@absolutejs/auth 0.57.9 → 0.58.0

package/dist/manifest.json

@@ -312,6 +312,15 @@
 				"@absolutejs/auth#memory"
 			],
 			"required": true
+		},
+		"verificationProvider": {
+			"configPath": "verificationProvider",
+			"contract": "auth/verification-provider",
+			"description": "Provider-managed phone verification for MFA and future passwordless flows",
+			"known": [
+				"@absolutejs/auth-twilio"
+			],
+			"required": false
 		}
 	},
 	"wiring": [

package/dist/mfa/challenge.d.ts

@@ -1,6 +1,6 @@
 import { Elysia } from 'elysia';
 import { type MfaRouteProps } from './config';
-export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute, cookieSecure, encryptionKey, getChallengeUser, getUserId, mfaStore, onMfaChallengeError, onMfaChallengeSuccess, onSendSmsCode, sessionDurationMs, smsCodeLength, smsCodeTtlMs, smsMaxAttempts, totpMaxAttempts }: MfaRouteProps<UserType>) => Elysia<"", {
+export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute, cookieSecure, encryptionKey, getChallengeUser, getUserId, mfaStore, onMfaChallengeError, onMfaChallengeSuccess, onSendSmsCode, verificationProvider, sessionDurationMs, smsCodeLength, smsCodeTtlMs, smsMaxAttempts, smsResendCooldownMs, totpMaxAttempts }: MfaRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;
@@ -30,7 +30,7 @@ export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute
             query: unknown;
             headers: unknown;
             response: {
-                400: "SMS code required" | "No SMS code in progress";
+                400: string;
                 401: "SMS code expired" | "Too many attempts" | "No MFA challenge in progress" | "Invalid MFA code";
                 200: {
                     readonly status: "sent";
@@ -46,6 +46,8 @@ export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute
                     property?: string;
                     expected?: string;
                 };
+                429: string;
+                503: string;
             };
         };
     };

package/dist/mfa/config.d.ts

@@ -7,11 +7,14 @@ export declare const DEFAULT_MFA_SESSION_TTL_MS: number;
 export declare const DEFAULT_SMS_CODE_LENGTH = 6;
 export declare const DEFAULT_SMS_CODE_TTL_MS: number;
 export declare const DEFAULT_SMS_MAX_ATTEMPTS = 3;
+export declare const DEFAULT_SMS_RESEND_COOLDOWN_MS: number;
 export declare const DEFAULT_TOTP_MAX_ATTEMPTS = 5;
 export type SmsCodeMessage = {
     code: string;
     expiresAt: number;
     phone: string;
+    purpose: 'mfa_challenge' | 'mfa_enrollment';
+    userId: string;
 };
 export type MfaConfig<UserType> = {
     mfaStore: MFAStore;
@@ -38,6 +41,8 @@ export type MfaConfig<UserType> = {
     smsCodeLength?: number;
     smsCodeTtlMs?: number;
     smsMaxAttempts?: number;
+    /** Minimum delay between code sends for the same enrollment. */
+    smsResendCooldownMs?: number;
     smsSetupRoute?: RouteString;
     smsVerifyRoute?: RouteString;
     totpMaxAttempts?: number;
@@ -47,4 +52,5 @@ export type MfaConfig<UserType> = {
 export type MfaRouteProps<UserType> = MfaConfig<UserType> & {
     authSessionStore?: AuthSessionStore<UserType>;
     cookieSecure?: boolean;
+    verificationProvider?: import('../verification/types').VerificationProvider;
 };

package/dist/mfa/postgresMfaStore.d.ts

@@ -49,6 +49,21 @@ export declare const mfaEnrollmentsTable: import("drizzle-orm/pg-core").PgTableW
             identity: undefined;
             generated: undefined;
         }>;
+        sms_code_sent_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgBigInt53Builder, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         sms_failed_attempts: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgSmallIntBuilder>>, {
             name: string;
             tableName: "auth_mfa_enrollments";
@@ -94,6 +109,21 @@ export declare const mfaEnrollmentsTable: import("drizzle-orm/pg-core").PgTableW
             identity: undefined;
             generated: undefined;
         }>;
+        sms_pending_purpose: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, import("..").VerificationPurpose | undefined>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "string";
+            data: import("..").VerificationPurpose | undefined;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         sms_phone: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
             name: string;
             tableName: "auth_mfa_enrollments";
@@ -109,6 +139,21 @@ export declare const mfaEnrollmentsTable: import("drizzle-orm/pg-core").PgTableW
             identity: undefined;
             generated: undefined;
         }>;
+        sms_provider_reference: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         sms_verified: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBooleanBuilder>>, {
             name: string;
             tableName: "auth_mfa_enrollments";

package/dist/mfa/routes.d.ts

@@ -136,7 +136,7 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             query: unknown;
             headers: unknown;
             response: {
-                400: "Phone must be in E.164 format";
+                400: string;
                 401: "Authentication required";
                 501: "SMS MFA is not configured";
                 200: {
@@ -151,6 +151,8 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
                     property?: string;
                     expected?: string;
                 };
+                429: string;
+                503: string;
             };
         };
     };
@@ -164,7 +166,7 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             query: unknown;
             headers: unknown;
             response: {
-                400: "No SMS enrollment in progress" | "SMS code expired" | "Invalid SMS code";
+                400: string;
                 401: "Authentication required";
                 200: {
                     readonly status: "enrolled";
@@ -178,7 +180,8 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
                     property?: string;
                     expected?: string;
                 };
-                429: "Too many attempts";
+                429: string;
+                503: string;
             };
         };
     };
@@ -194,7 +197,7 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             query: unknown;
             headers: unknown;
             response: {
-                400: "SMS code required" | "No SMS code in progress";
+                400: string;
                 401: "SMS code expired" | "Too many attempts" | "No MFA challenge in progress" | "Invalid MFA code";
                 200: {
                     readonly status: "sent";
@@ -210,6 +213,8 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
                     property?: string;
                     expected?: string;
                 };
+                429: string;
+                503: string;
             };
         };
     };

package/dist/mfa/sms.d.ts

@@ -1,16 +1,46 @@
 import { Elysia } from 'elysia';
+import { type VerificationCheckInput, type VerificationProvider } from '../verification/types';
 import { type MfaRouteProps, type SmsCodeMessage } from './config';
 import type { MfaEnrollment, MFAStore } from './types';
+export declare const checkWithVerificationProvider: (provider: VerificationProvider, input: VerificationCheckInput) => Promise<{
+    result: import("..").VerificationCheckResult;
+    readonly error?: undefined;
+} | {
+    error: {
+        message: string;
+        status: "Too Many Requests";
+    } | {
+        message: string;
+        status: "Bad Request";
+    } | {
+        message: string;
+        status: "Service Unavailable";
+    };
+    result?: undefined;
+}>;
 export declare const isE164Phone: (phone: string) => boolean;
-export declare const issueAndStoreSmsCode: ({ codeLength, enrollment, mfaStore, onSendSmsCode, ttlMs }: {
+export declare const issueAndStoreSmsCode: ({ codeLength, enrollment, mfaStore, onSendSmsCode, purpose, verificationProvider, ttlMs, userId }: {
     codeLength: number;
     enrollment: MfaEnrollment;
     mfaStore: MFAStore;
     onSendSmsCode?: (message: SmsCodeMessage) => void | Promise<void>;
+    verificationProvider?: MfaRouteProps<unknown>["verificationProvider"];
+    userId: string;
+    purpose: "mfa_challenge" | "mfa_enrollment";
     ttlMs: number;
 }) => Promise<number | undefined>;
+export declare const mapVerificationProviderError: (error: unknown) => {
+    message: string;
+    status: "Too Many Requests";
+} | {
+    message: string;
+    status: "Bad Request";
+} | {
+    message: string;
+    status: "Service Unavailable";
+} | undefined;
 export declare const maskPhone: (phone: string) => string;
-export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfaStore, onMfaEnrolled, onSendSmsCode, smsCodeLength, smsCodeTtlMs, smsMaxAttempts, smsSetupRoute, smsVerifyRoute }: MfaRouteProps<UserType>) => Elysia<"", {
+export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfaStore, onMfaEnrolled, onSendSmsCode, verificationProvider, smsCodeLength, smsCodeTtlMs, smsMaxAttempts, smsResendCooldownMs, smsSetupRoute, smsVerifyRoute }: MfaRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;
@@ -38,7 +68,7 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
             query: unknown;
             headers: unknown;
             response: {
-                400: "Phone must be in E.164 format";
+                400: string;
                 401: "Authentication required";
                 501: "SMS MFA is not configured";
                 200: {
@@ -53,6 +83,8 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
                     property?: string;
                     expected?: string;
                 };
+                429: string;
+                503: string;
             };
         };
     };
@@ -66,7 +98,7 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
             query: unknown;
             headers: unknown;
             response: {
-                400: "No SMS enrollment in progress" | "SMS code expired" | "Invalid SMS code";
+                400: string;
                 401: "Authentication required";
                 200: {
                     readonly status: "enrolled";
@@ -80,7 +112,8 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
                     property?: string;
                     expected?: string;
                 };
-                429: "Too many attempts";
+                429: string;
+                503: string;
             };
         };
     };

package/dist/mfa/types.d.ts

@@ -1,3 +1,4 @@
+import type { VerificationPurpose } from '../verification/types';
 export type MfaFactorType = 'backup_codes' | 'sms' | 'totp';
 export type MfaEnrollment = {
     backupCodeHashes: string[];
@@ -6,6 +7,9 @@ export type MfaEnrollment = {
     smsFailedAttempts?: number;
     smsPendingCodeHash?: string;
     smsPendingCodeExpiresAt?: number;
+    smsPendingPurpose?: VerificationPurpose;
+    smsProviderReference?: string;
+    smsCodeSentAt?: number;
     smsPhone?: string;
     smsVerified: boolean;
     totpFailedAttempts?: number;

package/dist/server.d.ts

@@ -18,6 +18,7 @@ export type { ScimConfig } from './scim/config';
 export type { ScimFilter, ScimGroup, ScimGroupInput, ScimTokenStore, ScimUser, ScimUserInput } from './scim/types';
 export { createPostgresScimTokenStore } from './scim/postgresScimTokenStore';
 export type { AuthSessionStore } from './session/types';
+export { VerificationProviderError, type VerificationCheckInput, type VerificationCheckResult, type VerificationCheckStatus, type VerificationProvider, type VerificationProviderErrorKind, type VerificationPurpose, type VerificationStartInput, type VerificationStartResult } from './verification/types';
 export type { NodeSamlAdapterOptions } from './sso/nodeSamlAdapter';
 export { createNodeSamlAdapter } from './sso/nodeSamlAdapter';
 export type { SsoIdentity, SSOConfig } from './sso/config';