeText(error.cause.message, "Session recovery fetch failed"),
+      name: safeText(error.cause.name, "Error", sensitiveValues),
+      message: safeText(error.cause.message, "Session recovery fetch failed", sensitiveValues),
       ...causeCode ? { code: causeCode } : {}
     };
   }
   return details;
 }
 __name(safeErrorDetails, "safeErrorDetails");
-function safeText(value, fallback) {
+function safeText(value, fallback, sensitiveValues) {
   if (typeof value !== "string" || !value) return fallback;
-  return value.replace(/[\u0000-\u001F\u007F]/g, " ").slice(0, 300);
+  let safe = value.replace(/[\u0000-\u001F\u007F]/g, " ").replace(/\b(authorization|cookie)\s*[:=]\s*[^\s,;]+/gi, "$1=[redacted]").replace(/\bBearer\s+[^\s,;]+/gi, "Bearer [redacted]").replace(/\beyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[redacted]");
+  for (const sensitive of sensitiveValues) {
+    if (sensitive) safe = safe.split(sensitive).join("[redacted]");
+  }
+  return safe.slice(0, 300);
 }
 __name(safeText, "safeText");
-function safeOptionalText(value) {
+function safeOptionalText(value, sensitiveValues) {
   if (typeof value !== "string" && typeof value !== "number") return void 0;
-  return safeText(String(value), "");
+  return safeText(String(value), "", sensitiveValues);
 }
 __name(safeOptionalText, "safeOptionalText");
 function isRecord2(value) {

package/dist/client/server/index.js

@@ -197,7 +197,12 @@ async function requestSessionRecovery(options) {
   } catch (error) {
     reportFailure(options, {
       reason: "fetch-error",
-      error: safeErrorDetails(error)
+      error: safeErrorDetails(error, [
+        options.refreshCookieValue,
+        options.sessionSecret,
+        endpoint,
+        options.requestOrigin
+      ])
     });
     return { status: "unavailable" };
   }
@@ -292,31 +297,35 @@ function reportFailure(options, failure) {
   } catch {
   }
 }
-function safeErrorDetails(value) {
+function safeErrorDetails(value, sensitiveValues) {
   const error = isRecord2(value) ? value : {};
   const details = {
-    name: safeText(error.name, "Error"),
-    message: safeText(error.message, "Session recovery fetch failed")
+    name: safeText(error.name, "Error", sensitiveValues),
+    message: safeText(error.message, "Session recovery fetch failed", sensitiveValues)
   };
-  const code = safeOptionalText(error.code);
+  const code = safeOptionalText(error.code, sensitiveValues);
   if (code) details.code = code;
   if (isRecord2(error.cause)) {
-    const causeCode = safeOptionalText(error.cause.code);
+    const causeCode = safeOptionalText(error.cause.code, sensitiveValues);
     details.cause = {
-      name: safeText(error.cause.name, "Error"),
-      message: safeText(error.cause.message, "Session recovery fetch failed"),
+      name: safeText(error.cause.name, "Error", sensitiveValues),
+      message: safeText(error.cause.message, "Session recovery fetch failed", sensitiveValues),
       ...causeCode ? { code: causeCode } : {}
     };
   }
   return details;
 }
-function safeText(value, fallback) {
+function safeText(value, fallback, sensitiveValues) {
   if (typeof value !== "string" || !value) return fallback;
-  return value.replace(/[\u0000-\u001F\u007F]/g, " ").slice(0, 300);
+  let safe = value.replace(/[\u0000-\u001F\u007F]/g, " ").replace(/\b(authorization|cookie)\s*[:=]\s*[^\s,;]+/gi, "$1=[redacted]").replace(/\bBearer\s+[^\s,;]+/gi, "Bearer [redacted]").replace(/\beyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[redacted]");
+  for (const sensitive of sensitiveValues) {
+    if (sensitive) safe = safe.split(sensitive).join("[redacted]");
+  }
+  return safe.slice(0, 300);
 }
-function safeOptionalText(value) {
+function safeOptionalText(value, sensitiveValues) {
   if (typeof value !== "string" && typeof value !== "number") return void 0;
-  return safeText(String(value), "");
+  return safeText(String(value), "", sensitiveValues);
 }
 function isRecord2(value) {
   return typeof value === "object" && value !== null;

package/dist/index.d.ts

@@ -545,7 +545,7 @@ declare class UserRepository {
     private schema;
     private get users();
     private get roles();
-    /** Shared query helper */
+    /** Shared query helper, scoped to the current database/transaction identity. */
     private queryHelper?;
     private get q();
     getAll(limit?: number, offset?: number): Promise<UserWithPermissions[]>;
@@ -820,6 +820,7 @@ declare class UserService {
     findByEmailInsensitive(email: string): Promise<(User & {
         role?: string | null;
     }) | undefined>;
+    findByPhone(phone: string): Promise<UserWithPermissions>;
     getAuthRecordById(id: string): Promise<User | undefined>;
     create(data: Record<string, any>): Promise<SanitizedUser>;
     update(id: string, data: Record<string, any>): Promise<SanitizedUser>;
@@ -846,7 +847,7 @@ declare class TokenRepository {
     private schema;
     private get tokens();
     private get users();
-    /** Shared query helper */
+    /** Shared query helper, scoped to the current database/transaction identity. */
     private queryHelper?;
     private get q();
     /**
@@ -1144,10 +1145,13 @@ declare const inviteUserDto: z.ZodObject<{
 declare const userIdParam: z.ZodObject<{
     id: z.ZodString;
 }, z.core.$strip>;
-declare const loginDto: z.ZodObject<{
+declare const loginDto: z.ZodUnion<readonly [z.ZodObject<{
+    identifier: z.ZodString;
+    password: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
     email: z.ZodString;
     password: z.ZodString;
-}, z.core.$strip>;
+}, z.core.$strip>]>;
 declare const changePasswordDto: z.ZodObject<{
     currentPassword: z.ZodString;
     newPassword: z.ZodString;
@@ -1306,6 +1310,12 @@ declare class AuthService {
     }>;
 }
 
+/**
+ * Composite key: IP + hashed normalized login/registration identity.
+ * Buckets rate limits per IP+credential combo so different users
+ * on the same IP (e.g. localhost, NAT) don't share a single bucket.
+ */
+declare const authIdentityRateLimitKey: (ctx: Context) => Promise<string>;
 declare class AuthController {
     private authService;
     constructor(authService: AuthService);
@@ -1419,6 +1429,15 @@ declare class AuthResolver {
     onReady(): Promise<void>;
 }
 
+/**
+ * Normalize an authentication identifier for both login resolution and
+ * rate-limit bucketing. Email comparison is case-insensitive. Phone login uses
+ * an E.164-compatible value and accepts common visual separators plus a `00`
+ * international prefix.
+ */
+declare function normalizeAuthIdentifier(value: unknown): string | null;
+declare function isEmailIdentifier(value: string): boolean;
+
 interface RunAsUser {
     id: string;
     role?: string | null;
@@ -2317,4 +2336,4 @@ declare const authSeed: (config: AuthSeedConfig) => Record<string, SeedEntry>;
  */
 declare function seedAuthData(config: SeedAuthDataConfig): Promise<SeedAuthDataResult>;
 
-export { AUTH_CONFIG, en as AUTH_EN, AUTH_LOCALES, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthPluginConfig, AuthQueries, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, AuthSessionService, type AuthUser, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type DefineRolesOptions, type EmailParam, EncryptionService, type GoogleOAuthConfig, type InviteUserDto, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, NewPermission, NewRoleEntity, NewUser, type OAuthConfig, type OAuthProvider, Owned, type OwnedMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, type ProvisionUserInput, ROLES, ROLE_GROUPS, type RefreshTokenDto, type RegisterDto, type ResetPasswordDto, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, TOKEN_STATUS, TOKEN_TYPE, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createPermissionDto, createRoleDto, createTokenDto, createUserDto, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, inviteUserDto, isAdmin, isAdministrator, isAuth, isEmpty, isFile, isPath, join, languageParam, loginDto, own, parseSchema, permissionIdParam, pickProps, refreshTokenDto, registerDto, resetPasswordDto, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };
+export { AUTH_CONFIG, en as AUTH_EN, AUTH_LOCALES, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthPluginConfig, AuthQueries, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, AuthSessionService, type AuthUser, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type DefineRolesOptions, type EmailParam, EncryptionService, type GoogleOAuthConfig, type InviteUserDto, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, NewPermission, NewRoleEntity, NewUser, type OAuthConfig, type OAuthProvider, Owned, type OwnedMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, type ProvisionUserInput, ROLES, ROLE_GROUPS, type RefreshTokenDto, type RegisterDto, type ResetPasswordDto, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, TOKEN_STATUS, TOKEN_TYPE, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authIdentityRateLimitKey, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createPermissionDto, createRoleDto, createTokenDto, createUserDto, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, inviteUserDto, isAdmin, isAdministrator, isAuth, isEmailIdentifier, isEmpty, isFile, isPath, join, languageParam, loginDto, normalizeAuthIdentifier, own, parseSchema, permissionIdParam, pickProps, refreshTokenDto, registerDto, resetPasswordDto, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };

package/dist/index.js

@@ -573,10 +573,14 @@ var UserRepository = class UserRepository2 {
   get roles() {
     return this.schema.roles;
   }
-  /** Shared query helper */
+  /** Shared query helper, scoped to the current database/transaction identity. */
   queryHelper;
   get q() {
-    return this.queryHelper ??= new AuthQueries(this.db, this.schema);
+    const db = this.db;
+    if (this.queryHelper?.db !== db) {
+      this.queryHelper = { db, queries: new AuthQueries(db, this.schema) };
+    }
+    return this.queryHelper.queries;
   }
   async getAll(limit = 50, offset = 0) {
     const allUsers = await this.db.select(this.q.userSelection()).from(this.users).leftJoin(this.roles, eq2(this.users.roleId, this.roles.id)).limit(limit).offset(offset);
@@ -1260,6 +1264,9 @@ var UserService = class UserService2 {
   async findByEmailInsensitive(email2) {
     return await this.userRepository.getByEmailInsensitive(email2);
   }
+  async findByPhone(phone) {
+    return await this.userRepository.findByPhone(phone);
+  }
   async getAuthRecordById(id) {
     return await this.userRepository.getRawById(id);
   }
@@ -1420,10 +1427,14 @@ var TokenRepository = class TokenRepository2 {
   get users() {
     return this.schema.users;
   }
-  /** Shared query helper */
+  /** Shared query helper, scoped to the current database/transaction identity. */
   queryHelper;
   get q() {
-    return this.queryHelper ??= new AuthQueries(this.db, this.schema);
+    const db = this.db;
+    if (this.queryHelper?.db !== db) {
+      this.queryHelper = { db, queries: new AuthQueries(db, this.schema) };
+    }
+    return this.queryHelper.queries;
   }
   /**
    * Upsert the refresh-token row for a session, keyed on `tokenFamily` (the
@@ -1575,7 +1586,7 @@ var TokenService = class TokenService2 {
     if (authorization?.startsWith("Bearer ")) {
       return authorization.split(" ")[1];
     }
-    Err6(this.t("errors.tokenMissing"));
+    Err6(this.t("errors.tokenMissing"), 401);
   }
   /**
    * Verify access token and check blacklist
@@ -1586,7 +1597,7 @@ var TokenService = class TokenService2 {
     try {
       payload = jwt.verify(token, this.config.jwt.accessSecret);
     } catch {
-      Err6(this.t("errors.tokenVerificationFailed"));
+      Err6(this.t("errors.tokenVerificationFailed"), 401);
     }
     const sessionKey = this.sessionVersionKey(payload.userId);
     const blacklistKey = payload.jti ? `${this.blacklistPrefix}${payload.jti}` : null;
@@ -1599,15 +1610,15 @@ var TokenService = class TokenService2 {
     const values = await this.getCacheValues(keys);
     const valueByKey = new Map(keys.map((key, i) => [key, values[i]]));
     if (blacklistKey && valueByKey.get(blacklistKey) != null) {
-      Err6(this.t("errors.tokenRevoked"));
+      Err6(this.t("errors.tokenRevoked"), 401);
     }
     if (familyKey && valueByKey.get(familyKey) != null) {
-      Err6(this.t("errors.tokenRevoked"));
+      Err6(this.t("errors.tokenRevoked"), 401);
     }
     const activeSessionVersion = this.parseSessionVersion(valueByKey.get(sessionKey) ?? null);
     const tokenSessionVersion = payload.sessionVersion ?? 0;
     if (tokenSessionVersion !== activeSessionVersion) {
-      Err6(this.t("errors.tokenRevoked"));
+      Err6(this.t("errors.tokenRevoked"), 401);
     }
     return payload;
   }
@@ -1616,13 +1627,13 @@ var TokenService = class TokenService2 {
     try {
       decoded = jwt.verify(token, this.config.jwt.refreshSecret);
     } catch {
-      Err6(this.t("errors.tokenVerificationFailed"));
+      Err6(this.t("errors.tokenVerificationFailed"), 401);
     }
     if (decoded.type && decoded.type !== "refresh") {
-      Err6(this.t("errors.tokenVerificationFailed"));
+      Err6(this.t("errors.tokenVerificationFailed"), 401);
     }
     if (!decoded.tokenFamily) {
-      Err6(this.t("errors.tokenVerificationFailed"));
+      Err6(this.t("errors.tokenVerificationFailed"), 401);
     }
     return { userId: decoded.userId, tokenFamily: decoded.tokenFamily };
   }
@@ -1641,12 +1652,12 @@ var TokenService = class TokenService2 {
   async resolveRefreshSessionFromCookie() {
     const refreshToken = this.cookieManager.getRefreshToken();
     if (!refreshToken) {
-      Err6(this.t("errors.refreshTokenMissing"));
+      Err6(this.t("errors.refreshTokenMissing"), 401);
     }
     const { userId, tokenFamily } = this.verifyRefreshToken(refreshToken);
     const stored = await this.tokenRepository.getByFamily(tokenFamily);
     if (!stored || stored.userId !== userId) {
-      Err6(this.t("errors.refreshTokenInvalid"));
+      Err6(this.t("errors.refreshTokenInvalid"), 401);
     }
     const presentedHash = this.hashToken(refreshToken);
     if (presentedHash === stored.token) {
@@ -1656,7 +1667,7 @@ var TokenService = class TokenService2 {
     if (canRecover) {
       return { userId, tokenFamily };
     }
-    Err6(this.t("errors.refreshTokenInvalid"));
+    Err6(this.t("errors.refreshTokenInvalid"), 401);
   }
   async resolveUserFromCookie() {
     return (await this.resolveRefreshSessionFromCookie()).userId;
@@ -1833,12 +1844,12 @@ var TokenService = class TokenService2 {
   async refreshTokens() {
     const refreshToken = this.cookieManager.getRefreshToken();
     if (!refreshToken) {
-      Err6(this.t("errors.refreshTokenMissing"));
+      Err6(this.t("errors.refreshTokenMissing"), 401);
     }
     const { userId, tokenFamily } = this.verifyRefreshToken(refreshToken);
     const stored = await this.tokenRepository.getByFamily(tokenFamily);
     if (!stored || stored.userId !== userId) {
-      Err6(this.t("errors.refreshTokenInvalid"));
+      Err6(this.t("errors.refreshTokenInvalid"), 401);
     }
     const presentedHash = this.hashToken(refreshToken);
     await this.requireActiveRefreshUser(userId, tokenFamily);
@@ -1849,18 +1860,18 @@ var TokenService = class TokenService2 {
     if (canRecover) {
       const claimed = await this.tokenRepository.markPreviousUsed(tokenFamily, presentedHash);
       if (!claimed?.length) {
-        Err6(this.t("errors.refreshTokenInvalid"));
+        Err6(this.t("errors.refreshTokenInvalid"), 401);
       }
       return this.generateTokens(userId, tokenFamily);
     }
     await this.revokeSuspectRefreshFamily(userId, tokenFamily);
-    Err6(this.t("errors.refreshTokenInvalid"));
+    Err6(this.t("errors.refreshTokenInvalid"), 401);
   }
   async requireActiveRefreshUser(userId, tokenFamily) {
     const user = await this.tokenRepository.getUser(userId);
     if (!user || user.status !== "active") {
       await this.revokeFamily(tokenFamily);
-      Err6(this.t("errors.refreshTokenInvalid"));
+      Err6(this.t("errors.refreshTokenInvalid"), 401);
     }
     return user;
   }
@@ -1894,7 +1905,7 @@ var TokenService = class TokenService2 {
     const userId = await this.resolveUserFromCookie();
     const user = await this.getUserById(userId);
     if (!user) {
-      Err6(this.t("errors.refreshTokenInvalid"));
+      Err6(this.t("errors.refreshTokenInvalid"), 401);
     }
     return user;
   }
@@ -2126,6 +2137,27 @@ AuthSessionService = __decorate11([
   __metadata11("design:paramtypes", [typeof (_a7 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a7 : Object, typeof (_b5 = typeof UserService !== "undefined" && UserService) === "function" ? _b5 : Object, typeof (_c3 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _c3 : Object])
 ], AuthSessionService);
 
+// src/auth/authIdentity.ts
+var PHONE_PATTERN = /^\+[1-9]\d{7,14}$/;
+function normalizeAuthIdentifier(value) {
+  if (typeof value !== "string")
+    return null;
+  const trimmed = value.trim();
+  if (!trimmed || trimmed.length > 254)
+    return null;
+  if (trimmed.includes("@")) {
+    return trimmed.toLowerCase();
+  }
+  const compact = trimmed.replace(/[\s().-]+/g, "");
+  const international = compact.startsWith("00") ? `+${compact.slice(2)}` : compact;
+  return PHONE_PATTERN.test(international) ? international : null;
+}
+__name(normalizeAuthIdentifier, "normalizeAuthIdentifier");
+function isEmailIdentifier(value) {
+  return value.includes("@");
+}
+__name(isEmailIdentifier, "isEmailIdentifier");
+
 // src/auth/AuthService.ts
 var __decorate12 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -2256,8 +2288,16 @@ var AuthService = class AuthService2 {
     return this.inviteUser(body);
   }
   async loginUser(body) {
-    const { email: email2, password } = body;
-    const user = await this.userService.findByEmail(email2);
+    const password = body.password;
+    const rawIdentifier = "identifier" in body ? body.identifier : body.email;
+    const identifier = normalizeAuthIdentifier(rawIdentifier);
+    let user;
+    if (identifier && isEmailIdentifier(identifier)) {
+      user = await this.userService.findByEmailInsensitive(identifier);
+    } else if (identifier) {
+      const phoneUser = await this.userService.findByPhone(identifier);
+      user = phoneUser ? await this.userService.findByEmail(phoneUser.email) : void 0;
+    }
     if (user?.lockoutUntil && !this.isLockoutActive(user.lockoutUntil)) {
       await this.userService.resetFailedAttempts(user.id);
       user.failedLoginAttempts = 0;
@@ -2276,10 +2316,10 @@ var AuthService = class AuthService2 {
           Err8(this.t("errors.accountLocked"), 423);
         }
       }
-      Err8(this.t("errors.invalidCredentials"));
+      Err8(this.t("errors.invalidCredentials"), 401);
     }
     if (user.status !== "active") {
-      Err8(this.t("errors.accountInactive"));
+      Err8(this.t("errors.accountInactive"), 403);
     }
     if (this.config.requireVerifiedEmail && !user.emailVerified) {
       Err8(this.t("errors.emailNotVerified"), 403);
@@ -2406,11 +2446,11 @@ var AuthService = class AuthService2 {
   async changePassword(userId, currentPassword, newPassword) {
     const user = await this.userService.getAuthRecordById(userId);
     if (!user?.password) {
-      Err8(this.t("errors.invalidCredentials"));
+      Err8(this.t("errors.invalidCredentials"), 401);
     }
     const isValid = await this.userValidator.comparePassword(currentPassword, user.password);
     if (!isValid) {
-      Err8(this.t("errors.invalidCredentials"));
+      Err8(this.t("errors.invalidCredentials"), 401);
     }
     this.userValidator.validatePasswordStrength(newPassword);
     await this.userService.update(userId, { password: newPassword });
@@ -2566,10 +2606,17 @@ var inviteUserDto = z.object({
 var userIdParam = z.object({
   id: z.string().min(1, "User ID is required")
 });
-var loginDto = z.object({
-  email: emailField,
-  password: passwordField
-});
+var identifierField = z.string().trim().min(1).max(254);
+var loginDto = z.union([
+  z.object({
+    identifier: identifierField,
+    password: passwordField
+  }),
+  z.object({
+    email: emailField,
+    password: passwordField
+  })
+]);
 var changePasswordDto = z.object({
   currentPassword: passwordField,
   newPassword: passwordField
@@ -2622,19 +2669,19 @@ var cookieFingerprint = /* @__PURE__ */ __name(() => (ctx) => {
   const fingerprint = cookie ? hashKeyPart(cookie) : "none";
   return `${ip}:${fingerprint}`;
 }, "cookieFingerprint");
-var ipAndEmail = /* @__PURE__ */ __name(async (ctx) => {
+var authIdentityRateLimitKey = /* @__PURE__ */ __name(async (ctx) => {
   const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
   try {
     const body = await ctx.req.json();
-    if (body?.email && typeof body.email === "string") {
-      const normalizedEmail = body.email.trim().toLowerCase();
-      if (normalizedEmail)
-        return `${ip}:${hashKeyPart(normalizedEmail)}`;
+    const identity = body?.identifier ?? body?.email;
+    const normalizedIdentity = normalizeAuthIdentifier(identity);
+    if (normalizedIdentity) {
+      return `${ip}:${hashKeyPart(normalizedIdentity)}`;
     }
   } catch {
   }
   return ip;
-}, "ipAndEmail");
+}, "authIdentityRateLimitKey");
 var AuthController = class AuthController2 {
   static {
     __name(this, "AuthController");
@@ -2681,7 +2728,7 @@ var AuthController = class AuthController2 {
 };
 __decorate15([
   Post("/register"),
-  RateLimit({ limit: 5, window: "15m", key: ipAndEmail }),
+  RateLimit({ limit: 5, window: "15m", key: authIdentityRateLimitKey }),
   Validate(registerDto),
   ResMsg("auth.success.register"),
   __param5(0, Body()),
@@ -2691,7 +2738,7 @@ __decorate15([
 ], AuthController.prototype, "registerUser", null);
 __decorate15([
   Post("/login"),
-  RateLimit({ limit: 5, window: "15m", key: ipAndEmail, message: "Too many login attempts. Please try again later." }),
+  RateLimit({ limit: 5, window: "15m", key: authIdentityRateLimitKey, message: "Too many login attempts. Please try again later." }),
   Validate(loginDto),
   ResMsg("auth.success.login"),
   __param5(0, Body()),
@@ -2760,7 +2807,7 @@ __decorate15([
 ], AuthController.prototype, "userProfile", null);
 __decorate15([
   Post("/forgot-password"),
-  RateLimit({ limit: 3, window: "15m", key: ipAndEmail, message: "Too many password reset requests. Please try again later." }),
+  RateLimit({ limit: 3, window: "15m", key: authIdentityRateLimitKey, message: "Too many password reset requests. Please try again later." }),
   Validate(resetPasswordDto),
   ResMsg("auth.success.passwordResetSent"),
   __param5(0, Body()),
@@ -5699,6 +5746,7 @@ export {
   assignRoleDto,
   assignRoleParams,
   auth,
+  authIdentityRateLimitKey,
   authSchema,
   authSeed,
   avatarsPath,
@@ -5723,12 +5771,14 @@ export {
   isAdmin,
   isAdministrator,
   isAuth,
+  isEmailIdentifier,
   isEmpty,
   isFile,
   isPath,
   join2 as join,
   languageParam,
   loginDto,
+  normalizeAuthIdentifier,
   oauthAccountsTable,
   own,
   parseSchema,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "2.0.9",
+  "version": "2.0.11",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [