najm-auth 4.2.1 → 4.2.2

package/dist/index.js

@@ -2118,6 +2118,24 @@ CredentialSetupRequirementRepository = __decorate11([
 // src/credentialSetup/types.ts
 var PASSWORD_SETUP_PURPOSE = "password";
 
+// src/shared/storedTime.ts
+function storedTimeMs(value) {
+  if (value instanceof Date)
+    return value.getTime();
+  const text3 = value.trim().replace(" ", "T");
+  const time = text3.split("T")[1];
+  if (!time)
+    return Date.parse(text3);
+  if (/Z$/i.test(time))
+    return Date.parse(text3);
+  const offset = /([+-])(\d{2}):?(\d{2})?$/.exec(time);
+  if (!offset)
+    return Date.parse(`${text3}Z`);
+  const [zone, sign, hours, minutes = "00"] = offset;
+  return Date.parse(`${text3.slice(0, -zone.length)}${sign}${hours}:${minutes}`);
+}
+__name(storedTimeMs, "storedTimeMs");
+
 // src/tokens/TokenService.ts
 import { Err as Err7 } from "najm-core";
 var __decorate12 = function(decorators, target, key, desc) {
@@ -2297,7 +2315,7 @@ var TokenService = class TokenService2 {
     if (presentedHash === stored.token) {
       return { userId, tokenFamily };
     }
-    const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && new Date(stored.previousValidUntil).getTime() > Date.now() && !stored.previousUsedAt;
+    const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && storedTimeMs(stored.previousValidUntil) > Date.now() && !stored.previousUsedAt;
     if (canRecover) {
       return { userId, tokenFamily };
     }
@@ -2557,7 +2575,7 @@ var TokenService = class TokenService2 {
     if (presentedHash === stored.token) {
       return this.rotateTokens(userId, tokenFamily, stored.token);
     }
-    const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && new Date(stored.previousValidUntil).getTime() > Date.now() && !stored.previousUsedAt;
+    const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && storedTimeMs(stored.previousValidUntil) > Date.now() && !stored.previousUsedAt;
     if (canRecover) {
       const claimed = await this.tokenRepository.markPreviousUsed(tokenFamily, presentedHash);
       if (!claimed?.length) {
@@ -2695,7 +2713,7 @@ var TokenService = class TokenService2 {
       if (presentedHash === stored.token) {
         return decoded.tokenFamily;
       }
-      const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && new Date(stored.previousValidUntil).getTime() > Date.now() && !stored.previousUsedAt;
+      const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && storedTimeMs(stored.previousValidUntil) > Date.now() && !stored.previousUsedAt;
       return canRecover ? decoded.tokenFamily : null;
     } catch {
       return null;
@@ -3503,7 +3521,7 @@ var AuthService = class AuthService2 {
   isLockoutActive(lockoutUntil) {
     if (!lockoutUntil)
       return false;
-    return new Date(lockoutUntil).getTime() > Date.now();
+    return storedTimeMs(lockoutUntil) > Date.now();
   }
   nextLockoutUntil() {
     const durationMs = timestring4(this.config.lockout.duration, "ms");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "4.2.1",
+  "version": "4.2.2",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [