@adminforth/two-factors-auth 3.3.9 → 4.0.0

package/dist/repositories/passkeyRepository.d.ts

@@ -0,0 +1,18 @@
+import type { AdminForthResource, AdminUser, IAdminForth } from "adminforth";
+import type { PluginOptions } from "../types.js";
+import type { AnyRecord } from "../utils/types.js";
+export declare class PasskeyRepository {
+    private readonly adminforth;
+    private readonly options;
+    constructor(adminforth: IAdminForth, options: PluginOptions);
+    getCredentialResource(): AdminForthResource;
+    getCredentialResourcePkField(): string;
+    getByCredentialId(credentialId: string): Promise<AnyRecord>;
+    getByCredentialIdAndUserId(credentialId: string, userId: string): Promise<AnyRecord>;
+    listByUserId(userId: string): Promise<AnyRecord[]>;
+    hasByUserId(userId: string): Promise<boolean>;
+    create(record: AnyRecord, adminUser: AdminUser): Promise<void>;
+    updateMeta(passkeyRecord: AnyRecord, meta: AnyRecord): Promise<void>;
+    update(passkeyRecord: AnyRecord, newRecord: AnyRecord, adminUser: AdminUser): Promise<void>;
+    delete(passkeyRecord: AnyRecord, adminUser: AdminUser): Promise<void>;
+}

package/dist/repositories/passkeyRepository.js

@@ -0,0 +1,89 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { Filters } from "adminforth";
+export class PasskeyRepository {
+    constructor(adminforth, options) {
+        this.adminforth = adminforth;
+        this.options = options;
+    }
+    getCredentialResource() {
+        return this.adminforth.config.resources.find(r => r.resourceId === this.options.passkeys.credentialResourceID);
+    }
+    getCredentialResourcePkField() {
+        return this.getCredentialResource().columns.find(c => c.primaryKey).name;
+    }
+    getByCredentialId(credentialId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.adminforth.resource(this.options.passkeys.credentialResourceID).get([
+                Filters.EQ(this.options.passkeys.credentialIdFieldName, credentialId),
+            ]);
+        });
+    }
+    getByCredentialIdAndUserId(credentialId, userId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.adminforth.resource(this.options.passkeys.credentialResourceID).get([
+                Filters.EQ(this.options.passkeys.credentialIdFieldName, credentialId),
+                Filters.EQ(this.options.passkeys.credentialUserIdFieldName, userId),
+            ]);
+        });
+    }
+    listByUserId(userId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.adminforth.resource(this.options.passkeys.credentialResourceID).list([
+                Filters.EQ(this.options.passkeys.credentialUserIdFieldName, userId),
+            ]);
+        });
+    }
+    hasByUserId(userId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const passkeys = yield this.listByUserId(userId);
+            return passkeys && passkeys.length > 0;
+        });
+    }
+    create(record, adminUser) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.adminforth.createResourceRecord({
+                resource: this.getCredentialResource(),
+                record,
+                adminUser,
+            });
+        });
+    }
+    updateMeta(passkeyRecord, meta) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.adminforth
+                .resource(this.options.passkeys.credentialResourceID)
+                .update(passkeyRecord[this.getCredentialResourcePkField()], {
+                [this.options.passkeys.credentialMetaFieldName]: meta,
+            });
+        });
+    }
+    update(passkeyRecord, newRecord, adminUser) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.adminforth.updateResourceRecord({
+                resource: this.getCredentialResource(),
+                recordId: passkeyRecord[this.getCredentialResourcePkField()],
+                oldRecord: passkeyRecord,
+                record: newRecord,
+                adminUser,
+            });
+        });
+    }
+    delete(passkeyRecord, adminUser) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.adminforth.deleteResourceRecord({
+                resource: this.getCredentialResource(),
+                recordId: passkeyRecord[this.getCredentialResourcePkField()],
+                record: passkeyRecord,
+                adminUser,
+            });
+        });
+    }
+}

package/dist/repositories/userRepository.d.ts

@@ -0,0 +1,14 @@
+import type { AdminForthResource, AdminUser, IAdminForth } from "adminforth";
+import type { PluginOptions } from "../types.js";
+import type { AnyRecord } from "../utils/types.js";
+export declare class UserRepository {
+    private readonly adminforth;
+    private readonly options;
+    constructor(adminforth: IAdminForth, options: PluginOptions);
+    getAuthResource(): AdminForthResource;
+    getUserPkField(): string;
+    getUserPk(adminUser: AdminUser): string;
+    getAuthUser(pk: string): Promise<AnyRecord>;
+    getSecret(user: AnyRecord): string;
+    updateSecret(pk: string, secret: string): Promise<void>;
+}

package/dist/repositories/userRepository.js

@@ -0,0 +1,45 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+export class UserRepository {
+    constructor(adminforth, options) {
+        this.adminforth = adminforth;
+        this.options = options;
+    }
+    getAuthResource() {
+        return this.adminforth.config.resources.find(r => r.resourceId === this.adminforth.config.auth.usersResourceId);
+    }
+    getUserPkField() {
+        return this.getAuthResource().columns.find(c => c.primaryKey).name;
+    }
+    getUserPk(adminUser) {
+        return adminUser.dbUser[this.getUserPkField()];
+    }
+    getAuthUser(pk) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const authResource = this.getAuthResource();
+            const connector = this.adminforth.connectors[authResource.dataSource];
+            return connector.getRecordByPrimaryKey(authResource, pk);
+        });
+    }
+    getSecret(user) {
+        return user[this.options.twoFaSecretFieldName];
+    }
+    updateSecret(pk, secret) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const authResource = this.getAuthResource();
+            const connector = this.adminforth.connectors[authResource.dataSource];
+            yield connector.updateRecord({
+                resource: authResource,
+                recordId: pk,
+                newValues: { [this.options.twoFaSecretFieldName]: secret },
+            });
+        });
+    }
+}

package/dist/services/cookieService.d.ts

@@ -0,0 +1,52 @@
+import type { IAdminForth, IAdminForthHttpResponse } from "adminforth";
+import type { PluginOptions } from "../types.js";
+import type { CookieList, HttpHeaders } from "../utils/types.js";
+export type TotpTemporaryPayload = {
+    userName: string;
+    issuer?: string;
+    pk: string;
+    newSecret?: string;
+    userCanSkipSetup?: boolean;
+    sessionDuration?: string;
+};
+export type PasskeyLoginTemporaryPayload = {
+    challenge: string;
+};
+export type RegisterPasskeyTemporaryPayload = {
+    challenge: string;
+    user_id: string;
+};
+export type MfaGracePayload = {
+    hash: string;
+    exp?: number;
+};
+export declare class CookieService {
+    private readonly adminforth;
+    private readonly options;
+    constructor(adminforth: IAdminForth, options: PluginOptions);
+    getAuthSessionCookie(cookies: CookieList): string | null;
+    setAuthCookie(opts: {
+        response: IAdminForthHttpResponse;
+        username: string;
+        pk: string;
+        expireInDuration: string;
+    }): void;
+    getTotpTemporary(cookies: CookieList): string | null;
+    verifyTotpTemporary(cookies: CookieList): Promise<TotpTemporaryPayload | null>;
+    setTotpTemporary(response: IAdminForthHttpResponse, payload: TotpTemporaryPayload): void;
+    removeTotpTemporary(response: IAdminForthHttpResponse): void;
+    getPasskeyLoginTemporary(cookies: CookieList): string | null;
+    verifyPasskeyLoginTemporary(cookies: CookieList): Promise<PasskeyLoginTemporaryPayload | null>;
+    setPasskeyLoginTemporary(response: IAdminForthHttpResponse, challenge: string): void;
+    getRegisterPasskeyTemporary(cookies: CookieList): string | null;
+    verifyRegisterPasskeyTemporary(cookies: CookieList): Promise<RegisterPasskeyTemporaryPayload | null>;
+    setRegisterPasskeyTemporary(response: IAdminForthHttpResponse, payload: RegisterPasskeyTemporaryPayload): void;
+    setMfaGrace(response: IAdminForthHttpResponse, hash: string): void;
+    verifyMfaGrace(cookies: CookieList): Promise<MfaGracePayload | null>;
+    private generateMfaGraceHash;
+    issueMfaGrace(opts: {
+        headers?: HttpHeaders;
+        response?: IAdminForthHttpResponse;
+    }, cookies: CookieList): void;
+    isMfaGraceValid(headers: HttpHeaders, cookies: CookieList, checkIfJWTAboutToExpire?: boolean): Promise<boolean>;
+}

package/dist/services/cookieService.js

@@ -0,0 +1,144 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import crypto from 'crypto';
+const TOTP_TEMP_COOKIE = "2FaTemporaryJWT";
+const PASSKEY_LOGIN_TEMP_COOKIE = "passkeyLoginTemporaryJWT";
+const REGISTER_PASSKEY_TEMP_COOKIE = "registerPasskeyTemporaryJWT";
+const MFA_GRACE_COOKIE = "TempSkip2FA_Modal_JWT";
+const AUTH_COOKIE = "jwt";
+export class CookieService {
+    constructor(adminforth, options) {
+        this.adminforth = adminforth;
+        this.options = options;
+    }
+    getAuthSessionCookie(cookies) {
+        return this.adminforth.auth.getCustomCookie({ cookies, name: AUTH_COOKIE });
+    }
+    setAuthCookie(opts) {
+        this.adminforth.auth.setAuthCookie(opts);
+    }
+    getTotpTemporary(cookies) {
+        return this.adminforth.auth.getCustomCookie({ cookies, name: TOTP_TEMP_COOKIE });
+    }
+    verifyTotpTemporary(cookies) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const jwt = this.getTotpTemporary(cookies);
+            if (!jwt)
+                return null;
+            return this.adminforth.auth.verify(jwt, 'temp2FA');
+        });
+    }
+    setTotpTemporary(response, payload) {
+        var _a;
+        const value = this.adminforth.auth.issueJWT(payload, 'temp2FA', ((_a = this.options.passkeys) === null || _a === void 0 ? void 0 : _a.challengeValidityPeriod) || '1m');
+        this.adminforth.auth.setCustomCookie({
+            response,
+            payload: { name: TOTP_TEMP_COOKIE, value, expiry: undefined, expirySeconds: 10 * 60, httpOnly: true },
+        });
+    }
+    removeTotpTemporary(response) {
+        this.adminforth.auth.removeCustomCookie({ response, name: TOTP_TEMP_COOKIE });
+    }
+    getPasskeyLoginTemporary(cookies) {
+        return this.adminforth.auth.getCustomCookie({ cookies, name: PASSKEY_LOGIN_TEMP_COOKIE });
+    }
+    verifyPasskeyLoginTemporary(cookies) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const jwt = this.getPasskeyLoginTemporary(cookies);
+            if (!jwt)
+                return null;
+            return this.adminforth.auth.verify(jwt, 'tempLoginPasskeyChallenge', false);
+        });
+    }
+    setPasskeyLoginTemporary(response, challenge) {
+        var _a;
+        const value = this.adminforth.auth.issueJWT({ challenge }, 'tempLoginPasskeyChallenge', ((_a = this.options.passkeys) === null || _a === void 0 ? void 0 : _a.challengeValidityPeriod) || '1m');
+        this.adminforth.auth.setCustomCookie({
+            response,
+            payload: { name: PASSKEY_LOGIN_TEMP_COOKIE, value, expiry: undefined, expirySeconds: 10 * 60, httpOnly: true },
+        });
+    }
+    getRegisterPasskeyTemporary(cookies) {
+        return this.adminforth.auth.getCustomCookie({ cookies, name: REGISTER_PASSKEY_TEMP_COOKIE });
+    }
+    verifyRegisterPasskeyTemporary(cookies) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const jwt = this.getRegisterPasskeyTemporary(cookies);
+            if (!jwt)
+                return null;
+            return this.adminforth.auth.verify(jwt, 'registerTempPasskeyChallenge', false);
+        });
+    }
+    setRegisterPasskeyTemporary(response, payload) {
+        var _a;
+        const value = this.adminforth.auth.issueJWT(payload, 'registerTempPasskeyChallenge', ((_a = this.options.passkeys) === null || _a === void 0 ? void 0 : _a.challengeValidityPeriod) || '1m');
+        this.adminforth.auth.setCustomCookie({
+            response,
+            payload: { name: REGISTER_PASSKEY_TEMP_COOKIE, value, expiry: undefined, expirySeconds: 10 * 60, httpOnly: true },
+        });
+    }
+    setMfaGrace(response, hash) {
+        const value = this.adminforth.auth.issueJWT({ hash }, 'MfaGrace', `${this.options.stepUpMfaGracePeriodSeconds}s`);
+        //TODO: fix ts-ignore after releasing new version of adminforth with updated types
+        //@ts-ignore
+        this.adminforth.auth.setCustomCookie({ response, payload: { name: MFA_GRACE_COOKIE, sessionBased: true, value, httpOnly: true } });
+    }
+    verifyMfaGrace(cookies) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const jwt = this.adminforth.auth.getCustomCookie({ cookies, name: MFA_GRACE_COOKIE });
+            if (!jwt)
+                return null;
+            return this.adminforth.auth.verify(jwt, 'MfaGrace', false);
+        });
+    }
+    generateMfaGraceHash(headers, cookies) {
+        const ip = this.adminforth.auth.getClientIp(headers);
+        const userAgent = headers['user-agent'] || '';
+        const acceptLanguage = headers['accept-language'] || '';
+        const sessionCookie = this.getAuthSessionCookie(cookies);
+        if (!process.env.ADMINFORTH_SECRET || !ip || !userAgent || !acceptLanguage || !sessionCookie) {
+            console.error("❗️❗️❗️ Cannot set step-up MFA grace cookie: missing required request headers to identify client ❗️❗️❗️");
+            return null;
+        }
+        return crypto.createHmac('sha256', process.env.ADMINFORTH_SECRET)
+            .update(`${acceptLanguage}_${userAgent}_${ip}_${sessionCookie}`)
+            .digest('hex');
+    }
+    issueMfaGrace(opts, cookies) {
+        if (!opts.response) {
+            console.error("❗️❗️❗️ Cannot set step-up MFA grace cookie: response object is missing. You probably called verify() method without response parameter ❗️❗️❗️");
+            return;
+        }
+        if (!opts.headers) {
+            return;
+        }
+        const hash = this.generateMfaGraceHash(opts.headers, cookies);
+        if (hash) {
+            this.setMfaGrace(opts.response, hash);
+        }
+    }
+    isMfaGraceValid(headers_1, cookies_1) {
+        return __awaiter(this, arguments, void 0, function* (headers, cookies, checkIfJWTAboutToExpire = false) {
+            const hash = this.generateMfaGraceHash(headers, cookies);
+            if (!hash) {
+                return false;
+            }
+            const jwtVerificationResult = yield this.verifyMfaGrace(cookies);
+            if (!jwtVerificationResult) {
+                return false;
+            }
+            if (checkIfJWTAboutToExpire && jwtVerificationResult.exp && (jwtVerificationResult.exp - (Date.now() / 1000)) < 30) {
+                console.error("❗️❗️❗️ Cannot validate step-up MFA grace cookie: token is expired or about to expire ❗️❗️❗️");
+                return false;
+            }
+            return hash === jwtVerificationResult['hash'];
+        });
+    }
+}

package/dist/services/passkeyService.d.ts

@@ -0,0 +1,84 @@
+import type { AdminUser, IAdminForth, IAdminForthHttpResponse } from "adminforth";
+import type { PluginOptions } from "../types.js";
+import { PasskeyRepository } from "../repositories/passkeyRepository.js";
+import { UserRepository } from "../repositories/userRepository.js";
+import { CookieService } from "./cookieService.js";
+import type { CookieList } from "../utils/types.js";
+type PasskeyAuthenticationPayload = {
+    response: string;
+    origin: string;
+};
+type PasskeyRegistrationPayload = {
+    credential: string;
+    origin: string;
+};
+type PluginAuthenticatorAttachment = NonNullable<NonNullable<NonNullable<PluginOptions["passkeys"]>["settings"]["authenticatorSelection"]>["authenticatorAttachment"]>;
+export declare class PasskeyService {
+    private readonly options;
+    private readonly adminforth;
+    private readonly userRepository;
+    private readonly passkeyRepository;
+    private readonly cookieService;
+    constructor(options: PluginOptions, adminforth: IAdminForth, userRepository?: UserRepository, passkeyRepository?: PasskeyRepository, cookieService?: CookieService);
+    private markChallengeAsUsed;
+    private isChallengeUnused;
+    validateLoginChallengeCookie(cookies: CookieList): Promise<{
+        ok: boolean;
+        decodedPasskeysCookies?: {
+            challenge: string;
+        };
+        error?: string;
+    }>;
+    verifyPasskeyResponse(body: PasskeyAuthenticationPayload, user_id: string, cookies: {
+        challenge: string;
+    }): Promise<import("../utils/types.js").ErrorResponse | {
+        ok: boolean;
+        passkeyConfirmed: boolean;
+    }>;
+    createRegistrationOptions(mode: PluginAuthenticatorAttachment, adminUser: AdminUser, response: IAdminForthHttpResponse): Promise<import("../utils/types.js").ErrorResponse | {
+        ok: boolean;
+        data: import("@simplewebauthn/server").PublicKeyCredentialCreationOptionsJSON;
+    }>;
+    finishRegistration(body: PasskeyRegistrationPayload, adminUser: AdminUser, cookies: CookieList): Promise<{
+        error: string;
+        ok?: undefined;
+    } | {
+        ok: boolean;
+        error?: undefined;
+    }>;
+    createLoginOptions(response: IAdminForthHttpResponse): Promise<{
+        ok: boolean;
+        data: import("@simplewebauthn/server").PublicKeyCredentialRequestOptionsJSON;
+        error?: undefined;
+    } | {
+        ok: boolean;
+        error: string;
+        data?: undefined;
+    }>;
+    getPasskeys(adminUser: AdminUser): Promise<import("../utils/types.js").ErrorResponse | {
+        ok: boolean;
+        data: any[];
+        authenticatorAttachment: "platform" | "cross-platform" | "both";
+    }>;
+    deletePasskey(credentialID: string, adminUser: AdminUser): Promise<import("../utils/types.js").ErrorResponse | {
+        ok: boolean;
+    }>;
+    renamePasskey(credentialID: string, newName: string, adminUser: AdminUser): Promise<import("../utils/types.js").ErrorResponse | {
+        ok: boolean;
+    }>;
+    checkIfUserHasPasskeys(cookies: CookieList): Promise<import("../utils/types.js").ErrorResponse | {
+        ok: boolean;
+        hasPasskeys: boolean;
+    }>;
+    hasPasskeysForUser(userId: string): Promise<boolean>;
+    getLoginUserByPasskeyResponse(passkeyResponse: PasskeyAuthenticationPayload, cookies: CookieList): Promise<{
+        error: string;
+        ok?: undefined;
+        user?: undefined;
+    } | {
+        ok: boolean;
+        user: import("../utils/types.js").AnyRecord;
+        error?: undefined;
+    }>;
+}
+export {};