@absolutejs/auth 0.57.9 → 0.59.0

package/dist/mfa/challenge.d.ts

@@ -1,6 +1,6 @@
 import { Elysia } from 'elysia';
 import { type MfaRouteProps } from './config';
-export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute, cookieSecure, encryptionKey, getChallengeUser, getUserId, mfaStore, onMfaChallengeError, onMfaChallengeSuccess, onSendSmsCode, sessionDurationMs, smsCodeLength, smsCodeTtlMs, smsMaxAttempts, totpMaxAttempts }: MfaRouteProps<UserType>) => Elysia<"", {
+export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute, cookieSecure, encryptionKey, getChallengeUser, getUserId, mfaStore, onMfaChallengeError, onMfaChallengeSuccess, onSendSmsCode, verificationProvider, sessionDurationMs, smsCodeLength, smsCodeTtlMs, smsMaxAttempts, smsResendCooldownMs, totpMaxAttempts }: MfaRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;
@@ -30,8 +30,8 @@ export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute
             query: unknown;
             headers: unknown;
             response: {
-                400: "SMS code required" | "No SMS code in progress";
-                401: "SMS code expired" | "Too many attempts" | "No MFA challenge in progress" | "Invalid MFA code";
+                400: string;
+                401: "SMS code expired" | "Too many attempts" | "SMS challenge is no longer active" | "No MFA challenge in progress" | "Invalid MFA code";
                 200: {
                     readonly status: "sent";
                 } | {
@@ -46,6 +46,8 @@ export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute
                     property?: string;
                     expected?: string;
                 };
+                429: string;
+                503: string;
             };
         };
     };

package/dist/mfa/config.d.ts

@@ -3,15 +3,19 @@ import type { RouteString, UserSessionId } from '../types';
 import type { MFAStore } from './types';
 export declare const DEFAULT_BACKUP_CODE_COUNT = 10;
 export declare const DEFAULT_MFA_ISSUER = "AbsoluteAuth";
+export declare const DEFAULT_MFA_MANAGEMENT_AUTH_MAX_AGE_MS: number;
 export declare const DEFAULT_MFA_SESSION_TTL_MS: number;
 export declare const DEFAULT_SMS_CODE_LENGTH = 6;
 export declare const DEFAULT_SMS_CODE_TTL_MS: number;
 export declare const DEFAULT_SMS_MAX_ATTEMPTS = 3;
+export declare const DEFAULT_SMS_RESEND_COOLDOWN_MS: number;
 export declare const DEFAULT_TOTP_MAX_ATTEMPTS = 5;
 export type SmsCodeMessage = {
     code: string;
     expiresAt: number;
     phone: string;
+    purpose: 'mfa_challenge' | 'mfa_enrollment';
+    userId: string;
 };
 export type MfaConfig<UserType> = {
     mfaStore: MFAStore;
@@ -22,6 +26,8 @@ export type MfaConfig<UserType> = {
     encryptionKey?: string;
     issuer?: string;
     managementRoute?: RouteString;
+    /** Maximum age of the authentication ceremony used to enroll, replace, or remove MFA. */
+    managementAuthMaxAgeMs?: number;
     onMfaChallengeError?: (context: {
         error: unknown;
         userId?: string;
@@ -38,6 +44,8 @@ export type MfaConfig<UserType> = {
     smsCodeLength?: number;
     smsCodeTtlMs?: number;
     smsMaxAttempts?: number;
+    /** Minimum delay between code sends for the same enrollment. */
+    smsResendCooldownMs?: number;
     smsSetupRoute?: RouteString;
     smsVerifyRoute?: RouteString;
     totpMaxAttempts?: number;
@@ -47,4 +55,5 @@ export type MfaConfig<UserType> = {
 export type MfaRouteProps<UserType> = MfaConfig<UserType> & {
     authSessionStore?: AuthSessionStore<UserType>;
     cookieSecure?: boolean;
+    verificationProvider?: import('../verification/types').VerificationProvider;
 };

package/dist/mfa/management.d.ts

@@ -1,5 +1,5 @@
 import { Elysia } from 'elysia';
-import type { MfaRouteProps } from './config';
+import { type MfaRouteProps } from './config';
 export type MfaStatus = {
     backupCodesRemaining: number;
     enabled: boolean;
@@ -11,7 +11,7 @@ export type MfaStatus = {
         enabled: boolean;
     };
 };
-export declare const mfaManagementRoutes: <UserType>({ authSessionStore, getUserId, managementRoute, mfaStore }: MfaRouteProps<UserType>) => Elysia<"", {
+export declare const mfaManagementRoutes: <UserType>({ authSessionStore, getUserId, managementRoute, managementAuthMaxAgeMs, mfaStore }: MfaRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;
@@ -69,7 +69,7 @@ export declare const mfaManagementRoutes: <UserType>({ authSessionStore, getUser
             query: unknown;
             headers: unknown;
             response: {
-                401: "Authentication required";
+                401: "Recent authentication required" | "Authentication required";
                 200: {
                     readonly status: "disabled";
                 };

package/dist/mfa/postgresMfaStore.d.ts

@@ -49,6 +49,36 @@ export declare const mfaEnrollmentsTable: import("drizzle-orm/pg-core").PgTableW
             identity: undefined;
             generated: undefined;
         }>;
+        sms_challenge_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        sms_code_sent_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgBigInt53Builder, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         sms_failed_attempts: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgSmallIntBuilder>>, {
             name: string;
             tableName: "auth_mfa_enrollments";
@@ -94,6 +124,21 @@ export declare const mfaEnrollmentsTable: import("drizzle-orm/pg-core").PgTableW
             identity: undefined;
             generated: undefined;
         }>;
+        sms_pending_purpose: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, import("..").VerificationPurpose | undefined>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "string";
+            data: import("..").VerificationPurpose | undefined;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         sms_phone: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
             name: string;
             tableName: "auth_mfa_enrollments";
@@ -109,6 +154,21 @@ export declare const mfaEnrollmentsTable: import("drizzle-orm/pg-core").PgTableW
             identity: undefined;
             generated: undefined;
         }>;
+        sms_provider_reference: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         sms_verified: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBooleanBuilder>>, {
             name: string;
             tableName: "auth_mfa_enrollments";

package/dist/mfa/recentAuth.d.ts

@@ -0,0 +1,2 @@
+import type { SessionData } from '../types';
+export declare const hasRecentAuthentication: <UserType>(session: SessionData<UserType>, maxAgeMs: number, now?: number) => boolean;

package/dist/mfa/routes.d.ts

@@ -58,7 +58,7 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             query: unknown;
             headers: unknown;
             response: {
-                401: "Authentication required";
+                401: "Recent authentication required" | "Authentication required";
                 200: {
                     readonly status: "disabled";
                 };
@@ -82,7 +82,7 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             query: unknown;
             headers: unknown;
             response: {
-                401: "Authentication required";
+                401: "Recent authentication required" | "Authentication required";
                 200: {
                     readonly secret: string;
                     readonly uri: string;
@@ -110,7 +110,7 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             headers: unknown;
             response: {
                 400: "No TOTP enrollment in progress" | "Invalid TOTP code";
-                401: "Authentication required";
+                401: "Recent authentication required" | "Authentication required";
                 200: {
                     readonly backupCodes: string[];
                 };
@@ -136,8 +136,8 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             query: unknown;
             headers: unknown;
             response: {
-                400: "Phone must be in E.164 format";
-                401: "Authentication required";
+                400: string;
+                401: "Recent authentication required" | "Authentication required";
                 501: "SMS MFA is not configured";
                 200: {
                     readonly phone: string;
@@ -151,6 +151,8 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
                     property?: string;
                     expected?: string;
                 };
+                429: string;
+                503: string;
             };
         };
     };
@@ -164,8 +166,8 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             query: unknown;
             headers: unknown;
             response: {
-                400: "No SMS enrollment in progress" | "SMS code expired" | "Invalid SMS code";
-                401: "Authentication required";
+                400: string;
+                401: "Recent authentication required" | "Authentication required";
                 200: {
                     readonly status: "enrolled";
                 };
@@ -178,7 +180,8 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
                     property?: string;
                     expected?: string;
                 };
-                429: "Too many attempts";
+                429: string;
+                503: string;
             };
         };
     };
@@ -194,8 +197,8 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             query: unknown;
             headers: unknown;
             response: {
-                400: "SMS code required" | "No SMS code in progress";
-                401: "SMS code expired" | "Too many attempts" | "No MFA challenge in progress" | "Invalid MFA code";
+                400: string;
+                401: "SMS code expired" | "Too many attempts" | "SMS challenge is no longer active" | "No MFA challenge in progress" | "Invalid MFA code";
                 200: {
                     readonly status: "sent";
                 } | {
@@ -210,6 +213,8 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
                     property?: string;
                     expected?: string;
                 };
+                429: string;
+                503: string;
             };
         };
     };

package/dist/mfa/sms.d.ts

@@ -1,16 +1,51 @@
 import { Elysia } from 'elysia';
+import { type VerificationCheckInput, type VerificationProvider } from '../verification/types';
 import { type MfaRouteProps, type SmsCodeMessage } from './config';
 import type { MfaEnrollment, MFAStore } from './types';
+export declare class SmsChallengeConflictError extends Error {
+    name: string;
+}
+export declare const checkWithVerificationProvider: (provider: VerificationProvider, input: VerificationCheckInput) => Promise<{
+    result: import("..").VerificationCheckResult;
+    readonly error?: undefined;
+} | {
+    error: {
+        message: string;
+        status: "Too Many Requests";
+    } | {
+        message: string;
+        status: "Bad Request";
+    } | {
+        message: string;
+        status: "Service Unavailable";
+    };
+    result?: undefined;
+}>;
 export declare const isE164Phone: (phone: string) => boolean;
-export declare const issueAndStoreSmsCode: ({ codeLength, enrollment, mfaStore, onSendSmsCode, ttlMs }: {
+export declare const issueAndStoreSmsCode: ({ codeLength, enrollment, mfaStore, onSendSmsCode, previousEnrollment, purpose, resendCooldownMs, verificationProvider, ttlMs, userId }: {
     codeLength: number;
     enrollment: MfaEnrollment;
     mfaStore: MFAStore;
     onSendSmsCode?: (message: SmsCodeMessage) => void | Promise<void>;
+    previousEnrollment?: MfaEnrollment;
+    verificationProvider?: MfaRouteProps<unknown>["verificationProvider"];
+    userId: string;
+    purpose: "mfa_challenge" | "mfa_enrollment";
+    resendCooldownMs: number;
     ttlMs: number;
 }) => Promise<number | undefined>;
+export declare const mapVerificationProviderError: (error: unknown) => {
+    message: string;
+    status: "Too Many Requests";
+} | {
+    message: string;
+    status: "Bad Request";
+} | {
+    message: string;
+    status: "Service Unavailable";
+} | undefined;
 export declare const maskPhone: (phone: string) => string;
-export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfaStore, onMfaEnrolled, onSendSmsCode, smsCodeLength, smsCodeTtlMs, smsMaxAttempts, smsSetupRoute, smsVerifyRoute }: MfaRouteProps<UserType>) => Elysia<"", {
+export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfaStore, managementAuthMaxAgeMs, onMfaEnrolled, onSendSmsCode, verificationProvider, smsCodeLength, smsCodeTtlMs, smsMaxAttempts, smsResendCooldownMs, smsSetupRoute, smsVerifyRoute }: MfaRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;
@@ -38,8 +73,8 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
             query: unknown;
             headers: unknown;
             response: {
-                400: "Phone must be in E.164 format";
-                401: "Authentication required";
+                400: string;
+                401: "Recent authentication required" | "Authentication required";
                 501: "SMS MFA is not configured";
                 200: {
                     readonly phone: string;
@@ -53,6 +88,8 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
                     property?: string;
                     expected?: string;
                 };
+                429: string;
+                503: string;
             };
         };
     };
@@ -66,8 +103,8 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
             query: unknown;
             headers: unknown;
             response: {
-                400: "No SMS enrollment in progress" | "SMS code expired" | "Invalid SMS code";
-                401: "Authentication required";
+                400: string;
+                401: "Recent authentication required" | "Authentication required";
                 200: {
                     readonly status: "enrolled";
                 };
@@ -80,7 +117,8 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
                     property?: string;
                     expected?: string;
                 };
-                429: "Too many attempts";
+                429: string;
+                503: string;
             };
         };
     };

package/dist/mfa/totp.d.ts

@@ -1,6 +1,6 @@
 import { Elysia } from 'elysia';
 import { type MfaRouteProps } from './config';
-export declare const mfaTotpRoutes: <UserType>({ authSessionStore, backupCodeCount, encryptionKey, getUserId, issuer, mfaStore, onMfaEnrolled, totpSetupRoute, totpVerifyRoute }: MfaRouteProps<UserType>) => Elysia<"", {
+export declare const mfaTotpRoutes: <UserType>({ authSessionStore, backupCodeCount, encryptionKey, getUserId, issuer, managementAuthMaxAgeMs, mfaStore, onMfaEnrolled, totpSetupRoute, totpVerifyRoute }: MfaRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;
@@ -26,7 +26,7 @@ export declare const mfaTotpRoutes: <UserType>({ authSessionStore, backupCodeCou
             query: unknown;
             headers: unknown;
             response: {
-                401: "Authentication required";
+                401: "Recent authentication required" | "Authentication required";
                 200: {
                     readonly secret: string;
                     readonly uri: string;
@@ -54,7 +54,7 @@ export declare const mfaTotpRoutes: <UserType>({ authSessionStore, backupCodeCou
             headers: unknown;
             response: {
                 400: "No TOTP enrollment in progress" | "Invalid TOTP code";
-                401: "Authentication required";
+                401: "Recent authentication required" | "Authentication required";
                 200: {
                     readonly backupCodes: string[];
                 };

package/dist/mfa/types.d.ts

@@ -1,3 +1,4 @@
+import type { VerificationPurpose } from '../verification/types';
 export type MfaFactorType = 'backup_codes' | 'sms' | 'totp';
 export type MfaEnrollment = {
     backupCodeHashes: string[];
@@ -6,6 +7,11 @@ export type MfaEnrollment = {
     smsFailedAttempts?: number;
     smsPendingCodeHash?: string;
     smsPendingCodeExpiresAt?: number;
+    smsPendingPurpose?: VerificationPurpose;
+    smsProviderReference?: string;
+    smsCodeSentAt?: number;
+    /** Opaque generation binding every update to the currently active challenge. */
+    smsChallengeId?: string;
     smsPhone?: string;
     smsVerified: boolean;
     totpFailedAttempts?: number;
@@ -15,9 +21,38 @@ export type MfaEnrollment = {
     userId: string;
 };
 export type MFAStore = {
+    /** Atomically reserves the SMS slot only when the resend cooldown has elapsed. */
+    claimSmsChallenge: (input: {
+        challengeId: string;
+        cooldownCutoff: number;
+        enrollment: MfaEnrollment;
+    }) => Promise<boolean>;
+    completeSmsChallenge: (input: {
+        challengeId: string;
+        lastUsedAt?: number;
+        smsVerified: boolean;
+        userId: string;
+    }) => Promise<boolean>;
+    finalizeSmsChallenge: (input: {
+        challengeId: string;
+        expiresAt: number;
+        hash?: string;
+        providerReference?: string;
+        userId: string;
+    }) => Promise<boolean>;
     getEnrollment: (userId: string) => Promise<MfaEnrollment | undefined>;
     listEnrollments: () => Promise<MfaEnrollment[]>;
     removeEnrollment: (userId: string) => Promise<void>;
+    recordSmsFailure: (input: {
+        challengeId: string;
+        maxAttempts: number;
+        userId: string;
+    }) => Promise<number | undefined>;
+    rollbackSmsChallenge: (input: {
+        challengeId: string;
+        previous?: MfaEnrollment;
+        userId: string;
+    }) => Promise<void>;
     saveEnrollment: (enrollment: MfaEnrollment) => Promise<void>;
 };
 export declare const isMfaEnrolled: (enrollment: MfaEnrollment | undefined) => boolean;