@absolutejs/auth 0.65.1 → 0.65.2

package/dist/mfa/postgresMfaStore.d.ts

@@ -0,0 +1,266 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { MFAStore } from './types';
+export declare const mfaEnrollmentsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_mfa_enrollments";
+    schema: undefined;
+    columns: {
+        backup_code_hashes: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgJsonbBuilder, string[]>>>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "object json";
+            data: string[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        last_used_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgBigInt53Builder, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        sms_challenge_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        sms_code_sent_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgBigInt53Builder, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        sms_failed_attempts: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgSmallIntBuilder>>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "number int16";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        sms_pending_code_expires_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgBigInt53Builder, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        sms_pending_code_hash: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        sms_pending_purpose: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, import("..").VerificationPurpose | undefined>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "string";
+            data: import("..").VerificationPurpose | undefined;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        sms_phone: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        sms_provider_reference: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        sms_verified: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBooleanBuilder>>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        totp_failed_attempts: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgSmallIntBuilder>>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "number int16";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        totp_secret_ciphertext: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        totp_verified: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBooleanBuilder>>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updated_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        user_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_mfa_enrollments", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_mfa_enrollments";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonMfaStore: (databaseUrl: string) => MFAStore;
+export declare const createPostgresMfaStore: <DB extends AnyPgDatabase>(db: DB) => MFAStore;

package/dist/mfa/recentAuth.d.ts

@@ -0,0 +1,2 @@
+import type { SessionData } from '../types';
+export declare const hasRecentAuthentication: <UserType>(session: SessionData<UserType>, maxAgeMs: number, now?: number) => boolean;

package/dist/mfa/rotation.d.ts

@@ -0,0 +1,17 @@
+import type { MFAStore } from './types';
+export type MfaKeyRotationResult = {
+    alreadyRotated: number;
+    rotated: number;
+    skippedNoSecret: number;
+    total: number;
+};
+export declare const rotateMfaEncryptionKey: ({ mfaStore, newKey, oldKey }: {
+    mfaStore: MFAStore;
+    newKey: string;
+    oldKey: string;
+}) => Promise<{
+    alreadyRotated: number;
+    rotated: number;
+    skippedNoSecret: number;
+    total: number;
+}>;

package/dist/mfa/routes.d.ts

@@ -0,0 +1,239 @@
+import { Elysia } from 'elysia';
+import type { MfaRouteProps } from './config';
+export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "Authentication required";
+                200: {
+                    backupCodesRemaining: number;
+                    enabled: boolean;
+                    smsBackup: {
+                        enabled: boolean;
+                        phone: string | null;
+                    };
+                    totp: {
+                        enabled: boolean;
+                    };
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        delete: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "Recent authentication required" | "Authentication required";
+                200: {
+                    readonly status: "disabled";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "Recent authentication required" | "Authentication required";
+                200: {
+                    readonly secret: string;
+                    readonly uri: string;
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                code: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: "No TOTP enrollment in progress" | "Invalid TOTP code";
+                401: "Recent authentication required" | "Authentication required";
+                200: {
+                    readonly backupCodes: string[];
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                phone: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: string;
+                401: "Recent authentication required" | "Authentication required";
+                501: "SMS MFA is not configured";
+                200: {
+                    readonly phone: string;
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+                429: string;
+                503: string;
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                code: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: string;
+                401: "Recent authentication required" | "Authentication required";
+                200: {
+                    readonly status: "enrolled";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+                429: string;
+                503: string;
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                code?: string | undefined;
+                action?: "verify" | "send" | undefined;
+                factor?: "sms" | undefined;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: string;
+                401: "SMS code expired" | "Too many attempts" | "SMS challenge is no longer active" | "No MFA challenge in progress" | "Invalid MFA code";
+                200: {
+                    readonly status: "sent";
+                } | {
+                    readonly status: "authenticated";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+                429: string;
+                503: string;
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/mfa/secret.d.ts

@@ -0,0 +1,2 @@
+export declare const decryptTotpSecret: (ciphertext: string, encryptionKey?: string) => Promise<string>;
+export declare const encryptTotpSecret: (secret: string, encryptionKey?: string) => Promise<string>;

package/dist/mfa/sms.d.ts

@@ -0,0 +1,143 @@
+import { Elysia } from 'elysia';
+import { type VerificationCheckInput, type VerificationProvider } from '../verification/types';
+import { type MfaRouteProps, type SmsCodeMessage } from './config';
+import type { MfaEnrollment, MFAStore } from './types';
+export declare class SmsChallengeConflictError extends Error {
+    name: string;
+}
+export declare const checkWithVerificationProvider: (provider: VerificationProvider, input: VerificationCheckInput) => Promise<{
+    result: import("..").VerificationCheckResult;
+    readonly error?: undefined;
+} | {
+    error: {
+        message: string;
+        status: "Too Many Requests";
+    } | {
+        message: string;
+        status: "Bad Request";
+    } | {
+        message: string;
+        status: "Service Unavailable";
+    };
+    result?: undefined;
+}>;
+export declare const isE164Phone: (phone: string) => boolean;
+export declare const issueAndStoreSmsCode: ({ codeLength, enrollment, mfaStore, onSendSmsCode, previousEnrollment, purpose, resendCooldownMs, verificationProvider, ttlMs, userId }: {
+    codeLength: number;
+    enrollment: MfaEnrollment;
+    mfaStore: MFAStore;
+    onSendSmsCode?: (message: SmsCodeMessage) => void | Promise<void>;
+    previousEnrollment?: MfaEnrollment;
+    verificationProvider?: MfaRouteProps<unknown>["verificationProvider"];
+    userId: string;
+    purpose: "mfa_challenge" | "mfa_enrollment";
+    resendCooldownMs: number;
+    ttlMs: number;
+}) => Promise<number | undefined>;
+export declare const mapVerificationProviderError: (error: unknown) => {
+    message: string;
+    status: "Too Many Requests";
+} | {
+    message: string;
+    status: "Bad Request";
+} | {
+    message: string;
+    status: "Service Unavailable";
+} | undefined;
+export declare const maskPhone: (phone: string) => string;
+export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfaStore, managementAuthMaxAgeMs, onMfaEnrolled, onSendSmsCode, verificationProvider, smsCodeLength, smsCodeTtlMs, smsMaxAttempts, smsResendCooldownMs, smsSetupRoute, smsVerifyRoute }: MfaRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        post: {
+            body: {
+                phone: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: string;
+                401: "Recent authentication required" | "Authentication required";
+                501: "SMS MFA is not configured";
+                200: {
+                    readonly phone: string;
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+                429: string;
+                503: string;
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                code: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: string;
+                401: "Recent authentication required" | "Authentication required";
+                200: {
+                    readonly status: "enrolled";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+                429: string;
+                503: string;
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;