najm-auth 3.1.2 → 3.1.4

package/README.md

@@ -721,7 +721,7 @@ limits are active when `auth()` is registered.
 | Route | Limit | Window | Key Strategy |
 |-------|-------|--------|--------------|
 | `POST /auth/register` | 5 | 15 minutes | IP |
-| `POST /auth/login` | 5 | 15 minutes | IP |
+| `POST /auth/login` | 8 | 10 minutes | IP + hashed normalized identity |
 | `POST /auth/refresh` | 15 | 15 minutes | Cookie fingerprint |
 | `POST /auth/session/recover` | 120 | 1 minute | Cookie fingerprint |
 | `POST /auth/logout` | 10 | 15 minutes | User ID |
@@ -729,10 +729,27 @@ limits are active when `auth()` is registered.
 | `POST /auth/forgot-password` | 3 | 15 minutes | IP |
 | `POST /auth/reset-password` | 5 | 15 minutes | IP |
 
-### Customizing Rate Limits
-
-```typescript
-auth({
+### Customizing Rate Limits
+
+The login route has strict environment overrides. Values are read when the
+server imports `najm-auth`, so restart the process after changing them. Invalid
+values fail startup rather than silently weakening the limiter.
+
+```bash
+NAJM_AUTH_LOGIN_RATE_LIMIT_ENABLED=true
+NAJM_AUTH_LOGIN_RATE_LIMIT=8
+NAJM_AUTH_LOGIN_RATE_WINDOW=10m
+```
+
+`NAJM_AUTH_LOGIN_RATE_LIMIT_ENABLED=false` disables only the login-route
+limiter. Keep it enabled on public production deployments; a shorter window is
+the safer setting for a disposable production-built demo.
+
+The generic plugin configuration remains available for global limits and skip
+rules:
+
+```typescript
+auth({
   rateLimit: {
     keyGenerator: 'ip',        // or 'user', 'api-key', 'user+ip'
     defaultWindow: '10m',

package/dist/client/index.js

@@ -463,7 +463,8 @@ var NajmAuthClient = class _NajmAuthClient {
     this._hydrated = true;
     this.resetRefreshFailures();
     if (!session || !session.user) {
-      this.api.blockAuthenticatedRequests();
+      if (this.refreshBlocked) this.api.blockAuthenticatedRequests();
+      else this.api.allowAuthenticatedRequests();
       this.state = { ...INITIAL_STATE };
       this.notify();
       return;

package/dist/client/server/index.js

@@ -1172,7 +1172,8 @@ var NajmAuthClient = class _NajmAuthClient {
     this._hydrated = true;
     this.resetRefreshFailures();
     if (!session || !session.user) {
-      this.api.blockAuthenticatedRequests();
+      if (this.refreshBlocked) this.api.blockAuthenticatedRequests();
+      else this.api.allowAuthenticatedRequests();
       this.state = { ...INITIAL_STATE };
       this.notify();
       return;

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import * as najm_core from 'najm-core';
 import { Container } from 'najm-core';
 import { ValidationPluginConfig } from 'najm-validation';
-import { RateLimitPluginConfig } from 'najm-rate';
+import { RateLimitPluginConfig, TimeWindow } from 'najm-rate';
 import { EmailPluginConfig, EmailService } from 'najm-email';
 import { R as ResolvedIdentityConfig, I as IdentityConfig, T as TemporaryCredentialInput } from './ma-sNHnUGLO.js';
 export { D as DEFAULT_IDENTITY_PRESET, E as EXACT_TEMPORARY_CREDENTIAL_KIND, a as IDENTITY_PRESETS, b as IdentityNormalizer, c as IdentityPreset, d as IdentityPresetName, M as MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND, e as TemporaryCredential, f as TemporaryCredentialKind, g as compactPhone, i as isMoroccanCin, h as isTemporaryCredentialKind, m as moroccanCinTemporaryCredential, j as moroccoIdentityPreset, n as normalizeMoroccanCin, k as normalizeMoroccanPhone, l as normalizeTunisianPhone, r as resolveTemporaryCredentialKind, t as toTemporaryCredential, o as tunisiaIdentityPreset } from './ma-sNHnUGLO.js';
@@ -1786,6 +1786,24 @@ declare function createIdentityResolver(config?: IdentityConfig): IdentityResolv
 declare function normalizeAuthIdentifier(value: unknown): string | null;
 declare function isEmailIdentifier(value: string): boolean;
 
+declare const AUTH_LOGIN_RATE_LIMIT_ENV: {
+    readonly enabled: "NAJM_AUTH_LOGIN_RATE_LIMIT_ENABLED";
+    readonly limit: "NAJM_AUTH_LOGIN_RATE_LIMIT";
+    readonly window: "NAJM_AUTH_LOGIN_RATE_WINDOW";
+};
+interface AuthLoginRateLimitConfig {
+    enabled: boolean;
+    limit: number;
+    window: TimeWindow;
+}
+type AuthRateLimitEnvironment = Record<string, string | undefined>;
+declare const DEFAULT_AUTH_LOGIN_RATE_LIMIT: {
+    readonly enabled: true;
+    readonly limit: 8;
+    readonly window: "10m";
+};
+declare function resolveAuthLoginRateLimitConfig(env?: AuthRateLimitEnvironment): AuthLoginRateLimitConfig;
+
 interface RunAsUser {
     id: string;
     role?: string | null;
@@ -2747,4 +2765,4 @@ declare const authSeed: (config: AuthSeedConfig) => Record<string, SeedEntry>;
  */
 declare function seedAuthData(config: SeedAuthDataConfig): Promise<SeedAuthDataResult>;
 
-export { AUTH_CONFIG, en as AUTH_EN, AUTH_LOCALES, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthPluginConfig, AuthQueries, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, AuthSessionService, type AuthUser, CREDENTIAL_SETUP_CODES, CREDENTIAL_SETUP_MODULE, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type CredentialSetupChangeDto, type CredentialSetupCode, type CredentialSetupConfig, CredentialSetupController, type CredentialSetupOptions, type CredentialSetupPasswordOptions, type CredentialSetupPending, CredentialSetupRepository, CredentialSetupRequirementRepository, type CredentialSetupRequirementRow, CredentialSetupRequirementService, CredentialSetupService, type CredentialSetupSessionInfo, type CredentialSetupStarted, DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME, DEFAULT_CREDENTIAL_SETUP_TTL_MS, type DefineRolesOptions, type EmailParam, EncryptionService, type GoogleOAuthConfig, IdentityConfig, type IdentityResolver, type InviteUserDto, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, type LoginResult, NewPermission, NewRoleEntity, NewUser, type OAuthConfig, type OAuthProvider, Owned, type OwnedMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, PASSWORD_SETUP_PURPOSE, PasswordSetupService, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, type ProvisionUserInput, type ProvisionUserWithPasswordInput, type ProvisionUserWithSetupInput, ROLES, ROLE_GROUPS, type RefreshTokenDto, type RegisterDto, type ResetPasswordDto, type ResolvedCredentialSetupConfig, ResolvedIdentityConfig, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, TOKEN_STATUS, TOKEN_TYPE, TemporaryCredentialInput, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authIdentityRateLimitKey, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createIdentityResolver, createPermissionDto, createRoleDto, createTokenDto, createUserDto, credentialSetupChangeDto, credentialSetupError, defaultCredentialSetupPasswordSchema, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, inviteUserDto, isAdmin, isAdministrator, isAuth, isEmailIdentifier, isEmpty, isFile, isPath, join, languageParam, loginDto, normalizeAuthIdentifier, normalizeSetupPurpose, own, parseSchema, permissionIdParam, pickProps, refreshTokenDto, registerDto, resetPasswordDto, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };
+export { AUTH_CONFIG, en as AUTH_EN, AUTH_LOCALES, AUTH_LOGIN_RATE_LIMIT_ENV, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthLoginRateLimitConfig, type AuthPluginConfig, AuthQueries, type AuthRateLimitEnvironment, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, AuthSessionService, type AuthUser, CREDENTIAL_SETUP_CODES, CREDENTIAL_SETUP_MODULE, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type CredentialSetupChangeDto, type CredentialSetupCode, type CredentialSetupConfig, CredentialSetupController, type CredentialSetupOptions, type CredentialSetupPasswordOptions, type CredentialSetupPending, CredentialSetupRepository, CredentialSetupRequirementRepository, type CredentialSetupRequirementRow, CredentialSetupRequirementService, CredentialSetupService, type CredentialSetupSessionInfo, type CredentialSetupStarted, DEFAULT_AUTH_LOGIN_RATE_LIMIT, DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME, DEFAULT_CREDENTIAL_SETUP_TTL_MS, type DefineRolesOptions, type EmailParam, EncryptionService, type GoogleOAuthConfig, IdentityConfig, type IdentityResolver, type InviteUserDto, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, type LoginResult, NewPermission, NewRoleEntity, NewUser, type OAuthConfig, type OAuthProvider, Owned, type OwnedMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, PASSWORD_SETUP_PURPOSE, PasswordSetupService, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, type ProvisionUserInput, type ProvisionUserWithPasswordInput, type ProvisionUserWithSetupInput, ROLES, ROLE_GROUPS, type RefreshTokenDto, type RegisterDto, type ResetPasswordDto, type ResolvedCredentialSetupConfig, ResolvedIdentityConfig, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, TOKEN_STATUS, TOKEN_TYPE, TemporaryCredentialInput, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authIdentityRateLimitKey, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createIdentityResolver, createPermissionDto, createRoleDto, createTokenDto, createUserDto, credentialSetupChangeDto, credentialSetupError, defaultCredentialSetupPasswordSchema, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, inviteUserDto, isAdmin, isAdministrator, isAuth, isEmailIdentifier, isEmpty, isFile, isPath, join, languageParam, loginDto, normalizeAuthIdentifier, normalizeSetupPurpose, own, parseSchema, permissionIdParam, pickProps, refreshTokenDto, registerDto, resetPasswordDto, resolveAuthLoginRateLimitConfig, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };

package/dist/index.js

@@ -3583,6 +3583,75 @@ function getRequestIdentityResolver(context) {
 }
 __name(getRequestIdentityResolver, "getRequestIdentityResolver");
 
+// src/auth/authLoginRateLimitConfig.ts
+var AUTH_LOGIN_RATE_LIMIT_ENV = {
+  enabled: "NAJM_AUTH_LOGIN_RATE_LIMIT_ENABLED",
+  limit: "NAJM_AUTH_LOGIN_RATE_LIMIT",
+  window: "NAJM_AUTH_LOGIN_RATE_WINDOW"
+};
+var DEFAULT_AUTH_LOGIN_RATE_LIMIT = {
+  enabled: true,
+  limit: 8,
+  window: "10m"
+};
+function parseEnabled(raw) {
+  if (raw === void 0 || raw.trim() === "") {
+    return DEFAULT_AUTH_LOGIN_RATE_LIMIT.enabled;
+  }
+  const normalized = raw.trim().toLowerCase();
+  if (normalized === "true")
+    return true;
+  if (normalized === "false")
+    return false;
+  throw new Error(`${AUTH_LOGIN_RATE_LIMIT_ENV.enabled} must be true or false`);
+}
+__name(parseEnabled, "parseEnabled");
+function parseLimit(raw) {
+  if (raw === void 0 || raw.trim() === "") {
+    return DEFAULT_AUTH_LOGIN_RATE_LIMIT.limit;
+  }
+  const normalized = raw.trim();
+  if (!/^\d+$/.test(normalized)) {
+    throw new Error(`${AUTH_LOGIN_RATE_LIMIT_ENV.limit} must be a positive safe integer`);
+  }
+  const limit = Number(normalized);
+  if (!Number.isSafeInteger(limit) || limit <= 0) {
+    throw new Error(`${AUTH_LOGIN_RATE_LIMIT_ENV.limit} must be a positive safe integer`);
+  }
+  return limit;
+}
+__name(parseLimit, "parseLimit");
+function parseWindow(raw) {
+  if (raw === void 0 || raw.trim() === "") {
+    return DEFAULT_AUTH_LOGIN_RATE_LIMIT.window;
+  }
+  const normalized = raw.trim().toLowerCase();
+  const match = normalized.match(/^([1-9]\d*)(s|m|h|d)$/);
+  if (!match) {
+    throw new Error(`${AUTH_LOGIN_RATE_LIMIT_ENV.window} must be a positive duration such as 30s, 10m, 1h, or 1d`);
+  }
+  const amount = Number(match[1]);
+  const multiplier = {
+    s: 1e3,
+    m: 6e4,
+    h: 36e5,
+    d: 864e5
+  }[match[2]];
+  if (!Number.isSafeInteger(amount) || !Number.isSafeInteger(amount * multiplier)) {
+    throw new Error(`${AUTH_LOGIN_RATE_LIMIT_ENV.window} is too large`);
+  }
+  return normalized;
+}
+__name(parseWindow, "parseWindow");
+function resolveAuthLoginRateLimitConfig(env = process.env) {
+  return {
+    enabled: parseEnabled(env[AUTH_LOGIN_RATE_LIMIT_ENV.enabled]),
+    limit: parseLimit(env[AUTH_LOGIN_RATE_LIMIT_ENV.limit]),
+    window: parseWindow(env[AUTH_LOGIN_RATE_LIMIT_ENV.window])
+  };
+}
+__name(resolveAuthLoginRateLimitConfig, "resolveAuthLoginRateLimitConfig");
+
 // src/users/UserDto.ts
 import { z } from "zod";
 var emailField = z.string().email("Invalid email format");
@@ -3692,6 +3761,7 @@ var authIdentityRateLimitKey = /* @__PURE__ */ __name(async (ctx) => {
   }
   return ip;
 }, "authIdentityRateLimitKey");
+var loginRateLimit = resolveAuthLoginRateLimitConfig();
 var AuthController = class AuthController2 {
   static {
     __name(this, "AuthController");
@@ -3748,7 +3818,13 @@ __decorate20([
 ], AuthController.prototype, "registerUser", null);
 __decorate20([
   Post("/login"),
-  RateLimit({ limit: 5, window: "15m", key: authIdentityRateLimitKey, message: "Too many login attempts. Please try again later." }),
+  RateLimit({
+    limit: loginRateLimit.limit,
+    window: loginRateLimit.window,
+    key: authIdentityRateLimitKey,
+    message: "Too many login attempts. Please try again later.",
+    skip: !loginRateLimit.enabled
+  }),
   Validate(loginDto),
   ResMsg("auth.success.login"),
   __param5(0, Body()),
@@ -6885,6 +6961,7 @@ export {
   AUTH_CONFIG,
   en_default as AUTH_EN,
   AUTH_LOCALES,
+  AUTH_LOGIN_RATE_LIMIT_ENV,
   AUTH_MODULE,
   AUTH_PERMISSIONS,
   AUTH_ROLE,
@@ -6911,6 +6988,7 @@ export {
   CredentialSetupRequirementRepository,
   CredentialSetupRequirementService,
   CredentialSetupService,
+  DEFAULT_AUTH_LOGIN_RATE_LIMIT,
   DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME,
   DEFAULT_CREDENTIAL_SETUP_TTL_MS,
   DEFAULT_IDENTITY_PRESET,
@@ -7007,6 +7085,7 @@ export {
   refreshTokenDto,
   registerDto,
   resetPasswordDto,
+  resolveAuthLoginRateLimitConfig,
   resolveTemporaryCredentialKind,
   revokeTokenDto,
   roleIdParam,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "3.1.2",
+  "version": "3.1.4",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [
@@ -97,7 +97,7 @@
     "najm-i18n": "^2.0.3",
     "najm-cache": "^2.0.2",
     "najm-email": "^2.0.2",
-    "najm-rate": "^2.0.2",
+    "najm-rate": "^2.0.3",
     "najm-validation": "^2.0.2",
     "jsonwebtoken": "^9.0.3",
     "jose": "^6.1.3",