Feat: anomaly and security service integration

lib/ts/recipe/emailpassword/types.ts

@@ -89,6 +89,14 @@ export type RecipeInterface = {
         password: string;
         session: SessionContainerInterface | undefined;
         tenantId: string;
+        securityOptions: {
+            enforceEmailBan: boolean;
+            ipBan: {
+                enabled: boolean;
+                ipAddress: string;
+            };
+            checkBreachedPassword: boolean;
+        };
         userContext: UserContext;
     }): Promise<
         | {
@@ -105,6 +113,9 @@ export type RecipeInterface = {
                   | "ACCOUNT_INFO_ALREADY_ASSOCIATED_WITH_ANOTHER_PRIMARY_USER_ID_ERROR"
                   | "SESSION_USER_ACCOUNT_INFO_ALREADY_ASSOCIATED_WITH_ANOTHER_PRIMARY_USER_ID_ERROR";
           }
+        | {
+              status: "EMAIL_BANNED_ERROR" | "BREACHED_PASSWORD_ERROR" | "IP_BANNED_ERROR";
+          }
     >;
     // this function is meant only for creating the recipe in the core and nothing else.
     // we added this even though signUp exists cause devs may override signup expecting it
@@ -114,6 +125,14 @@ export type RecipeInterface = {
         email: string;
         password: string;
         tenantId: string;
+        securityOptions: {
+            enforceEmailBan: boolean;
+            checkBreachedPassword: boolean;
+            ipBan: {
+                enabled: boolean;
+                ipAddress: string;
+            };
+        };
         userContext: UserContext;
     }): Promise<
         | {
@@ -122,17 +141,34 @@ export type RecipeInterface = {
               recipeUserId: RecipeUserId;
           }
         | { status: "EMAIL_ALREADY_EXISTS_ERROR" }
+        | {
+              status: "EMAIL_BANNED_ERROR" | "BREACHED_PASSWORD_ERROR" | "IP_BANNED_ERROR";
+          }
     >;
 
     signIn(input: {
         email: string;
         password: string;
         session: SessionContainerInterface | undefined;
         tenantId: string;
+        securityOptions: {
+            enforceUserBan: boolean;
+            enforceEmailBan: boolean;
+            ipBan: {
+                enabled: boolean;
+                ipAddress: string;
+            };
+            checkBreachedPassword: boolean;
+            limitWrongPasswordAttempts: {
+                enabled: boolean;
+                counterKey?: string; // by default will be email, so that the counter is per email, but users can customize it to be something else, like email + IP if they want.
+                maxNumberOfAttempts?: number; // by default will be 4
+            };
+        };
         userContext: UserContext;
     }): Promise<
         | { status: "OK"; user: User; recipeUserId: RecipeUserId }
-        | { status: "WRONG_CREDENTIALS_ERROR" }
+        | { status: "WRONG_CREDENTIALS_ERROR"; numberOfIncorrectAttemptsSoFar: number }
         | {
               status: "LINKING_TO_SESSION_USER_FAILED";
               reason:
@@ -141,8 +177,25 @@ export type RecipeInterface = {
                   | "ACCOUNT_INFO_ALREADY_ASSOCIATED_WITH_ANOTHER_PRIMARY_USER_ID_ERROR"
                   | "SESSION_USER_ACCOUNT_INFO_ALREADY_ASSOCIATED_WITH_ANOTHER_PRIMARY_USER_ID_ERROR";
           }
+        | {
+              status: "EMAIL_BANNED_ERROR" | "BREACHED_PASSWORD_ERROR" | "IP_BANNED_ERROR";
+          }
+        | {
+              status: "USER_BANNED";
+              user: User;
+              recipeUserId: RecipeUserId;
+          }
+        | {
+              status: "WRONG_CREDENTIALS_LIMIT_REACHED_ERROR";
+              lastLoginAttemptTime: number; // this can be used to reset the timer and try again.
+          }
     >;
 
+    resetWrongCredentialsCounter(input: {
+        email: string;
+        tenantId: string;
+    }): Promise<{ status: "OK" | "UNKNOWN_EMAIL_ERROR" }>;
+
     verifyCredentials(input: {
         email: string;
         password: string;
@@ -159,8 +212,27 @@ export type RecipeInterface = {
         userId: string; // the id can be either recipeUserId or primaryUserId
         email: string;
         tenantId: string;
+        securityOptions: {
+            enforceUserBan: boolean;
+            enforceEmailBan: boolean;
+            ipBan: {
+                enabled: boolean;
+                ipAddress: string;
+            };
+        };
         userContext: UserContext;
-    }): Promise<{ status: "OK"; token: string } | { status: "UNKNOWN_USER_ID_ERROR" }>;
+    }): Promise<
+        | { status: "OK"; token: string }
+        | { status: "UNKNOWN_USER_ID_ERROR" }
+        | {
+              status: "EMAIL_BANNED_ERROR" | "IP_BANNED_ERROR";
+          }
+        | {
+              status: "USER_BANNED";
+              user: User;
+              recipeUserId: RecipeUserId;
+          }
+    >;
 
     consumePasswordResetToken(input: {
         token: string;
@@ -183,6 +255,13 @@ export type RecipeInterface = {
         password?: string;
         userContext: UserContext;
         applyPasswordPolicy?: boolean;
+        securityOptions: {
+            checkBreachedPassword: boolean;
+            limitOldPasswordReuse: {
+                enabled: boolean;
+                numberOfOldPasswordsToCheck?: number; // can be infinity by default
+            };
+        };
         tenantIdForPasswordPolicy: string;
     }): Promise<
         | {
@@ -193,6 +272,7 @@ export type RecipeInterface = {
               reason: string;
           }
         | { status: "PASSWORD_POLICY_VIOLATED_ERROR"; failureReason: string }
+        | { status: "BREACHED_PASSWORD_ERROR" | "OLD_PASSWORD_REUSED_ERROR" }
     >;
 };