@acorex-platform/module-security-management-server 0.0.18 → 2.0.0-next.42

package/server/src/lib/two-factor/start-two-factor-enrollment.command.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StartTwoFactorEnrollmentCommand = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+const user_two_factor_service_1 = require("./user-two-factor.service");
+//#region ----- Start two-factor enrollment command -----
+let StartTwoFactorEnrollmentCommand = class StartTwoFactorEnrollmentCommand {
+    constructor(twoFactor) {
+        this.twoFactor = twoFactor;
+    }
+    execute() {
+        return tslib_1.__awaiter(this, arguments, void 0, function* (input = { password: '' }) {
+            const result = yield this.twoFactor.startEnrollment(input);
+            if (!result.success) {
+                return { success: false, message: { code: result.code } };
+            }
+            return { success: true, kind: 'object', data: result.data };
+        });
+    }
+};
+exports.StartTwoFactorEnrollmentCommand = StartTwoFactorEnrollmentCommand;
+exports.StartTwoFactorEnrollmentCommand = StartTwoFactorEnrollmentCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: module_security_management_contracts_1.AXMSecurityManagementServerCommands.StartTwoFactorEnrollment, auth: 'session' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [user_two_factor_service_1.UserTwoFactorService])
+], StartTwoFactorEnrollmentCommand);
+//#endregion
+//# sourceMappingURL=start-two-factor-enrollment.command.js.map

package/server/src/lib/two-factor/start-two-factor-enrollment.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-two-factor-enrollment.command.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/two-factor/start-two-factor-enrollment.command.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAE5C,gFAAkF;AAClF,gHAI+D;AAE/D,uEAAiE;AAEjE,yDAAyD;AAIlD,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAG1C,YAA6B,SAA+B;QAA/B,cAAS,GAAT,SAAS,CAAsB;IAAG,CAAC;IAE1D,OAAO;qEACX,QAA0C,EAAE,QAAQ,EAAE,EAAE,EAAE;YAE1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5D,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9D,CAAC;KAAA;CACF,CAAA;AAdY,0EAA+B;0CAA/B,+BAA+B;IAF3C,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,0EAAmC,CAAC,wBAAwB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACrG,IAAA,mBAAU,GAAE;6CAI6B,8CAAoB;GAHjD,+BAA+B,CAc3C;AAED,YAAY"}

package/server/src/lib/two-factor/totp.util.d.ts

@@ -0,0 +1,32 @@
+export declare const TOTP_DIGITS = 6;
+export declare const TOTP_PERIOD_SECONDS = 30;
+export declare const TOTP_WINDOW = 1;
+export declare const TOTP_SECRET_BYTES = 20;
+export declare function base32Encode(bytes: Buffer): string;
+export declare function base32Decode(input: string): Buffer;
+/** RFC 4226 HOTP (HMAC-SHA1). */
+export declare function hotp(secret: Buffer, counter: number, digits?: number): string;
+export declare function totpTimeStep(unixSeconds: number, period?: number): number;
+export declare function generateTotp(secret: Buffer, unixSeconds?: number, digits?: number, period?: number): string;
+export interface TotpVerifyResult {
+    valid: boolean;
+    /** Matched time-step when valid. */
+    step?: number;
+}
+/**
+ * Verifies TOTP with ±window steps. Caller must reject when `step` was already consumed.
+ */
+export declare function verifyTotp(secret: Buffer, code: string, options?: {
+    unixSeconds?: number;
+    window?: number;
+    digits?: number;
+    period?: number;
+}): TotpVerifyResult;
+export declare function generateTotpSecretBytes(byteLength?: number): Buffer;
+export declare function buildOtpAuthUri(params: {
+    secretBase32: string;
+    accountName: string;
+    issuer: string;
+    digits?: number;
+    period?: number;
+}): string;

package/server/src/lib/two-factor/totp.util.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOTP_SECRET_BYTES = exports.TOTP_WINDOW = exports.TOTP_PERIOD_SECONDS = exports.TOTP_DIGITS = void 0;
+exports.base32Encode = base32Encode;
+exports.base32Decode = base32Decode;
+exports.hotp = hotp;
+exports.totpTimeStep = totpTimeStep;
+exports.generateTotp = generateTotp;
+exports.verifyTotp = verifyTotp;
+exports.generateTotpSecretBytes = generateTotpSecretBytes;
+exports.buildOtpAuthUri = buildOtpAuthUri;
+const crypto_1 = require("crypto");
+//#region ----- Constants -----
+const BASE32_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+exports.TOTP_DIGITS = 6;
+exports.TOTP_PERIOD_SECONDS = 30;
+exports.TOTP_WINDOW = 1;
+exports.TOTP_SECRET_BYTES = 20;
+//#endregion
+//#region ----- Base32 -----
+function base32Encode(bytes) {
+    let bits = 0;
+    let value = 0;
+    let output = '';
+    for (const byte of bytes) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            output += BASE32_ALPHABET[(value >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0) {
+        output += BASE32_ALPHABET[(value << (5 - bits)) & 31];
+    }
+    return output;
+}
+function base32Decode(input) {
+    const cleaned = input.replace(/=+$/g, '').replace(/\s+/g, '').toUpperCase();
+    let bits = 0;
+    let value = 0;
+    const bytes = [];
+    for (const char of cleaned) {
+        const idx = BASE32_ALPHABET.indexOf(char);
+        if (idx < 0) {
+            throw new Error('Invalid Base32 character');
+        }
+        value = (value << 5) | idx;
+        bits += 5;
+        if (bits >= 8) {
+            bytes.push((value >>> (bits - 8)) & 0xff);
+            bits -= 8;
+        }
+    }
+    return Buffer.from(bytes);
+}
+//#endregion
+//#region ----- HOTP / TOTP -----
+function counterToBuffer(counter) {
+    const buf = Buffer.alloc(8);
+    let c = counter;
+    for (let i = 7; i >= 0; i -= 1) {
+        buf[i] = c & 0xff;
+        c = Math.floor(c / 256);
+    }
+    return buf;
+}
+/** RFC 4226 HOTP (HMAC-SHA1). */
+function hotp(secret, counter, digits = exports.TOTP_DIGITS) {
+    const hmac = (0, crypto_1.createHmac)('sha1', secret).update(counterToBuffer(counter)).digest();
+    const offset = hmac[hmac.length - 1] & 0x0f;
+    const binary = ((hmac[offset] & 0x7f) << 24) |
+        ((hmac[offset + 1] & 0xff) << 16) |
+        ((hmac[offset + 2] & 0xff) << 8) |
+        (hmac[offset + 3] & 0xff);
+    const otp = binary % Math.pow(10, digits);
+    return String(otp).padStart(digits, '0');
+}
+function totpTimeStep(unixSeconds, period = exports.TOTP_PERIOD_SECONDS) {
+    return Math.floor(unixSeconds / period);
+}
+function generateTotp(secret, unixSeconds = Math.floor(Date.now() / 1000), digits = exports.TOTP_DIGITS, period = exports.TOTP_PERIOD_SECONDS) {
+    return hotp(secret, totpTimeStep(unixSeconds, period), digits);
+}
+/**
+ * Verifies TOTP with ±window steps. Caller must reject when `step` was already consumed.
+ */
+function verifyTotp(secret, code, options) {
+    var _a, _b, _c, _d;
+    const normalized = String(code !== null && code !== void 0 ? code : '').replace(/\s+/g, '');
+    const digits = (_a = options === null || options === void 0 ? void 0 : options.digits) !== null && _a !== void 0 ? _a : exports.TOTP_DIGITS;
+    const period = (_b = options === null || options === void 0 ? void 0 : options.period) !== null && _b !== void 0 ? _b : exports.TOTP_PERIOD_SECONDS;
+    const window = (_c = options === null || options === void 0 ? void 0 : options.window) !== null && _c !== void 0 ? _c : exports.TOTP_WINDOW;
+    const unixSeconds = (_d = options === null || options === void 0 ? void 0 : options.unixSeconds) !== null && _d !== void 0 ? _d : Math.floor(Date.now() / 1000);
+    if (!/^\d+$/.test(normalized) || normalized.length !== digits) {
+        return { valid: false };
+    }
+    const expectedBuf = Buffer.from(normalized);
+    const center = totpTimeStep(unixSeconds, period);
+    for (let delta = -window; delta <= window; delta += 1) {
+        const step = center + delta;
+        if (step < 0) {
+            continue;
+        }
+        const candidate = Buffer.from(hotp(secret, step, digits));
+        if (candidate.length === expectedBuf.length && (0, crypto_1.timingSafeEqual)(candidate, expectedBuf)) {
+            return { valid: true, step };
+        }
+    }
+    return { valid: false };
+}
+function generateTotpSecretBytes(byteLength = exports.TOTP_SECRET_BYTES) {
+    return (0, crypto_1.randomBytes)(byteLength);
+}
+function buildOtpAuthUri(params) {
+    var _a, _b;
+    const label = encodeURIComponent(`${params.issuer}:${params.accountName}`);
+    const query = new URLSearchParams({
+        secret: params.secretBase32,
+        issuer: params.issuer,
+        algorithm: 'SHA1',
+        digits: String((_a = params.digits) !== null && _a !== void 0 ? _a : exports.TOTP_DIGITS),
+        period: String((_b = params.period) !== null && _b !== void 0 ? _b : exports.TOTP_PERIOD_SECONDS),
+    });
+    return `otpauth://totp/${label}?${query.toString()}`;
+}
+//#endregion
+//# sourceMappingURL=totp.util.js.map

package/server/src/lib/two-factor/totp.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.util.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/two-factor/totp.util.ts"],"names":[],"mappings":";;;AAcA,oCAgBC;AAED,oCAkBC;AAiBD,oBAUC;AAED,oCAEC;AAED,oCAOC;AAWD,gCAkCC;AAED,0DAEC;AAED,0CAgBC;AA7JD,mCAAkE;AAElE,+BAA+B;AAE/B,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAC9C,QAAA,WAAW,GAAG,CAAC,CAAC;AAChB,QAAA,mBAAmB,GAAG,EAAE,CAAC;AACzB,QAAA,WAAW,GAAG,CAAC,CAAC;AAChB,QAAA,iBAAiB,GAAG,EAAE,CAAC;AAEpC,YAAY;AAEZ,4BAA4B;AAE5B,SAAgB,YAAY,CAAC,KAAa;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACvD,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,YAAY,CAAC,KAAa;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5E,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;QAC3B,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1C,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,YAAY;AAEZ,iCAAiC;AAEjC,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG,OAAO,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QAClB,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iCAAiC;AACjC,SAAgB,IAAI,CAAC,MAAc,EAAE,OAAe,EAAE,MAAM,GAAG,mBAAW;IACxE,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5C,MAAM,MAAM,GACV,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,GAAG,SAAA,EAAE,EAAI,MAAM,CAAA,CAAC;IAClC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,SAAgB,YAAY,CAAC,WAAmB,EAAE,MAAM,GAAG,2BAAmB;IAC5E,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,SAAgB,YAAY,CAC1B,MAAc,EACd,cAAsB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EACnD,MAAM,GAAG,mBAAW,EACpB,MAAM,GAAG,2BAAmB;IAE5B,OAAO,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC;AAQD;;GAEG;AACH,SAAgB,UAAU,CACxB,MAAc,EACd,IAAY,EACZ,OAKC;;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,mBAAW,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,2BAAmB,CAAC;IACtD,MAAM,MAAM,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,mBAAW,CAAC;IAC9C,MAAM,WAAW,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW,mCAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAEjD,KAAK,IAAI,KAAK,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,GAAG,KAAK,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1D,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,IAAI,IAAA,wBAAe,EAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;YACvF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,SAAgB,uBAAuB,CAAC,UAAU,GAAG,yBAAiB;IACpE,OAAO,IAAA,oBAAW,EAAC,UAAU,CAAC,CAAC;AACjC,CAAC;AAED,SAAgB,eAAe,CAAC,MAM/B;;IACC,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QAChC,MAAM,EAAE,MAAM,CAAC,YAAY;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,MAAM,CAAC,MAAA,MAAM,CAAC,MAAM,mCAAI,mBAAW,CAAC;QAC5C,MAAM,EAAE,MAAM,CAAC,MAAA,MAAM,CAAC,MAAM,mCAAI,2BAAmB,CAAC;KACrD,CAAC,CAAC;IACH,OAAO,kBAAkB,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,YAAY"}

package/server/src/lib/two-factor/two-factor-encryption.util.d.ts

@@ -0,0 +1,25 @@
+export interface AXMTwoFactorEncryptedSecret {
+    encryptedSecret: string;
+    iv: string;
+    authTag: string;
+    keyVersion: number;
+}
+/**
+ * Loads 2FA-only versioned keys from env.
+ * `AUTH_2FA_ENCRYPTION_KEYS` JSON object: `{ "1": "<key>", "2": "<key>" }`
+ * or colon map `1=<key>;2=<key>`.
+ */
+export declare function loadTwoFactorEncryptionKeyring(): {
+    keys: Map<number, Buffer>;
+    currentVersion: number;
+};
+export declare function encryptTwoFactorSecret(plaintextSecret: Buffer, keyring?: {
+    keys: Map<number, Buffer>;
+    currentVersion: number;
+}): AXMTwoFactorEncryptedSecret;
+export declare function decryptTwoFactorSecret(envelope: Pick<AXMTwoFactorEncryptedSecret, 'encryptedSecret' | 'iv' | 'authTag' | 'keyVersion'>, keyring?: {
+    keys: Map<number, Buffer>;
+    currentVersion: number;
+}): Buffer;
+/** Constant-time compare for equal-length buffers. */
+export declare function timingSafeEqualBuffers(a: Buffer, b: Buffer): boolean;

package/server/src/lib/two-factor/two-factor-encryption.util.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadTwoFactorEncryptionKeyring = loadTwoFactorEncryptionKeyring;
+exports.encryptTwoFactorSecret = encryptTwoFactorSecret;
+exports.decryptTwoFactorSecret = decryptTwoFactorSecret;
+exports.timingSafeEqualBuffers = timingSafeEqualBuffers;
+const crypto_1 = require("crypto");
+//#endregion
+//#region ----- Constants -----
+const ALGORITHM = 'aes-256-gcm';
+const IV_BYTES = 12;
+const KEYS_ENV = 'AUTH_2FA_ENCRYPTION_KEYS';
+const CURRENT_VERSION_ENV = 'AUTH_2FA_ENCRYPTION_KEY_CURRENT_VERSION';
+//#endregion
+//#region ----- Keyring -----
+function parseKeyMaterial(raw) {
+    const trimmed = raw.trim();
+    if (/^[0-9a-fA-F]{64}$/.test(trimmed)) {
+        return Buffer.from(trimmed, 'hex');
+    }
+    try {
+        const fromBase64 = Buffer.from(trimmed, 'base64');
+        if (fromBase64.length === 32) {
+            return fromBase64;
+        }
+    }
+    catch (_a) {
+        // fall through
+    }
+    return (0, crypto_1.createHash)('sha256').update(trimmed, 'utf8').digest();
+}
+/**
+ * Loads 2FA-only versioned keys from env.
+ * `AUTH_2FA_ENCRYPTION_KEYS` JSON object: `{ "1": "<key>", "2": "<key>" }`
+ * or colon map `1=<key>;2=<key>`.
+ */
+function loadTwoFactorEncryptionKeyring() {
+    var _a, _b;
+    const isProduction = process.env['NODE_ENV'] === 'production';
+    const rawKeys = (_a = process.env[KEYS_ENV]) === null || _a === void 0 ? void 0 : _a.trim();
+    const rawVersion = (_b = process.env[CURRENT_VERSION_ENV]) === null || _b === void 0 ? void 0 : _b.trim();
+    const keys = new Map();
+    if (rawKeys) {
+        if (rawKeys.startsWith('{')) {
+            const parsed = JSON.parse(rawKeys);
+            for (const [version, material] of Object.entries(parsed)) {
+                const v = Number(version);
+                if (!Number.isInteger(v) || v < 1 || typeof material !== 'string' || !material.trim()) {
+                    throw new Error(`${KEYS_ENV} entry "${version}" is invalid`);
+                }
+                keys.set(v, parseKeyMaterial(material));
+            }
+        }
+        else {
+            for (const part of rawKeys.split(/[;,]/).map((p) => p.trim()).filter(Boolean)) {
+                const eq = part.indexOf('=');
+                if (eq <= 0) {
+                    throw new Error(`${KEYS_ENV} must be JSON or version=key pairs`);
+                }
+                const v = Number(part.slice(0, eq).trim());
+                const material = part.slice(eq + 1).trim();
+                if (!Number.isInteger(v) || v < 1 || !material) {
+                    throw new Error(`${KEYS_ENV} entry "${part}" is invalid`);
+                }
+                keys.set(v, parseKeyMaterial(material));
+            }
+        }
+    }
+    let currentVersion = rawVersion ? Number(rawVersion) : 1;
+    if (!Number.isInteger(currentVersion) || currentVersion < 1) {
+        throw new Error(`${CURRENT_VERSION_ENV} must be a positive integer`);
+    }
+    if (keys.size === 0) {
+        if (isProduction) {
+            throw new Error(`${KEYS_ENV} is required in production`);
+        }
+        keys.set(1, (0, crypto_1.createHash)('sha256').update('acorex-auth-2fa-dev-only', 'utf8').digest());
+        currentVersion = 1;
+    }
+    if (!keys.has(currentVersion)) {
+        throw new Error(`${CURRENT_VERSION_ENV}=${currentVersion} is missing from ${KEYS_ENV}`);
+    }
+    return { keys, currentVersion };
+}
+//#endregion
+//#region ----- Encrypt / decrypt -----
+function encryptTwoFactorSecret(plaintextSecret, keyring = loadTwoFactorEncryptionKeyring()) {
+    const key = keyring.keys.get(keyring.currentVersion);
+    if (!key) {
+        throw new Error('2FA encryption current key is unavailable');
+    }
+    const iv = (0, crypto_1.randomBytes)(IV_BYTES);
+    const cipher = (0, crypto_1.createCipheriv)(ALGORITHM, key, iv);
+    const encrypted = Buffer.concat([cipher.update(plaintextSecret), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    return {
+        encryptedSecret: encrypted.toString('base64'),
+        iv: iv.toString('base64'),
+        authTag: authTag.toString('base64'),
+        keyVersion: keyring.currentVersion,
+    };
+}
+function decryptTwoFactorSecret(envelope, keyring = loadTwoFactorEncryptionKeyring()) {
+    const key = keyring.keys.get(envelope.keyVersion);
+    if (!key) {
+        throw new Error(`2FA encryption key version ${envelope.keyVersion} is unavailable`);
+    }
+    const iv = Buffer.from(envelope.iv, 'base64');
+    const authTag = Buffer.from(envelope.authTag, 'base64');
+    const encrypted = Buffer.from(envelope.encryptedSecret, 'base64');
+    const decipher = (0, crypto_1.createDecipheriv)(ALGORITHM, key, iv);
+    decipher.setAuthTag(authTag);
+    return Buffer.concat([decipher.update(encrypted), decipher.final()]);
+}
+/** Constant-time compare for equal-length buffers. */
+function timingSafeEqualBuffers(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    return (0, crypto_1.timingSafeEqual)(a, b);
+}
+//#endregion
+//# sourceMappingURL=two-factor-encryption.util.js.map

package/server/src/lib/two-factor/two-factor-encryption.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-encryption.util.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/two-factor/two-factor-encryption.util.ts"],"names":[],"mappings":";;AA6CA,wEAsDC;AAMD,wDAkBC;AAED,wDAcC;AAGD,wDAKC;AAnJD,mCAAoG;AAWpG,YAAY;AAEZ,+BAA+B;AAE/B,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AAC5C,MAAM,mBAAmB,GAAG,yCAAyC,CAAC;AAEtE,YAAY;AAEZ,6BAA6B;AAE7B,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC7B,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,WAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,SAAgB,8BAA8B;;IAI5C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,CAAC;IAC9D,MAAM,OAAO,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,0CAAE,IAAI,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,0CAAE,IAAI,EAAE,CAAC;IAE5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEvC,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA2B,CAAC;YAC7D,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;oBACtF,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,WAAW,OAAO,cAAc,CAAC,CAAC;gBAC/D,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9E,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;oBACZ,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,oCAAoC,CAAC,CAAC;gBACnE,CAAC;gBACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAC/C,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,WAAW,IAAI,cAAc,CAAC,CAAC;gBAC5D,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,GAAG,mBAAmB,6BAA6B,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpB,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,4BAA4B,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,cAAc,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,mBAAmB,IAAI,cAAc,oBAAoB,QAAQ,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AAClC,CAAC;AAED,YAAY;AAEZ,uCAAuC;AAEvC,SAAgB,sBAAsB,CACpC,eAAuB,EACvB,OAAO,GAAG,8BAA8B,EAAE;IAE1C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO;QACL,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7C,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACnC,UAAU,EAAE,OAAO,CAAC,cAAc;KACnC,CAAC;AACJ,CAAC;AAED,SAAgB,sBAAsB,CACpC,QAAgG,EAChG,OAAO,GAAG,8BAA8B,EAAE;IAE1C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,UAAU,iBAAiB,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAA,yBAAgB,EAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,sDAAsD;AACtD,SAAgB,sBAAsB,CAAC,CAAS,EAAE,CAAS;IACzD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAA,wBAAe,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,YAAY"}

package/server/src/lib/two-factor/two-factor-gate.bootstrap.d.ts

@@ -0,0 +1,9 @@
+import { type OnModuleInit } from '@nestjs/common';
+import { UserTwoFactorService } from './user-two-factor.service';
+export declare class TwoFactorGateBootstrap implements OnModuleInit {
+    private readonly twoFactor;
+    constructor(twoFactor: UserTwoFactorService);
+    onModuleInit(): void;
+    private afterPassword;
+    private verify;
+}

package/server/src/lib/two-factor/two-factor-gate.bootstrap.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TwoFactorGateBootstrap = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const security_1 = require("@acorex-platform/framework-server/security");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+const user_two_factor_service_1 = require("./user-two-factor.service");
+//#region ----- Two-factor gate bootstrap -----
+let TwoFactorGateBootstrap = class TwoFactorGateBootstrap {
+    constructor(twoFactor) {
+        this.twoFactor = twoFactor;
+    }
+    onModuleInit() {
+        (0, security_1.configureAuthTwoFactorGate)({
+            afterPasswordAuthenticated: (user, options) => tslib_1.__awaiter(this, void 0, void 0, function* () { return this.afterPassword(user, options); }),
+            verifyChallenge: (challengeId, code) => tslib_1.__awaiter(this, void 0, void 0, function* () { return this.verify(challengeId, code); }),
+        });
+    }
+    afterPassword(user, options) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            try {
+                const challenge = yield this.twoFactor.createLoginChallengeAfterPassword(user, options);
+                if (!challenge) {
+                    return { requiresTwoFactor: false };
+                }
+                return challenge;
+            }
+            catch (error) {
+                const code = error && typeof error === 'object' && 'code' in error
+                    ? String((_a = error.code) !== null && _a !== void 0 ? _a : '')
+                    : '';
+                if (code === module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.InvalidConfiguration) {
+                    return {
+                        requiresTwoFactor: true,
+                        blocked: true,
+                        code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.InvalidConfiguration,
+                    };
+                }
+                throw error;
+            }
+        });
+    }
+    verify(challengeId, code) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const result = yield this.twoFactor.verifyLoginChallenge(challengeId, code);
+            if (!result.success) {
+                return { success: false, code: result.code };
+            }
+            return {
+                success: true,
+                userId: result.data.userId,
+                rememberMe: result.data.rememberMe,
+            };
+        });
+    }
+};
+exports.TwoFactorGateBootstrap = TwoFactorGateBootstrap;
+exports.TwoFactorGateBootstrap = TwoFactorGateBootstrap = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [user_two_factor_service_1.UserTwoFactorService])
+], TwoFactorGateBootstrap);
+//#endregion
+//# sourceMappingURL=two-factor-gate.bootstrap.js.map

package/server/src/lib/two-factor/two-factor-gate.bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-gate.bootstrap.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/two-factor/two-factor-gate.bootstrap.ts"],"names":[],"mappings":";;;;AAAA,2CAA+D;AAC/D,yEAGoD;AAEpD,gHAAmG;AAEnG,uEAAiE;AAEjE,+CAA+C;AAGxC,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YAA6B,SAA+B;QAA/B,cAAS,GAAT,SAAS,CAAsB;IAAG,CAAC;IAEhE,YAAY;QACV,IAAA,qCAA0B,EAAC;YACzB,0BAA0B,EAAE,CAAO,IAAI,EAAE,OAAO,EAAE,EAAE,wDAAC,OAAA,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA,GAAA;YACtF,eAAe,EAAE,CAAO,WAAW,EAAE,IAAI,EAAE,EAAE,wDAAC,OAAA,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA,GAAA;SAC7E,CAAC,CAAC;IACL,CAAC;IAEa,aAAa,CACzB,IAAkC,EAClC,OAAkC;;;YAElC,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,iCAAiC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACxF,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;gBACtC,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,GACR,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK;oBACnD,CAAC,CAAC,MAAM,CAAC,MAAC,KAA2B,CAAC,IAAI,mCAAI,EAAE,CAAC;oBACjD,CAAC,CAAC,EAAE,CAAC;gBACT,IAAI,IAAI,KAAK,iEAA0B,CAAC,oBAAoB,EAAE,CAAC;oBAC7D,OAAO;wBACL,iBAAiB,EAAE,IAAI;wBACvB,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,iEAA0B,CAAC,oBAAoB;qBACtD,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;IAEa,MAAM,CAClB,WAAmB,EACnB,IAAY;;YAEZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YAC/C,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;aACnC,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AAlDY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;6CAE6B,8CAAoB;GADjD,sBAAsB,CAkDlC;AAED,YAAY"}

package/server/src/lib/two-factor/two-factor-redis.store.d.ts

@@ -0,0 +1,63 @@
+import { OnModuleDestroy } from '@nestjs/common';
+import type { AXMTwoFactorEncryptedSecret } from './two-factor-encryption.util';
+export interface TwoFactorEnrollmentRecord {
+    userId: string;
+    /** AES-GCM envelope for temporary TOTP secret (never plaintext in Redis). */
+    secret: AXMTwoFactorEncryptedSecret;
+    createdAt: string;
+    expiresAt: string;
+}
+export interface TwoFactorLoginChallengeRecord {
+    userId: string;
+    username?: string;
+    rememberMe?: boolean;
+    createdAt: string;
+    expiresAt: string;
+}
+export declare const TWO_FACTOR_TTL_MS: number;
+export declare class TwoFactorRedisStore implements OnModuleDestroy {
+    private readonly logger;
+    private readonly redis;
+    private readonly local;
+    constructor();
+    private enrollKey;
+    private challengeKey;
+    private challengeAttemptsKey;
+    private userAttemptsKey;
+    private userChallengesIndexKey;
+    private stepLockKey;
+    private recoveryLockKey;
+    saveEnrollment(enrollmentId: string, record: TwoFactorEnrollmentRecord, ttlMs?: number): Promise<void>;
+    getEnrollment(enrollmentId: string): Promise<TwoFactorEnrollmentRecord | null>;
+    consumeEnrollment(enrollmentId: string): Promise<TwoFactorEnrollmentRecord | null>;
+    deleteEnrollment(enrollmentId: string): Promise<void>;
+    saveLoginChallenge(challengeId: string, record: TwoFactorLoginChallengeRecord, ttlMs?: number): Promise<void>;
+    getLoginChallenge(challengeId: string): Promise<TwoFactorLoginChallengeRecord | null>;
+    consumeLoginChallenge(challengeId: string): Promise<TwoFactorLoginChallengeRecord | null>;
+    invalidateChallengesForUser(userId: string): Promise<void>;
+    incrementAttemptCounters(challengeId: string, userId: string, ttlMs?: number): Promise<{
+        challengeAttempts: number;
+        userAttempts: number;
+    }>;
+    getAttemptCounters(challengeId: string, userId: string): Promise<{
+        challengeAttempts: number;
+        userAttempts: number;
+    }>;
+    clearAttemptCounters(challengeId: string, userId: string): Promise<void>;
+    /** Returns true when this process acquired the step lock (first consumer). */
+    tryAcquireStepLock(userId: string, step: number, ttlMs: number): Promise<boolean>;
+    /** One-shot lock so concurrent recovery-code use allows only one success. */
+    tryAcquireRecoveryLock(userId: string, normalizedCode: string, ttlMs: number): Promise<boolean>;
+    onModuleDestroy(): Promise<void>;
+    private tryAcquireLock;
+    private purgeExpiredLocal;
+    private setJson;
+    private getJson;
+    private consumeJson;
+    private del;
+    private incrWithTtl;
+    private getInt;
+    private addToSet;
+    private removeFromSet;
+    private getSetMembers;
+}