Signup route spec for account creation.
Public endpoint that creates an account. When open_signup is disabled
(default), a matching unclaimed invite is required. When enabled, anyone
can sign up without an invite. Follows the auth/bootstrap_routes.ts pattern.
4 declarations
auth/signup_routes.ts view source
(deps: RouteFactoryDeps, options: SignupRouteOptions): RouteSpec[] import {create_signup_route_specs} from '@fuzdev/fuz_app/auth/signup_routes.js'; Create signup route specs for account creation.
depsstateless capabilities
optionsper-factory configuration
RouteSpec[] route specs (not yet applied to Hono)
auth/signup_routes.ts view source
250 import {DEFAULT_SIGNUP_FAIL_FLOOR_MS} from '@fuzdev/fuz_app/auth/signup_routes.js'; Default minimum wall-clock time (ms) for a signup denial (403 / 409) response.
Parallel to login's DEFAULT_LOGIN_FAIL_FLOOR_MS. Without a floor, an attacker can distinguish ERROR_NO_MATCHING_INVITE (cheap — bails before Argon2 + tx) from ERROR_SIGNUP_CONFLICT (Argon2 + tx + rollback) via response time and use the gap as a username-enumeration oracle. Picked to exceed the p99 of every denial code path (Argon2id dominates at ~100ms, plus DB + overhead). 429 stays fast by design (same precedent as login) so rate-limit DoS handling stays cheap.
auth/signup_routes.ts view source
25 import {DEFAULT_SIGNUP_FAIL_JITTER_MS} from '@fuzdev/fuz_app/auth/signup_routes.js'; Default uniform jitter window (±ms) layered on the floor.
Random jitter prevents a stable clamp point from leaking whenever a
path occasionally exceeds the floor. Math.random is sufficient —
we only need unpredictability of the exact delay, not cryptographic
guarantees.
auth/signup_routes.ts view source
SignupRouteOptions import type {SignupRouteOptions} from '@fuzdev/fuz_app/auth/signup_routes.js'; Per-factory configuration for signup route specs.
signup_ip_rate_limiterRate limiter for signup attempts, keyed by client IP. Pass null to
disable. Its own instance, not login's: signup failures bound username
*enumeration* (the 403/409 split), not credential guessing, and an
open-signup deployment lets any unauthenticated caller spend this budget
— which must not cost anyone their login attempts. Never refunded on
success (see RateLimiter.reset). Mirrors the Rust spine's
signup_ip_rate_limiter.
type RateLimiter | null
signup_account_rate_limiterRate limiter for signup attempts, keyed by submitted username. Pass null to disable.
type RateLimiter | null
signup_fail_floor_ms?Minimum wall-clock time (ms) for signup denial responses (403 / 409).
Set to 0 or a negative number to disable (e.g., in tests). Default
DEFAULT_SIGNUP_FAIL_FLOOR_MS. 429 responses are not floored.
type number
signup_fail_jitter_ms?Uniform jitter window (±ms) layered on the floor. Set to 0 to
disable jitter while keeping the floor. Default
DEFAULT_SIGNUP_FAIL_JITTER_MS.
type number