@absolutejs/auth 0.58.0 → 0.59.1

package/dist/mfa/challenge.d.ts

@@ -31,7 +31,7 @@ export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute
             headers: unknown;
             response: {
                 400: string;
-                401: "SMS code expired" | "Too many attempts" | "No MFA challenge in progress" | "Invalid MFA code";
+                401: "SMS code expired" | "Too many attempts" | "SMS challenge is no longer active" | "No MFA challenge in progress" | "Invalid MFA code";
                 200: {
                     readonly status: "sent";
                 } | {

package/dist/mfa/config.d.ts

@@ -3,6 +3,7 @@ import type { RouteString, UserSessionId } from '../types';
 import type { MFAStore } from './types';
 export declare const DEFAULT_BACKUP_CODE_COUNT = 10;
 export declare const DEFAULT_MFA_ISSUER = "AbsoluteAuth";
+export declare const DEFAULT_MFA_MANAGEMENT_AUTH_MAX_AGE_MS: number;
 export declare const DEFAULT_MFA_SESSION_TTL_MS: number;
 export declare const DEFAULT_SMS_CODE_LENGTH = 6;
 export declare const DEFAULT_SMS_CODE_TTL_MS: number;
@@ -25,6 +26,8 @@ export type MfaConfig<UserType> = {
     encryptionKey?: string;
     issuer?: string;
     managementRoute?: RouteString;
+    /** Maximum age of the authentication ceremony used to enroll, replace, or remove MFA. */
+    managementAuthMaxAgeMs?: number;
     onMfaChallengeError?: (context: {
         error: unknown;
         userId?: string;

package/dist/mfa/management.d.ts

@@ -1,5 +1,5 @@
 import { Elysia } from 'elysia';
-import type { MfaRouteProps } from './config';
+import { type MfaRouteProps } from './config';
 export type MfaStatus = {
     backupCodesRemaining: number;
     enabled: boolean;
@@ -11,7 +11,7 @@ export type MfaStatus = {
         enabled: boolean;
     };
 };
-export declare const mfaManagementRoutes: <UserType>({ authSessionStore, getUserId, managementRoute, mfaStore }: MfaRouteProps<UserType>) => Elysia<"", {
+export declare const mfaManagementRoutes: <UserType>({ authSessionStore, getUserId, managementRoute, managementAuthMaxAgeMs, mfaStore }: MfaRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;
@@ -69,7 +69,7 @@ export declare const mfaManagementRoutes: <UserType>({ authSessionStore, getUser
             query: unknown;
             headers: unknown;
             response: {
-                401: "Authentication required";
+                401: "Recent authentication required" | "Authentication required";
                 200: {
                     readonly status: "disabled";
                 };

package/dist/mfa/postgresMfaStore.d.ts

@@ -49,6 +49,21 @@ export declare const mfaEnrollmentsTable: import("drizzle-orm/pg-core").PgTableW
             identity: undefined;
             generated: undefined;
         }>;
+        sms_challenge_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         sms_code_sent_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgBigInt53Builder, {
             name: string;
             tableName: "auth_mfa_enrollments";

package/dist/mfa/recentAuth.d.ts

@@ -0,0 +1,2 @@
+import type { SessionData } from '../types';
+export declare const hasRecentAuthentication: <UserType>(session: SessionData<UserType>, maxAgeMs: number, now?: number) => boolean;

package/dist/mfa/routes.d.ts

@@ -58,7 +58,7 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             query: unknown;
             headers: unknown;
             response: {
-                401: "Authentication required";
+                401: "Recent authentication required" | "Authentication required";
                 200: {
                     readonly status: "disabled";
                 };
@@ -82,7 +82,7 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             query: unknown;
             headers: unknown;
             response: {
-                401: "Authentication required";
+                401: "Recent authentication required" | "Authentication required";
                 200: {
                     readonly secret: string;
                     readonly uri: string;
@@ -110,7 +110,7 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             headers: unknown;
             response: {
                 400: "No TOTP enrollment in progress" | "Invalid TOTP code";
-                401: "Authentication required";
+                401: "Recent authentication required" | "Authentication required";
                 200: {
                     readonly backupCodes: string[];
                 };
@@ -137,7 +137,7 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             headers: unknown;
             response: {
                 400: string;
-                401: "Authentication required";
+                401: "Recent authentication required" | "Authentication required";
                 501: "SMS MFA is not configured";
                 200: {
                     readonly phone: string;
@@ -167,7 +167,7 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             headers: unknown;
             response: {
                 400: string;
-                401: "Authentication required";
+                401: "Recent authentication required" | "Authentication required";
                 200: {
                     readonly status: "enrolled";
                 };
@@ -198,7 +198,7 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             headers: unknown;
             response: {
                 400: string;
-                401: "SMS code expired" | "Too many attempts" | "No MFA challenge in progress" | "Invalid MFA code";
+                401: "SMS code expired" | "Too many attempts" | "SMS challenge is no longer active" | "No MFA challenge in progress" | "Invalid MFA code";
                 200: {
                     readonly status: "sent";
                 } | {

package/dist/mfa/sms.d.ts

@@ -2,6 +2,9 @@ import { Elysia } from 'elysia';
 import { type VerificationCheckInput, type VerificationProvider } from '../verification/types';
 import { type MfaRouteProps, type SmsCodeMessage } from './config';
 import type { MfaEnrollment, MFAStore } from './types';
+export declare class SmsChallengeConflictError extends Error {
+    name: string;
+}
 export declare const checkWithVerificationProvider: (provider: VerificationProvider, input: VerificationCheckInput) => Promise<{
     result: import("..").VerificationCheckResult;
     readonly error?: undefined;
@@ -19,14 +22,16 @@ export declare const checkWithVerificationProvider: (provider: VerificationProvi
     result?: undefined;
 }>;
 export declare const isE164Phone: (phone: string) => boolean;
-export declare const issueAndStoreSmsCode: ({ codeLength, enrollment, mfaStore, onSendSmsCode, purpose, verificationProvider, ttlMs, userId }: {
+export declare const issueAndStoreSmsCode: ({ codeLength, enrollment, mfaStore, onSendSmsCode, previousEnrollment, purpose, resendCooldownMs, verificationProvider, ttlMs, userId }: {
     codeLength: number;
     enrollment: MfaEnrollment;
     mfaStore: MFAStore;
     onSendSmsCode?: (message: SmsCodeMessage) => void | Promise<void>;
+    previousEnrollment?: MfaEnrollment;
     verificationProvider?: MfaRouteProps<unknown>["verificationProvider"];
     userId: string;
     purpose: "mfa_challenge" | "mfa_enrollment";
+    resendCooldownMs: number;
     ttlMs: number;
 }) => Promise<number | undefined>;
 export declare const mapVerificationProviderError: (error: unknown) => {
@@ -40,7 +45,7 @@ export declare const mapVerificationProviderError: (error: unknown) => {
     status: "Service Unavailable";
 } | undefined;
 export declare const maskPhone: (phone: string) => string;
-export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfaStore, onMfaEnrolled, onSendSmsCode, verificationProvider, smsCodeLength, smsCodeTtlMs, smsMaxAttempts, smsResendCooldownMs, smsSetupRoute, smsVerifyRoute }: MfaRouteProps<UserType>) => Elysia<"", {
+export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfaStore, managementAuthMaxAgeMs, onMfaEnrolled, onSendSmsCode, verificationProvider, smsCodeLength, smsCodeTtlMs, smsMaxAttempts, smsResendCooldownMs, smsSetupRoute, smsVerifyRoute }: MfaRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;
@@ -69,7 +74,7 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
             headers: unknown;
             response: {
                 400: string;
-                401: "Authentication required";
+                401: "Recent authentication required" | "Authentication required";
                 501: "SMS MFA is not configured";
                 200: {
                     readonly phone: string;
@@ -99,7 +104,7 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
             headers: unknown;
             response: {
                 400: string;
-                401: "Authentication required";
+                401: "Recent authentication required" | "Authentication required";
                 200: {
                     readonly status: "enrolled";
                 };

package/dist/mfa/totp.d.ts

@@ -1,6 +1,6 @@
 import { Elysia } from 'elysia';
 import { type MfaRouteProps } from './config';
-export declare const mfaTotpRoutes: <UserType>({ authSessionStore, backupCodeCount, encryptionKey, getUserId, issuer, mfaStore, onMfaEnrolled, totpSetupRoute, totpVerifyRoute }: MfaRouteProps<UserType>) => Elysia<"", {
+export declare const mfaTotpRoutes: <UserType>({ authSessionStore, backupCodeCount, encryptionKey, getUserId, issuer, managementAuthMaxAgeMs, mfaStore, onMfaEnrolled, totpSetupRoute, totpVerifyRoute }: MfaRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;
@@ -26,7 +26,7 @@ export declare const mfaTotpRoutes: <UserType>({ authSessionStore, backupCodeCou
             query: unknown;
             headers: unknown;
             response: {
-                401: "Authentication required";
+                401: "Recent authentication required" | "Authentication required";
                 200: {
                     readonly secret: string;
                     readonly uri: string;
@@ -54,7 +54,7 @@ export declare const mfaTotpRoutes: <UserType>({ authSessionStore, backupCodeCou
             headers: unknown;
             response: {
                 400: "No TOTP enrollment in progress" | "Invalid TOTP code";
-                401: "Authentication required";
+                401: "Recent authentication required" | "Authentication required";
                 200: {
                     readonly backupCodes: string[];
                 };

package/dist/mfa/types.d.ts

@@ -10,6 +10,8 @@ export type MfaEnrollment = {
     smsPendingPurpose?: VerificationPurpose;
     smsProviderReference?: string;
     smsCodeSentAt?: number;
+    /** Opaque generation binding every update to the currently active challenge. */
+    smsChallengeId?: string;
     smsPhone?: string;
     smsVerified: boolean;
     totpFailedAttempts?: number;
@@ -19,9 +21,38 @@ export type MfaEnrollment = {
     userId: string;
 };
 export type MFAStore = {
+    /** Atomically reserves the SMS slot only when the resend cooldown has elapsed. */
+    claimSmsChallenge: (input: {
+        challengeId: string;
+        cooldownCutoff: number;
+        enrollment: MfaEnrollment;
+    }) => Promise<boolean>;
+    completeSmsChallenge: (input: {
+        challengeId: string;
+        lastUsedAt?: number;
+        smsVerified: boolean;
+        userId: string;
+    }) => Promise<boolean>;
+    finalizeSmsChallenge: (input: {
+        challengeId: string;
+        expiresAt: number;
+        hash?: string;
+        providerReference?: string;
+        userId: string;
+    }) => Promise<boolean>;
     getEnrollment: (userId: string) => Promise<MfaEnrollment | undefined>;
     listEnrollments: () => Promise<MfaEnrollment[]>;
     removeEnrollment: (userId: string) => Promise<void>;
+    recordSmsFailure: (input: {
+        challengeId: string;
+        maxAttempts: number;
+        userId: string;
+    }) => Promise<number | undefined>;
+    rollbackSmsChallenge: (input: {
+        challengeId: string;
+        previous?: MfaEnrollment;
+        userId: string;
+    }) => Promise<void>;
     saveEnrollment: (enrollment: MfaEnrollment) => Promise<void>;
 };
 export declare const isMfaEnrolled: (enrollment: MfaEnrollment | undefined) => boolean;