@absolutejs/auth 0.49.3 → 0.50.0

package/dist/index.js

@@ -4354,6 +4354,7 @@ var DEFAULT_SMS_CODE_LENGTH = 6;
 var SMS_CODE_TTL_MINUTES = 5;
 var DEFAULT_SMS_CODE_TTL_MS = SMS_CODE_TTL_MINUTES * SECONDS_IN_A_MINUTE * MILLISECONDS_IN_A_SECOND;
 var DEFAULT_SMS_MAX_ATTEMPTS = 3;
+var DEFAULT_TOTP_MAX_ATTEMPTS = 5;
 
 // src/mfa/secret.ts
 init_crypto();
@@ -4521,7 +4522,8 @@ var mfaChallenge = ({
   sessionDurationMs = DEFAULT_MFA_SESSION_TTL_MS,
   smsCodeLength = DEFAULT_SMS_CODE_LENGTH,
   smsCodeTtlMs = DEFAULT_SMS_CODE_TTL_MS,
-  smsMaxAttempts = DEFAULT_SMS_MAX_ATTEMPTS
+  smsMaxAttempts = DEFAULT_SMS_MAX_ATTEMPTS,
+  totpMaxAttempts = DEFAULT_TOTP_MAX_ATTEMPTS
 }) => new Elysia13().use(sessionStore()).post(challengeRoute, async ({
   body: { action, code, factor },
   cookie: { user_session_id },
@@ -4620,12 +4622,24 @@ var mfaChallenge = ({
   if (code === undefined) {
     return status("Unauthorized", "Invalid MFA code");
   }
+  if ((enrollment.totpFailedAttempts ?? 0) >= totpMaxAttempts) {
+    await onMfaChallengeError?.({
+      error: new Error("mfa_totp_attempts_exceeded"),
+      userId: getUserId(user)
+    });
+    return status("Unauthorized", "Too many attempts");
+  }
   const totpValid = enrollment.totpVerified && enrollment.totpSecretCiphertext ? await verifyTotp({
     secret: await decryptTotpSecret(enrollment.totpSecretCiphertext, encryptionKey),
     token: code
   }) : false;
   const remainingBackupHashes = totpValid ? undefined : await consumeBackupCode(code, enrollment.backupCodeHashes);
   if (!totpValid && remainingBackupHashes === undefined) {
+    await mfaStore.saveEnrollment({
+      ...enrollment,
+      totpFailedAttempts: (enrollment.totpFailedAttempts ?? 0) + 1,
+      updatedAt: Date.now()
+    });
     await onMfaChallengeError?.({
       error: new Error("invalid_mfa_code"),
       userId: getUserId(user)
@@ -4636,6 +4650,7 @@ var mfaChallenge = ({
     ...enrollment,
     backupCodeHashes: remainingBackupHashes ?? enrollment.backupCodeHashes,
     lastUsedAt: Date.now(),
+    totpFailedAttempts: 0,
     updatedAt: Date.now()
   });
   return promote();
@@ -23203,6 +23218,7 @@ var mfaEnrollmentsTable = pgTable("auth_mfa_enrollments", {
   sms_pending_code_hash: text("sms_pending_code_hash"),
   sms_phone: varchar("sms_phone", { length: PHONE_LENGTH }),
   sms_verified: boolean("sms_verified").notNull().default(false),
+  totp_failed_attempts: smallint("totp_failed_attempts").notNull().default(0),
   totp_secret_ciphertext: text("totp_secret_ciphertext"),
   totp_verified: boolean("totp_verified").notNull().default(false),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull(),
@@ -23217,6 +23233,7 @@ var toEnrollment = (row) => ({
   smsPendingCodeHash: row.sms_pending_code_hash ?? undefined,
   smsPhone: row.sms_phone ?? undefined,
   smsVerified: row.sms_verified,
+  totpFailedAttempts: row.totp_failed_attempts,
   totpSecretCiphertext: row.totp_secret_ciphertext ?? undefined,
   totpVerified: row.totp_verified,
   updatedAt: row.updated_at_ms,
@@ -23245,6 +23262,7 @@ var createPostgresMfaStore = (db) => ({
       sms_pending_code_hash: enrollment.smsPendingCodeHash ?? null,
       sms_phone: enrollment.smsPhone ?? null,
       sms_verified: enrollment.smsVerified,
+      totp_failed_attempts: enrollment.totpFailedAttempts ?? 0,
       totp_secret_ciphertext: enrollment.totpSecretCiphertext ?? null,
       totp_verified: enrollment.totpVerified,
       updated_at_ms: enrollment.updatedAt,
@@ -26573,6 +26591,10 @@ var mfaSmsColumnsMigration = {
   ].join(`
 `)
 };
+var mfaTotpLockoutMigration = {
+  id: "0003_totp_lockout",
+  sql: 'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "totp_failed_attempts" smallint NOT NULL DEFAULT 0;'
+};
 var blockMigrations = {
   adaptive: initMigration("adaptive", [knownDevicesTable, loginHistoryTable]),
   apikeys: initMigration("apikeys", [
@@ -26596,7 +26618,8 @@ var blockMigrations = {
     block: "mfa",
     migrations: [
       ...initMigration("mfa", [mfaEnrollmentsTable]).migrations,
-      mfaSmsColumnsMigration
+      mfaSmsColumnsMigration,
+      mfaTotpLockoutMigration
     ]
   },
   oidc: initMigration("oidc", [
@@ -27872,6 +27895,7 @@ export {
   DEFAULT_VP_ROUTE,
   DEFAULT_VERIFICATION_TOKEN_TTL_MS,
   DEFAULT_VCI_ROUTE,
+  DEFAULT_TOTP_MAX_ATTEMPTS,
   DEFAULT_TOKEN_ROUTE,
   DEFAULT_STATUS_ROUTE,
   DEFAULT_SSO_SESSION_TTL_MS,
@@ -27903,5 +27927,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=178CE4DFADBEB75764756E2164756E21
+//# debugId=47718768D4F1D77064756E2164756E21
 //# sourceMappingURL=index.js.map