sporades 0.7.1 → 0.7.2

package/CHANGES.md

@@ -1,22 +1,9 @@
 # Changes
 
-## Unreleased - 2026-08-12
+## Unreleased - 2026-08-13
 
-Changes since v0.7.0.
-
-### 🚀 Features
-
-- Adapt Mailgun email events (66d4291).
-- Adapt Postmark email events (d30efa2).
-- Adapt SMTP2GO email events (8d39237).
-- Dispatch verified email provider events (d818b6d).
-- Trust required native installers (c0a539c).
+Changes since v0.7.1.
 
 ### 📝 Documentation
 
-- Clarify provider callback responses (7fde2ae).
-- Document Mailjet SMTP configuration (e710ba2).
-
-### 🧪 Tests
-
-- Cover Mailgun non-delivery retries (c5e566e).
+- Require current password to change email credentials (bfba651).

package/bin/sporades-host-helper.js

@@ -413,7 +413,7 @@ function writeEnvelope(result, failed = false) {
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.7.1";
+var CLI_VERSION = "0.7.2";
 
 // src/cli/schedule-inspection-envelope.ts
 function sanitizeScheduleInspectionEnvelope(envelope, invalid) {

package/bin/sporades.js

@@ -82,8 +82,8 @@ export const auth = {
   signOut() {
     return connect().signOut();
   },
-  setPassword(email, newPassword) {
-    return connect().setPassword(email, newPassword);
+  setPassword(email, currentPassword, newPassword) {
+    return connect().setPassword(email, currentPassword, newPassword);
   },
   sendPasswordResetLink(email) {
     return connect().sendPasswordResetLink(email);
@@ -174,8 +174,8 @@ export function createHooks(primitives) {
       signOut() {
         return connect().signOut();
       },
-      setPassword(email, newPassword) {
-        return connect().setPassword(email, newPassword);
+      setPassword(email, currentPassword, newPassword) {
+        return connect().setPassword(email, currentPassword, newPassword);
       },
     };
   }
@@ -232,7 +232,7 @@ export function createVueComposables(primitives) {
     state.signUp = (provider, credentials) => connect().signUp(provider, credentials);
     state.signIn = (provider, credentials) => connect().signIn(provider, credentials);
     state.signOut = () => connect().signOut();
-    state.setPassword = (email, newPassword) => connect().setPassword(email, newPassword);
+    state.setPassword = (email, currentPassword, newPassword) => connect().setPassword(email, currentPassword, newPassword);
     return state;
   }
 
@@ -284,7 +284,7 @@ export function createSolidPrimitives(primitives) {
       signUp: (provider, credentials) => connect().signUp(provider, credentials),
       signIn: (provider, credentials) => connect().signIn(provider, credentials),
       signOut: () => connect().signOut(),
-      setPassword: (email, newPassword) => connect().setPassword(email, newPassword),
+      setPassword: (email, currentPassword, newPassword) => connect().setPassword(email, currentPassword, newPassword),
     };
   }
 
@@ -382,7 +382,7 @@ export function createLitControllers() {
     controller.signUp = (provider, credentials) => connect().signUp(provider, credentials);
     controller.signIn = (provider, credentials) => connect().signIn(provider, credentials);
     controller.signOut = () => connect().signOut();
-    controller.setPassword = (email, newPassword) => connect().setPassword(email, newPassword);
+    controller.setPassword = (email, currentPassword, newPassword) => connect().setPassword(email, currentPassword, newPassword);
     return controller;
   }
 
@@ -455,7 +455,7 @@ export function createInfernoAdapters() {
     adapter.signUp = (provider, credentials) => connect().signUp(provider, credentials);
     adapter.signIn = (provider, credentials) => connect().signIn(provider, credentials);
     adapter.signOut = () => connect().signOut();
-    adapter.setPassword = (email, newPassword) => connect().setPassword(email, newPassword);
+    adapter.setPassword = (email, currentPassword, newPassword) => connect().setPassword(email, currentPassword, newPassword);
     return adapter;
   }
   return { queryAdapter, mutationAdapter, authAdapter };
@@ -505,7 +505,7 @@ export function createSvelteStores() {
       signUp: (provider, credentials) => connect().signUp(provider, credentials),
       signIn: (provider, credentials) => connect().signIn(provider, credentials),
       signOut: () => connect().signOut(),
-      setPassword: (email, newPassword) => connect().setPassword(email, newPassword),
+      setPassword: (email, currentPassword, newPassword) => connect().setPassword(email, currentPassword, newPassword),
     };
   }
 
@@ -1010,8 +1010,8 @@ function createConnection() {
         return result;
       });
     },
-    setPassword(email, newPassword) {
-      return request("auth.setPassword", { email, newPassword });
+    setPassword(email, currentPassword, newPassword) {
+      return request("auth.setPassword", { email, currentPassword, newPassword });
     },
     sendPasswordResetLink(email) {
       return request("auth.sendPasswordResetLink", { email });
@@ -7053,6 +7053,7 @@ var EMAIL_SIGN_IN_FAILURE_LIMIT = 5;
 var EMAIL_SIGN_IN_THROTTLE_WINDOW_MS = 15 * 60 * 1e3;
 var EMAIL_SIGN_IN_THROTTLE_MAX_ENTRIES = 256;
 var EMAIL_SIGN_IN_THROTTLE_FIELD = "__emailSignInThrottle";
+var PASSWORD_CHANGE_THROTTLE_FIELD = "__emailPasswordChangeThrottle";
 var PASSWORD_RESET_THROTTLE_FIELD = "__emailPasswordResetThrottle";
 var PASSWORD_RESET_DEFAULT_PATH = "/reset-password";
 var PASSWORD_RESET_DEFAULT_TTL_MS = 60 * 60 * 1e3;
@@ -8827,7 +8828,7 @@ function mailNotConfiguredError() {
     hint: "Set `mail.smtp` in sporades.json, or use ctx.serverAuth.createEmailPasswordResetLink with your own delivery path."
   };
 }
-async function setOwnEmailPassword(database, session, email, newPassword) {
+async function setOwnEmailPassword(database, session, email, currentPassword, newPassword) {
   let auth;
   try {
     auth = requireAuth({ ...session, kind: "message" }, { linked: true });
@@ -8839,6 +8840,15 @@ async function setOwnEmailPassword(database, session, email, newPassword) {
   if (!credential || credential.userId !== auth.userId) {
     return { ok: false, error: emailNotOwnedError() };
   }
+  const throttle = currentEmailSignInThrottleState(database, cleanEmail, session, PASSWORD_CHANGE_THROTTLE_FIELD);
+  if (throttle.throttled) {
+    return { ok: false, error: invalidCurrentPasswordError() };
+  }
+  if (typeof currentPassword !== "string" || !verifyEmailPassword(currentPassword, credential.passwordSalt, credential.passwordHash)) {
+    recordFailedEmailSignInAttempt(database, cleanEmail, session, PASSWORD_CHANGE_THROTTLE_FIELD);
+    return { ok: false, error: invalidCurrentPasswordError() };
+  }
+  resetEmailSignInAttempts(database, cleanEmail, session, PASSWORD_CHANGE_THROTTLE_FIELD);
   return await setEmailPassword(database, session, cleanEmail, newPassword);
 }
 function emailNotOwnedError() {
@@ -8848,6 +8858,13 @@ function emailNotOwnedError() {
     hint: "Change the password for the signed-in account, or use a password reset link."
   };
 }
+function invalidCurrentPasswordError() {
+  return {
+    code: "INVALID_CURRENT_PASSWORD",
+    message: "Current password is incorrect.",
+    hint: "Enter the current password for this email credential, or use a password reset link."
+  };
+}
 async function setEmailPassword(database, _session, email, newPassword) {
   if (!database.authConfig.providers.email.enabled) {
     return { ok: false, error: emailAuthDisabledError() };
@@ -15161,7 +15178,13 @@ function createWebSocketHub(getDatabase, trustedRefresh = null) {
       return;
     }
     if (message.type === "auth.setPassword") {
-      const result = await setOwnEmailPassword(database, client.session, message.email ?? "", message.newPassword ?? "");
+      const result = await setOwnEmailPassword(
+        database,
+        client.session,
+        message.email ?? "",
+        message.currentPassword ?? "",
+        message.newPassword ?? ""
+      );
       sendJson(client, {
         id: message.id ?? null,
         type: result.ok ? "auth.setPassword.result" : "error",
@@ -22142,7 +22165,7 @@ jobs:
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.7.1";
+var CLI_VERSION = "0.7.2";
 
 // src/cli/sporades.ts
 var SUPPORTED_TEMPLATES = new Set(CLIENT_TEMPLATES);

package/dist/auth-runtime.d.ts

@@ -7,6 +7,7 @@ export declare const EMAIL_SIGN_IN_FAILURE_LIMIT = 5;
 export declare const EMAIL_SIGN_IN_THROTTLE_WINDOW_MS: number;
 export declare const EMAIL_SIGN_IN_THROTTLE_MAX_ENTRIES = 256;
 export declare const EMAIL_SIGN_IN_THROTTLE_FIELD = "__emailSignInThrottle";
+export declare const PASSWORD_CHANGE_THROTTLE_FIELD = "__emailPasswordChangeThrottle";
 export declare const PASSWORD_RESET_THROTTLE_FIELD = "__emailPasswordResetThrottle";
 export declare const PASSWORD_RESET_DEFAULT_PATH = "/reset-password";
 export declare const PASSWORD_RESET_DEFAULT_TTL_MS: number;
@@ -135,7 +136,7 @@ export declare function mailNotConfiguredError(): {
     message: string;
     hint: string;
 };
-export declare function setOwnEmailPassword(database: LooseRecord, session: LooseRecord, email: string, newPassword: string): Promise<{
+export declare function setOwnEmailPassword(database: LooseRecord, session: LooseRecord, email: string, currentPassword: string, newPassword: string): Promise<{
     ok: boolean;
     error: {
         message: string;

package/dist/auth-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-runtime.d.ts","sourceRoot":"","sources":["../src/auth-runtime.ts"],"names":[],"mappings":"AAmEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAI9C,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA6BjE,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAoBvC,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AAExD,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C,eAAO,MAAM,gCAAgC,QAAiB,CAAC;AAE/D,eAAO,MAAM,kCAAkC,MAAM,CAAC;AAEtD,eAAO,MAAM,4BAA4B,0BAA0B,CAAC;AAEpE,eAAO,MAAM,6BAA6B,iCAAiC,CAAC;AAE5E,eAAO,MAAM,2BAA2B,oBAAoB,CAAC;AAE7D,eAAO,MAAM,6BAA6B,QAAiB,CAAC;AAE5D,eAAO,MAAM,yBAAyB,QAAgB,CAAC;AAEvD,eAAO,MAAM,yBAAyB,QAAsB,CAAC;AAE7D,eAAO,MAAM,wCAAwC,IAAI,CAAC;AAG1D,eAAO,MAAM,uBAAuB,kCAAkC,CAAC;AAEvE,eAAO,MAAM,0BAA0B,qCAAqC,CAAC;AAE7E,wBAAgB,oBAAoB,WAEnC;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,GAAG,WAE/C;AAED,wBAAgB,6BAA6B,CAAC,YAAY,EAAE,GAAG,OAK9D;AAED,wBAAgB,8BAA8B,CAAC,aAAa,EAAE,GAAG,OAKhE;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,GAAG,QAStD;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;CAAE,EAAE,KAAK,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IAAC,YAAY,CAAC,EAAE,GAAG,CAAC;CAAE,OAExH;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,GAAE,WAAgB,OAO1E;AAyBD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,QAQ5E;AAED,wBAAsB,4BAA4B,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,GAAE,WAAgB,gBA2FlG;AAUD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,IAAI,GAAG,SAAS,iBAM7D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM;;;;EA4C9C;AAyCD,wBAAgB,uCAAuC,CAAC,UAAU,EAAE,eAAe,QAYlF;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,GAAG,SAAS,4BAazF;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,OAW3E;AAMD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,GAAG,WAIpD;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,UAmB7E;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,WAAW,gBAoCpB;AAED,wBAAsB,+BAA+B,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,gBA2CvH;AAkFD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,GAAG,WAenD;AAyCD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,SAAgC,UAwDxG;AAyWD,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM;;;;;;GAsF1G;AA+BD,wBAAsB,oCAAoC,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,gBA2H/F;AAED,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,WAAW,gBAOpB;AAiFD,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW;;;;;;GAyCvF;AAED,wBAAsB,4BAA4B,CAChD,QAAQ,EAAE,WAAW,EACrB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,WAAW;;;;;;GAqGvB;AAED,wBAAsB,wBAAwB,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM;;;;;;GAoGzG;AAwFD,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,WAAW,EACrB,SAAS,EAAE,WAAW,EACtB,YAAY,UAAQ,EACpB,kBAAkB,GAAE,MAAM,GAAG,IAAW,EACxC,UAAU,GAAE,MAAM,GAAG,IAAW,gBA8GjC;AAiFD,wBAAgB,aAAa,CAAC,QAAQ,EAAE;IAAE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,QAAQ,EAAE,GAAG,CAAC;KAAE,KAAK,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,IAAI,CAAC;CAAE,EAAE,QAAQ,EAAE,GAAG,QAGvI;AAID,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,GAAG,iBAWpD;AAkBD,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,UAEzD;AAKD,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,WAAW,EACrB,UAAU,EAAE,WAAW,EACvB,aAAa,GAAE,MAAM,GAAG,IAAW,EACnC,wBAAwB,UAAO;;;;;UAmChC;AAKD,wBAAsB,iCAAiC,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,SAAI;;;;;UAa/G;AAED,wBAAsB,4BAA4B,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM;;;;;;;;;;;;;GAiB7G;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM;WAC9C,MAAM;WAAS,MAAM;EAItD;AAoCD,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG;;;;;;;;;;;GASpG;AAED,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,gBAqCtH;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM;;;EAWjD;AAMD,wBAAgB,sBAAsB;;;;EAMrC;AAOD,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;;;;;;;;;;;;;;;;GAaxH;AAUD,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;;;;;;;;;GAkBtH;AAkBD,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,SAA+B;;;;;;;;;EAmB/I;AAED,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,SAA+B,QAU9I;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,SAA+B,QAKxI;AAiDD,wBAAgB,4BAA4B,CAAC,OAAO,GAAE,WAAgB;;;;EAMrE;AAED,wBAAgB,yBAAyB,CAAC,WAAW,EAAE;IAAE,KAAK,EAAE,GAAG,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;CAAE;;;;;;;;;;;;;;;EAuBhG;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,UAAU;;;EAIrD;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,oBAAoB,CAAC,MAAM,CAAC,WAIrH;AAED,wBAAgB,sBAAsB;;;EAKrC;AAED,wBAAgB,gBAAgB,CAAC,IAAI,SAA2B,UAG/D;AAMD,wBAAgB,kBAAkB,WAEjC;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,mBAK5E;AAED,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;;;;;;;;;;;GAwC/F;AAiBD,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW;;;;;;;;EA0DrE;AAqFD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,GAAE,GAAU,eAajF;AAqCD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,gBA2DpH;AAED,wBAAsB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,gBAoC1F;AAED,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,gBAuG7H;AAoCD,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,CAAC,eAAe,CAAC,GAAG;IAAE,GAAG,EAAE,eAAe,CAAC;CAAE,oBAkG7J;AA4BD,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW;;;;;;;;;;;;GAqFzH;AAID,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,WAAW;;;;EAa7D;AA2CD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,GAAE,WAAW,GAAG,IAAW,OAgFnG"}
+{"version":3,"file":"auth-runtime.d.ts","sourceRoot":"","sources":["../src/auth-runtime.ts"],"names":[],"mappings":"AAmEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAI9C,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA6BjE,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAoBvC,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AAExD,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C,eAAO,MAAM,gCAAgC,QAAiB,CAAC;AAE/D,eAAO,MAAM,kCAAkC,MAAM,CAAC;AAEtD,eAAO,MAAM,4BAA4B,0BAA0B,CAAC;AAEpE,eAAO,MAAM,8BAA8B,kCAAkC,CAAC;AAE9E,eAAO,MAAM,6BAA6B,iCAAiC,CAAC;AAE5E,eAAO,MAAM,2BAA2B,oBAAoB,CAAC;AAE7D,eAAO,MAAM,6BAA6B,QAAiB,CAAC;AAE5D,eAAO,MAAM,yBAAyB,QAAgB,CAAC;AAEvD,eAAO,MAAM,yBAAyB,QAAsB,CAAC;AAE7D,eAAO,MAAM,wCAAwC,IAAI,CAAC;AAG1D,eAAO,MAAM,uBAAuB,kCAAkC,CAAC;AAEvE,eAAO,MAAM,0BAA0B,qCAAqC,CAAC;AAE7E,wBAAgB,oBAAoB,WAEnC;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,GAAG,WAE/C;AAED,wBAAgB,6BAA6B,CAAC,YAAY,EAAE,GAAG,OAK9D;AAED,wBAAgB,8BAA8B,CAAC,aAAa,EAAE,GAAG,OAKhE;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,GAAG,QAStD;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;CAAE,EAAE,KAAK,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IAAC,YAAY,CAAC,EAAE,GAAG,CAAC;CAAE,OAExH;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,GAAE,WAAgB,OAO1E;AAyBD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,QAQ5E;AAED,wBAAsB,4BAA4B,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,GAAE,WAAgB,gBA2FlG;AAUD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,IAAI,GAAG,SAAS,iBAM7D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM;;;;EA4C9C;AAyCD,wBAAgB,uCAAuC,CAAC,UAAU,EAAE,eAAe,QAYlF;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,GAAG,SAAS,4BAazF;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,OAW3E;AAMD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,GAAG,WAIpD;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,UAmB7E;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,WAAW,gBAoCpB;AAED,wBAAsB,+BAA+B,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,gBA2CvH;AAkFD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,GAAG,WAenD;AAyCD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,SAAgC,UAwDxG;AAyWD,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM;;;;;;GAsF1G;AA+BD,wBAAsB,oCAAoC,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,gBA2H/F;AAED,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,WAAW,gBAOpB;AAiFD,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW;;;;;;GAyCvF;AAED,wBAAsB,4BAA4B,CAChD,QAAQ,EAAE,WAAW,EACrB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,WAAW;;;;;;GAqGvB;AAED,wBAAsB,wBAAwB,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM;;;;;;GAoGzG;AAwFD,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,WAAW,EACrB,SAAS,EAAE,WAAW,EACtB,YAAY,UAAQ,EACpB,kBAAkB,GAAE,MAAM,GAAG,IAAW,EACxC,UAAU,GAAE,MAAM,GAAG,IAAW,gBA8GjC;AAiFD,wBAAgB,aAAa,CAAC,QAAQ,EAAE;IAAE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,QAAQ,EAAE,GAAG,CAAC;KAAE,KAAK,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,IAAI,CAAC;CAAE,EAAE,QAAQ,EAAE,GAAG,QAGvI;AAID,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,GAAG,iBAWpD;AAkBD,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,UAEzD;AAKD,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,WAAW,EACrB,UAAU,EAAE,WAAW,EACvB,aAAa,GAAE,MAAM,GAAG,IAAW,EACnC,wBAAwB,UAAO;;;;;UAmChC;AAKD,wBAAsB,iCAAiC,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,SAAI;;;;;UAa/G;AAED,wBAAsB,4BAA4B,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM;;;;;;;;;;;;;GAiB7G;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM;WAC9C,MAAM;WAAS,MAAM;EAItD;AAoCD,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG;;;;;;;;;;;GASpG;AAED,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,gBAqCtH;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM;;;EAWjD;AAMD,wBAAgB,sBAAsB;;;;EAMrC;AAQD,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;;;;;;;;;;;;;;;;GAsBjJ;AAkBD,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;;;;;;;;;GAkBtH;AAkBD,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,SAA+B;;;;;;;;;EAmB/I;AAED,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,SAA+B,QAU9I;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,SAA+B,QAKxI;AAiDD,wBAAgB,4BAA4B,CAAC,OAAO,GAAE,WAAgB;;;;EAMrE;AAED,wBAAgB,yBAAyB,CAAC,WAAW,EAAE;IAAE,KAAK,EAAE,GAAG,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;CAAE;;;;;;;;;;;;;;;EAuBhG;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,UAAU;;;EAIrD;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,oBAAoB,CAAC,MAAM,CAAC,WAIrH;AAED,wBAAgB,sBAAsB;;;EAKrC;AAED,wBAAgB,gBAAgB,CAAC,IAAI,SAA2B,UAG/D;AAMD,wBAAgB,kBAAkB,WAEjC;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,mBAK5E;AAED,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;;;;;;;;;;;GAwC/F;AAiBD,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW;;;;;;;;EA0DrE;AAqFD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,GAAE,GAAU,eAajF;AAqCD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,gBA2DpH;AAED,wBAAsB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,gBAoC1F;AAED,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,gBAuG7H;AAoCD,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,CAAC,eAAe,CAAC,GAAG;IAAE,GAAG,EAAE,eAAe,CAAC;CAAE,oBAkG7J;AA4BD,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW;;;;;;;;;;;;GAqFzH;AAID,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,WAAW;;;;EAa7D;AA2CD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,GAAE,WAAW,GAAG,IAAW,OAgFnG"}

package/dist/auth-runtime.js

@@ -108,6 +108,7 @@ export const EMAIL_SIGN_IN_FAILURE_LIMIT = 5;
 export const EMAIL_SIGN_IN_THROTTLE_WINDOW_MS = 15 * 60 * 1000;
 export const EMAIL_SIGN_IN_THROTTLE_MAX_ENTRIES = 256;
 export const EMAIL_SIGN_IN_THROTTLE_FIELD = "__emailSignInThrottle";
+export const PASSWORD_CHANGE_THROTTLE_FIELD = "__emailPasswordChangeThrottle";
 export const PASSWORD_RESET_THROTTLE_FIELD = "__emailPasswordResetThrottle";
 export const PASSWORD_RESET_DEFAULT_PATH = "/reset-password";
 export const PASSWORD_RESET_DEFAULT_TTL_MS = 60 * 60 * 1000;
@@ -1968,11 +1969,12 @@ export function mailNotConfiguredError() {
     };
 }
 // Browser-facing password change. `setEmailPassword` is the trusted server-only
-// API and deliberately accepts any registered email, so the ownership gate lives
-// here rather than there: a browser may only change the credential its own
-// Session owns. Non-existent and someone-else's emails share one opaque denial,
-// so this cannot be used to discover which addresses have accounts.
-export async function setOwnEmailPassword(database, session, email, newPassword) {
+// API and deliberately accepts any registered email, so the ownership and
+// re-authentication gates live here rather than there: a browser may only
+// change the credential its own Session owns after proving knowledge of its
+// current password. Non-existent and someone-else's emails share one opaque
+// denial, so this cannot be used to discover which addresses have accounts.
+export async function setOwnEmailPassword(database, session, email, currentPassword, newPassword) {
     let auth;
     try {
         auth = requireAuth({ ...session, kind: "message" }, { linked: true });
@@ -1985,6 +1987,15 @@ export async function setOwnEmailPassword(database, session, email, newPassword)
     if (!credential || credential.userId !== auth.userId) {
         return { ok: false, error: emailNotOwnedError() };
     }
+    const throttle = currentEmailSignInThrottleState(database, cleanEmail, session, PASSWORD_CHANGE_THROTTLE_FIELD);
+    if (throttle.throttled) {
+        return { ok: false, error: invalidCurrentPasswordError() };
+    }
+    if (typeof currentPassword !== "string" || !verifyEmailPassword(currentPassword, credential.passwordSalt, credential.passwordHash)) {
+        recordFailedEmailSignInAttempt(database, cleanEmail, session, PASSWORD_CHANGE_THROTTLE_FIELD);
+        return { ok: false, error: invalidCurrentPasswordError() };
+    }
+    resetEmailSignInAttempts(database, cleanEmail, session, PASSWORD_CHANGE_THROTTLE_FIELD);
     return await setEmailPassword(database, session, cleanEmail, newPassword);
 }
 function emailNotOwnedError() {
@@ -1994,6 +2005,13 @@ function emailNotOwnedError() {
         hint: "Change the password for the signed-in account, or use a password reset link.",
     };
 }
+function invalidCurrentPasswordError() {
+    return {
+        code: "INVALID_CURRENT_PASSWORD",
+        message: "Current password is incorrect.",
+        hint: "Enter the current password for this email credential, or use a password reset link.",
+    };
+}
 export async function setEmailPassword(database, _session, email, newPassword) {
     if (!database.authConfig.providers.email.enabled) {
         return { ok: false, error: emailAuthDisabledError() };
@@ -2013,8 +2031,8 @@ export async function setEmailPassword(database, _session, email, newPassword) {
     await database.adapter.updateEmailCredentialPassword(cleanEmail, password.hash, password.salt);
     return { ok: true };
 }
-// Sign-in failures and reset requests share this throttle shape but never share a
-// bucket: requesting a reset must not lock the account out of sign-in.
+// Sign-in, password-change, and reset requests share this throttle shape but
+// never share a bucket: one auth action must not lock out another.
 function createEmailSignInThrottleState(database, scope = EMAIL_SIGN_IN_THROTTLE_FIELD) {
     const existing = database[scope];
     if (existing instanceof Map) {