fix(registration): send the response ttl as a number

.changeset/registration-ttl-is-a-number.md

@@ -0,0 +1,14 @@
+---
+'seamless-auth-api': patch
+---
+
+Send the registration response's `ttl` as a number.
+
+It was the string `'300'`, the only `ttl` this API sends that was not a number. A caller sets its
+registration cookie from it, and the Fastify adapter passes the value to a cookie library that
+requires an integer, so registration failed there with `TypeError: option maxAge is invalid: 300`.
+The Express adapter multiplies it into milliseconds, which coerces the string, so the same response
+worked and the mismatch went unnoticed.
+
+Requires `@seamless-auth/types` 0.6.0, where `RegistrationSuccessSchema.ttl` becomes a number.
+Response bodies are validated against that schema at runtime, so the two move together.

openapi.json

@@ -1,6 +1,6 @@
 {
   "openapi": "3.0.3",
-  "info": { "title": "Seamless Auth API", "version": "0.6.0" },
+  "info": { "title": "Seamless Auth API", "version": "0.7.0" },
   "components": {
     "schemas": {},
     "parameters": {},
@@ -5415,7 +5415,7 @@
                     "message": { "type": "string" },
                     "sub": { "type": "string" },
                     "token": { "type": "string" },
-                    "ttl": { "type": "string" },
+                    "ttl": { "type": "number" },
                     "delivery": {
                       "oneOf": [
                         {
@@ -5455,7 +5455,7 @@
                   "message": "string",
                   "sub": "string",
                   "token": "string",
-                  "ttl": "string",
+                  "ttl": 0,
                   "delivery": null
                 }
               }

package.json

@@ -50,7 +50,7 @@
     "@seamless-auth/messaging": "^0.1.0",
     "@seamless-auth/messaging-aws": "^0.1.0",
     "@seamless-auth/messaging-twilio": "^0.1.0",
-    "@seamless-auth/types": "^0.5.0",
+    "@seamless-auth/types": "^0.6.0",
     "@simplewebauthn/server": "^13.1.1",
     "base64url": "^3.0.1",
     "bcrypt-ts": "^7.1.0",

src/controllers/registration.ts

@@ -158,7 +158,10 @@ export const register = async (req: Request, res: Response) => {
       message: 'Success',
       sub: user.id,
       token,
-      ttl: '300',
+      // Seconds, and it has to match the `5m` in signEphemeralToken. A caller
+      // sets its registration cookie from this, so a larger value here leaves a
+      // cookie outliving the token it carries.
+      ttl: 300,
       ...(delivery ? { delivery } : {}),
     });
   } catch (error: unknown) {

src/generated/api.ts

@@ -5769,15 +5769,15 @@ export interface paths {
              *       "message": "string",
              *       "sub": "string",
              *       "token": "string",
-             *       "ttl": "string",
+             *       "ttl": 0,
              *       "delivery": null
              *     }
              */
             'application/json': {
               message: string;
               sub?: string;
               token?: string;
-              ttl?: string;
+              ttl?: number;
               delivery?:
                 | {
                     /** @enum {string} */