@adminforth/two-factors-auth 3.3.9 → 4.0.0

package/dist/services/passkeyService.js

@@ -0,0 +1,369 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { convertPeriodToSeconds } from "adminforth";
+import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse } from '@simplewebauthn/server';
+import { isoUint8Array, isoBase64URL } from '@simplewebauthn/server/helpers';
+import aaguids from '../custom/aaguid.json';
+import { PasskeyRepository } from "../repositories/passkeyRepository.js";
+import { UserRepository } from "../repositories/userRepository.js";
+import { CookieService } from "./cookieService.js";
+import { errorMessage, errorResult, prefixedErrorResult } from "../utils/errors.js";
+export class PasskeyService {
+    constructor(options, adminforth, userRepository = new UserRepository(adminforth, options), passkeyRepository = new PasskeyRepository(adminforth, options), cookieService = new CookieService(adminforth, options)) {
+        this.options = options;
+        this.adminforth = adminforth;
+        this.userRepository = userRepository;
+        this.passkeyRepository = passkeyRepository;
+        this.cookieService = cookieService;
+    }
+    markChallengeAsUsed(challenge, expiresIn) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const expiresInSeconds = expiresIn ? convertPeriodToSeconds(expiresIn) : undefined;
+            yield this.options.passkeys.keyValueAdapter.set(challenge, 'stub_value', expiresInSeconds);
+        });
+    }
+    isChallengeUnused(challenge) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const res = yield this.options.passkeys.keyValueAdapter.get(challenge);
+            return !res;
+        });
+    }
+    validateLoginChallengeCookie(cookies) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const passkeysCookies = this.cookieService.getPasskeyLoginTemporary(cookies);
+            if (!passkeysCookies) {
+                return errorResult('Passkey token is required');
+            }
+            const decodedPasskeysCookies = yield this.cookieService.verifyPasskeyLoginTemporary(cookies);
+            if (!(decodedPasskeysCookies === null || decodedPasskeysCookies === void 0 ? void 0 : decodedPasskeysCookies.challenge)) {
+                return errorResult('Invalid passkey');
+            }
+            const isChallangeValid = yield this.isChallengeUnused(decodedPasskeysCookies.challenge);
+            if (isChallangeValid) {
+                yield this.markChallengeAsUsed(decodedPasskeysCookies.challenge, ((_a = this.options.passkeys) === null || _a === void 0 ? void 0 : _a.challengeValidityPeriod) || '2m');
+            }
+            if (!decodedPasskeysCookies || !isChallangeValid) {
+                return errorResult('Invalid passkey');
+            }
+            return { ok: true, decodedPasskeysCookies };
+        });
+    }
+    verifyPasskeyResponse(body, user_id, cookies) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f;
+            const settingsOrigin = (_a = this.options.passkeys) === null || _a === void 0 ? void 0 : _a.settings.expectedOrigin;
+            const expectedOrigin = body.origin;
+            const expectedChallenge = cookies.challenge;
+            const expectedRPID = ((_d = (_c = (_b = this.options.passkeys) === null || _b === void 0 ? void 0 : _b.settings) === null || _c === void 0 ? void 0 : _c.rp) === null || _d === void 0 ? void 0 : _d.id) || (new URL(settingsOrigin)).hostname;
+            try {
+                const response = JSON.parse(body.response);
+                if (settingsOrigin !== expectedOrigin) {
+                    throw new Error(`Origin mismatch. Allowed in settings: ${settingsOrigin}, received from client: ${expectedOrigin}`);
+                }
+                const cred = yield this.passkeyRepository.getByCredentialId(response.id);
+                if (!cred) {
+                    throw new Error('Credential not found.');
+                }
+                const credMeta = cred[this.options.passkeys.credentialMetaFieldName];
+                if (!credMeta || !credMeta.public_key) {
+                    throw new Error('Credential public key not found.');
+                }
+                const usersPrimaryKeyFieldName = this.userRepository.getUserPkField();
+                const user = yield this.userRepository.getAuthUser(cred[this.options.passkeys.credentialUserIdFieldName]);
+                if (!user || !user_id || user[usersPrimaryKeyFieldName] !== user_id) {
+                    throw new Error('User not found.');
+                }
+                const counter = (_e = credMeta.sign_count) !== null && _e !== void 0 ? _e : 0;
+                const { verified, authenticationInfo } = yield verifyAuthenticationResponse({
+                    response,
+                    expectedChallenge,
+                    expectedOrigin: settingsOrigin,
+                    expectedRPID,
+                    credential: {
+                        id: cred[this.options.passkeys.credentialIdFieldName],
+                        publicKey: isoBase64URL.toBuffer(credMeta.public_key),
+                        counter,
+                        transports: credMeta.transports,
+                    },
+                    requireUserVerification: ((_f = this.options.passkeys) === null || _f === void 0 ? void 0 : _f.settings.authenticatorSelection.userVerification) === 'discouraged' ? false : true,
+                });
+                if (!verified) {
+                    return errorResult('User verification failed.');
+                }
+                credMeta.sign_count = authenticationInfo.newCounter;
+                credMeta.last_used_at = new Date().toISOString();
+                yield this.passkeyRepository.updateMeta(cred, credMeta);
+                return { ok: true, passkeyConfirmed: true };
+            }
+            catch (e) {
+                return prefixedErrorResult('Error authenticating passkey: ', e);
+            }
+        });
+    }
+    createRegistrationOptions(mode, adminUser, response) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
+            const settingsOrigin = (_a = this.options.passkeys) === null || _a === void 0 ? void 0 : _a.settings.expectedOrigin;
+            const authenticatorAttachment = mode === "both" ? undefined : mode;
+            const rp = {
+                name: ((_c = (_b = this.options.passkeys) === null || _b === void 0 ? void 0 : _b.settings.rp) === null || _c === void 0 ? void 0 : _c.name) || this.adminforth.config.customization.brandName,
+                id: ((_f = (_e = (_d = this.options.passkeys) === null || _d === void 0 ? void 0 : _d.settings) === null || _e === void 0 ? void 0 : _e.rp) === null || _f === void 0 ? void 0 : _f.id) || (new URL(settingsOrigin)).hostname,
+            };
+            const userInfo = yield this.userRepository.getAuthUser(adminUser.pk);
+            if (!userInfo) {
+                return errorResult('User not found');
+            }
+            const user = {
+                pk: adminUser.pk,
+                name: userInfo[(_g = this.options.passkeys) === null || _g === void 0 ? void 0 : _g.settings.user.nameField],
+                displayName: userInfo[(_h = this.options.passkeys) === null || _h === void 0 ? void 0 : _h.settings.user.displayNameField] ? userInfo[(_j = this.options.passkeys) === null || _j === void 0 ? void 0 : _j.settings.user.displayNameField] : userInfo[(_k = this.options.passkeys) === null || _k === void 0 ? void 0 : _k.settings.user.nameField],
+            };
+            const excludeCredentials = [];
+            const temp = yield this.passkeyRepository.listByUserId(adminUser.pk);
+            for (const rec of temp) {
+                const credentialId = rec[this.options.passkeys.credentialIdFieldName];
+                if (credentialId) {
+                    const meta = rec[this.options.passkeys.credentialMetaFieldName];
+                    excludeCredentials.push({
+                        id: credentialId,
+                        type: "public-key",
+                        transports: meta.transports || []
+                    });
+                }
+            }
+            const options = yield generateRegistrationOptions({
+                rpName: rp.name,
+                rpID: rp.id,
+                userID: isoUint8Array.fromUTF8String(user.pk),
+                userName: user.name,
+                userDisplayName: user.displayName,
+                excludeCredentials,
+                authenticatorSelection: {
+                    authenticatorAttachment,
+                    requireResidentKey: (_m = (_l = this.options.passkeys) === null || _l === void 0 ? void 0 : _l.settings.authenticatorSelection.requireResidentKey) !== null && _m !== void 0 ? _m : true,
+                    userVerification: ((_o = this.options.passkeys) === null || _o === void 0 ? void 0 : _o.settings.authenticatorSelection.userVerification) || "required"
+                },
+            });
+            this.cookieService.setRegisterPasskeyTemporary(response, { challenge: options.challenge, user_id: adminUser.pk });
+            return { ok: true, data: options };
+        });
+    }
+    finishRegistration(body, adminUser, cookies) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f;
+            const passkeysCookies = this.cookieService.getRegisterPasskeyTemporary(cookies);
+            if (!passkeysCookies) {
+                return { error: 'Passkey token is required' };
+            }
+            const decodedPasskeysCookies = yield this.cookieService.verifyRegisterPasskeyTemporary(cookies);
+            if (!decodedPasskeysCookies) {
+                return { error: 'Invalid passkey token' };
+            }
+            if (decodedPasskeysCookies.user_id !== adminUser.pk) {
+                return { error: 'Invalid user' };
+            }
+            const secret = this.userRepository.getSecret(adminUser.dbUser);
+            if (!secret || secret.length === 0) {
+                return { error: 'TOTP must be set up before registering a passkey' };
+            }
+            const settingsOrigin = (_a = this.options.passkeys) === null || _a === void 0 ? void 0 : _a.settings.expectedOrigin;
+            const expectedOrigin = body.origin;
+            const expectedChallenge = decodedPasskeysCookies.challenge;
+            const expectedRPID = ((_d = (_c = (_b = this.options.passkeys) === null || _b === void 0 ? void 0 : _b.settings) === null || _c === void 0 ? void 0 : _c.rp) === null || _d === void 0 ? void 0 : _d.id) || (new URL(settingsOrigin)).hostname;
+            try {
+                const response = JSON.parse(body.credential);
+                if (settingsOrigin !== expectedOrigin) {
+                    throw new Error('Invalid origin');
+                }
+                const { verified, registrationInfo } = yield verifyRegistrationResponse({
+                    response,
+                    expectedChallenge,
+                    expectedOrigin,
+                    expectedRPID,
+                    requireUserVerification: ((_e = this.options.passkeys) === null || _e === void 0 ? void 0 : _e.settings.authenticatorSelection.userVerification) === 'discouraged' ? false : true,
+                });
+                if (!verified) {
+                    throw new Error('Verification failed.');
+                }
+                const { aaguid, credential, } = registrationInfo;
+                const provider_name = ((_f = aaguids[aaguid]) === null || _f === void 0 ? void 0 : _f.name) || 'Unknown provider';
+                const credentialPublicKey = credential.publicKey;
+                const credentialID = credential.id;
+                const base64CredentialID = credentialID;
+                const base64PublicKey = isoBase64URL.fromBuffer(credentialPublicKey);
+                yield this.passkeyRepository.create({
+                    [this.options.passkeys.credentialIdFieldName]: base64CredentialID,
+                    [this.options.passkeys.credentialUserIdFieldName]: adminUser.pk,
+                    [this.options.passkeys.credentialMetaFieldName]: {
+                        public_key: base64PublicKey,
+                        public_key_algorithm: response.response.publicKeyAlgorithm,
+                        sign_count: 0,
+                        transports: response.response.transports,
+                        created_at: new Date().toISOString(),
+                        last_used_at: new Date().toISOString(),
+                        aaguid: aaguid,
+                        name: provider_name,
+                    },
+                }, adminUser);
+            }
+            catch (error) {
+                console.error(error);
+                return { error: 'Error registering passkey: ' + errorMessage(error) };
+            }
+            return { ok: true };
+        });
+    }
+    createLoginOptions(response) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
+            try {
+                const options = yield generateAuthenticationOptions({
+                    rpID: ((_b = (_a = this.options.passkeys) === null || _a === void 0 ? void 0 : _a.settings.rp) === null || _b === void 0 ? void 0 : _b.id) || (new URL((_c = this.options.passkeys) === null || _c === void 0 ? void 0 : _c.settings.expectedOrigin)).hostname,
+                    userVerification: ((_d = this.options.passkeys) === null || _d === void 0 ? void 0 : _d.settings.authenticatorSelection.userVerification) || "required"
+                });
+                this.cookieService.setPasskeyLoginTemporary(response, options.challenge);
+                return { ok: true, data: options };
+            }
+            catch (e) {
+                return { ok: false, error: errorMessage(e) };
+            }
+        });
+    }
+    getPasskeys(adminUser) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            let passkeys;
+            try {
+                passkeys = yield this.passkeyRepository.listByUserId(adminUser.pk);
+            }
+            catch (error) {
+                return prefixedErrorResult('Error fetching passkeys: ', error);
+            }
+            let dataToReturn = [];
+            for (const pk of passkeys) {
+                const parsedKey = pk[this.options.passkeys.credentialMetaFieldName];
+                dataToReturn.push({
+                    name: parsedKey.name,
+                    light_icon: ((_a = aaguids[parsedKey.aaguid]) === null || _a === void 0 ? void 0 : _a.icon_light) || null,
+                    dark_icon: ((_b = aaguids[parsedKey.aaguid]) === null || _b === void 0 ? void 0 : _b.icon_dark) || null,
+                    created_at: parsedKey.created_at,
+                    last_used_at: parsedKey.last_used_at,
+                    id: pk[this.options.passkeys.credentialIdFieldName],
+                });
+            }
+            return { ok: true, data: dataToReturn, authenticatorAttachment: ((_c = this.options.passkeys) === null || _c === void 0 ? void 0 : _c.settings.authenticatorSelection.authenticatorAttachment) || 'both' };
+        });
+    }
+    deletePasskey(credentialID, adminUser) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!credentialID) {
+                return errorResult('Passkey ID is required');
+            }
+            const passkeyRecord = yield this.passkeyRepository.getByCredentialIdAndUserId(credentialID, adminUser.pk);
+            if (!passkeyRecord) {
+                return errorResult('Passkey not found');
+            }
+            try {
+                yield this.passkeyRepository.delete(passkeyRecord, adminUser);
+            }
+            catch (error) {
+                return prefixedErrorResult('Error deleting passkey: ', error);
+            }
+            return { ok: true };
+        });
+    }
+    renamePasskey(credentialID, newName, adminUser) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!credentialID) {
+                return errorResult('Passkey ID is required');
+            }
+            if (!newName) {
+                return errorResult('New name is required');
+            }
+            const passkeyRecord = yield this.passkeyRepository.getByCredentialIdAndUserId(credentialID, adminUser.pk);
+            if (!passkeyRecord) {
+                return errorResult('Passkey not found');
+            }
+            const metaField = this.options.passkeys.credentialMetaFieldName;
+            const oldMeta = passkeyRecord[metaField];
+            const newMeta = Object.assign(Object.assign({}, oldMeta), { name: newName });
+            const newRecord = Object.assign(Object.assign({}, passkeyRecord), { [metaField]: newMeta });
+            try {
+                yield this.passkeyRepository.update(passkeyRecord, newRecord, adminUser);
+            }
+            catch (error) {
+                return prefixedErrorResult('Error renaming passkey: ', error);
+            }
+            return { ok: true };
+        });
+    }
+    checkIfUserHasPasskeys(cookies) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.options.passkeys) {
+                return { ok: false, hasPasskeys: false };
+            }
+            const decoded = yield this.cookieService.verifyTotpTemporary(cookies);
+            if (!decoded)
+                return errorResult('Invalid token');
+            if (decoded.newSecret) {
+                return { ok: true, hasPasskeys: false };
+            }
+            const hasPasskeys = yield this.passkeyRepository.hasByUserId(decoded.pk);
+            if (hasPasskeys) {
+                return { ok: true, hasPasskeys: true };
+            }
+            else {
+                return { ok: true, hasPasskeys: false };
+            }
+        });
+    }
+    hasPasskeysForUser(userId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.passkeyRepository.hasByUserId(userId);
+        });
+    }
+    getLoginUserByPasskeyResponse(passkeyResponse, cookies) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const cookiesValidationResult = yield this.validateLoginChallengeCookie(cookies);
+            if (!cookiesValidationResult.ok) {
+                return { error: cookiesValidationResult.error };
+            }
+            let parsedPasskeyResponse;
+            try {
+                parsedPasskeyResponse = JSON.parse(passkeyResponse.response);
+            }
+            catch (e) {
+                return { error: 'Malformed passkey response' };
+            }
+            const credential_id = parsedPasskeyResponse.id;
+            if (!credential_id) {
+                return { error: 'Credential ID is required' };
+            }
+            const passkeyRecord = yield this.passkeyRepository.getByCredentialId(credential_id);
+            if (!passkeyRecord) {
+                return { error: 'No such passkey found, most likely it was removed on this website but you still have it on your device' };
+            }
+            const userPk = passkeyRecord[this.options.passkeys.credentialUserIdFieldName];
+            if (!userPk) {
+                return { error: 'User ID not found in passkey record' };
+            }
+            const user = yield this.userRepository.getAuthUser(userPk);
+            if (!user) {
+                return { error: 'User not found' };
+            }
+            const verificationResult = yield this.verifyPasskeyResponse(passkeyResponse, userPk, cookiesValidationResult.decodedPasskeysCookies);
+            if (!verificationResult.ok || !verificationResult.passkeyConfirmed) {
+                return { error: 'Passkey verification failed' };
+            }
+            return { ok: true, user };
+        });
+    }
+}

package/dist/services/totpService.d.ts

@@ -0,0 +1,21 @@
+import type { AdminUser } from "adminforth";
+import type { PluginOptions } from "../types.js";
+import { UserRepository } from "../repositories/userRepository.js";
+export declare class TotpService {
+    private readonly options;
+    private readonly userRepository;
+    constructor(options: PluginOptions, userRepository: UserRepository);
+    generateSecret(issuerName: string, userName: string): string;
+    verifySecret(secret: string, code: string): boolean;
+    verifyUserCode(userPk: string, code: string): Promise<{
+        ok: true;
+    } | {
+        error: string;
+    }>;
+    verifyAdminUserCode(adminUser: AdminUser, code: string): Promise<{
+        ok: true;
+    } | {
+        error: string;
+    }>;
+    saveSecret(userPk: string, secret: string): Promise<void>;
+}

package/dist/services/totpService.js

@@ -0,0 +1,43 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import twofactor from 'node-2fa';
+export class TotpService {
+    constructor(options, userRepository) {
+        this.options = options;
+        this.userRepository = userRepository;
+    }
+    generateSecret(issuerName, userName) {
+        return twofactor.generateSecret({ name: issuerName, account: userName }).secret;
+    }
+    verifySecret(secret, code) {
+        return Boolean(twofactor.verifyToken(secret, code, this.options.timeStepWindow));
+    }
+    verifyUserCode(userPk, code) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const user = yield this.userRepository.getAuthUser(userPk);
+            if (!user)
+                return { error: "User not found" };
+            const secret = this.userRepository.getSecret(user);
+            if (!secret)
+                return { error: "2FA is not set up for this user" };
+            return this.verifySecret(secret, code) ? { ok: true } : { error: "Wrong or expired OTP code" };
+        });
+    }
+    verifyAdminUserCode(adminUser, code) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.verifyUserCode(this.userRepository.getUserPk(adminUser), code);
+        });
+    }
+    saveSecret(userPk, secret) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.userRepository.updateSecret(userPk, secret);
+        });
+    }
+}

package/dist/services/verifyMfaConfirmation.d.ts

@@ -0,0 +1,30 @@
+import type { AdminUser, HttpExtra, IAdminForthHttpResponse } from "adminforth";
+import type { CookieList } from "../utils/types.js";
+type TotpConfirmationResult = {
+    mode: "totp";
+    result: string;
+};
+type PasskeyConfirmationResult = {
+    mode: "passkey";
+    result: {
+        response: string;
+        origin: string;
+    };
+};
+type GraceConfirmationResult = {
+    mode?: undefined;
+};
+export type MfaConfirmationResult = TotpConfirmationResult | PasskeyConfirmationResult | GraceConfirmationResult;
+export type VerifyOptions = {
+    adminUser: AdminUser;
+    userPk: string;
+    cookies?: CookieList;
+    response?: IAdminForthHttpResponse;
+    extra?: HttpExtra;
+};
+export declare function verifyMfaConfirmation(ctx: any, confirmationResult: MfaConfirmationResult, opts: VerifyOptions): Promise<{
+    ok: true;
+} | {
+    error: string;
+}>;
+export {};

package/dist/services/verifyMfaConfirmation.js

@@ -0,0 +1,67 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+export function verifyMfaConfirmation(ctx, confirmationResult, opts) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d, _e;
+        if (!confirmationResult)
+            return { error: "Confirmation result is required" };
+        const cookies = ((_a = opts.extra) === null || _a === void 0 ? void 0 : _a.cookies) || opts.cookies;
+        const response = ((_b = opts.extra) === null || _b === void 0 ? void 0 : _b.response) || opts.response;
+        if (ctx.options.usersFilterToApply) {
+            const res = ctx.options.usersFilterToApply(opts.adminUser);
+            if (res === false) {
+                return { ok: true };
+            }
+        }
+        if (ctx.options.usersFilterToAllowSkipSetup) {
+            const res = yield ctx.checkIfSkipSetupAllowSkipVerify(opts.adminUser);
+            if (res.skipAllowed === true) {
+                return { ok: true };
+            }
+        }
+        if (ctx.options.stepUpMfaGracePeriodSeconds && ((_c = opts.extra) === null || _c === void 0 ? void 0 : _c.headers) && !confirmationResult.mode) {
+            const verificationResult = yield ctx.cookieService.isMfaGraceValid(opts.extra.headers, cookies);
+            if (verificationResult === true) {
+                return { ok: true };
+            }
+        }
+        const mode = confirmationResult.mode;
+        if (!mode) {
+            return { error: "Unsupported confirmation mode" };
+        }
+        if (mode === "totp") {
+            const { result: code } = confirmationResult;
+            const verificationResult = yield ctx.totpService.verifyUserCode(opts.userPk, code);
+            if ('ok' in verificationResult && verificationResult.ok) {
+                if (ctx.options.stepUpMfaGracePeriodSeconds) {
+                    ctx.cookieService.issueMfaGrace({ headers: (_d = opts.extra) === null || _d === void 0 ? void 0 : _d.headers, response }, cookies);
+                }
+                return { ok: true };
+            }
+            return verificationResult;
+        }
+        else if (mode === "passkey") {
+            const { result } = confirmationResult;
+            const cookiesValidationResult = yield ctx.passkeyService.validateLoginChallengeCookie(cookies);
+            if (!cookiesValidationResult.ok) {
+                return { error: cookiesValidationResult.error };
+            }
+            const verificationResult = yield ctx.passkeyService.verifyPasskeyResponse(result, opts.userPk, cookiesValidationResult.decodedPasskeysCookies);
+            if (verificationResult.ok && verificationResult.passkeyConfirmed) {
+                if (ctx.options.stepUpMfaGracePeriodSeconds) {
+                    ctx.cookieService.issueMfaGrace({ headers: (_e = opts.extra) === null || _e === void 0 ? void 0 : _e.headers, response }, cookies);
+                }
+                return { ok: true };
+            }
+            return { error: "Invalid passkey" };
+        }
+        return { error: "Unsupported confirmation mode" };
+    });
+}

package/dist/types.d.ts

@@ -0,0 +1,116 @@
+import { AdminUser, KeyValueAdapter } from "adminforth";
+import { type PluginsCommonOptions } from "adminforth";
+export interface PluginOptions extends PluginsCommonOptions {
+    /**
+     * Name of the field in the auth resource which will store 2FA secret.
+     *
+     * Resource mandatory should have one columns which defined {@link AdminForthResourceColumn} which
+     * name should be equal to the value .
+     */
+    twoFaSecretFieldName: string;
+    /**
+     * Not-negative optional time step window for 2FA. This value means that the user will be able to enter the old code
+     * for the next 30 seconds after the new code was generated.
+     */
+    timeStepWindow?: number;
+    /**
+     * Number of seconds for step-up MFA grace period.
+     * During this period, user will not be challenged with 2FA on sensitive actions.
+     */
+    stepUpMfaGracePeriodSeconds?: number;
+    customBrandPrefix?: string;
+    /**
+     * Passkeys (WebAuthn) configuration.
+     */
+    passkeys?: {
+        credentialResourceID: string;
+        credentialIdFieldName: string;
+        credentialMetaFieldName: string;
+        credentialUserIdFieldName: string;
+        /**
+         * KeyValueAdapter is required to make sure that generated challenge can't be reused more than once
+         */
+        keyValueAdapter: KeyValueAdapter;
+        /**
+         * Allow login with Passkeys even if 2FA is not set up. Default is true.
+         */
+        allowLoginWithPasskeys?: boolean;
+        /**
+         * Remember user for number of days after login with Passkey, so that user won't be challenged with 2FA on every login.
+         */
+        rememberDaysAfterPasskeyLogin?: number;
+        /**
+         * Order of "Continue with passkey" button in under login button injection
+         */
+        continueWithButtonsOrder?: number;
+        /**
+         *  Period between showing alert suggesting to set up Passkeys if not set up yet.
+         */
+        suggestionPeriod?: string;
+        /**
+         * Challenge period for Passkeys authentication.
+         */
+        challengeValidityPeriod?: string;
+        /**
+         *  Passkeys settings for WebAuthn API.
+         */
+        settings: {
+            /**
+             * The origin that you expect the authentication to come from. (e.g. https://example.com or http://localhost:3000)
+             */
+            expectedOrigin: string;
+            rp?: {
+                /**
+                 * The Relying Party name.
+                 */
+                name?: string;
+                /**
+                 * The Relying Party ID. A domain or subdomain (e.g. example.com or login.example.com).
+                 */
+                id?: string;
+            };
+            user: {
+                /**
+                 * Field in users resource, that user will recognize as unique user ID.(e.g. email or username)
+                 */
+                nameField: string;
+                /**
+                 * Field in users resource, that user will recognize as display name.(e.g. full name)
+                 */
+                displayNameField?: string;
+            };
+            authenticatorSelection?: {
+                /**
+                 * The preferred authenticator attachment. It can be either "platform", "cross-platform" or "both".
+                 * Default to "platform".
+                 */
+                authenticatorAttachment?: 'platform' | 'cross-platform' | 'both';
+                /**
+                 * Set it to a boolean true. A discoverable credential (resident key)
+                 * stores user information to the passkey and lets users select the account upon authentication.
+                 * Default to "True".
+                 */
+                requireResidentKey?: boolean;
+                /**
+                 * Indicates whether a user verification using the device screen lock is "required" or "discouraged".
+                 * The default is "required".
+                 */
+                userVerification?: 'required' | 'discouraged';
+            };
+        };
+    };
+    /**
+     * Optional function to filter users to apply 2FA.
+     * Should return true if 2FA should be applied to the user and false if AdminForth should not challenge the user with 2FA.
+     * @param adminUser
+     * @returns true if 2FA should be applied to the user and false if AdminForth should not challenge the user with 2FA.
+     */
+    usersFilterToApply?: (adminUser: AdminUser) => boolean;
+    /**
+     * Optional function to allow users to skip 2FA setup.
+     * Should return true if the user should be allowed to skip the 2FA setup and false if AdminForth should require the user to set up 2FA.
+     * @param adminUser
+     * @returns true if the user should be allowed to skip the 2FA setup and false if AdminForth should require the user to set up 2FA.
+     */
+    usersFilterToAllowSkipSetup?: (adminUser: AdminUser) => boolean;
+}

package/dist/utils/errors.d.ts

@@ -0,0 +1,4 @@
+import type { ErrorResponse } from "./types.js";
+export declare function errorMessage(error: unknown): string;
+export declare function errorResult(message: string): ErrorResponse;
+export declare function prefixedErrorResult(prefix: string, error: unknown): ErrorResponse;

package/dist/utils/errors.js

@@ -0,0 +1,9 @@
+export function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+export function errorResult(message) {
+    return { ok: false, error: message };
+}
+export function prefixedErrorResult(prefix, error) {
+    return errorResult(`${prefix}${errorMessage(error)}`);
+}

package/dist/utils/parsePeriod.d.ts

@@ -0,0 +1 @@
+export declare function parsePeriod(period?: string): number;