okengine 0.8.0 → 0.9.0

package/src/plugins/auth-delivery.mailpit.integration.test.ts

@@ -14,7 +14,7 @@ import { deriveInfrastructure, writeDerivedFiles } from "../docker/index.ts";
 import { oke } from "../kernel/app.ts";
 import { resetFlowSeq } from "../kernel/flow.ts";
 import { resetBindings } from "../kernel/on.ts";
-import { emailOtp } from "./email-otp.ts";
+import { otp } from "./otp.ts";
 import { magicLink } from "./magic-link.ts";
 
 const SECRET = "test-secret-at-least-16";
@@ -290,21 +290,21 @@ describe("auth delivery — Mailpit integration", () => {
           config: {
             drivers: { channel: { email: { test: "smtp" } } },
           },
-        }).plug(emailOtp({ exposeDevOtp: true }));
+        }).plug(otp({ tier: 2, channels: ["email"], exposeDevOtp: true }));
         await app.boot({ env: "test" });
 
-        const res = await app.fetch(jsonPost("/auth/email-otp/request", { email }));
+        const res = await app.fetch(jsonPost("/auth/otp/request", { email }));
         expect(res.status).toBe(200);
         const body = (await res.json()) as { data: { ok: true; devOtp?: string } };
         expect(body.data.ok).toBe(true);
         expect(body.data.devOtp).toMatch(/^\d{6}$/);
-        const otp = body.data.devOtp!;
+        const code = body.data.devOtp!;
 
         const msg = await waitForMessage(uiUrl, email);
         expect(msg.Subject).toBe("Your sign-in code");
         const text = msg.Text ?? "";
         const html = msg.HTML ?? "";
-        expect(text.includes(otp) || html.includes(otp)).toBe(true);
+        expect(text.includes(code) || html.includes(code)).toBe(true);
 
         await app.stop();
       } finally {

package/src/plugins/auth-methods.security.test.ts

@@ -12,11 +12,10 @@ import { oke } from "../kernel/app.ts";
 import { resetFlowSeq } from "../kernel/flow.ts";
 import { resetBindings } from "../kernel/on.ts";
 import { anonymous } from "./anonymous.ts";
-import { emailOtp } from "./email-otp.ts";
 import { magicLink } from "./magic-link.ts";
+import { otp } from "./otp.ts";
 import { passkey } from "./passkey.ts";
 import { b64urlEncode, buildAuthenticatorData, signWebAuthnAssertion } from "./passkey-webauthn.ts";
-import { phoneNumber } from "./phone-number.ts";
 import { twoFactor, verifyTotp, createTwoFactorStore } from "./two-factor.ts";
 import { username } from "./username.ts";
 
@@ -51,8 +50,7 @@ function fullAuthApp() {
     .plug(username())
     .plug(anonymous())
     .plug(magicLink({ exposeDevToken: true }))
-    .plug(emailOtp({ exposeDevOtp: true }))
-    .plug(phoneNumber({ exposeDevOtp: true }))
+    .plug(otp({ tier: 2, channels: ["email", "sms"], exposeDevOtp: true }))
     .plug(twoFactor())
     .plug(passkey({ origins: ["http://localhost"] }));
 }
@@ -141,8 +139,7 @@ describe("auth methods — rate limiting / enumeration", () => {
 
     const paths: Array<{ path: string; body: unknown }> = [
       { path: "/auth/magic-link/request", body: { email: "r@example.com" } },
-      { path: "/auth/email-otp/request", body: { email: "r@example.com" } },
-      { path: "/auth/phone/request", body: { phone: "+15551234567" } },
+      { path: "/auth/otp/request", body: { email: "r@example.com" } },
       { path: "/auth/passkey/authenticate/options", body: {} },
     ];
 
@@ -225,14 +222,14 @@ describe("auth methods — single-use OTP / token / backup codes", () => {
     const app = fullAuthApp();
     await app.boot({ env: "test" });
 
-    const req = await app.fetch(jsonPost("/auth/email-otp/request", { email: "otp@example.com" }));
+    const req = await app.fetch(jsonPost("/auth/otp/request", { email: "otp@example.com" }));
     const { data } = (await req.json()) as { data: { devOtp: string } };
     const first = await app.fetch(
-      jsonPost("/auth/email-otp/verify", { email: "otp@example.com", otp: data.devOtp }),
+      jsonPost("/auth/otp/verify", { email: "otp@example.com", otp: data.devOtp }),
     );
     expect(first.status).toBe(200);
     const reuse = await app.fetch(
-      jsonPost("/auth/email-otp/verify", { email: "otp@example.com", otp: data.devOtp }),
+      jsonPost("/auth/otp/verify", { email: "otp@example.com", otp: data.devOtp }),
     );
     expect((await readError(reuse)).reason).toBe("invalid_credentials");
 
@@ -243,14 +240,14 @@ describe("auth methods — single-use OTP / token / backup codes", () => {
     const app = fullAuthApp();
     await app.boot({ env: "test" });
 
-    const req = await app.fetch(jsonPost("/auth/phone/request", { phone: "+15559876543" }));
+    const req = await app.fetch(jsonPost("/auth/otp/request", { phone: "+15559876543" }));
     const { data } = (await req.json()) as { data: { devOtp: string } };
     const first = await app.fetch(
-      jsonPost("/auth/phone/verify", { phone: "+15559876543", otp: data.devOtp }),
+      jsonPost("/auth/otp/verify", { phone: "+15559876543", otp: data.devOtp }),
     );
     expect(first.status).toBe(200);
     const reuse = await app.fetch(
-      jsonPost("/auth/phone/verify", { phone: "+15559876543", otp: data.devOtp }),
+      jsonPost("/auth/otp/verify", { phone: "+15559876543", otp: data.devOtp }),
     );
     expect((await readError(reuse)).reason).toBe("invalid_credentials");
 
@@ -421,7 +418,7 @@ describe("auth methods — anonymous non-escalation", () => {
 });
 
 describe("auth methods — channel delivery", () => {
-  test("magic / email-otp send via fx.send; phone uses fx.sendOtp (Taqnyat Verify); exposeDev* stays off by default", async () => {
+  test("magic uses fx.send; otp Tier 2 uses fx.deliverOtp; exposeDev* stays off by default", async () => {
     resetBindings();
     resetFlowSeq();
     const app = oke({
@@ -431,8 +428,7 @@ describe("auth methods — channel delivery", () => {
       gate: { auth: { secret: SECRET, emailAndPassword: { enabled: true } } },
     })
       .plug(magicLink())
-      .plug(emailOtp())
-      .plug(phoneNumber());
+      .plug(otp({ tier: 2, channels: ["email", "sms"] }));
     await app.boot({ env: "test" });
 
     const ml = await app.fetch(jsonPost("/auth/magic-link/request", { email: "x@example.com" }));
@@ -440,30 +436,24 @@ describe("auth methods — channel delivery", () => {
     expect(mlBody.data.ok).toBe(true);
     expect(mlBody.data.devToken).toBeUndefined();
 
-    const otp = await app.fetch(jsonPost("/auth/email-otp/request", { email: "x@example.com" }));
-    const otpBody = (await otp.json()) as { data: Record<string, unknown> };
+    const otpRes = await app.fetch(jsonPost("/auth/otp/request", { email: "x@example.com" }));
+    const otpBody = (await otpRes.json()) as { data: Record<string, unknown> };
     expect(otpBody.data.ok).toBe(true);
     expect(otpBody.data.devOtp).toBeUndefined();
 
-    // No SMS driver in test env → local hashed path; never exposeDevOtp by default.
-    const phone = await app.fetch(jsonPost("/auth/phone/request", { phone: "+15551112222" }));
+    const phone = await app.fetch(jsonPost("/auth/otp/request", { phone: "+15551112222" }));
     const phoneBody = (await phone.json()) as { data: Record<string, unknown> };
     expect(phoneBody.data.ok).toBe(true);
     expect(phoneBody.data.devOtp).toBeUndefined();
 
     const magicSrc = await Bun.file(new URL("./magic-link.ts", import.meta.url)).text();
-    const emailSrc = await Bun.file(new URL("./email-otp.ts", import.meta.url)).text();
-    const phoneSrc = await Bun.file(new URL("./phone-number.ts", import.meta.url)).text();
+    const otpSrc = await Bun.file(new URL("./otp.ts", import.meta.url)).text();
     expect(magicSrc).toMatch(/fx\.send\(/);
     expect(magicSrc).toMatch(/channel\./);
-    expect(emailSrc).toMatch(/fx\.send\(/);
-    expect(emailSrc).toMatch(/channel\./);
-    // Phone OTP is provider-managed via Taqnyat Verify through fx — never a
-    // raw transport import or a generic fx.send template. Regexes tolerate
-    // formatter line wraps between `fx` and the method name.
-    expect(phoneSrc).toMatch(/fx\s*\.\s*sendOtp/);
-    expect(phoneSrc).toMatch(/fx\s*\.\s*verifyOtp/);
-    expect(phoneSrc).not.toMatch(/taqnyat-sms|sently\/transports/);
+    expect(otpSrc).toMatch(/fx\s*\.\s*deliverOtp/);
+    expect(otpSrc).toMatch(/fx\s*\.\s*sendOtp/);
+    expect(otpSrc).toMatch(/fx\s*\.\s*verifyOtp/);
+    expect(otpSrc).not.toMatch(/taqnyat-sms|sently\/transports/);
 
     await app.stop();
   });

package/src/plugins/auth-methods.test.ts

@@ -7,8 +7,8 @@ import { oke } from "../kernel/app.ts";
 import { resetFlowSeq } from "../kernel/flow.ts";
 import { resetBindings } from "../kernel/on.ts";
 import { anonymous } from "./anonymous.ts";
-import { emailOtp } from "./email-otp.ts";
 import { magicLink } from "./magic-link.ts";
+import { otp } from "./otp.ts";
 import { username } from "./username.ts";
 
 afterEach(() => {
@@ -31,7 +31,7 @@ function authApp() {
     .plug(username())
     .plug(anonymous())
     .plug(magicLink({ exposeDevToken: true }))
-    .plug(emailOtp({ exposeDevOtp: true }));
+    .plug(otp({ tier: 2, channels: ["email"], exposeDevOtp: true }));
 }
 
 describe("auth method plugins", () => {
@@ -42,8 +42,9 @@ describe("auth method plugins", () => {
     expect(app.router.match("POST", "/auth/sign-in/anonymous")).toBeTruthy();
     expect(app.router.match("POST", "/auth/magic-link/request")).toBeTruthy();
     expect(app.router.match("POST", "/auth/magic-link/verify")).toBeTruthy();
-    expect(app.router.match("POST", "/auth/email-otp/request")).toBeTruthy();
-    expect(app.router.match("POST", "/auth/email-otp/verify")).toBeTruthy();
+    expect(app.router.match("POST", "/auth/otp/request")).toBeTruthy();
+    expect(app.router.match("POST", "/auth/otp/verify")).toBeTruthy();
+    expect(app.router.match("POST", "/auth/otp/resend")).toBeTruthy();
     await app.boot({ env: "test" });
     await app.stop();
   });
@@ -147,7 +148,7 @@ describe("auth method plugins", () => {
     await app.boot({ env: "test" });
 
     const req = await app.fetch(
-      new Request("http://localhost/auth/email-otp/request", {
+      new Request("http://localhost/auth/otp/request", {
         method: "POST",
         headers: { "content-type": "application/json" },
         body: JSON.stringify({ email: "otp@example.com" }),
@@ -158,7 +159,7 @@ describe("auth method plugins", () => {
     expect(requested.data.devOtp).toMatch(/^\d{6}$/);
 
     const verify = await app.fetch(
-      new Request("http://localhost/auth/email-otp/verify", {
+      new Request("http://localhost/auth/otp/verify", {
         method: "POST",
         headers: { "content-type": "application/json" },
         body: JSON.stringify({

package/src/plugins/index.ts

@@ -15,8 +15,6 @@ export {
   type ConfigSourceOptions,
 } from "./config-source.ts";
 export { cors, type CorsOptions } from "./cors.ts";
-export { csrf, type CsrfOptions } from "./csrf.ts";
-export { emailOtp, emailOtpCatalog, emailOtpTemplate, type EmailOtpOptions } from "./email-otp.ts";
 export { ipAllowlist, type IpAllowlistOptions } from "./ip-allowlist.ts";
 export {
   magicLink,
@@ -25,6 +23,18 @@ export {
   type MagicLinkOptions,
 } from "./magic-link.ts";
 export { maintenanceMode, type MaintenanceModeOptions } from "./maintenance-mode.ts";
+export {
+  createPhoneStore,
+  otp,
+  otpCatalog,
+  otpEmailTemplate,
+  otpSmsTemplate,
+  otpWhatsappTemplate,
+  type OtpOptions,
+  type OtpTier1Options,
+  type OtpTier2Options,
+  type PhoneStore,
+} from "./otp.ts";
 export {
   createPasskeyStore,
   passkey,
@@ -40,12 +50,6 @@ export {
   verifyWebAuthnCeremony,
   type WebAuthnVerifyOptions,
 } from "./passkey-webauthn.ts";
-export {
-  createPhoneStore,
-  phoneNumber,
-  type PhoneNumberOptions,
-  type PhoneStore,
-} from "./phone-number.ts";
 export {
   defaultCspDirectives,
   headers,

package/src/plugins/magic-link.ts

@@ -8,9 +8,9 @@
 
 import {
   createIdentityStore,
+  ensureUserByEmail,
   normalizeEmail,
   type IdentityStore,
-  type UserIdentityRow,
 } from "../auth/identity.ts";
 import { issueSessionWithScopes } from "../auth/sessions.ts";
 import {
@@ -199,25 +199,3 @@ export function magicLink(opts: MagicLinkOptions = {}): PluginDef {
     .binding(bindPublicAuth("/magic-link/request", request, "otp"))
     .binding(bindPublicAuth("/magic-link/verify", verify, "otp"));
 }
-
-function ensureUserByEmail(store: IdentityStore, email: string, now: number): UserIdentityRow {
-  const existingId = store.byEmail.get(email);
-  if (existingId) {
-    const existing = store.users.get(existingId);
-    if (existing) return existing;
-  }
-  const id = crypto.randomUUID();
-  const user: UserIdentityRow = {
-    id,
-    email,
-    name: email.split("@")[0] || "user",
-    emailVerified: true,
-    status: "active",
-    createdAt: now,
-    updatedAt: now,
-    extra: {},
-  };
-  store.users.set(id, user);
-  store.byEmail.set(email, id);
-  return user;
-}

package/src/plugins/otp.test.ts

@@ -0,0 +1,236 @@
+/**
+ * otp() plugin — plug-time fail-loud, Tier 2 resend / sealed lifetime, Tier 1 boot.
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+import {
+  createVerificationStore,
+  findActiveVerification,
+  type VerificationStore,
+} from "../auth/verification.ts";
+import { openConsoleChannel } from "../drivers/channel-console.ts";
+import type { ChannelDriver, SmsOtpTransport, SmsTransport } from "../drivers/channel-types.ts";
+import { oke } from "../kernel/app.ts";
+import { resetFlowSeq } from "../kernel/flow.ts";
+import { resetBindings } from "../kernel/on.ts";
+import { otp } from "./otp.ts";
+
+afterEach(() => {
+  resetBindings();
+  resetFlowSeq();
+});
+
+const SECRET = "test-secret-at-least-16";
+
+function jsonPost(path: string, body: unknown): Request {
+  return new Request(`http://localhost${path}`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+function mockOtpSmsDriver(): ChannelDriver {
+  const codes = new Map<string, string>();
+  const otpTransport: SmsTransport & SmsOtpTransport = {
+    provider: "mock-otp",
+    async send() {
+      return { messageId: "m", to: "+", status: "ok", response: "ok" };
+    },
+    async sendOtp(opts) {
+      codes.set(opts.requestId, "pending");
+      return {
+        requestId: opts.requestId,
+        to: opts.to,
+        code: 5,
+        response: "ok",
+        provider: "mock-otp",
+      };
+    },
+    async verifyOtp(opts) {
+      if (!codes.has(opts.requestId)) throw new Error("unknown request");
+      return { ok: true as const, code: 10, message: "ok", response: "ok", provider: "mock-otp" };
+    },
+  };
+  return {
+    id: "taqnyat",
+    smsTransport: otpTransport,
+    channel: {
+      provider: "mock-otp",
+      mediums: ["sms"],
+      async send() {
+        return {
+          ok: true,
+          messageId: "m",
+          driverId: "mock-otp",
+          attempts: [{ driverId: "mock-otp", ok: true, at: Date.now() }],
+        };
+      },
+    },
+  };
+}
+
+describe("otp() plug-time fail-loud", () => {
+  test("missing tier throws", () => {
+    expect(() => otp({} as never)).toThrow(/tier is required/);
+  });
+
+  test("tier 1 with channels throws", () => {
+    expect(() => otp({ tier: 1, channels: ["sms"] } as never)).toThrow(/channels are forbidden/);
+  });
+
+  test("tier 1 with exposeDevOtp throws", () => {
+    expect(() => otp({ tier: 1, exposeDevOtp: true } as never)).toThrow(
+      /exposeDevOtp is forbidden/,
+    );
+  });
+
+  test("tier 2 without channels throws", () => {
+    expect(() => otp({ tier: 2 } as never)).toThrow(/channels is required/);
+  });
+});
+
+describe("otp() Tier 1 boot", () => {
+  test("fails loud without Verify-capable SMS driver", async () => {
+    const app = oke({
+      name: `otp-t1-${crypto.randomUUID()}`,
+      env: "test",
+      registry: "ignore",
+      gate: { auth: { secret: SECRET } },
+    }).plug(otp({ tier: 1 }));
+    await expect(app.boot({ env: "test" })).rejects.toThrow(/tier: 1/);
+  });
+
+  test("boots when Verify-capable SMS driver is bound", async () => {
+    const app = oke({
+      name: `otp-t1-ok-${crypto.randomUUID()}`,
+      env: "test",
+      registry: "ignore",
+      gate: { auth: { secret: SECRET } },
+      channel: { drivers: [mockOtpSmsDriver()] },
+    }).plug(otp({ tier: 1 }));
+    await app.boot({ env: "test" });
+    const res = await app.fetch(jsonPost("/auth/otp/request", { phone: "+15551234567" }));
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { data: { ok: true; devOtp?: string } };
+    expect(body.data.ok).toBe(true);
+    expect(body.data.devOtp).toBeUndefined();
+    expect(app.router.match("POST", "/auth/otp/resend")).toBeFalsy();
+    await app.stop();
+  });
+});
+
+describe("otp() Tier 2 resend + sealed lifetime", () => {
+  test("cross-channel resend keeps same code; cooldown then verify wipes seal", async () => {
+    let now = 1_000_000;
+    const verifications: VerificationStore = createVerificationStore();
+    const app = oke({
+      name: `otp-t2-${crypto.randomUUID()}`,
+      env: "test",
+      registry: "ignore",
+      gate: { auth: { secret: SECRET } },
+      channel: { drivers: [openConsoleChannel()] },
+      fx: { now: () => now },
+    }).plug(
+      otp({
+        tier: 2,
+        channels: ["sms", "email"],
+        exposeDevOtp: true,
+        resendCooldownMs: 60_000,
+        verifications,
+        now: () => now,
+        secret: SECRET,
+      }),
+    );
+    await app.boot({ env: "test" });
+
+    const req = await app.fetch(
+      jsonPost("/auth/otp/request", {
+        phone: "+15551234567",
+        email: "a@example.com",
+      }),
+    );
+    expect(req.status).toBe(200);
+    const requested = (await req.json()) as {
+      data: { ok: true; devOtp: string; channel: string };
+    };
+    expect(requested.data.devOtp).toMatch(/^\d{6}$/);
+    const code = requested.data.devOtp;
+    const expiresAt = findActiveVerification(verifications, "otp:+15551234567", now)?.expiresAt;
+    expect(expiresAt).toBeDefined();
+    expect(findActiveVerification(verifications, "otp:+15551234567", now)?.sealedOtp).toBeTruthy();
+
+    const cool = await app.fetch(
+      jsonPost("/auth/otp/resend", {
+        phone: "+15551234567",
+        email: "a@example.com",
+        channel: "email",
+      }),
+    );
+    const coolBody = (await cool.json()) as { error?: { data?: { reason?: string } } };
+    expect(coolBody.error?.data?.reason).toBe("resend_cooldown");
+
+    now += 60_001;
+    const resent = await app.fetch(
+      jsonPost("/auth/otp/resend", {
+        phone: "+15551234567",
+        email: "a@example.com",
+        channel: "email",
+      }),
+    );
+    expect(resent.status).toBe(200);
+    const resentBody = (await resent.json()) as { data: { channel: string; devOtp?: string } };
+    expect(resentBody.data.channel).toBe("email");
+    expect(resentBody.data.devOtp).toBe(code);
+    expect(findActiveVerification(verifications, "otp:+15551234567", now)?.expiresAt).toBe(
+      expiresAt,
+    );
+
+    const verify = await app.fetch(
+      jsonPost("/auth/otp/verify", { phone: "+15551234567", otp: code }),
+    );
+    expect(verify.status).toBe(200);
+
+    const row = [...verifications.rows.values()].find((r) => r.identifier === "otp:+15551234567");
+    expect(row?.sealedOtp).toBeNull();
+    expect(row?.consumedAt).toBeTruthy();
+
+    await app.stop();
+  });
+
+  test("expired challenge wipes sealed OTP", async () => {
+    let now = 1_000_000;
+    const verifications = createVerificationStore();
+    const app = oke({
+      name: `otp-ttl-${crypto.randomUUID()}`,
+      env: "test",
+      registry: "ignore",
+      gate: { auth: { secret: SECRET } },
+      fx: { now: () => now },
+    }).plug(
+      otp({
+        tier: 2,
+        channels: ["email"],
+        exposeDevOtp: true,
+        ttlMs: 1_000,
+        verifications,
+        now: () => now,
+        secret: SECRET,
+      }),
+    );
+    await app.boot({ env: "test" });
+
+    await app.fetch(jsonPost("/auth/otp/request", { email: "ttl@example.com" }));
+    const active = findActiveVerification(verifications, "otp:ttl@example.com", now);
+    expect(active?.sealedOtp).toBeTruthy();
+
+    now += 2_000;
+    expect(findActiveVerification(verifications, "otp:ttl@example.com", now)).toBeUndefined();
+    const row = [...verifications.rows.values()].find(
+      (r) => r.identifier === "otp:ttl@example.com",
+    );
+    expect(row?.sealedOtp).toBeNull();
+
+    await app.stop();
+  });
+});