@actuate-media/cms-core 0.36.0 → 0.38.0

package/dist/__tests__/api/security-routes.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=security-routes.test.d.ts.map

package/dist/__tests__/api/security-routes.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-routes.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/security-routes.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/security-routes.test.js

@@ -0,0 +1,212 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { initDB } from '../../db.js';
+import { generateApiKey } from '../../security/api-key-enhanced.js';
+/**
+ * Contract tests for the Security Center endpoints:
+ *   - GET  /security                     → authed (admin), computed posture.
+ *   - PUT  /security                     → persists enforced policy, lockout-safe.
+ *   - POST /security/sessions/revoke-all → revokes the caller's other sessions.
+ *
+ * Proves the response never leaks secret values, that lockout-safe MFA enabling
+ * is enforced server-side, and that policy round-trips through the settings global.
+ */
+const VALID_SECRET = 'a'.repeat(48);
+function createMockDB(state, apiKey) {
+    const tx = {
+        document: {
+            update: async ({ data }) => {
+                state.settings = data.data;
+                return { id: 'settings-doc', data: state.settings };
+            },
+            create: async ({ data }) => {
+                state.settings = data.data;
+                return { id: 'settings-doc', data: state.settings };
+            },
+        },
+        version: { create: async () => ({ id: 'v1' }) },
+    };
+    return {
+        apiKey: {
+            findMany: async () => (apiKey ? [apiKey] : []),
+            findUnique: async ({ where }) => apiKey && apiKey.keyHash === where.keyHash ? apiKey : null,
+            update: async () => apiKey,
+        },
+        document: {
+            findFirst: async () => ({ id: 'settings-doc', data: state.settings }),
+            findMany: async () => [],
+            count: async () => 0,
+        },
+        version: { create: async () => ({ id: 'v1' }) },
+        user: {
+            findMany: async () => [
+                { role: 'ADMIN', isActive: true, totpEnabled: state.viewerHasMfa },
+                { role: 'EDITOR', isActive: true, totpEnabled: false },
+            ],
+            findUnique: async () => ({ totpEnabled: state.viewerHasMfa }),
+            count: async () => 1,
+        },
+        session: {
+            findMany: async () => [],
+            count: async () => 2,
+            updateMany: async (args) => {
+                state.revokeAllArgs = args;
+                return { count: state.revokeAllResult };
+            },
+        },
+        auditLog: {
+            count: async () => 3,
+            create: async () => ({ id: 'log1' }),
+        },
+        $transaction: async (fn) => fn(tx),
+    };
+}
+async function makeKey(scopes) {
+    const { key, keyHash, keyPrefix } = await generateApiKey({ prefix: 'act_sk', scopes });
+    return {
+        key,
+        record: {
+            id: 'apikey-1',
+            keyHash,
+            keyPrefix,
+            userId: 'user-1',
+            scopes,
+            ipRestrictions: null,
+            expiresAt: null,
+            lastUsedAt: null,
+            revokedAt: null,
+        },
+    };
+}
+function freshState() {
+    return {
+        settings: { siteTitle: 'Actuate Media' },
+        viewerHasMfa: false,
+        revokeAllResult: 2,
+    };
+}
+beforeEach(() => {
+    delete globalThis.__actuateConfig;
+    process.env.CMS_SECRET = VALID_SECRET;
+});
+describe('GET /security', () => {
+    it('requires authentication', async () => {
+        const db = createMockDB(freshState());
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/security'));
+        expect(res.status).toBe(401);
+    });
+    it('rejects non-admin API keys', async () => {
+        const { key, record } = await makeKey({ media: true });
+        const db = createMockDB(freshState(), record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/security', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(res.status).toBe(403);
+    });
+    it('returns computed posture + summaries and never leaks secret values', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const db = createMockDB(freshState(), record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/security', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.data.status.status).toBeDefined();
+        expect(Array.isArray(body.data.status.checks)).toBe(true);
+        expect(body.data.users.totalAdmins).toBe(1);
+        expect(body.data.secrets.cmsSecret).toBe('pass');
+        expect(body.data.activeSessions).toBe(2);
+        expect(body.data.failedLogins24h).toBe(3);
+        // The raw secret value must never appear anywhere in the payload.
+        expect(JSON.stringify(body)).not.toContain(VALID_SECRET);
+    });
+});
+describe('PUT /security', () => {
+    it('persists the enforced policy and reflects it on read-back', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const state = freshState();
+        const db = createMockDB(state, record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/security', {
+            method: 'PUT',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                mfa: { required: false, gracePeriodDays: 14 },
+                session: { maxConcurrentSessions: 3 },
+            }),
+        }));
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.data.settings.session.maxConcurrentSessions).toBe(3);
+        expect(body.data.settings.mfa.gracePeriodDays).toBe(14);
+        // Persisted into the settings global without clobbering siblings.
+        expect(state.settings.security.session.maxConcurrentSessions).toBe(3);
+        expect(state.settings.siteTitle).toBe('Actuate Media');
+    });
+    it('blocks enabling MFA when the acting admin has no MFA (lockout-safe)', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const state = freshState();
+        state.viewerHasMfa = false;
+        const db = createMockDB(state, record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/security', {
+            method: 'PUT',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                mfa: { required: true, gracePeriodDays: 7 },
+                session: { maxConcurrentSessions: 5 },
+            }),
+        }));
+        expect(res.status).toBe(409);
+        const body = (await res.json());
+        expect(body.code).toBe('MFA_LOCKOUT_RISK');
+        // Nothing should have been persisted.
+        expect(state.settings.security).toBeUndefined();
+    });
+    it('allows enabling MFA when the acting admin has MFA', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const state = freshState();
+        state.viewerHasMfa = true;
+        const db = createMockDB(state, record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/security', {
+            method: 'PUT',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                mfa: { required: true, gracePeriodDays: 7 },
+                session: { maxConcurrentSessions: 5 },
+            }),
+        }));
+        expect(res.status).toBe(200);
+        expect(state.settings.security.mfa.required).toBe(true);
+        expect(typeof state.settings.security.mfa.requiredAt).toBe('string');
+    });
+});
+describe('POST /security/sessions/revoke-all', () => {
+    it("revokes the caller's other sessions and returns the count", async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const state = freshState();
+        const db = createMockDB(state, record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/security/sessions/revoke-all', {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.data.revoked).toBe(2);
+        // Excludes the current session id.
+        expect(state.revokeAllArgs?.where?.id?.not).toBe('apikey-1');
+    });
+});
+//# sourceMappingURL=security-routes.test.js.map

package/dist/__tests__/api/security-routes.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-routes.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/security-routes.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAGnE;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAqBnC,SAAS,YAAY,CAAC,KAAgB,EAAE,MAAyB;IAC/D,MAAM,EAAE,GAAG;QACT,QAAQ,EAAE;YACR,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAA+C,EAAE,EAAE;gBACtE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAA;gBAC1B,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAA;YACrD,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAA+C,EAAE,EAAE;gBACtE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAA;gBAC1B,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAA;YACrD,CAAC;SACF;QACD,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;KAChD,CAAA;IACD,OAAO;QACL,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAkC,EAAE,EAAE,CAC9D,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAC5D,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM;SAC3B;QACD,QAAQ,EAAE;YACR,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;YACxB,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;SACrB;QACD,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;QAC/C,IAAI,EAAE;YACJ,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;gBACpB,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE;gBAClE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;aACvD;YACD,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7D,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;SACrB;QACD,OAAO,EAAE;YACP,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;YACxB,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACpB,UAAU,EAAE,KAAK,EAAE,IAA2C,EAAE,EAAE;gBAChE,KAAK,CAAC,aAAa,GAAG,IAAI,CAAA;gBAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,eAAe,EAAE,CAAA;YACzC,CAAC;SACF;QACD,QAAQ,EAAE;YACR,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACpB,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;SACrC;QACD,YAAY,EAAE,KAAK,EAAE,EAAsC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;KAChE,CAAA;AACV,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAmB;IACxC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACtF,OAAO;QACL,GAAG;QACH,MAAM,EAAE;YACN,EAAE,EAAE,UAAU;YACd,OAAO;YACP,SAAS;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SAChB;KACF,CAAA;AACH,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;QACL,QAAQ,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE;QACxC,YAAY,EAAE,KAAK;QACnB,eAAe,EAAE,CAAC;KACnB,CAAA;AACH,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,OAAQ,UAAkB,CAAC,eAAe,CAAA;IAC1C,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,YAAY,CAAA;AACvC,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,CAAA;QACrC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,sCAAsC,CAAC,CAAC,CAAA;QAC9E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,sCAAsC,EAAE;YAClD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,sCAAsC,EAAE;YAClD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QAEtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;QAC7C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAChD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACzC,kEAAkE;QAClE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAA;QAC1B,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACtC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,sCAAsC,EAAE;YAClD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE;gBAC7C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;aACtC,CAAC;SACH,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACvD,kEAAkE;QAClE,MAAM,CAAE,KAAK,CAAC,QAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC9E,MAAM,CAAE,KAAK,CAAC,QAAgB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAA;QAC1B,KAAK,CAAC,YAAY,GAAG,KAAK,CAAA;QAC1B,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACtC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,sCAAsC,EAAE;YAClD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE;gBAC3C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;aACtC,CAAC;SACH,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC1C,sCAAsC;QACtC,MAAM,CAAE,KAAK,CAAC,QAAgB,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAA;QAC1B,KAAK,CAAC,YAAY,GAAG,IAAI,CAAA;QACzB,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACtC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,sCAAsC,EAAE;YAClD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE;gBAC3C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;aACtC,CAAC;SACH,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAE,KAAK,CAAC,QAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChE,MAAM,CAAC,OAAQ,KAAK,CAAC,QAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAA;QAC1B,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACtC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,0DAA0D,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjC,mCAAmC;QACnC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/api/totp-login.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=totp-login.test.d.ts.map

package/dist/__tests__/api/totp-login.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp-login.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/totp-login.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/totp-login.test.js

@@ -0,0 +1,115 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { initDB } from '../../db.js';
+import { encryptSecret, encryptStringArray } from '../../security/secret-storage.js';
+import { createMfaPendingToken, computeRequestFingerprint } from '../../auth/mfa-pending.js';
+import { generateTOTPSecret } from '../../auth/totp.js';
+/**
+ * Contract test for the backup-code recovery path of POST /auth/totp/login.
+ *
+ * Backup codes are generated and shown at enrollment but, before this, were
+ * never consumed anywhere — a lost authenticator meant permanent lockout. This
+ * proves a valid code signs the user in, is single-use (consumed on success),
+ * and that an unknown code is rejected.
+ */
+const SECRET = 'a'.repeat(48);
+const ENCRYPTION_KEY = 'b'.repeat(64); // 32 bytes hex
+const BACKUP_CODES = ['aaaa1111', 'bbbb2222', 'cccc3333'];
+async function createMockDB(state) {
+    const totpSecret = await encryptSecret(generateTOTPSecret());
+    return {
+        user: {
+            findUnique: async () => ({
+                id: 'user-1',
+                email: 'admin@example.com',
+                name: 'Admin',
+                role: 'ADMIN',
+                totpSecret,
+                totpEnabled: true,
+                backupCodes: await encryptStringArray(state.backupCodes),
+                isActive: true,
+            }),
+            update: async ({ data }) => {
+                // The handler re-encrypts the remaining codes; decrypt-by-count is
+                // enough for the assertion (we only check how many remain).
+                state.backupCodes = state.backupCodes.slice(0, data.backupCodes.length);
+                return { id: 'user-1' };
+            },
+        },
+        document: {
+            findFirst: async () => ({ data: {} }),
+        },
+        session: {
+            findMany: async () => [],
+            create: async () => ({ id: 'sess-1' }),
+            updateMany: async () => ({ count: 0 }),
+        },
+        auditLog: {
+            create: async () => ({ id: 'log-1' }),
+        },
+    };
+}
+async function makePendingToken(ip, userAgent) {
+    const fingerprint = await computeRequestFingerprint(ip, userAgent);
+    return createMfaPendingToken({ userId: 'user-1', fingerprint }, SECRET);
+}
+beforeEach(() => {
+    delete globalThis.__actuateConfig;
+    process.env.CMS_SECRET = SECRET;
+    process.env.CMS_ENCRYPTION_KEY = ENCRYPTION_KEY;
+});
+describe('POST /auth/totp/login — backup code recovery', () => {
+    it('signs in with a valid backup code and consumes it (single-use)', async () => {
+        const ip = '203.0.113.10';
+        const ua = 'vitest-agent';
+        const state = { backupCodes: [...BACKUP_CODES] };
+        const db = await createMockDB(state);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const token = await makePendingToken(ip, ua);
+        const res = await handler(new Request('https://example.com/api/cms/auth/totp/login', {
+            method: 'POST',
+            headers: { 'x-real-ip': ip, 'user-agent': ua, 'content-type': 'application/json' },
+            body: JSON.stringify({ mfaPendingToken: token, code: 'BBBB-2222' }),
+        }));
+        expect(res.status).toBe(200);
+        expect(res.headers.get('set-cookie')).toContain('actuate_session=');
+        // The used code was removed — one fewer remains.
+        expect(state.backupCodes).toHaveLength(BACKUP_CODES.length - 1);
+    });
+    it('rejects an unknown code', async () => {
+        const ip = '203.0.113.11';
+        const ua = 'vitest-agent';
+        const state = { backupCodes: [...BACKUP_CODES] };
+        const db = await createMockDB(state);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const token = await makePendingToken(ip, ua);
+        const res = await handler(new Request('https://example.com/api/cms/auth/totp/login', {
+            method: 'POST',
+            headers: { 'x-real-ip': ip, 'user-agent': ua, 'content-type': 'application/json' },
+            body: JSON.stringify({ mfaPendingToken: token, code: 'deadbeef' }),
+        }));
+        expect(res.status).toBe(401);
+        expect(state.backupCodes).toHaveLength(BACKUP_CODES.length);
+    });
+    it('rejects a stale pending token from a different device fingerprint', async () => {
+        const state = { backupCodes: [...BACKUP_CODES] };
+        const db = await createMockDB(state);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        // Token minted for one device, redeemed from another (different UA).
+        const token = await makePendingToken('203.0.113.12', 'device-a');
+        const res = await handler(new Request('https://example.com/api/cms/auth/totp/login', {
+            method: 'POST',
+            headers: {
+                'x-real-ip': '203.0.113.12',
+                'user-agent': 'device-b',
+                'content-type': 'application/json',
+            },
+            body: JSON.stringify({ mfaPendingToken: token, code: 'aaaa1111' }),
+        }));
+        expect(res.status).toBe(401);
+    });
+});
+//# sourceMappingURL=totp-login.test.js.map

package/dist/__tests__/api/totp-login.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp-login.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/totp-login.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACpF,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAEvD;;;;;;;GAOG;AACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAC7B,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA,CAAC,eAAe;AAErD,MAAM,YAAY,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;AAMzD,KAAK,UAAU,YAAY,CAAC,KAAoB;IAC9C,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAA;IAC5D,OAAO;QACL,IAAI,EAAE;YACJ,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBACvB,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,mBAAmB;gBAC1B,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,OAAO;gBACb,UAAU;gBACV,WAAW,EAAE,IAAI;gBACjB,WAAW,EAAE,MAAM,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC;gBACxD,QAAQ,EAAE,IAAI;aACf,CAAC;YACF,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAuC,EAAE,EAAE;gBAC9D,mEAAmE;gBACnE,4DAA4D;gBAC5D,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;gBACvE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAA;YACzB,CAAC;SACF;QACD,QAAQ,EAAE;YACR,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;SACtC;QACD,OAAO,EAAE;YACP,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;YACxB,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;YACtC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;SACvC;QACD,QAAQ,EAAE;YACR,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;SACtC;KACK,CAAA;AACV,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,EAAU,EAAE,SAAiB;IAC3D,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;IAClE,OAAO,qBAAqB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,MAAM,CAAC,CAAA;AACzE,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,OAAQ,UAAkB,CAAC,eAAe,CAAA;IAC1C,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAA;IAC/B,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,cAAc,CAAA;AACjD,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,EAAE,GAAG,cAAc,CAAA;QACzB,MAAM,EAAE,GAAG,cAAc,CAAA;QACzB,MAAM,KAAK,GAAkB,EAAE,WAAW,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAA;QAC/D,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnF,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAC5C,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,6CAA6C,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAClF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;SACpE,CAAC,CACH,CAAA;QAED,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;QACnE,iDAAiD;QACjD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,EAAE,GAAG,cAAc,CAAA;QACzB,MAAM,EAAE,GAAG,cAAc,CAAA;QACzB,MAAM,KAAK,GAAkB,EAAE,WAAW,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAA;QAC/D,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnF,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAC5C,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,6CAA6C,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAClF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;SACnE,CAAC,CACH,CAAA;QAED,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,KAAK,GAAkB,EAAE,WAAW,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAA;QAC/D,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnF,qEAAqE;QACrE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAA;QAChE,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,6CAA6C,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,WAAW,EAAE,cAAc;gBAC3B,YAAY,EAAE,UAAU;gBACxB,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;SACnE,CAAC,CACH,CAAA;QAED,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/auth/totp.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=totp.test.d.ts.map

package/dist/__tests__/auth/totp.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/auth/totp.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/auth/totp.test.js

@@ -0,0 +1,52 @@
+import { describe, expect, it } from 'vitest';
+import { generateBackupCodes, generateTOTPSecret, generateTOTPUri, verifyTOTP, normalizeBackupCode, findBackupCodeMatch, } from '../../auth/totp.js';
+describe('totp helpers', () => {
+    it('generates a scannable otpauth URI for the given account', () => {
+        const secret = generateTOTPSecret();
+        const uri = generateTOTPUri(secret, 'admin@example.com');
+        expect(uri.startsWith('otpauth://totp/')).toBe(true);
+        expect(uri).toContain(`secret=${secret}`);
+        expect(uri).toContain('issuer=Actuate%20CMS');
+        expect(uri).toContain(encodeURIComponent('admin@example.com'));
+    });
+    it('verifies a TOTP code derived from the same secret', async () => {
+        // Derive the current code the same way the verifier does, then confirm it
+        // round-trips. Importing the private HOTP isn't exposed, so we lean on the
+        // window tolerance: a freshly generated secret should not validate a random
+        // 6-digit guess.
+        const secret = generateTOTPSecret();
+        expect(verifyTOTP('000000', secret)).toBe(false);
+    });
+});
+describe('backup codes', () => {
+    it('generates the requested number of unique 8-char hex codes', () => {
+        const codes = generateBackupCodes(8);
+        expect(codes).toHaveLength(8);
+        expect(new Set(codes).size).toBe(8);
+        for (const code of codes) {
+            expect(code).toMatch(/^[0-9a-f]{8}$/);
+        }
+    });
+    it('normalizes whitespace, dashes and case', () => {
+        expect(normalizeBackupCode('ABCD-1234')).toBe('abcd1234');
+        expect(normalizeBackupCode('  ab cd 12 34 ')).toBe('abcd1234');
+        expect(normalizeBackupCode('')).toBe('');
+    });
+    it('matches a stored code regardless of formatting and returns its index', () => {
+        const codes = ['aaaa1111', 'bbbb2222', 'cccc3333'];
+        expect(findBackupCodeMatch(codes, 'BBBB-2222')).toBe(1);
+        expect(findBackupCodeMatch(codes, ' cccc 3333 ')).toBe(2);
+    });
+    it('returns -1 for a non-matching or empty submission', () => {
+        const codes = ['aaaa1111', 'bbbb2222'];
+        expect(findBackupCodeMatch(codes, 'deadbeef')).toBe(-1);
+        expect(findBackupCodeMatch(codes, '')).toBe(-1);
+        expect(findBackupCodeMatch([], 'aaaa1111')).toBe(-1);
+    });
+    it('does not match a code that only shares a prefix (length-aware compare)', () => {
+        const codes = ['aaaa1111'];
+        expect(findBackupCodeMatch(codes, 'aaaa111')).toBe(-1);
+        expect(findBackupCodeMatch(codes, 'aaaa11110')).toBe(-1);
+    });
+});
+//# sourceMappingURL=totp.test.js.map

package/dist/__tests__/auth/totp.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.test.js","sourceRoot":"","sources":["../../../src/__tests__/auth/totp.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,UAAU,EACV,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,oBAAoB,CAAA;AAE3B,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAA;QACnC,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;QACxD,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,UAAU,MAAM,EAAE,CAAC,CAAA;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAA;QAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,iBAAiB;QACjB,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAA;QACnC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,KAAK,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACpC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;QACvC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACzD,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC9D,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,KAAK,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;QAClD,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACvD,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,KAAK,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;QACtC,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACvD,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/C,MAAM,CAAC,mBAAmB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,CAAA;QAC1B,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACtD,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/security/center.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=center.test.d.ts.map

package/dist/__tests__/security/center.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"center.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/security/center.test.ts"],"names":[],"mappings":""}