@absolutejs/auth 0.58.0 → 0.59.1

package/dist/index.js

@@ -5848,6 +5848,7 @@ var generateBackupCodes = async (count) => {
 init_constants();
 var DEFAULT_BACKUP_CODE_COUNT = 10;
 var DEFAULT_MFA_ISSUER = "AbsoluteAuth";
+var DEFAULT_MFA_MANAGEMENT_AUTH_MAX_AGE_MS = 5 * SECONDS_IN_A_MINUTE * MILLISECONDS_IN_A_SECOND;
 var DEFAULT_MFA_SESSION_TTL_MS = MILLISECONDS_IN_A_DAY;
 var DEFAULT_SMS_CODE_LENGTH = 6;
 var SMS_CODE_TTL_MINUTES = 5;
@@ -5877,6 +5878,9 @@ class VerificationProviderError extends Error {
   }
 }
 
+// src/mfa/recentAuth.ts
+var hasRecentAuthentication = (session, maxAgeMs, now = Date.now()) => session.authenticatedAt !== undefined && now >= session.authenticatedAt && now - session.authenticatedAt <= maxAgeMs;
+
 // src/mfa/sms.ts
 var DECIMAL_RADIX2 = 10;
 var MASK_VISIBLE_DIGITS = 4;
@@ -5892,6 +5896,46 @@ var issueSmsCode = async (codeLength, ttlMs) => {
   const expiresAt = Date.now() + ttlMs;
   return { code, expiresAt, hash };
 };
+var startProviderSmsChallenge = async (input) => {
+  let started;
+  try {
+    started = await input.verificationProvider.start({
+      channel: "sms",
+      purpose: input.purpose,
+      subject: input.userId,
+      to: input.phone
+    });
+  } catch (error) {
+    await input.mfaStore.rollbackSmsChallenge({
+      challengeId: input.challengeId,
+      previous: input.previousEnrollment,
+      userId: input.userId
+    });
+    throw error;
+  }
+  const finalized = await input.mfaStore.finalizeSmsChallenge({
+    challengeId: input.challengeId,
+    expiresAt: started.expiresAt,
+    providerReference: started.reference,
+    userId: input.userId
+  });
+  if (finalized)
+    return started;
+  await input.verificationProvider.cancel({
+    channel: "sms",
+    purpose: input.purpose,
+    reference: started.reference,
+    subject: input.userId,
+    to: input.phone
+  }).catch(() => {
+    return;
+  });
+  throw new SmsChallengeConflictError("SMS challenge claim was lost");
+};
+
+class SmsChallengeConflictError extends Error {
+  name = "SmsChallengeConflictError";
+}
 var checkWithVerificationProvider = async (provider, input) => {
   try {
     return { result: await provider.check(input) };
@@ -5908,7 +5952,9 @@ var issueAndStoreSmsCode = async ({
   enrollment,
   mfaStore,
   onSendSmsCode,
+  previousEnrollment,
   purpose,
+  resendCooldownMs,
   verificationProvider,
   ttlMs,
   userId
@@ -5916,40 +5962,62 @@ var issueAndStoreSmsCode = async ({
   const phone = enrollment.smsPhone;
   if (phone === undefined)
     return;
-  if (verificationProvider !== undefined) {
-    const started = await verificationProvider.start({
-      channel: "sms",
-      purpose,
-      subject: userId,
-      to: phone
-    });
-    await mfaStore.saveEnrollment({
+  const challengeId = crypto.randomUUID();
+  const now = Date.now();
+  const claimed = await mfaStore.claimSmsChallenge({
+    challengeId,
+    cooldownCutoff: now - resendCooldownMs,
+    enrollment: {
       ...enrollment,
-      smsCodeSentAt: Date.now(),
+      smsChallengeId: challengeId,
+      smsCodeSentAt: now,
       smsFailedAttempts: 0,
-      smsPendingCodeExpiresAt: started.expiresAt,
+      smsPendingCodeExpiresAt: now + ttlMs,
       smsPendingCodeHash: undefined,
       smsPendingPurpose: purpose,
-      smsProviderReference: started.reference,
-      updatedAt: Date.now()
+      smsProviderReference: undefined,
+      updatedAt: now
+    }
+  });
+  if (!claimed)
+    throw new SmsChallengeConflictError("SMS resend cooldown active");
+  if (verificationProvider !== undefined) {
+    const started = await startProviderSmsChallenge({
+      challengeId,
+      mfaStore,
+      phone,
+      previousEnrollment,
+      purpose,
+      userId,
+      verificationProvider
     });
     return started.expiresAt;
   }
   const { code, expiresAt, hash } = await issueSmsCode(codeLength, ttlMs);
-  await mfaStore.saveEnrollment({
-    ...enrollment,
-    smsCodeSentAt: Date.now(),
-    smsFailedAttempts: 0,
-    smsPendingCodeExpiresAt: expiresAt,
-    smsPendingCodeHash: hash,
-    smsPendingPurpose: purpose,
-    smsProviderReference: undefined,
-    updatedAt: Date.now()
+  const finalized = await mfaStore.finalizeSmsChallenge({
+    challengeId,
+    expiresAt,
+    hash,
+    userId
   });
-  await onSendSmsCode?.({ code, expiresAt, phone, purpose, userId });
+  if (!finalized)
+    throw new SmsChallengeConflictError("SMS challenge claim was lost");
+  try {
+    await onSendSmsCode?.({ code, expiresAt, phone, purpose, userId });
+  } catch (error) {
+    await mfaStore.rollbackSmsChallenge({
+      challengeId,
+      previous: previousEnrollment,
+      userId
+    });
+    throw error;
+  }
   return expiresAt;
 };
 var mapVerificationProviderError = (error) => {
+  if (error instanceof SmsChallengeConflictError) {
+    return { message: error.message, status: "Too Many Requests" };
+  }
   if (!(error instanceof VerificationProviderError))
     return;
   if (error.kind === "rate_limited") {
@@ -5978,6 +6046,7 @@ var mfaSmsRoutes = ({
   authSessionStore,
   getUserId,
   mfaStore,
+  managementAuthMaxAgeMs = DEFAULT_MFA_MANAGEMENT_AUTH_MAX_AGE_MS,
   onMfaEnrolled,
   onSendSmsCode,
   verificationProvider,
@@ -6004,6 +6073,9 @@ var mfaSmsRoutes = ({
   if (!userSession) {
     return status("Unauthorized", "Authentication required");
   }
+  if (!hasRecentAuthentication(userSession, managementAuthMaxAgeMs)) {
+    return status("Unauthorized", "Recent authentication required");
+  }
   if (!isE164Phone(phone)) {
     return status("Bad Request", "Phone must be in E.164 format");
   }
@@ -6013,48 +6085,37 @@ var mfaSmsRoutes = ({
   if (existing?.smsCodeSentAt !== undefined && now - existing.smsCodeSentAt < smsResendCooldownMs) {
     return status("Too Many Requests", "SMS resend cooldown active");
   }
-  let started;
   try {
-    started = verificationProvider ? await verificationProvider.start({
-      channel: "sms",
+    await issueAndStoreSmsCode({
+      codeLength: smsCodeLength,
+      enrollment: {
+        backupCodeHashes: existing?.backupCodeHashes ?? [],
+        createdAt: existing?.createdAt ?? now,
+        lastUsedAt: existing?.lastUsedAt,
+        smsFailedAttempts: 0,
+        smsPhone: phone,
+        smsVerified: false,
+        totpFailedAttempts: existing?.totpFailedAttempts ?? 0,
+        totpSecretCiphertext: existing?.totpSecretCiphertext,
+        totpVerified: existing?.totpVerified ?? false,
+        updatedAt: now,
+        userId
+      },
+      mfaStore,
+      onSendSmsCode,
+      previousEnrollment: existing,
       purpose: "mfa_enrollment",
-      subject: userId,
-      to: phone
-    }) : undefined;
+      resendCooldownMs: smsResendCooldownMs,
+      ttlMs: smsCodeTtlMs,
+      userId,
+      verificationProvider
+    });
   } catch (error) {
     const mapped = mapVerificationProviderError(error);
     if (mapped === undefined)
       throw error;
     return status(mapped.status, mapped.message);
   }
-  const local = started ? undefined : await issueSmsCode(smsCodeLength, smsCodeTtlMs);
-  await mfaStore.saveEnrollment({
-    backupCodeHashes: existing?.backupCodeHashes ?? [],
-    createdAt: existing?.createdAt ?? now,
-    lastUsedAt: existing?.lastUsedAt,
-    smsCodeSentAt: now,
-    smsFailedAttempts: 0,
-    smsPendingCodeExpiresAt: started?.expiresAt ?? local?.expiresAt,
-    smsPendingCodeHash: local?.hash,
-    smsPendingPurpose: "mfa_enrollment",
-    smsPhone: phone,
-    smsProviderReference: started?.reference,
-    smsVerified: false,
-    totpFailedAttempts: existing?.totpFailedAttempts ?? 0,
-    totpSecretCiphertext: existing?.totpSecretCiphertext,
-    totpVerified: existing?.totpVerified ?? false,
-    updatedAt: now,
-    userId
-  });
-  if (local !== undefined && onSendSmsCode !== undefined) {
-    await onSendSmsCode({
-      code: local.code,
-      expiresAt: local.expiresAt,
-      phone,
-      purpose: "mfa_enrollment",
-      userId
-    });
-  }
   return status("OK", { phone: maskPhone(phone) });
 }, {
   body: t11.Object({ phone: t11.String() }),
@@ -6073,15 +6134,19 @@ var mfaSmsRoutes = ({
   if (!userSession) {
     return status("Unauthorized", "Authentication required");
   }
+  if (!hasRecentAuthentication(userSession, managementAuthMaxAgeMs)) {
+    return status("Unauthorized", "Recent authentication required");
+  }
   const userId = getUserId(userSession.user);
   const enrollment = await mfaStore.getEnrollment(userId);
   if (!enrollment?.smsPhone) {
     return status("Bad Request", "No SMS enrollment in progress");
   }
   const localCodeHash = enrollment.smsPendingCodeHash;
+  const challengeId = enrollment.smsChallengeId;
   const localCodeExpiresAt = enrollment.smsPendingCodeExpiresAt;
   const providerReference = enrollment.smsProviderReference;
-  if (enrollment.smsPendingPurpose !== "mfa_enrollment" || localCodeExpiresAt === undefined) {
+  if (enrollment.smsPendingPurpose !== "mfa_enrollment" || localCodeExpiresAt === undefined || challengeId === undefined) {
     return status("Bad Request", "No SMS enrollment in progress");
   }
   if (verificationProvider === undefined && localCodeHash === undefined) {
@@ -6113,23 +6178,21 @@ var mfaSmsRoutes = ({
   }
   const codeValid = providerResult ? providerResult.status === "approved" : localCodeHash !== undefined && await constantTimeEqual(await hashToken(code), localCodeHash);
   if (!codeValid) {
-    await mfaStore.saveEnrollment({
-      ...enrollment,
-      smsFailedAttempts: (enrollment.smsFailedAttempts ?? 0) + 1,
-      updatedAt: Date.now()
+    const attempts = await mfaStore.recordSmsFailure({
+      challengeId,
+      maxAttempts: smsMaxAttempts,
+      userId
     });
-    return status(providerResult?.status === "max_attempts_reached" ? "Too Many Requests" : "Bad Request", providerResult?.status === "expired" ? "SMS code expired" : "Invalid SMS code");
+    return status(providerResult?.status === "max_attempts_reached" || attempts === undefined ? "Too Many Requests" : "Bad Request", providerResult?.status === "expired" ? "SMS code expired" : "Invalid SMS code");
   }
-  await mfaStore.saveEnrollment({
-    ...enrollment,
-    smsFailedAttempts: 0,
-    smsPendingCodeExpiresAt: undefined,
-    smsPendingCodeHash: undefined,
-    smsPendingPurpose: undefined,
-    smsProviderReference: undefined,
+  const completed = await mfaStore.completeSmsChallenge({
+    challengeId,
     smsVerified: true,
-    updatedAt: Date.now()
+    userId
   });
+  if (!completed) {
+    return status("Bad Request", "SMS challenge is no longer active");
+  }
   await onMfaEnrolled?.({ userId });
   return status("OK", { status: "enrolled" });
 }, {
@@ -6206,7 +6269,9 @@ var mfaChallenge = ({
         enrollment,
         mfaStore,
         onSendSmsCode,
+        previousEnrollment: enrollment,
         purpose: "mfa_challenge",
+        resendCooldownMs: smsResendCooldownMs,
         ttlMs: smsCodeTtlMs,
         userId: getUserId(user),
         verificationProvider
@@ -6229,9 +6294,10 @@ var mfaChallenge = ({
       return status("Bad Request", "SMS code required");
     }
     const localCodeHash = enrollment.smsPendingCodeHash;
+    const challengeId = enrollment.smsChallengeId;
     const localCodeExpiresAt = enrollment.smsPendingCodeExpiresAt;
     const providerReference = enrollment.smsProviderReference;
-    if (enrollment.smsPendingPurpose !== "mfa_challenge" || localCodeExpiresAt === undefined) {
+    if (enrollment.smsPendingPurpose !== "mfa_challenge" || localCodeExpiresAt === undefined || challengeId === undefined) {
       return status("Bad Request", "No SMS code in progress");
     }
     if (verificationProvider === undefined && localCodeHash === undefined) {
@@ -6267,27 +6333,26 @@ var mfaChallenge = ({
     }
     const smsValid = providerResult ? providerResult.status === "approved" : localCodeHash !== undefined && await constantTimeEqual(await hashToken(code), localCodeHash);
     if (!smsValid) {
-      await mfaStore.saveEnrollment({
-        ...enrollment,
-        smsFailedAttempts: (enrollment.smsFailedAttempts ?? 0) + 1,
-        updatedAt: Date.now()
+      const attempts = await mfaStore.recordSmsFailure({
+        challengeId,
+        maxAttempts: smsMaxAttempts,
+        userId: getUserId(user)
       });
       await onMfaChallengeError?.({
         error: new Error("invalid_mfa_code"),
         userId: getUserId(user)
       });
-      return status(providerResult?.status === "max_attempts_reached" ? "Too Many Requests" : "Unauthorized", providerResult?.status === "expired" ? "SMS code expired" : "Invalid MFA code");
+      return status(providerResult?.status === "max_attempts_reached" || attempts === undefined ? "Too Many Requests" : "Unauthorized", providerResult?.status === "expired" ? "SMS code expired" : "Invalid MFA code");
     }
-    await mfaStore.saveEnrollment({
-      ...enrollment,
+    const completed = await mfaStore.completeSmsChallenge({
+      challengeId,
       lastUsedAt: Date.now(),
-      smsFailedAttempts: 0,
-      smsPendingCodeExpiresAt: undefined,
-      smsPendingCodeHash: undefined,
-      smsPendingPurpose: undefined,
-      smsProviderReference: undefined,
-      updatedAt: Date.now()
+      smsVerified: true,
+      userId: getUserId(user)
     });
+    if (!completed) {
+      return status("Unauthorized", "SMS challenge is no longer active");
+    }
     return promote();
   };
   if (factor === "sms")
@@ -6349,6 +6414,7 @@ var mfaManagementRoutes = ({
   authSessionStore,
   getUserId,
   managementRoute = "/auth/mfa",
+  managementAuthMaxAgeMs = DEFAULT_MFA_MANAGEMENT_AUTH_MAX_AGE_MS,
   mfaStore
 }) => new Elysia19().use(sessionStore()).get(managementRoute, async ({
   cookie: { user_session_id },
@@ -6387,6 +6453,9 @@ var mfaManagementRoutes = ({
   if (!userSession) {
     return status("Unauthorized", "Authentication required");
   }
+  if (!hasRecentAuthentication(userSession, managementAuthMaxAgeMs)) {
+    return status("Unauthorized", "Recent authentication required");
+  }
   await mfaStore.removeEnrollment(getUserId(userSession.user));
   return status("OK", { status: "disabled" });
 }, { cookie: t13.Cookie({ user_session_id: userSessionIdTypebox }) });
@@ -6400,6 +6469,7 @@ var mfaTotpRoutes = ({
   encryptionKey,
   getUserId,
   issuer = DEFAULT_MFA_ISSUER,
+  managementAuthMaxAgeMs = DEFAULT_MFA_MANAGEMENT_AUTH_MAX_AGE_MS,
   mfaStore,
   onMfaEnrolled,
   totpSetupRoute = "/auth/mfa/totp/setup",
@@ -6417,6 +6487,9 @@ var mfaTotpRoutes = ({
   if (!userSession) {
     return status("Unauthorized", "Authentication required");
   }
+  if (!hasRecentAuthentication(userSession, managementAuthMaxAgeMs)) {
+    return status("Unauthorized", "Recent authentication required");
+  }
   const userId = getUserId(userSession.user);
   const secret = generateTotpSecret();
   const existing = await mfaStore.getEnrollment(userId);
@@ -6456,6 +6529,9 @@ var mfaTotpRoutes = ({
   if (!userSession) {
     return status("Unauthorized", "Authentication required");
   }
+  if (!hasRecentAuthentication(userSession, managementAuthMaxAgeMs)) {
+    return status("Unauthorized", "Recent authentication required");
+  }
   const userId = getUserId(userSession.user);
   const enrollment = await mfaStore.getEnrollment(userId);
   if (!enrollment?.totpSecretCiphertext) {
@@ -31994,14 +32070,85 @@ var cloneEnrollment = (value) => ({
 var createInMemoryMfaStore = () => {
   const enrollments = new Map;
   return {
+    claimSmsChallenge: async ({
+      challengeId,
+      cooldownCutoff,
+      enrollment
+    }) => {
+      const current = enrollments.get(enrollment.userId);
+      if (current?.smsCodeSentAt !== undefined && current.smsCodeSentAt > cooldownCutoff) {
+        return false;
+      }
+      enrollments.set(enrollment.userId, cloneEnrollment({
+        ...enrollment,
+        smsChallengeId: challengeId
+      }));
+      return true;
+    },
+    completeSmsChallenge: async ({
+      challengeId,
+      lastUsedAt,
+      smsVerified,
+      userId
+    }) => {
+      const current = enrollments.get(userId);
+      if (current?.smsChallengeId !== challengeId)
+        return false;
+      enrollments.set(userId, cloneEnrollment({
+        ...current,
+        lastUsedAt: lastUsedAt ?? current.lastUsedAt,
+        smsChallengeId: undefined,
+        smsFailedAttempts: 0,
+        smsPendingCodeExpiresAt: undefined,
+        smsPendingCodeHash: undefined,
+        smsPendingPurpose: undefined,
+        smsProviderReference: undefined,
+        smsVerified,
+        updatedAt: Date.now()
+      }));
+      return true;
+    },
+    finalizeSmsChallenge: async (input) => {
+      const current = enrollments.get(input.userId);
+      if (current?.smsChallengeId !== input.challengeId)
+        return false;
+      enrollments.set(input.userId, cloneEnrollment({
+        ...current,
+        smsPendingCodeExpiresAt: input.expiresAt,
+        smsPendingCodeHash: input.hash,
+        smsProviderReference: input.providerReference,
+        updatedAt: Date.now()
+      }));
+      return true;
+    },
     getEnrollment: async (userId) => {
       const enrollment = enrollments.get(userId);
       return enrollment ? cloneEnrollment(enrollment) : undefined;
     },
     listEnrollments: async () => Array.from(enrollments.values()).map(cloneEnrollment),
+    recordSmsFailure: async ({ challengeId, maxAttempts, userId }) => {
+      const current = enrollments.get(userId);
+      if (current?.smsChallengeId !== challengeId || (current.smsFailedAttempts ?? 0) >= maxAttempts)
+        return;
+      const attempts = (current.smsFailedAttempts ?? 0) + 1;
+      enrollments.set(userId, cloneEnrollment({
+        ...current,
+        smsFailedAttempts: attempts,
+        updatedAt: Date.now()
+      }));
+      return attempts;
+    },
     removeEnrollment: async (userId) => {
       enrollments.delete(userId);
     },
+    rollbackSmsChallenge: async ({ challengeId, previous, userId }) => {
+      if (enrollments.get(userId)?.smsChallengeId !== challengeId)
+        return;
+      if (previous)
+        enrollments.set(userId, cloneEnrollment(previous));
+      else
+        enrollments.delete(userId);
+    },
     saveEnrollment: async (enrollment) => {
       enrollments.set(enrollment.userId, cloneEnrollment(enrollment));
     }
@@ -32014,6 +32161,7 @@ var mfaEnrollmentsTable = pgTable("auth_mfa_enrollments", {
   backup_code_hashes: jsonb("backup_code_hashes").$type().notNull().default([]),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   last_used_at_ms: bigint("last_used_at_ms", { mode: "number" }),
+  sms_challenge_id: text("sms_challenge_id"),
   sms_code_sent_at_ms: bigint("sms_code_sent_at_ms", { mode: "number" }),
   sms_failed_attempts: smallint("sms_failed_attempts").notNull().default(0),
   sms_pending_code_expires_at_ms: bigint("sms_pending_code_expires_at_ms", {
@@ -32034,6 +32182,7 @@ var toEnrollment = (row) => ({
   backupCodeHashes: row.backup_code_hashes,
   createdAt: row.created_at_ms,
   lastUsedAt: row.last_used_at_ms ?? undefined,
+  smsChallengeId: row.sms_challenge_id ?? undefined,
   smsCodeSentAt: row.sms_code_sent_at_ms ?? undefined,
   smsFailedAttempts: row.sms_failed_attempts,
   smsPendingCodeExpiresAt: row.sms_pending_code_expires_at_ms ?? undefined,
@@ -32049,43 +32198,118 @@ var toEnrollment = (row) => ({
   userId: row.user_id
 });
 var createNeonMfaStore = (databaseUrl) => createPostgresMfaStore(createNeonDatabase(databaseUrl));
-var createPostgresMfaStore = (db) => ({
-  getEnrollment: async (userId) => {
-    const [row] = await db.select().from(mfaEnrollmentsTable).where(eq(mfaEnrollmentsTable.user_id, userId)).limit(1);
-    return row ? toEnrollment(row) : undefined;
-  },
-  listEnrollments: async () => {
-    const rows = await db.select().from(mfaEnrollmentsTable);
-    return rows.map(toEnrollment);
-  },
-  removeEnrollment: async (userId) => {
-    await db.delete(mfaEnrollmentsTable).where(eq(mfaEnrollmentsTable.user_id, userId));
-  },
-  saveEnrollment: async (enrollment) => {
-    const values = {
-      backup_code_hashes: enrollment.backupCodeHashes,
-      created_at_ms: enrollment.createdAt,
-      last_used_at_ms: enrollment.lastUsedAt ?? null,
-      sms_code_sent_at_ms: enrollment.smsCodeSentAt ?? null,
-      sms_failed_attempts: enrollment.smsFailedAttempts ?? 0,
-      sms_pending_code_expires_at_ms: enrollment.smsPendingCodeExpiresAt ?? null,
-      sms_pending_code_hash: enrollment.smsPendingCodeHash ?? null,
-      sms_pending_purpose: enrollment.smsPendingPurpose ?? null,
-      sms_phone: enrollment.smsPhone ?? null,
-      sms_provider_reference: enrollment.smsProviderReference ?? null,
-      sms_verified: enrollment.smsVerified,
-      totp_failed_attempts: enrollment.totpFailedAttempts ?? 0,
-      totp_secret_ciphertext: enrollment.totpSecretCiphertext ?? null,
-      totp_verified: enrollment.totpVerified,
-      updated_at_ms: enrollment.updatedAt,
-      user_id: enrollment.userId
-    };
-    await db.insert(mfaEnrollmentsTable).values(values).onConflictDoUpdate({
-      set: values,
-      target: mfaEnrollmentsTable.user_id
-    });
-  }
-});
+var createPostgresMfaStore = (db) => {
+  const toValues = (enrollment) => ({
+    backup_code_hashes: enrollment.backupCodeHashes,
+    created_at_ms: enrollment.createdAt,
+    last_used_at_ms: enrollment.lastUsedAt ?? null,
+    sms_challenge_id: enrollment.smsChallengeId ?? null,
+    sms_code_sent_at_ms: enrollment.smsCodeSentAt ?? null,
+    sms_failed_attempts: enrollment.smsFailedAttempts ?? 0,
+    sms_pending_code_expires_at_ms: enrollment.smsPendingCodeExpiresAt ?? null,
+    sms_pending_code_hash: enrollment.smsPendingCodeHash ?? null,
+    sms_pending_purpose: enrollment.smsPendingPurpose ?? null,
+    sms_phone: enrollment.smsPhone ?? null,
+    sms_provider_reference: enrollment.smsProviderReference ?? null,
+    sms_verified: enrollment.smsVerified,
+    totp_failed_attempts: enrollment.totpFailedAttempts ?? 0,
+    totp_secret_ciphertext: enrollment.totpSecretCiphertext ?? null,
+    totp_verified: enrollment.totpVerified,
+    updated_at_ms: enrollment.updatedAt,
+    user_id: enrollment.userId
+  });
+  return {
+    claimSmsChallenge: async ({
+      challengeId,
+      cooldownCutoff,
+      enrollment
+    }) => {
+      const values = toValues({
+        ...enrollment,
+        smsChallengeId: challengeId
+      });
+      const rows = await db.insert(mfaEnrollmentsTable).values(values).onConflictDoUpdate({
+        set: {
+          sms_challenge_id: challengeId,
+          sms_code_sent_at_ms: enrollment.smsCodeSentAt ?? null,
+          sms_failed_attempts: 0,
+          sms_pending_code_expires_at_ms: enrollment.smsPendingCodeExpiresAt ?? null,
+          sms_pending_code_hash: null,
+          sms_pending_purpose: enrollment.smsPendingPurpose ?? null,
+          sms_phone: enrollment.smsPhone ?? null,
+          sms_provider_reference: null,
+          sms_verified: enrollment.smsVerified,
+          updated_at_ms: enrollment.updatedAt
+        },
+        setWhere: or(isNull(mfaEnrollmentsTable.sms_code_sent_at_ms), lte(mfaEnrollmentsTable.sms_code_sent_at_ms, cooldownCutoff)),
+        target: mfaEnrollmentsTable.user_id
+      }).returning({ userId: mfaEnrollmentsTable.user_id });
+      return rows.length === 1;
+    },
+    completeSmsChallenge: async ({
+      challengeId,
+      lastUsedAt,
+      smsVerified,
+      userId
+    }) => {
+      const rows = await db.update(mfaEnrollmentsTable).set({
+        last_used_at_ms: lastUsedAt,
+        sms_challenge_id: null,
+        sms_failed_attempts: 0,
+        sms_pending_code_expires_at_ms: null,
+        sms_pending_code_hash: null,
+        sms_pending_purpose: null,
+        sms_provider_reference: null,
+        sms_verified: smsVerified,
+        updated_at_ms: Date.now()
+      }).where(and(eq(mfaEnrollmentsTable.user_id, userId), eq(mfaEnrollmentsTable.sms_challenge_id, challengeId))).returning({ userId: mfaEnrollmentsTable.user_id });
+      return rows.length === 1;
+    },
+    finalizeSmsChallenge: async (input) => {
+      const rows = await db.update(mfaEnrollmentsTable).set({
+        sms_pending_code_expires_at_ms: input.expiresAt,
+        sms_pending_code_hash: input.hash ?? null,
+        sms_provider_reference: input.providerReference ?? null,
+        updated_at_ms: Date.now()
+      }).where(and(eq(mfaEnrollmentsTable.user_id, input.userId), eq(mfaEnrollmentsTable.sms_challenge_id, input.challengeId))).returning({ userId: mfaEnrollmentsTable.user_id });
+      return rows.length === 1;
+    },
+    getEnrollment: async (userId) => {
+      const [row] = await db.select().from(mfaEnrollmentsTable).where(eq(mfaEnrollmentsTable.user_id, userId)).limit(1);
+      return row ? toEnrollment(row) : undefined;
+    },
+    listEnrollments: async () => {
+      const rows = await db.select().from(mfaEnrollmentsTable);
+      return rows.map(toEnrollment);
+    },
+    recordSmsFailure: async ({ challengeId, maxAttempts, userId }) => {
+      const rows = await db.update(mfaEnrollmentsTable).set({
+        sms_failed_attempts: sql`${mfaEnrollmentsTable.sms_failed_attempts} + 1`,
+        updated_at_ms: Date.now()
+      }).where(and(eq(mfaEnrollmentsTable.user_id, userId), eq(mfaEnrollmentsTable.sms_challenge_id, challengeId), lte(mfaEnrollmentsTable.sms_failed_attempts, maxAttempts - 1))).returning({
+        attempts: mfaEnrollmentsTable.sms_failed_attempts
+      });
+      return rows[0]?.attempts;
+    },
+    removeEnrollment: async (userId) => {
+      await db.delete(mfaEnrollmentsTable).where(eq(mfaEnrollmentsTable.user_id, userId));
+    },
+    rollbackSmsChallenge: async ({ challengeId, previous, userId }) => {
+      if (previous) {
+        await db.update(mfaEnrollmentsTable).set(toValues(previous)).where(and(eq(mfaEnrollmentsTable.user_id, userId), eq(mfaEnrollmentsTable.sms_challenge_id, challengeId)));
+        return;
+      }
+      await db.delete(mfaEnrollmentsTable).where(and(eq(mfaEnrollmentsTable.user_id, userId), eq(mfaEnrollmentsTable.sms_challenge_id, challengeId)));
+    },
+    saveEnrollment: async (enrollment) => {
+      const values = toValues(enrollment);
+      await db.insert(mfaEnrollmentsTable).values(values).onConflictDoUpdate({
+        set: values,
+        target: mfaEnrollmentsTable.user_id
+      });
+    }
+  };
+};
 // src/audit/types.ts
 var AUDIT_EVENT_TYPES = [
   "account_deleted",
@@ -36430,6 +36654,10 @@ var mfaSmsDeliveryPolicyMigration = {
   ].join(`
 `)
 };
+var mfaSmsAtomicChallengeMigration = {
+  id: "0005_sms_atomic_challenge",
+  sql: 'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_challenge_id" text;'
+};
 var oidcResourceAudienceMigration = {
   id: "0002_resource_audience",
   sql: [
@@ -36485,7 +36713,8 @@ var blockMigrations = {
       ...initMigration("mfa", [mfaEnrollmentsTable]).migrations,
       mfaSmsColumnsMigration,
       mfaTotpLockoutMigration,
-      mfaSmsDeliveryPolicyMigration
+      mfaSmsDeliveryPolicyMigration,
+      mfaSmsAtomicChallengeMigration
     ]
   },
   oidc: {
@@ -37795,6 +38024,7 @@ export {
   DEFAULT_ORGANIZATIONS_ROUTE,
   DEFAULT_OIDC_ROUTE,
   DEFAULT_MFA_SESSION_TTL_MS,
+  DEFAULT_MFA_MANAGEMENT_AUTH_MAX_AGE_MS,
   DEFAULT_MFA_ISSUER,
   DEFAULT_MAGIC_LINK_TTL_MS,
   DEFAULT_INVITATION_TTL_MS,
@@ -37810,5 +38040,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=588FAC011547AB7964756E2164756E21
+//# debugId=FC3F27A521162E4064756E2164756E21
 //# sourceMappingURL=index.js.map