@absolutejs/auth 0.56.3 → 0.56.5

package/dist/mfa/backupCodes.d.ts

@@ -0,0 +1,5 @@
+export declare const consumeBackupCode: (code: string, hashes: string[]) => Promise<string[] | undefined>;
+export declare const generateBackupCodes: (count: number) => Promise<{
+    codes: string[];
+    hashes: string[];
+}>;

package/dist/mfa/challenge.d.ts

@@ -0,0 +1,70 @@
+import { Elysia } from 'elysia';
+import { type MfaRouteProps } from './config';
+export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute, cookieSecure, encryptionKey, getChallengeUser, getUserId, mfaStore, onMfaChallengeError, onMfaChallengeSuccess, onSendSmsCode, sessionDurationMs, smsCodeLength, smsCodeTtlMs, smsMaxAttempts, totpMaxAttempts }: MfaRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        post: {
+            body: {
+                code?: string | undefined;
+                action?: "verify" | "send" | undefined;
+                factor?: "sms" | undefined;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: "SMS code required" | "No SMS code in progress";
+                401: "SMS code expired" | "Too many attempts" | "No MFA challenge in progress" | "Invalid MFA code";
+                200: {
+                    readonly status: "sent";
+                } | {
+                    readonly status: "authenticated";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/mfa/config.d.ts

@@ -0,0 +1,50 @@
+import type { AuthSessionStore } from '../session/types';
+import type { RouteString, UserSessionId } from '../types';
+import type { MFAStore } from './types';
+export declare const DEFAULT_BACKUP_CODE_COUNT = 10;
+export declare const DEFAULT_MFA_ISSUER = "AbsoluteAuth";
+export declare const DEFAULT_MFA_SESSION_TTL_MS: number;
+export declare const DEFAULT_SMS_CODE_LENGTH = 6;
+export declare const DEFAULT_SMS_CODE_TTL_MS: number;
+export declare const DEFAULT_SMS_MAX_ATTEMPTS = 3;
+export declare const DEFAULT_TOTP_MAX_ATTEMPTS = 5;
+export type SmsCodeMessage = {
+    code: string;
+    expiresAt: number;
+    phone: string;
+};
+export type MfaConfig<UserType> = {
+    mfaStore: MFAStore;
+    getUserId: (user: UserType) => string;
+    getChallengeUser: (userIdentity: Record<string, unknown>) => Promise<UserType | null | undefined> | UserType | null | undefined;
+    backupCodeCount?: number;
+    challengeRoute?: RouteString;
+    encryptionKey?: string;
+    issuer?: string;
+    managementRoute?: RouteString;
+    onMfaChallengeError?: (context: {
+        error: unknown;
+        userId?: string;
+    }) => void | Promise<void>;
+    onMfaChallengeSuccess?: (context: {
+        user: UserType;
+        userSessionId: UserSessionId;
+    }) => void | Promise<void>;
+    onMfaEnrolled?: (context: {
+        userId: string;
+    }) => void | Promise<void>;
+    onSendSmsCode?: (message: SmsCodeMessage) => void | Promise<void>;
+    sessionDurationMs?: number;
+    smsCodeLength?: number;
+    smsCodeTtlMs?: number;
+    smsMaxAttempts?: number;
+    smsSetupRoute?: RouteString;
+    smsVerifyRoute?: RouteString;
+    totpMaxAttempts?: number;
+    totpSetupRoute?: RouteString;
+    totpVerifyRoute?: RouteString;
+};
+export type MfaRouteProps<UserType> = MfaConfig<UserType> & {
+    authSessionStore?: AuthSessionStore<UserType>;
+    cookieSecure?: boolean;
+};

package/dist/mfa/gate.d.ts

@@ -0,0 +1,2 @@
+import type { MfaConfig } from './config';
+export declare const createMfaGate: <UserType>({ getUserId, mfaStore }: MfaConfig<UserType>) => (user: UserType) => Promise<boolean>;

package/dist/mfa/inMemoryMfaStore.d.ts

@@ -0,0 +1,2 @@
+import type { MFAStore } from './types';
+export declare const createInMemoryMfaStore: () => MFAStore;

package/dist/mfa/management.d.ts

@@ -0,0 +1,106 @@
+import { Elysia } from 'elysia';
+import type { MfaRouteProps } from './config';
+export type MfaStatus = {
+    backupCodesRemaining: number;
+    enabled: boolean;
+    smsBackup: {
+        enabled: boolean;
+        phone: string | null;
+    };
+    totp: {
+        enabled: boolean;
+    };
+};
+export declare const mfaManagementRoutes: <UserType>({ authSessionStore, getUserId, managementRoute, mfaStore }: MfaRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "Authentication required";
+                200: {
+                    backupCodesRemaining: number;
+                    enabled: boolean;
+                    smsBackup: {
+                        enabled: boolean;
+                        phone: string | null;
+                    };
+                    totp: {
+                        enabled: boolean;
+                    };
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        delete: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "Authentication required";
+                200: {
+                    readonly status: "disabled";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/mfa/postgresMfaStore.d.ts

@@ -0,0 +1,206 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { MFAStore } from './types';
+export declare const mfaEnrollmentsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_mfa_enrollments";
+    schema: undefined;
+    columns: {
+        backup_code_hashes: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgJsonbBuilder, string[]>>>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "object json";
+            data: string[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        last_used_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgBigInt53Builder, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        sms_failed_attempts: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgSmallIntBuilder>>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "number int16";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        sms_pending_code_expires_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgBigInt53Builder, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        sms_pending_code_hash: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        sms_phone: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        sms_verified: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBooleanBuilder>>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        totp_failed_attempts: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgSmallIntBuilder>>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "number int16";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        totp_secret_ciphertext: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        totp_verified: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBooleanBuilder>>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updated_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        user_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonMfaStore: (databaseUrl: string) => MFAStore;
+export declare const createPostgresMfaStore: <DB extends AnyPgDatabase>(db: DB) => MFAStore;

package/dist/mfa/rotation.d.ts

@@ -0,0 +1,17 @@
+import type { MFAStore } from './types';
+export type MfaKeyRotationResult = {
+    alreadyRotated: number;
+    rotated: number;
+    skippedNoSecret: number;
+    total: number;
+};
+export declare const rotateMfaEncryptionKey: ({ mfaStore, newKey, oldKey }: {
+    mfaStore: MFAStore;
+    newKey: string;
+    oldKey: string;
+}) => Promise<{
+    alreadyRotated: number;
+    rotated: number;
+    skippedNoSecret: number;
+    total: number;
+}>;

package/dist/mfa/routes.d.ts

@@ -0,0 +1,234 @@
+import { Elysia } from 'elysia';
+import type { MfaRouteProps } from './config';
+export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "Authentication required";
+                200: {
+                    backupCodesRemaining: number;
+                    enabled: boolean;
+                    smsBackup: {
+                        enabled: boolean;
+                        phone: string | null;
+                    };
+                    totp: {
+                        enabled: boolean;
+                    };
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        delete: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "Authentication required";
+                200: {
+                    readonly status: "disabled";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "Authentication required";
+                200: {
+                    readonly secret: string;
+                    readonly uri: string;
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                code: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: "No TOTP enrollment in progress" | "Invalid TOTP code";
+                401: "Authentication required";
+                200: {
+                    readonly backupCodes: string[];
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                phone: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: "Phone must be in E.164 format";
+                401: "Authentication required";
+                501: "SMS MFA is not configured";
+                200: {
+                    readonly phone: string;
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                code: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: "No SMS enrollment in progress" | "SMS code expired" | "Invalid SMS code";
+                401: "Authentication required";
+                200: {
+                    readonly status: "enrolled";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+                429: "Too many attempts";
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                code?: string | undefined;
+                action?: "verify" | "send" | undefined;
+                factor?: "sms" | undefined;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: "SMS code required" | "No SMS code in progress";
+                401: "SMS code expired" | "Too many attempts" | "No MFA challenge in progress" | "Invalid MFA code";
+                200: {
+                    readonly status: "sent";
+                } | {
+                    readonly status: "authenticated";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;