@adminforth/two-factors-auth 3.3.9 → 4.0.0

package/dist/handlers/createPasskeyHandlers.js

@@ -0,0 +1,99 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { errorMessage } from "../utils/errors.js";
+export function createPasskeyHandlers(ctx) {
+    return {
+        createRegistrationOptions: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response, cookies, headers }) {
+            const mode = body === null || body === void 0 ? void 0 : body.mode;
+            const confirmationResult = body === null || body === void 0 ? void 0 : body.confirmationResult;
+            const verificationResult = yield ctx.verifyMfaConfirmation(confirmationResult, {
+                adminUser: adminUser,
+                userPk: adminUser.pk,
+                cookies: cookies,
+                response: response,
+                extra: {
+                    headers,
+                }
+            });
+            if (!verificationResult || !('ok' in verificationResult)) {
+                return { ok: false, error: 'error' in verificationResult ? verificationResult.error : 'Verification failed' };
+            }
+            return ctx.passkeyService.createRegistrationOptions(mode, adminUser, response);
+        }),
+        finishRegistration: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, cookies }) {
+            return ctx.passkeyService.finishRegistration(body, adminUser, cookies);
+        }),
+        createLoginOptions: (_a) => __awaiter(this, [_a], void 0, function* ({ response }) {
+            return ctx.passkeyService.createLoginOptions(response);
+        }),
+        getPasskeys: (_a) => __awaiter(this, [_a], void 0, function* ({ adminUser }) {
+            return ctx.passkeyService.getPasskeys(adminUser);
+        }),
+        deletePasskey: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser }) {
+            return ctx.passkeyService.deletePasskey(body.passkeyId, adminUser);
+        }),
+        renamePasskey: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser }) {
+            return ctx.passkeyService.renamePasskey(body.passkeyId, body.newName, adminUser);
+        }),
+        checkIfUserHasPasskeys: (_a) => __awaiter(this, [_a], void 0, function* ({ cookies }) {
+            return ctx.passkeyService.checkIfUserHasPasskeys(cookies);
+        }),
+        resolveVerifyAuto: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response, cookies, headers }) {
+            var _b;
+            const sessionsIds = body === null || body === void 0 ? void 0 : body.sessionsIds;
+            const confirmationResult = body === null || body === void 0 ? void 0 : body.confirmationResult;
+            const idsToResolve = Array.isArray(sessionsIds) ? sessionsIds : [];
+            const resolveAllIdsAsFailed = (message, code) => {
+                const payload = code ? { ok: false, code, error: message } : { ok: false, error: message };
+                for (const id of idsToResolve) {
+                    ctx.autoVerify.resolveResponse(id, payload);
+                }
+                return payload;
+            };
+            try {
+                if (!idsToResolve.length || !confirmationResult) {
+                    return (resolveAllIdsAsFailed('Confirmation window was closed', 'VERIFICATION_CANCELLED'));
+                }
+                for (const id of idsToResolve) {
+                    const validationResult = yield ctx.adminforth.auth.verify(id, 'auto2FA', false);
+                    if (!validationResult) {
+                        return (resolveAllIdsAsFailed('Invalid session ID or confirmation result'));
+                    }
+                    if (validationResult.adminUserPk !== adminUser.pk) {
+                        return (resolveAllIdsAsFailed('Session does not belong to the authenticated user'));
+                    }
+                }
+                const verificationResult = yield ctx.verifyMfaConfirmation(confirmationResult, {
+                    adminUser: adminUser,
+                    userPk: adminUser.pk,
+                    cookies: cookies,
+                    response: response,
+                    extra: {
+                        headers: headers,
+                    }
+                });
+                if (!verificationResult || !('ok' in verificationResult)) {
+                    return (resolveAllIdsAsFailed((_b = verificationResult === null || verificationResult === void 0 ? void 0 : verificationResult.error) !== null && _b !== void 0 ? _b : 'Verification failed'));
+                }
+                if ('ok' in verificationResult && verificationResult.ok) {
+                    for (const id of idsToResolve) {
+                        ctx.autoVerify.resolveResponse(id, { ok: true, passkeyConfirmed: verificationResult });
+                    }
+                    return { ok: true };
+                }
+                return (resolveAllIdsAsFailed('Verification failed'));
+            }
+            catch (error) {
+                console.error('[AdminForth 2FA] Error resolving automatic 2FA verification', error);
+                return (resolveAllIdsAsFailed(errorMessage(error)));
+            }
+        }),
+    };
+}

package/dist/handlers/createTwoFaHandlers.d.ts

@@ -0,0 +1,56 @@
+export declare function createTwoFaHandlers(ctx: any): {
+    initSetup: ({ cookies }: {
+        cookies: any;
+    }) => Promise<{
+        totpJWT: any;
+        status: string;
+    }>;
+    confirmLogin: ({ body, response, cookies }: {
+        body: any;
+        response: any;
+        cookies: any;
+    }) => Promise<{
+        status: string;
+        allowedLogin: boolean;
+        error?: undefined;
+    } | {
+        error: any;
+        status?: undefined;
+        allowedLogin?: undefined;
+    }>;
+    confirmLoginWithPasskey: ({ body, response, cookies, headers, requestUrl, query }: {
+        body: any;
+        response: any;
+        cookies: any;
+        headers: any;
+        requestUrl: any;
+        query: any;
+    }) => Promise<{
+        allowedLogin: boolean;
+        error: string;
+    } | {
+        error: any;
+    }>;
+    skipAllow: ({ cookies }: {
+        cookies: any;
+    }) => Promise<{
+        status: string;
+        message: string;
+        skipAllowed?: undefined;
+    } | {
+        status: string;
+        skipAllowed: any;
+        message?: undefined;
+    }>;
+    skipAllowModal: ({ adminUser, headers, cookies }: {
+        adminUser: any;
+        headers: any;
+        cookies: any;
+    }) => Promise<{
+        skipAllowed: boolean;
+    }>;
+    verifyTotp: ({ adminUser, body }: {
+        adminUser: any;
+        body: any;
+    }) => Promise<any>;
+};

package/dist/handlers/createTwoFaHandlers.js

@@ -0,0 +1,167 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+export function createTwoFaHandlers(ctx) {
+    return {
+        initSetup: (_a) => __awaiter(this, [_a], void 0, function* ({ cookies }) {
+            const toReturn = { totpJWT: null, status: 'ok', };
+            const totpTemporaryJWT = ctx.cookieService.getTotpTemporary(cookies);
+            if (totpTemporaryJWT) {
+                toReturn.totpJWT = totpTemporaryJWT;
+            }
+            return toReturn;
+        }),
+        confirmLogin: (_a) => __awaiter(this, [_a], void 0, function* ({ body, response, cookies }) {
+            var _b, _c;
+            const totpTemporaryJWT = ctx.cookieService.getTotpTemporary(cookies);
+            if (!totpTemporaryJWT) {
+                return { error: 'Login session expired. Please log in again.' };
+            }
+            const decoded = yield ctx.cookieService.verifyTotpTemporary(cookies);
+            if (!decoded) {
+                return { error: 'Login session expired. Please log in again.' };
+            }
+            if (decoded.newSecret) {
+                const verified = body.skip && decoded.userCanSkipSetup ? true : ctx.totpService.verifySecret(decoded.newSecret, body.code);
+                if (verified) {
+                    if (!body.skip) {
+                        yield ctx.totpService.saveSecret(decoded.pk, decoded.newSecret);
+                    }
+                    ctx.cookieService.removeTotpTemporary(response);
+                    ctx.cookieService.setAuthCookie({ expireInDuration: decoded.sessionDuration, response, username: decoded.userName, pk: decoded.pk });
+                    return { status: 'ok', allowedLogin: true };
+                }
+                else {
+                    return { error: 'Wrong or expired OTP code' };
+                }
+            }
+            let verified = false;
+            let verificationError = 'Wrong or expired OTP code';
+            if (body.usePasskey && ctx.options.passkeys) {
+                const cookiesValidationResult = yield ctx.passkeyService.validateLoginChallengeCookie(cookies);
+                if (!cookiesValidationResult.ok) {
+                    return { error: cookiesValidationResult.error };
+                }
+                const res = yield ctx.passkeyService.verifyPasskeyResponse(body.passkeyOptions, decoded.pk, cookiesValidationResult.decodedPasskeysCookies);
+                if (res.ok && res.passkeyConfirmed) {
+                    verified = true;
+                }
+                else {
+                    verificationError = (_b = res.error) !== null && _b !== void 0 ? _b : 'Invalid passkey';
+                }
+            }
+            else {
+                const verificationResult = yield ctx.totpService.verifyUserCode(decoded.pk, body.code);
+                verified = 'ok' in verificationResult && verificationResult.ok;
+                if (!verified) {
+                    verificationError = (_c = verificationResult.error) !== null && _c !== void 0 ? _c : verificationError;
+                }
+            }
+            if (verified) {
+                ctx.cookieService.removeTotpTemporary(response);
+                ctx.cookieService.setAuthCookie({ expireInDuration: decoded.sessionDuration, response, username: decoded.userName, pk: decoded.pk });
+                return { status: 'ok', allowedLogin: true };
+            }
+            else {
+                return { error: verificationError };
+            }
+        }),
+        confirmLoginWithPasskey: (_a) => __awaiter(this, [_a], void 0, function* ({ body, response, cookies, headers, requestUrl, query }) {
+            var _b;
+            if (!ctx.options.passkeys || ctx.options.passkeys.allowLoginWithPasskeys === false) {
+                return { error: 'Login with passkeys is not allowed' };
+            }
+            const passkeyResponse = body.passkeyResponse;
+            if (!passkeyResponse) {
+                return { error: 'Passkey response is required' };
+            }
+            const passkeyLoginResult = yield ctx.passkeyService.getLoginUserByPasskeyResponse(passkeyResponse, cookies);
+            if (!passkeyLoginResult.ok) {
+                return { error: passkeyLoginResult.error };
+            }
+            const user = passkeyLoginResult.user;
+            const username = user[ctx.adminforth.config.auth.usernameField];
+            const userPk = user[ctx.userRepository.getUserPkField()];
+            const adminUser = {
+                dbUser: user,
+                pk: userPk,
+                username,
+            };
+            const toReturn = { allowedLogin: true, error: '' };
+            const rememberMe = (body === null || body === void 0 ? void 0 : body.rememberMe) || false;
+            const rememberDaysAfterPasskeyLogin = ctx.options.passkeys.rememberDaysAfterPasskeyLogin
+                ? ctx.options.passkeys.rememberDaysAfterPasskeyLogin.toString().concat('d')
+                : null;
+            const expireInDuration = rememberMe
+                ? ((_b = rememberDaysAfterPasskeyLogin !== null && rememberDaysAfterPasskeyLogin !== void 0 ? rememberDaysAfterPasskeyLogin : ctx.adminforth.config.auth.rememberMeDuration) !== null && _b !== void 0 ? _b : '30d')
+                : '1d';
+            yield ctx.adminforth.restApi.processLoginCallbacks(adminUser, toReturn, response, {
+                headers,
+                cookies,
+                requestUrl,
+                query,
+                body: {},
+                response,
+                meta: {
+                    loginAllowedByPasskeyDirectSignIn: true
+                },
+            }, expireInDuration);
+            if (toReturn.allowedLogin === true) {
+                ctx.cookieService.setAuthCookie({
+                    response,
+                    username,
+                    pk: userPk,
+                    expireInDuration,
+                });
+            }
+            return toReturn;
+        }),
+        skipAllow: (_a) => __awaiter(this, [_a], void 0, function* ({ cookies }) {
+            const decoded = yield ctx.cookieService.verifyTotpTemporary(cookies);
+            if (!decoded) {
+                return { status: "error", message: "Invalid token" };
+            }
+            if (!decoded.newSecret) {
+                return { status: "ok", skipAllowed: false };
+            }
+            else {
+                return {
+                    status: "ok",
+                    skipAllowed: decoded.userCanSkipSetup,
+                };
+            }
+        }),
+        skipAllowModal: (_a) => __awaiter(this, [_a], void 0, function* ({ adminUser, headers, cookies }) {
+            if (ctx.options.usersFilterToApply) {
+                const res = ctx.options.usersFilterToApply(adminUser);
+                if (res === false) {
+                    return { skipAllowed: true };
+                }
+            }
+            if (ctx.options.usersFilterToAllowSkipSetup) {
+                const res = yield ctx.checkIfSkipSetupAllowSkipVerify(adminUser);
+                if (res.skipAllowed === true) {
+                    return { skipAllowed: true };
+                }
+            }
+            if (ctx.options.stepUpMfaGracePeriodSeconds) {
+                const verificationResult = yield ctx.cookieService.isMfaGraceValid(headers, cookies, true);
+                if (verificationResult === true) {
+                    return { skipAllowed: true };
+                }
+            }
+            return { skipAllowed: false };
+        }),
+        verifyTotp: (_a) => __awaiter(this, [_a], void 0, function* ({ adminUser, body }) {
+            if (!(body === null || body === void 0 ? void 0 : body.code))
+                return { error: 'Code is required' };
+            return ctx.totpService.verifyAdminUserCode(adminUser, body.code);
+        }),
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,37 @@
+import { AdminForthPlugin } from "adminforth";
+import type { AdminForthResource, AdminUser, IAdminForth, IHttpServer, IAdminForthAuth } from "adminforth";
+import { PluginOptions } from "./types.js";
+import { PasskeyService } from "./services/passkeyService.js";
+import { TotpService } from "./services/totpService.js";
+import { type MfaConfirmationResult, type VerifyOptions } from "./services/verifyMfaConfirmation.js";
+import { CookieService } from "./services/cookieService.js";
+import { UserRepository } from "./repositories/userRepository.js";
+export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
+    options: PluginOptions;
+    adminforth: IAdminForth;
+    authResource: AdminForthResource;
+    adminForthAuth: IAdminForthAuth;
+    passkeyService: PasskeyService;
+    totpService: TotpService;
+    cookieService: CookieService;
+    userRepository: UserRepository;
+    private ctx;
+    constructor(options: PluginOptions);
+    instanceUniqueRepresentation(pluginOptions: any): string;
+    checkIfSkipSetupAllowSkipVerify(adminUser: AdminUser): Promise<{
+        skipAllowed: boolean;
+    }>;
+    private pending;
+    private waitForResponse;
+    private resolveResponse;
+    verifyAuto(adminUser: AdminUser): Promise<any>;
+    verify(confirmationResult: MfaConfirmationResult, opts: VerifyOptions): Promise<{
+        ok: true;
+    } | {
+        error: string;
+    }>;
+    modifyResourceConfig(adminforth: IAdminForth, resourceConfig: AdminForthResource): void;
+    validateConfigAfterDiscover(adminforth: IAdminForth, resourceConfig: AdminForthResource): void;
+    activate(resourceConfig: AdminForthResource, adminforth: IAdminForth): void;
+    setupEndpoints(server: IHttpServer): void;
+}