@absolutejs/auth 0.57.9 → 0.58.0

package/dist/server.js

@@ -6849,6 +6849,7 @@ var DEFAULT_SMS_CODE_LENGTH = 6;
 var SMS_CODE_TTL_MINUTES = 5;
 var DEFAULT_SMS_CODE_TTL_MS = SMS_CODE_TTL_MINUTES * SECONDS_IN_A_MINUTE * MILLISECONDS_IN_A_SECOND;
 var DEFAULT_SMS_MAX_ATTEMPTS = 3;
+var DEFAULT_SMS_RESEND_COOLDOWN_MS = 30 * MILLISECONDS_IN_A_SECOND;
 var DEFAULT_TOTP_MAX_ATTEMPTS = 5;
 
 // src/mfa/secret.ts
@@ -6859,6 +6860,20 @@ var encryptTotpSecret = (secret, encryptionKey) => encryptionKey ? encryptSecret
 // src/mfa/sms.ts
 init_crypto();
 import { Elysia as Elysia17, t as t11 } from "elysia";
+
+// src/verification/types.ts
+class VerificationProviderError extends Error {
+  kind;
+  provider;
+  constructor(input) {
+    super(input.message, { cause: input.cause });
+    this.name = "VerificationProviderError";
+    this.kind = input.kind;
+    this.provider = input.provider;
+  }
+}
+
+// src/mfa/sms.ts
 var DECIMAL_RADIX2 = 10;
 var MASK_VISIBLE_DIGITS = 4;
 var E164_PATTERN = /^\+[1-9]\d{7,14}$/u;
@@ -6873,28 +6888,83 @@ var issueSmsCode = async (codeLength, ttlMs) => {
   const expiresAt = Date.now() + ttlMs;
   return { code, expiresAt, hash };
 };
+var checkWithVerificationProvider = async (provider, input) => {
+  try {
+    return { result: await provider.check(input) };
+  } catch (error) {
+    const mapped = mapVerificationProviderError(error);
+    if (mapped === undefined)
+      throw error;
+    return { error: mapped };
+  }
+};
 var isE164Phone = (phone) => E164_PATTERN.test(phone);
 var issueAndStoreSmsCode = async ({
   codeLength,
   enrollment,
   mfaStore,
   onSendSmsCode,
-  ttlMs
+  purpose,
+  verificationProvider,
+  ttlMs,
+  userId
 }) => {
   const phone = enrollment.smsPhone;
   if (phone === undefined)
     return;
+  if (verificationProvider !== undefined) {
+    const started = await verificationProvider.start({
+      channel: "sms",
+      purpose,
+      subject: userId,
+      to: phone
+    });
+    await mfaStore.saveEnrollment({
+      ...enrollment,
+      smsCodeSentAt: Date.now(),
+      smsFailedAttempts: 0,
+      smsPendingCodeExpiresAt: started.expiresAt,
+      smsPendingCodeHash: undefined,
+      smsPendingPurpose: purpose,
+      smsProviderReference: started.reference,
+      updatedAt: Date.now()
+    });
+    return started.expiresAt;
+  }
   const { code, expiresAt, hash } = await issueSmsCode(codeLength, ttlMs);
   await mfaStore.saveEnrollment({
     ...enrollment,
+    smsCodeSentAt: Date.now(),
     smsFailedAttempts: 0,
     smsPendingCodeExpiresAt: expiresAt,
     smsPendingCodeHash: hash,
+    smsPendingPurpose: purpose,
+    smsProviderReference: undefined,
     updatedAt: Date.now()
   });
-  await onSendSmsCode?.({ code, expiresAt, phone });
+  await onSendSmsCode?.({ code, expiresAt, phone, purpose, userId });
   return expiresAt;
 };
+var mapVerificationProviderError = (error) => {
+  if (!(error instanceof VerificationProviderError))
+    return;
+  if (error.kind === "rate_limited") {
+    return {
+      message: "Verification provider rate limit reached",
+      status: "Too Many Requests"
+    };
+  }
+  if (error.kind === "invalid_destination") {
+    return {
+      message: "Phone number cannot receive verification codes",
+      status: "Bad Request"
+    };
+  }
+  return {
+    message: "Verification provider unavailable",
+    status: "Service Unavailable"
+  };
+};
 var maskPhone = (phone) => {
   const visible = phone.slice(-MASK_VISIBLE_DIGITS);
   const maskedLength = Math.max(phone.length - MASK_VISIBLE_DIGITS, 0);
@@ -6906,9 +6976,11 @@ var mfaSmsRoutes = ({
   mfaStore,
   onMfaEnrolled,
   onSendSmsCode,
+  verificationProvider,
   smsCodeLength = DEFAULT_SMS_CODE_LENGTH,
   smsCodeTtlMs = DEFAULT_SMS_CODE_TTL_MS,
   smsMaxAttempts = DEFAULT_SMS_MAX_ATTEMPTS,
+  smsResendCooldownMs = DEFAULT_SMS_RESEND_COOLDOWN_MS,
   smsSetupRoute = "/auth/mfa/sms/setup",
   smsVerifyRoute = "/auth/mfa/sms/verify"
 }) => new Elysia17().use(sessionStore()).post(smsSetupRoute, async ({
@@ -6917,7 +6989,7 @@ var mfaSmsRoutes = ({
   status,
   store: { session }
 }) => {
-  if (onSendSmsCode === undefined) {
+  if (onSendSmsCode === undefined && verificationProvider === undefined) {
     return status("Not Implemented", "SMS MFA is not configured");
   }
   const userSession = await loadSessionFromSource({
@@ -6934,21 +7006,51 @@ var mfaSmsRoutes = ({
   const userId = getUserId(userSession.user);
   const existing = await mfaStore.getEnrollment(userId);
   const now = Date.now();
-  const { code, expiresAt, hash } = await issueSmsCode(smsCodeLength, smsCodeTtlMs);
+  if (existing?.smsCodeSentAt !== undefined && now - existing.smsCodeSentAt < smsResendCooldownMs) {
+    return status("Too Many Requests", "SMS resend cooldown active");
+  }
+  let started;
+  try {
+    started = verificationProvider ? await verificationProvider.start({
+      channel: "sms",
+      purpose: "mfa_enrollment",
+      subject: userId,
+      to: phone
+    }) : undefined;
+  } catch (error) {
+    const mapped = mapVerificationProviderError(error);
+    if (mapped === undefined)
+      throw error;
+    return status(mapped.status, mapped.message);
+  }
+  const local = started ? undefined : await issueSmsCode(smsCodeLength, smsCodeTtlMs);
   await mfaStore.saveEnrollment({
     backupCodeHashes: existing?.backupCodeHashes ?? [],
     createdAt: existing?.createdAt ?? now,
+    lastUsedAt: existing?.lastUsedAt,
+    smsCodeSentAt: now,
     smsFailedAttempts: 0,
-    smsPendingCodeExpiresAt: expiresAt,
-    smsPendingCodeHash: hash,
+    smsPendingCodeExpiresAt: started?.expiresAt ?? local?.expiresAt,
+    smsPendingCodeHash: local?.hash,
+    smsPendingPurpose: "mfa_enrollment",
     smsPhone: phone,
+    smsProviderReference: started?.reference,
     smsVerified: false,
+    totpFailedAttempts: existing?.totpFailedAttempts ?? 0,
     totpSecretCiphertext: existing?.totpSecretCiphertext,
     totpVerified: existing?.totpVerified ?? false,
     updatedAt: now,
     userId
   });
-  await onSendSmsCode({ code, expiresAt, phone });
+  if (local !== undefined && onSendSmsCode !== undefined) {
+    await onSendSmsCode({
+      code: local.code,
+      expiresAt: local.expiresAt,
+      phone,
+      purpose: "mfa_enrollment",
+      userId
+    });
+  }
   return status("OK", { phone: maskPhone(phone) });
 }, {
   body: t11.Object({ phone: t11.String() }),
@@ -6969,29 +7071,58 @@ var mfaSmsRoutes = ({
   }
   const userId = getUserId(userSession.user);
   const enrollment = await mfaStore.getEnrollment(userId);
-  if (!enrollment?.smsPendingCodeHash || enrollment.smsPendingCodeExpiresAt === undefined) {
+  if (!enrollment?.smsPhone) {
+    return status("Bad Request", "No SMS enrollment in progress");
+  }
+  const localCodeHash = enrollment.smsPendingCodeHash;
+  const localCodeExpiresAt = enrollment.smsPendingCodeExpiresAt;
+  const providerReference = enrollment.smsProviderReference;
+  if (enrollment.smsPendingPurpose !== "mfa_enrollment" || localCodeExpiresAt === undefined) {
     return status("Bad Request", "No SMS enrollment in progress");
   }
-  if (Date.now() > enrollment.smsPendingCodeExpiresAt) {
+  if (verificationProvider === undefined && localCodeHash === undefined) {
+    return status("Bad Request", "No SMS enrollment in progress");
+  }
+  if (Date.now() > localCodeExpiresAt) {
     return status("Bad Request", "SMS code expired");
   }
   if ((enrollment.smsFailedAttempts ?? 0) >= smsMaxAttempts) {
     return status("Too Many Requests", "Too many attempts");
   }
-  const codeValid = await constantTimeEqual(await hashToken(code), enrollment.smsPendingCodeHash);
+  let providerResult;
+  if (verificationProvider !== undefined) {
+    if (providerReference === undefined) {
+      return status("Bad Request", "No SMS enrollment in progress");
+    }
+    const checked = await checkWithVerificationProvider(verificationProvider, {
+      channel: "sms",
+      code,
+      purpose: "mfa_enrollment",
+      reference: providerReference,
+      subject: userId,
+      to: enrollment.smsPhone
+    });
+    if (checked.error !== undefined) {
+      return status(checked.error.status, checked.error.message);
+    }
+    providerResult = checked.result;
+  }
+  const codeValid = providerResult ? providerResult.status === "approved" : localCodeHash !== undefined && await constantTimeEqual(await hashToken(code), localCodeHash);
   if (!codeValid) {
     await mfaStore.saveEnrollment({
       ...enrollment,
       smsFailedAttempts: (enrollment.smsFailedAttempts ?? 0) + 1,
       updatedAt: Date.now()
     });
-    return status("Bad Request", "Invalid SMS code");
+    return status(providerResult?.status === "max_attempts_reached" ? "Too Many Requests" : "Bad Request", providerResult?.status === "expired" ? "SMS code expired" : "Invalid SMS code");
   }
   await mfaStore.saveEnrollment({
     ...enrollment,
     smsFailedAttempts: 0,
     smsPendingCodeExpiresAt: undefined,
     smsPendingCodeHash: undefined,
+    smsPendingPurpose: undefined,
+    smsProviderReference: undefined,
     smsVerified: true,
     updatedAt: Date.now()
   });
@@ -7014,10 +7145,12 @@ var mfaChallenge = ({
   onMfaChallengeError,
   onMfaChallengeSuccess,
   onSendSmsCode,
+  verificationProvider,
   sessionDurationMs = DEFAULT_MFA_SESSION_TTL_MS,
   smsCodeLength = DEFAULT_SMS_CODE_LENGTH,
   smsCodeTtlMs = DEFAULT_SMS_CODE_TTL_MS,
   smsMaxAttempts = DEFAULT_SMS_MAX_ATTEMPTS,
+  smsResendCooldownMs = DEFAULT_SMS_RESEND_COOLDOWN_MS,
   totpMaxAttempts = DEFAULT_TOTP_MAX_ATTEMPTS
 }) => new Elysia18().use(sessionStore()).post(challengeRoute, async ({
   body: { action, code, factor },
@@ -7059,27 +7192,48 @@ var mfaChallenge = ({
     await onMfaChallengeSuccess?.({ user, userSessionId });
     return status("OK", { status: "authenticated" });
   };
-  const runSmsChallenge = async () => {
-    if (!enrollment.smsVerified || !enrollment.smsPhone) {
-      return status("Unauthorized", "No MFA challenge in progress");
+  const sendSmsChallenge = async () => {
+    if (enrollment.smsCodeSentAt !== undefined && Date.now() - enrollment.smsCodeSentAt < smsResendCooldownMs) {
+      return status("Too Many Requests", "SMS resend cooldown active");
     }
-    if (action === "send") {
+    try {
       await issueAndStoreSmsCode({
         codeLength: smsCodeLength,
         enrollment,
         mfaStore,
         onSendSmsCode,
-        ttlMs: smsCodeTtlMs
+        purpose: "mfa_challenge",
+        ttlMs: smsCodeTtlMs,
+        userId: getUserId(user),
+        verificationProvider
       });
-      return status("OK", { status: "sent" });
+    } catch (error) {
+      const mapped = mapVerificationProviderError(error);
+      if (mapped === undefined)
+        throw error;
+      return status(mapped.status, mapped.message);
     }
+    return status("OK", { status: "sent" });
+  };
+  const runSmsChallenge = async () => {
+    if (!enrollment.smsVerified || !enrollment.smsPhone) {
+      return status("Unauthorized", "No MFA challenge in progress");
+    }
+    if (action === "send")
+      return sendSmsChallenge();
     if (code === undefined) {
       return status("Bad Request", "SMS code required");
     }
-    if (!enrollment.smsPendingCodeHash || enrollment.smsPendingCodeExpiresAt === undefined) {
+    const localCodeHash = enrollment.smsPendingCodeHash;
+    const localCodeExpiresAt = enrollment.smsPendingCodeExpiresAt;
+    const providerReference = enrollment.smsProviderReference;
+    if (enrollment.smsPendingPurpose !== "mfa_challenge" || localCodeExpiresAt === undefined) {
       return status("Bad Request", "No SMS code in progress");
     }
-    if (Date.now() > enrollment.smsPendingCodeExpiresAt) {
+    if (verificationProvider === undefined && localCodeHash === undefined) {
+      return status("Bad Request", "No SMS code in progress");
+    }
+    if (Date.now() > localCodeExpiresAt) {
       return status("Unauthorized", "SMS code expired");
     }
     if ((enrollment.smsFailedAttempts ?? 0) >= smsMaxAttempts) {
@@ -7089,7 +7243,25 @@ var mfaChallenge = ({
       });
       return status("Unauthorized", "Too many attempts");
     }
-    const smsValid = await constantTimeEqual(await hashToken(code), enrollment.smsPendingCodeHash);
+    let providerResult;
+    if (verificationProvider !== undefined) {
+      if (providerReference === undefined) {
+        return status("Bad Request", "No SMS code in progress");
+      }
+      const checked = await checkWithVerificationProvider(verificationProvider, {
+        channel: "sms",
+        code,
+        purpose: "mfa_challenge",
+        reference: providerReference,
+        subject: getUserId(user),
+        to: enrollment.smsPhone
+      });
+      if (checked.error !== undefined) {
+        return status(checked.error.status, checked.error.message);
+      }
+      providerResult = checked.result;
+    }
+    const smsValid = providerResult ? providerResult.status === "approved" : localCodeHash !== undefined && await constantTimeEqual(await hashToken(code), localCodeHash);
     if (!smsValid) {
       await mfaStore.saveEnrollment({
         ...enrollment,
@@ -7100,7 +7272,7 @@ var mfaChallenge = ({
         error: new Error("invalid_mfa_code"),
         userId: getUserId(user)
       });
-      return status("Unauthorized", "Invalid MFA code");
+      return status(providerResult?.status === "max_attempts_reached" ? "Too Many Requests" : "Unauthorized", providerResult?.status === "expired" ? "SMS code expired" : "Invalid MFA code");
     }
     await mfaStore.saveEnrollment({
       ...enrollment,
@@ -7108,6 +7280,8 @@ var mfaChallenge = ({
       smsFailedAttempts: 0,
       smsPendingCodeExpiresAt: undefined,
       smsPendingCodeHash: undefined,
+      smsPendingPurpose: undefined,
+      smsProviderReference: undefined,
       updatedAt: Date.now()
     });
     return promote();
@@ -32836,12 +33010,15 @@ var mfaEnrollmentsTable = pgTable("auth_mfa_enrollments", {
   backup_code_hashes: jsonb("backup_code_hashes").$type().notNull().default([]),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   last_used_at_ms: bigint("last_used_at_ms", { mode: "number" }),
+  sms_code_sent_at_ms: bigint("sms_code_sent_at_ms", { mode: "number" }),
   sms_failed_attempts: smallint("sms_failed_attempts").notNull().default(0),
   sms_pending_code_expires_at_ms: bigint("sms_pending_code_expires_at_ms", {
     mode: "number"
   }),
   sms_pending_code_hash: text("sms_pending_code_hash"),
+  sms_pending_purpose: text("sms_pending_purpose").$type(),
   sms_phone: varchar("sms_phone", { length: PHONE_LENGTH }),
+  sms_provider_reference: text("sms_provider_reference"),
   sms_verified: boolean("sms_verified").notNull().default(false),
   totp_failed_attempts: smallint("totp_failed_attempts").notNull().default(0),
   totp_secret_ciphertext: text("totp_secret_ciphertext"),
@@ -32853,10 +33030,13 @@ var toEnrollment = (row) => ({
   backupCodeHashes: row.backup_code_hashes,
   createdAt: row.created_at_ms,
   lastUsedAt: row.last_used_at_ms ?? undefined,
+  smsCodeSentAt: row.sms_code_sent_at_ms ?? undefined,
   smsFailedAttempts: row.sms_failed_attempts,
   smsPendingCodeExpiresAt: row.sms_pending_code_expires_at_ms ?? undefined,
   smsPendingCodeHash: row.sms_pending_code_hash ?? undefined,
+  smsPendingPurpose: row.sms_pending_purpose ?? undefined,
   smsPhone: row.sms_phone ?? undefined,
+  smsProviderReference: row.sms_provider_reference ?? undefined,
   smsVerified: row.sms_verified,
   totpFailedAttempts: row.totp_failed_attempts,
   totpSecretCiphertext: row.totp_secret_ciphertext ?? undefined,
@@ -32882,10 +33062,13 @@ var createPostgresMfaStore = (db) => ({
       backup_code_hashes: enrollment.backupCodeHashes,
       created_at_ms: enrollment.createdAt,
       last_used_at_ms: enrollment.lastUsedAt ?? null,
+      sms_code_sent_at_ms: enrollment.smsCodeSentAt ?? null,
       sms_failed_attempts: enrollment.smsFailedAttempts ?? 0,
       sms_pending_code_expires_at_ms: enrollment.smsPendingCodeExpiresAt ?? null,
       sms_pending_code_hash: enrollment.smsPendingCodeHash ?? null,
+      sms_pending_purpose: enrollment.smsPendingPurpose ?? null,
       sms_phone: enrollment.smsPhone ?? null,
+      sms_provider_reference: enrollment.smsProviderReference ?? null,
       sms_verified: enrollment.smsVerified,
       totp_failed_attempts: enrollment.totpFailedAttempts ?? 0,
       totp_secret_ciphertext: enrollment.totpSecretCiphertext ?? null,
@@ -37234,6 +37417,15 @@ var mfaTotpLockoutMigration = {
   id: "0003_totp_lockout",
   sql: 'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "totp_failed_attempts" smallint NOT NULL DEFAULT 0;'
 };
+var mfaSmsDeliveryPolicyMigration = {
+  id: "0004_sms_delivery_policy",
+  sql: [
+    'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_code_sent_at_ms" bigint;',
+    'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_pending_purpose" text;',
+    'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_provider_reference" text;'
+  ].join(`
+`)
+};
 var oidcResourceAudienceMigration = {
   id: "0002_resource_audience",
   sql: [
@@ -37288,7 +37480,8 @@ var blockMigrations = {
     migrations: [
       ...initMigration("mfa", [mfaEnrollmentsTable]).migrations,
       mfaSmsColumnsMigration,
-      mfaTotpLockoutMigration
+      mfaTotpLockoutMigration,
+      mfaSmsDeliveryPolicyMigration
     ]
   },
   oidc: {
@@ -37801,6 +37994,7 @@ var buildAuthApplications = async (configuration) => {
     credentials,
     customProviders,
     mfa,
+    verificationProvider,
     passwordless,
     lockout,
     sessions,
@@ -38033,7 +38227,8 @@ var buildAuthApplications = async (configuration) => {
     auditedMfa ? mfaRoutes({
       ...auditedMfa,
       authSessionStore,
-      cookieSecure: resolvedCookieSecure
+      cookieSecure: resolvedCookieSecure,
+      verificationProvider
     }) : new Elysia45,
     passwordless ? passwordlessRoutes({
       ...passwordless,
@@ -38280,8 +38475,9 @@ export {
   createPostgresScimTokenStore,
   createNodeSamlAdapter,
   createAuthContext,
-  auth2 as auth
+  auth2 as auth,
+  VerificationProviderError
 };
 
-//# debugId=8E94D3B40F6913D564756E2164756E21
+//# debugId=AAFF3B14FB3E90D564756E2164756E21
 //# sourceMappingURL=server.js.map