@acorex-platform/module-security-management-server 0.0.18 → 2.0.0-next.42

package/server/src/lib/two-factor/two-factor-redis.store.js

@@ -0,0 +1,321 @@
+"use strict";
+var TwoFactorRedisStore_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TwoFactorRedisStore = exports.TWO_FACTOR_TTL_MS = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const ioredis_1 = require("ioredis");
+//#endregion
+//#region ----- Constants -----
+exports.TWO_FACTOR_TTL_MS = 10 * 60 * 1000;
+const GETDEL_SCRIPT = `
+local v = redis.call('GET', KEYS[1])
+if v then
+  redis.call('DEL', KEYS[1])
+end
+return v
+`;
+//#endregion
+//#region ----- Helpers -----
+function resolveRedisConnection() {
+    var _a, _b, _c;
+    const url = (_a = process.env['REDIS_URL']) === null || _a === void 0 ? void 0 : _a.trim();
+    if (url) {
+        return { url };
+    }
+    const host = (_b = process.env['REDIS_HOST']) === null || _b === void 0 ? void 0 : _b.trim();
+    const portRaw = Number((_c = process.env['REDIS_PORT']) !== null && _c !== void 0 ? _c : 6379);
+    if (host) {
+        return { host, port: Number.isFinite(portRaw) ? portRaw : 6379 };
+    }
+    return null;
+}
+//#endregion
+//#region ----- Two-factor Redis store -----
+let TwoFactorRedisStore = TwoFactorRedisStore_1 = class TwoFactorRedisStore {
+    constructor() {
+        this.logger = new common_1.Logger(TwoFactorRedisStore_1.name);
+        this.local = new Map();
+        const connection = resolveRedisConnection();
+        if (!connection) {
+            this.logger.warn('Redis not configured; 2FA store falls back to in-process Map (single instance only).');
+            this.redis = null;
+            return;
+        }
+        this.redis =
+            'url' in connection
+                ? new ioredis_1.default(connection.url, { maxRetriesPerRequest: null, lazyConnect: true })
+                : new ioredis_1.default(Object.assign(Object.assign({}, connection), { maxRetriesPerRequest: null, lazyConnect: true }));
+    }
+    //#region ----- Key builders -----
+    enrollKey(enrollmentId) {
+        return `axp:auth:2fa:enroll:${enrollmentId}`;
+    }
+    challengeKey(challengeId) {
+        return `axp:auth:2fa:challenge:${challengeId}`;
+    }
+    challengeAttemptsKey(challengeId) {
+        return `axp:auth:2fa:attempts:challenge:${challengeId}`;
+    }
+    userAttemptsKey(userId) {
+        return `axp:auth:2fa:attempts:user:${userId}`;
+    }
+    userChallengesIndexKey(userId) {
+        return `axp:auth:2fa:user-challenges:${userId}`;
+    }
+    stepLockKey(userId, step) {
+        return `axp:auth:2fa:step:${userId}:${step}`;
+    }
+    recoveryLockKey(userId, normalizedCode) {
+        return `axp:auth:2fa:recovery:${userId}:${normalizedCode}`;
+    }
+    //#endregion
+    //#region ----- Enrollment -----
+    saveEnrollment(enrollmentId_1, record_1) {
+        return tslib_1.__awaiter(this, arguments, void 0, function* (enrollmentId, record, ttlMs = exports.TWO_FACTOR_TTL_MS) {
+            yield this.setJson(this.enrollKey(enrollmentId), record, ttlMs);
+        });
+    }
+    getEnrollment(enrollmentId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            return this.getJson(this.enrollKey(enrollmentId));
+        });
+    }
+    consumeEnrollment(enrollmentId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            return this.consumeJson(this.enrollKey(enrollmentId));
+        });
+    }
+    deleteEnrollment(enrollmentId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            yield this.del(this.enrollKey(enrollmentId));
+        });
+    }
+    //#endregion
+    //#region ----- Login challenge -----
+    saveLoginChallenge(challengeId_1, record_1) {
+        return tslib_1.__awaiter(this, arguments, void 0, function* (challengeId, record, ttlMs = exports.TWO_FACTOR_TTL_MS) {
+            yield this.setJson(this.challengeKey(challengeId), record, ttlMs);
+            yield this.addToSet(this.userChallengesIndexKey(record.userId), challengeId, ttlMs);
+        });
+    }
+    getLoginChallenge(challengeId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            return this.getJson(this.challengeKey(challengeId));
+        });
+    }
+    consumeLoginChallenge(challengeId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const record = yield this.consumeJson(this.challengeKey(challengeId));
+            if (record === null || record === void 0 ? void 0 : record.userId) {
+                yield this.removeFromSet(this.userChallengesIndexKey(record.userId), challengeId);
+            }
+            return record;
+        });
+    }
+    invalidateChallengesForUser(userId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const uid = userId.trim();
+            if (!uid) {
+                return;
+            }
+            const indexKey = this.userChallengesIndexKey(uid);
+            const challengeIds = yield this.getSetMembers(indexKey);
+            for (const id of challengeIds) {
+                yield this.del(this.challengeKey(id));
+                yield this.del(this.challengeAttemptsKey(id));
+            }
+            yield this.del(indexKey);
+            yield this.del(this.userAttemptsKey(uid));
+        });
+    }
+    //#endregion
+    //#region ----- Rate limits -----
+    incrementAttemptCounters(challengeId_1, userId_1) {
+        return tslib_1.__awaiter(this, arguments, void 0, function* (challengeId, userId, ttlMs = exports.TWO_FACTOR_TTL_MS) {
+            const challengeAttempts = yield this.incrWithTtl(this.challengeAttemptsKey(challengeId), ttlMs);
+            const userAttempts = yield this.incrWithTtl(this.userAttemptsKey(userId), ttlMs);
+            return { challengeAttempts, userAttempts };
+        });
+    }
+    getAttemptCounters(challengeId, userId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            return {
+                challengeAttempts: yield this.getInt(this.challengeAttemptsKey(challengeId)),
+                userAttempts: yield this.getInt(this.userAttemptsKey(userId)),
+            };
+        });
+    }
+    clearAttemptCounters(challengeId, userId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            yield this.del(this.challengeAttemptsKey(challengeId));
+            yield this.del(this.userAttemptsKey(userId));
+        });
+    }
+    //#endregion
+    //#region ----- Step lock (replay guard assist) -----
+    /** Returns true when this process acquired the step lock (first consumer). */
+    tryAcquireStepLock(userId, step, ttlMs) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            return this.tryAcquireLock(this.stepLockKey(userId, step), ttlMs);
+        });
+    }
+    /** One-shot lock so concurrent recovery-code use allows only one success. */
+    tryAcquireRecoveryLock(userId, normalizedCode, ttlMs) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            return this.tryAcquireLock(this.recoveryLockKey(userId, normalizedCode), ttlMs);
+        });
+    }
+    //#endregion
+    onModuleDestroy() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (this.redis) {
+                yield this.redis.quit().catch(() => { var _a; return (_a = this.redis) === null || _a === void 0 ? void 0 : _a.disconnect(); });
+            }
+        });
+    }
+    //#region ----- Low-level -----
+    tryAcquireLock(key, ttlMs) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (!this.redis) {
+                this.purgeExpiredLocal();
+                if (this.local.has(key)) {
+                    return false;
+                }
+                this.local.set(key, { value: '1', expiresAt: Date.now() + ttlMs });
+                return true;
+            }
+            const result = yield this.redis.set(key, '1', 'PX', ttlMs, 'NX');
+            return result === 'OK';
+        });
+    }
+    purgeExpiredLocal() {
+        const now = Date.now();
+        for (const [key, entry] of this.local) {
+            if (entry.expiresAt <= now) {
+                this.local.delete(key);
+            }
+        }
+    }
+    setJson(key, value, ttlMs) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const raw = JSON.stringify(value);
+            if (!this.redis) {
+                this.local.set(key, { value: raw, expiresAt: Date.now() + ttlMs });
+                return;
+            }
+            yield this.redis.set(key, raw, 'PX', ttlMs);
+        });
+    }
+    getJson(key) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (!this.redis) {
+                this.purgeExpiredLocal();
+                const entry = this.local.get(key);
+                return entry ? JSON.parse(entry.value) : null;
+            }
+            const raw = yield this.redis.get(key);
+            return raw ? JSON.parse(raw) : null;
+        });
+    }
+    consumeJson(key) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (!this.redis) {
+                this.purgeExpiredLocal();
+                const entry = (_a = this.local.get(key)) !== null && _a !== void 0 ? _a : null;
+                this.local.delete(key);
+                return entry ? JSON.parse(entry.value) : null;
+            }
+            const raw = (yield this.redis.eval(GETDEL_SCRIPT, 1, key));
+            return raw ? JSON.parse(raw) : null;
+        });
+    }
+    del(key) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (!this.redis) {
+                this.local.delete(key);
+                return;
+            }
+            yield this.redis.del(key);
+        });
+    }
+    incrWithTtl(key, ttlMs) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (!this.redis) {
+                this.purgeExpiredLocal();
+                const existing = this.local.get(key);
+                const next = (existing ? Number(existing.value) || 0 : 0) + 1;
+                this.local.set(key, { value: String(next), expiresAt: Date.now() + ttlMs });
+                return next;
+            }
+            const count = yield this.redis.incr(key);
+            if (count === 1) {
+                yield this.redis.pexpire(key, ttlMs);
+            }
+            return count;
+        });
+    }
+    getInt(key) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (!this.redis) {
+                this.purgeExpiredLocal();
+                const entry = this.local.get(key);
+                return entry ? Number(entry.value) || 0 : 0;
+            }
+            const raw = yield this.redis.get(key);
+            return raw ? Number(raw) || 0 : 0;
+        });
+    }
+    addToSet(key, member, ttlMs) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (!this.redis) {
+                this.purgeExpiredLocal();
+                const existing = this.local.get(key);
+                const set = new Set(existing ? JSON.parse(existing.value) : []);
+                set.add(member);
+                this.local.set(key, { value: JSON.stringify([...set]), expiresAt: Date.now() + ttlMs });
+                return;
+            }
+            yield this.redis.sadd(key, member);
+            yield this.redis.pexpire(key, ttlMs);
+        });
+    }
+    removeFromSet(key, member) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (!this.redis) {
+                const existing = this.local.get(key);
+                if (!existing) {
+                    return;
+                }
+                const set = new Set(JSON.parse(existing.value));
+                set.delete(member);
+                if (set.size === 0) {
+                    this.local.delete(key);
+                }
+                else {
+                    this.local.set(key, Object.assign(Object.assign({}, existing), { value: JSON.stringify([...set]) }));
+                }
+                return;
+            }
+            yield this.redis.srem(key, member);
+        });
+    }
+    getSetMembers(key) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (!this.redis) {
+                this.purgeExpiredLocal();
+                const existing = this.local.get(key);
+                return existing ? JSON.parse(existing.value) : [];
+            }
+            return this.redis.smembers(key);
+        });
+    }
+};
+exports.TwoFactorRedisStore = TwoFactorRedisStore;
+exports.TwoFactorRedisStore = TwoFactorRedisStore = TwoFactorRedisStore_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [])
+], TwoFactorRedisStore);
+//#endregion
+//# sourceMappingURL=two-factor-redis.store.js.map

package/server/src/lib/two-factor/two-factor-redis.store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-redis.store.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/two-factor/two-factor-redis.store.ts"],"names":[],"mappings":";;;;;AAAA,2CAAqE;AACrE,qCAA4B;AAwB5B,YAAY;AAEZ,+BAA+B;AAElB,QAAA,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD,MAAM,aAAa,GAAG;;;;;;CAMrB,CAAC;AAEF,YAAY;AAEZ,6BAA6B;AAE7B,SAAS,sBAAsB;;IAC7B,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,0CAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,GAAG,EAAE,CAAC;QACR,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,0CAAE,IAAI,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,mCAAI,IAAI,CAAC,CAAC;IAC1D,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,YAAY;AAEZ,4CAA4C;AAGrC,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IAK9B;QAJiB,WAAM,GAAG,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;QAE9C,UAAK,GAAG,IAAI,GAAG,EAAgD,CAAC;QAG/E,MAAM,UAAU,GAAG,sBAAsB,EAAE,CAAC;QAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,sFAAsF,CACvF,CAAC;YACF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK;YACR,KAAK,IAAI,UAAU;gBACjB,CAAC,CAAC,IAAI,iBAAK,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;gBAC9E,CAAC,CAAC,IAAI,iBAAK,iCAAM,UAAU,KAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,IAAG,CAAC;IACpF,CAAC;IAED,kCAAkC;IAE1B,SAAS,CAAC,YAAoB;QACpC,OAAO,uBAAuB,YAAY,EAAE,CAAC;IAC/C,CAAC;IAEO,YAAY,CAAC,WAAmB;QACtC,OAAO,0BAA0B,WAAW,EAAE,CAAC;IACjD,CAAC;IAEO,oBAAoB,CAAC,WAAmB;QAC9C,OAAO,mCAAmC,WAAW,EAAE,CAAC;IAC1D,CAAC;IAEO,eAAe,CAAC,MAAc;QACpC,OAAO,8BAA8B,MAAM,EAAE,CAAC;IAChD,CAAC;IAEO,sBAAsB,CAAC,MAAc;QAC3C,OAAO,gCAAgC,MAAM,EAAE,CAAC;IAClD,CAAC;IAEO,WAAW,CAAC,MAAc,EAAE,IAAY;QAC9C,OAAO,qBAAqB,MAAM,IAAI,IAAI,EAAE,CAAC;IAC/C,CAAC;IAEO,eAAe,CAAC,MAAc,EAAE,cAAsB;QAC5D,OAAO,yBAAyB,MAAM,IAAI,cAAc,EAAE,CAAC;IAC7D,CAAC;IAED,YAAY;IAEZ,gCAAgC;IAE1B,cAAc;qEAClB,YAAoB,EACpB,MAAiC,EACjC,KAAK,GAAG,yBAAiB;YAEzB,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAClE,CAAC;KAAA;IAEK,aAAa,CAAC,YAAoB;;YACtC,OAAO,IAAI,CAAC,OAAO,CAA4B,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;QAC/E,CAAC;KAAA;IAEK,iBAAiB,CAAC,YAAoB;;YAC1C,OAAO,IAAI,CAAC,WAAW,CAA4B,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;QACnF,CAAC;KAAA;IAEK,gBAAgB,CAAC,YAAoB;;YACzC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;QAC/C,CAAC;KAAA;IAED,YAAY;IAEZ,qCAAqC;IAE/B,kBAAkB;qEACtB,WAAmB,EACnB,MAAqC,EACrC,KAAK,GAAG,yBAAiB;YAEzB,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAClE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QACtF,CAAC;KAAA;IAEK,iBAAiB,CAAC,WAAmB;;YACzC,OAAO,IAAI,CAAC,OAAO,CAAgC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;QACrF,CAAC;KAAA;IAEK,qBAAqB,CAAC,WAAmB;;YAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAgC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;YACrG,IAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAEK,2BAA2B,CAAC,MAAc;;YAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAClD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACxD,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;gBACtC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACzB,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC;KAAA;IAED,YAAY;IAEZ,iCAAiC;IAE3B,wBAAwB;qEAC5B,WAAmB,EACnB,MAAc,EACd,KAAK,GAAG,yBAAiB;YAEzB,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;YAChG,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YACjF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC;QAC7C,CAAC;KAAA;IAEK,kBAAkB,CACtB,WAAmB,EACnB,MAAc;;YAEd,OAAO;gBACL,iBAAiB,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;gBAC5E,YAAY,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;aAC9D,CAAC;QACJ,CAAC;KAAA;IAEK,oBAAoB,CAAC,WAAmB,EAAE,MAAc;;YAC5D,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC;YACvD,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,CAAC;KAAA;IAED,YAAY;IAEZ,qDAAqD;IAErD,8EAA8E;IACxE,kBAAkB,CAAC,MAAc,EAAE,IAAY,EAAE,KAAa;;YAClE,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACpE,CAAC;KAAA;IAED,6EAA6E;IACvE,sBAAsB,CAAC,MAAc,EAAE,cAAsB,EAAE,KAAa;;YAChF,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC;KAAA;IAED,YAAY;IAEN,eAAe;;YACnB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,WAAC,OAAA,MAAA,IAAI,CAAC,KAAK,0CAAE,UAAU,EAAE,CAAA,EAAA,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;KAAA;IAED,+BAA+B;IAEjB,cAAc,CAAC,GAAW,EAAE,KAAa;;YACrD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;gBACnE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACjE,OAAO,MAAM,KAAK,IAAI,CAAC;QACzB,CAAC;KAAA;IAEO,iBAAiB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAEa,OAAO,CAAC,GAAW,EAAE,KAAc,EAAE,KAAa;;YAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;KAAA;IAEa,OAAO,CAAI,GAAW;;YAClC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAClC,OAAO,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAO,CAAC,CAAC,CAAC,IAAI,CAAC;YACvD,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtC,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7C,CAAC;KAAA;IAEa,WAAW,CAAI,GAAW;;;YACtC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,mCAAI,IAAI,CAAC;gBAC1C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACvB,OAAO,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAO,CAAC,CAAC,CAAC,IAAI,CAAC;YACvD,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC,CAAkB,CAAC;YAC5E,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7C,CAAC;KAAA;IAEa,GAAG,CAAC,GAAW;;YAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;KAAA;IAEa,WAAW,CAAC,GAAW,EAAE,KAAa;;YAClD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC9D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;gBAC5E,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;IAEa,MAAM,CAAC,GAAW;;YAC9B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAClC,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtC,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;KAAA;IAEa,QAAQ,CAAC,GAAW,EAAE,MAAc,EAAE,KAAa;;YAC/D,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACtF,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAChB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACnC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvC,CAAC;KAAA;IAEa,aAAa,CAAC,GAAW,EAAE,MAAc;;YACrD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAa,CAAC,CAAC;gBACpE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACnB,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;oBACnB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,kCAAO,QAAQ,KAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAG,CAAC;gBACxE,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;KAAA;IAEa,aAAa,CAAC,GAAW;;YACrC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrC,OAAO,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;KAAA;CAGF,CAAA;AAtSY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;;GACA,mBAAmB,CAsS/B;AAED,YAAY"}

package/server/src/lib/two-factor/user-two-factor.service.d.ts

@@ -0,0 +1,62 @@
+import { EventEmitter2 } from '@nestjs/event-emitter';
+import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+import { AuthService, DeviceSessionService, type SecurityManagementUserRecord } from '@acorex-platform/framework-server/security';
+import { type AXMAdminResetTwoFactorInput, type AXMAdminResetTwoFactorResult, type AXMConfirmTwoFactorEnrollmentInput, type AXMConfirmTwoFactorEnrollmentResult, type AXMDisableTwoFactorInput, type AXMDisableTwoFactorResult, type AXMGenerateTwoFactorRecoveryCodesInput, type AXMGenerateTwoFactorRecoveryCodesResult, type AXMGetTwoFactorStatusResult, type AXMStartTwoFactorEnrollmentInput, type AXMStartTwoFactorEnrollmentResult } from '@acorex-platform/module-security-management-client/contracts';
+import { SettingsManagementStoreService } from '@acorex-platform/module-settings-management-server';
+import { TwoFactorRedisStore } from './two-factor-redis.store';
+export type TwoFactorOutcome<T> = {
+    success: true;
+    data: T;
+} | {
+    success: false;
+    code: string;
+};
+export interface TwoFactorLoginChallengeResult {
+    requiresTwoFactor: true;
+    challengeId: string;
+}
+export interface TwoFactorVerifyLoginResult {
+    userId: string;
+    rememberMe?: boolean;
+}
+export declare class UserTwoFactorService {
+    private readonly entityStorage;
+    private readonly settingsStore;
+    private readonly redisStore;
+    private readonly deviceSessions;
+    private readonly auth;
+    private readonly events?;
+    private readonly logger;
+    constructor(entityStorage: EntityStorageMiddlewareService, settingsStore: SettingsManagementStoreService, redisStore: TwoFactorRedisStore, deviceSessions: DeviceSessionService, auth: AuthService, events?: EventEmitter2 | undefined);
+    getStatus(userId?: string): Promise<TwoFactorOutcome<AXMGetTwoFactorStatusResult>>;
+    startEnrollment(input: AXMStartTwoFactorEnrollmentInput): Promise<TwoFactorOutcome<AXMStartTwoFactorEnrollmentResult>>;
+    confirmEnrollment(input: AXMConfirmTwoFactorEnrollmentInput): Promise<TwoFactorOutcome<AXMConfirmTwoFactorEnrollmentResult>>;
+    disable(input: AXMDisableTwoFactorInput): Promise<TwoFactorOutcome<AXMDisableTwoFactorResult>>;
+    generateRecoveryCodes(input: AXMGenerateTwoFactorRecoveryCodesInput): Promise<TwoFactorOutcome<AXMGenerateTwoFactorRecoveryCodesResult>>;
+    adminReset(input: AXMAdminResetTwoFactorInput): Promise<TwoFactorOutcome<AXMAdminResetTwoFactorResult>>;
+    /**
+     * After password OK: if user setting Enabled=true, create Redis challenge (fail-closed without row).
+     * Returns null when 2FA is not required.
+     */
+    createLoginChallengeAfterPassword(user: SecurityManagementUserRecord, options?: {
+        rememberMe?: boolean;
+    }): Promise<TwoFactorLoginChallengeResult | null>;
+    verifyLoginChallenge(challengeId: string, code: string): Promise<TwoFactorOutcome<TwoFactorVerifyLoginResult>>;
+    private wipeEnrollment;
+    private revokeAllUserSessions;
+    private verifySensitiveProof;
+    private findByUserId;
+    private getUser;
+    private verifyUserPassword;
+    private userSettingsPartition;
+    private readEnabledSetting;
+    /**
+     * Effective 2FA on/off for UI + login.
+     * Heals drift when a verified enrollment row exists but the user setting is missing/false
+     * (otherwise profile shows "Not enabled" while StartEnrollment returns AlreadyEnabled).
+     */
+    private resolveEffectiveTwoFactorState;
+    private writeEnabledSetting;
+    private readSessionUserId;
+    private emitSecurityAlert;
+}