@arthur.eudeline/payload-plugin-mfa 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Arthur Eudeline
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,124 @@
+# @arthur-eudeline/payload-plugin-mfa
+
+Two-factor authentication for the [Payload CMS](https://payloadcms.com) 3 admin panel: TOTP
+(Google Authenticator, 1Password, Aegis…) plus one-time backup codes. Payload 3 ships nothing for
+this — the plugin adds the fields, the endpoints, the login step and the enrolment UI.
+
+```bash
+pnpm add @arthur-eudeline/payload-plugin-mfa
+```
+
+```ts
+// payload.config.ts
+import { mfaPlugin } from '@arthur-eudeline/payload-plugin-mfa';
+
+export default buildConfig({
+  admin: { user: 'users' },
+  collections: [Users /* … */],
+  plugins: [mfaPlugin({ issuer: 'Acme' })],
+});
+```
+
+Then, once:
+
+```bash
+pnpm payload generate:types
+pnpm payload generate:importmap
+pnpm payload migrate:create   # the plugin adds columns
+```
+
+That is the whole setup. Users enable 2FA themselves from `/admin/account`; the next sign-in asks
+for a code.
+
+## What it does
+
+- **Enrolment** — a panel on the user's own account renders a QR code, confirms the secret with a
+  first valid code, then shows ten single-use backup codes once.
+- **Sign-in** — `/admin/login` is replaced by a two-step form: email + password first, then the
+  code, only for accounts that have 2FA on. Backup codes are accepted in the same field.
+- **Recovery** — `resetMfa()` for the one dead end the UI can't fix (phone _and_ backup codes lost).
+
+## Security properties
+
+- The TOTP secret is encrypted at rest with `payload.encrypt` (keyed on `PAYLOAD_SECRET`); backup
+  codes are stored as per-code salted scrypt hashes, never in clear.
+- Every MFA field denies `create`/`update` through the API and the secrets also deny `read`. The
+  only write path is the plugin's own endpoints, which use `overrideAccess`. A `PATCH` on
+  `/api/users/:id` from a stolen session can neither disable 2FA nor plant a chosen secret.
+- The last accepted TOTP timestep is recorded, so an intercepted code cannot be replayed within its
+  ±30 s validity window.
+- Five consecutive invalid codes lock the second factor for 15 minutes (both configurable). Payload's
+  own `maxLoginAttempts` does not cover this: a bad code rolls the login transaction back, taking
+  the attempt counter with it — which is why the counter is written from an `afterError` hook.
+- Every endpoint acts on `req.user` only. No account can enrol, unlock or disable another.
+- Disabling 2FA requires a valid TOTP code rather than the password: verifying a password outside
+  the login flow would mean reimplementing Payload's internal hashing (`authenticateLocalStrategy`
+  is not exported), and `payload.login()` would mint a stray session. Re-asking for the second
+  factor is the guarantee that matters here — it blocks a stolen session, which is what 2FA is for.
+
+## Options
+
+| Option              | Default                                 |                                                                                                                        |
+| ------------------- | --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
+| `collections`       | `[config.admin.user]`                   | Auth collections to protect.                                                                                           |
+| `issuer`            | `admin.meta.titleSuffix` ?? `'Payload'` | Name shown in the authenticator app.                                                                                   |
+| `enabled`           | `true`                                  | `false` neutralises the behaviour but **keeps the fields**, so an already-migrated database doesn't lose its columns.  |
+| `fieldName`         | `'mfa'`                                 | Name of the field group added to the collection.                                                                       |
+| `backupCodeCount`   | `10`                                    | Backup codes issued on activation.                                                                                     |
+| `maxAttempts`       | `5`                                     | Consecutive invalid codes before locking.                                                                              |
+| `lockDuration`      | `900000`                                | Lock duration, in milliseconds.                                                                                        |
+| `overrideLoginView` | `true`                                  | Set `false` to keep your own login view — then mount `MfaLoginForm` yourself, or handle the `MFA_REQUIRED` error code. |
+| `labels`            | —                                       | Per-language label overrides: `{ fr: { panelTitle: '…' } }`.                                                           |
+| `language`          | admin language                          | Pins the label language instead of following the admin's.                                                              |
+
+English and French are built in; any other admin language falls back to English.
+
+## HTTP surface
+
+All five are mounted on the protected collection and act on the caller only.
+
+|                                           |                                                                                                            |
+| ----------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
+| `GET /api/<collection>/mfa/status`        | `{ enabled, confirmedAt, backupCodesRemaining, hasPendingSecret }`                                         |
+| `POST /api/<collection>/mfa/setup`        | → `{ secret, qrCode }` (data URL). Stores a _pending_ secret; sign-in is unaffected until it is confirmed. |
+| `POST /api/<collection>/mfa/activate`     | `{ code }` → `{ backupCodes }`. The only time backup codes are readable.                                   |
+| `POST /api/<collection>/mfa/backup-codes` | `{ code }` → `{ backupCodes }`. Invalidates the previous set.                                              |
+| `POST /api/<collection>/mfa/disable`      | `{ code }` → `{ enabled: false }`                                                                          |
+
+On sign-in, `POST /api/<collection>/login` accepts an extra `mfaCode` field. Without it, an enrolled
+account gets `401` with `errors[0].data.code === 'MFA_REQUIRED'`; a wrong code gives `MFA_INVALID`,
+and a locked account `MFA_LOCKED` (`429`). Those constants are exported as `MFA_ERROR_CODES`.
+
+> **Note for plugin authors.** The error codes above are delivered through `formatErrors`'s
+> `Array.isArray(message)` branch rather than an `APIError`'s `data` field. Payload only forwards
+> `data` for an error it recognises with `instanceof APIError`, and that check fails in a Next.js
+> production build — `withPayload` externalises `payload` only in development, so the bundled copy
+> the plugin throws from is not the one `formatErrors` compares against. Going through the array
+> branch is identity-independent and behaves the same in dev and in production.
+
+## Recovery
+
+```ts
+import { resetMfa } from '@arthur-eudeline/payload-plugin-mfa';
+
+await resetMfa({ payload, email: 'someone@example.com' });
+```
+
+Server-side and privileged — call it from an admin script, never from an exposed route.
+
+## Exports
+
+|                                              |                                                                    |
+| -------------------------------------------- | ------------------------------------------------------------------ |
+| `@arthur-eudeline/payload-plugin-mfa`        | `mfaPlugin`, `resetMfa`, `MFA_ERROR_CODES`, `builtInLabels`, types |
+| `@arthur-eudeline/payload-plugin-mfa/client` | `MfaPanel`, `MfaLoginForm`, `resolveLabels`                        |
+| `@arthur-eudeline/payload-plugin-mfa/rsc`    | `MfaLoginView`                                                     |
+
+## Requirements
+
+Payload 3.88+, React 19, Next 15 or 16. The database adapter must support transactions (the
+Postgres, SQLite and MongoDB adapters all do).
+
+## License
+
+MIT

package/dist/backup-codes.d.ts

@@ -0,0 +1,28 @@
+export declare const DEFAULT_BACKUP_CODE_COUNT = 10;
+export type StoredBackupCode = {
+    hash: string;
+    salt: string;
+    usedAt: null | string;
+};
+/** Tolère la casse et les séparateurs, pour que « abcd-efgh » et « ABCDEFGH » soient équivalents. */
+export declare function normalizeBackupCode(code: string): string;
+/**
+ * Retourne les codes en clair — à afficher une seule fois — et leur version stockée en base.
+ * Les codes en clair ne sont jamais persistés.
+ */
+export declare function generateBackupCodes(count?: number): {
+    plain: string[];
+    stored: StoredBackupCode[];
+};
+/**
+ * Cherche `candidate` parmi les codes non encore utilisés et le marque comme consommé.
+ *
+ * La boucle parcourt toujours l'intégralité des codes (pas de sortie anticipée) pour ne pas laisser
+ * fuiter, par le temps de réponse, la position du code dans la liste.
+ */
+export declare function consumeBackupCode(codes: StoredBackupCode[], candidate: string): {
+    codes: StoredBackupCode[];
+    matched: boolean;
+};
+export declare function countRemainingBackupCodes(codes: StoredBackupCode[]): number;
+//# sourceMappingURL=backup-codes.d.ts.map

package/dist/backup-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-codes.d.ts","sourceRoot":"","sources":["../src/backup-codes.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,IAAI,GAAG,MAAM,CAAC;CACvB,CAAC;AAaF,qGAAqG;AACrG,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD;AAMD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,SAA4B,GAAG;IACtE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,gBAAgB,EAAE,CAAC;CAC5B,CAWA;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,gBAAgB,EAAE,EACzB,SAAS,EAAE,MAAM,GAChB;IAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAqBjD;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAE3E"}

package/dist/backup-codes.js

@@ -0,0 +1,66 @@
+import { randomBytes, scryptSync, timingSafeEqual } from 'crypto';
+/** 32 caractères : A-Z sans I ni L, et 2-9. Ni 0/O ni 1/l ne peuvent être confondus. */
+const ALPHABET = 'ABCDEFGHJKMNOPQRSTUVWXYZ23456789';
+const GROUP_LENGTH = 4;
+const GROUPS_PER_CODE = 2;
+export const DEFAULT_BACKUP_CODE_COUNT = 10;
+/**
+ * `ALPHABET` fait exactement 32 caractères : `256 % 32 === 0`, donc le modulo ne biaise pas la
+ * distribution des octets aléatoires. Toute modification de sa longueur casserait cette propriété.
+ */
+function randomChars(length) {
+    const bytes = randomBytes(length);
+    let out = '';
+    for (let i = 0; i < length; i++)
+        out += ALPHABET[bytes[i] % ALPHABET.length];
+    return out;
+}
+/** Tolère la casse et les séparateurs, pour que « abcd-efgh » et « ABCDEFGH » soient équivalents. */
+export function normalizeBackupCode(code) {
+    return code.toUpperCase().replace(/[^A-Z0-9]/g, '');
+}
+function hashBackupCode(code, salt) {
+    return scryptSync(normalizeBackupCode(code), salt, 32).toString('hex');
+}
+/**
+ * Retourne les codes en clair — à afficher une seule fois — et leur version stockée en base.
+ * Les codes en clair ne sont jamais persistés.
+ */
+export function generateBackupCodes(count = DEFAULT_BACKUP_CODE_COUNT) {
+    const plain = Array.from({ length: count }, () => Array.from({ length: GROUPS_PER_CODE }, () => randomChars(GROUP_LENGTH)).join('-'));
+    const stored = plain.map((code) => {
+        const salt = randomBytes(16).toString('hex');
+        return { hash: hashBackupCode(code, salt), salt, usedAt: null };
+    });
+    return { plain, stored };
+}
+/**
+ * Cherche `candidate` parmi les codes non encore utilisés et le marque comme consommé.
+ *
+ * La boucle parcourt toujours l'intégralité des codes (pas de sortie anticipée) pour ne pas laisser
+ * fuiter, par le temps de réponse, la position du code dans la liste.
+ */
+export function consumeBackupCode(codes, candidate) {
+    const normalized = normalizeBackupCode(candidate);
+    if (normalized.length !== GROUP_LENGTH * GROUPS_PER_CODE)
+        return { codes, matched: false };
+    let matchedIndex = -1;
+    codes.forEach((code, index) => {
+        if (code.usedAt)
+            return;
+        const candidateHash = Buffer.from(hashBackupCode(normalized, code.salt), 'hex');
+        const storedHash = Buffer.from(code.hash, 'hex');
+        if (candidateHash.length !== storedHash.length)
+            return;
+        if (timingSafeEqual(candidateHash, storedHash) && matchedIndex === -1)
+            matchedIndex = index;
+    });
+    if (matchedIndex === -1)
+        return { codes, matched: false };
+    const next = codes.map((code, index) => index === matchedIndex ? { ...code, usedAt: new Date().toISOString() } : code);
+    return { codes: next, matched: true };
+}
+export function countRemainingBackupCodes(codes) {
+    return codes.filter((code) => !code.usedAt).length;
+}
+//# sourceMappingURL=backup-codes.js.map

package/dist/backup-codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-codes.js","sourceRoot":"","sources":["../src/backup-codes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAElE,wFAAwF;AACxF,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AACpD,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAQ5C;;;GAGG;AACH,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,IAAY;IAChD,OAAO,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAK,GAAG,yBAAyB;IAInE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CACnF,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAyB,EACzB,SAAiB;IAEjB,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,MAAM,KAAK,YAAY,GAAG,eAAe;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE3F,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IAEtB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QAChF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;YAAE,OAAO;QACvD,IAAI,eAAe,CAAC,aAAa,EAAE,UAAU,CAAC,IAAI,YAAY,KAAK,CAAC,CAAC;YAAE,YAAY,GAAG,KAAK,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE1D,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACrC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAC9E,CAAC;IAEF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAyB;IACjE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;AACrD,CAAC"}

package/dist/coded-error.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Erreur d'API portant un code exploitable par le formulaire de connexion.
+ *
+ * Payload transmet bien `data` au client — mais seulement pour une erreur que `formatErrors`
+ * reconnaît par `instanceof APIError`. Ce test échoue dès que le module `payload` vu par le plugin
+ * et celui vu par `formatErrors` ne sont pas la même instance, ce qui est précisément le cas dans
+ * un build de production Next.js : `withPayload` n'ajoute `payload` à `serverExternalPackages` que
+ * si `NODE_ENV === 'development'`, donc il est externalisé en dev et bundlé en production.
+ *
+ * Conséquence observée : en développement le code arrivait, en production `data` disparaissait
+ * silencieusement, la réponse ne contenait plus que `message`, et le formulaire — incapable de
+ * distinguer « code requis » d'une erreur quelconque — affichait le message au lieu de révéler le
+ * champ du second facteur.
+ *
+ * `formatErrors` a une seconde branche, indépendante de toute identité de classe :
+ * `Array.isArray(message)` renvoie le tableau tel quel. On y place directement l'objet d'erreur
+ * final. `data` n'est délibérément pas posé sur l'erreur, pour que la branche `instanceof` ne
+ * puisse pas prendre le pas et renvoyer un `message` qui serait un tableau.
+ *
+ * `isPublic` et `status` restent de simples propriétés : `isErrorPublic` et `routeError` les lisent
+ * sans passer par `instanceof`, et fonctionnent donc dans les deux cas.
+ */
+export declare function codedError(code: string, message: string, status: number): Error;
+//# sourceMappingURL=coded-error.d.ts.map

package/dist/coded-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coded-error.d.ts","sourceRoot":"","sources":["../src/coded-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAU/E"}

package/dist/coded-error.js

@@ -0,0 +1,33 @@
+/**
+ * Erreur d'API portant un code exploitable par le formulaire de connexion.
+ *
+ * Payload transmet bien `data` au client — mais seulement pour une erreur que `formatErrors`
+ * reconnaît par `instanceof APIError`. Ce test échoue dès que le module `payload` vu par le plugin
+ * et celui vu par `formatErrors` ne sont pas la même instance, ce qui est précisément le cas dans
+ * un build de production Next.js : `withPayload` n'ajoute `payload` à `serverExternalPackages` que
+ * si `NODE_ENV === 'development'`, donc il est externalisé en dev et bundlé en production.
+ *
+ * Conséquence observée : en développement le code arrivait, en production `data` disparaissait
+ * silencieusement, la réponse ne contenait plus que `message`, et le formulaire — incapable de
+ * distinguer « code requis » d'une erreur quelconque — affichait le message au lieu de révéler le
+ * champ du second facteur.
+ *
+ * `formatErrors` a une seconde branche, indépendante de toute identité de classe :
+ * `Array.isArray(message)` renvoie le tableau tel quel. On y place directement l'objet d'erreur
+ * final. `data` n'est délibérément pas posé sur l'erreur, pour que la branche `instanceof` ne
+ * puisse pas prendre le pas et renvoyer un `message` qui serait un tableau.
+ *
+ * `isPublic` et `status` restent de simples propriétés : `isErrorPublic` et `routeError` les lisent
+ * sans passer par `instanceof`, et fonctionnent donc dans les deux cas.
+ */
+export function codedError(code, message, status) {
+    const error = new Error(message);
+    // Conservé pour que Payload journalise cette erreur comme les siennes (`config.loggingLevels`).
+    error.name = 'APIError';
+    return Object.assign(error, {
+        isPublic: true,
+        message: [{ data: { code }, message }],
+        status,
+    });
+}
+//# sourceMappingURL=coded-error.js.map

package/dist/coded-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coded-error.js","sourceRoot":"","sources":["../src/coded-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,OAAe,EAAE,MAAc;IACtE,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,gGAAgG;IAChG,KAAK,CAAC,IAAI,GAAG,UAAU,CAAC;IAExB,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE;QAC1B,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC;QACtC,MAAM;KACP,CAAC,CAAC;AACL,CAAC"}

package/dist/components/login-form.d.ts

@@ -0,0 +1,22 @@
+import React from 'react';
+import { type MfaLabelOverrides } from '../i18n.js';
+import './mfa.css';
+export type MfaLoginFormProps = {
+    labels?: MfaLabelOverrides;
+    language?: string;
+    searchParams?: {
+        [key: string]: string | string[] | undefined;
+    };
+};
+/**
+ * Formulaire de connexion en deux temps.
+ *
+ * Le premier envoi ne contient qu'email + mot de passe. Si le compte a la double authentification
+ * activée, le hook `beforeLogin` répond `MFA_REQUIRED` et le formulaire révèle le champ du code,
+ * puis rejoue la requête complète — le mot de passe n'est jamais validé « à moitié » côté serveur,
+ * il n'existe pas d'état intermédiaire de session.
+ *
+ * Il remplace le formulaire natif de Payload, qui ne sait pas envoyer de champ supplémentaire.
+ */
+export declare const MfaLoginForm: React.FC<MfaLoginFormProps>;
+//# sourceMappingURL=login-form.d.ts.map

package/dist/components/login-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-form.d.ts","sourceRoot":"","sources":["../../src/components/login-form.tsx"],"names":[],"mappings":"AAKA,OAAO,KAAsC,MAAM,OAAO,CAAC;AAG3D,OAAO,EAAiB,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEnE,OAAO,WAAW,CAAC;AASnB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;KAAE,CAAC;CACjE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,iBAAiB,CA0KpD,CAAC"}

package/dist/components/login-form.js

@@ -0,0 +1,91 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Button, Link, useAuth, useConfig, useTranslation } from '@payloadcms/ui';
+import { useRouter } from 'next/navigation.js';
+import { formatAdminURL, getSafeRedirect } from 'payload/shared';
+import { useEffect, useRef, useState } from 'react';
+import { MFA_ERROR_CODES } from '../errors.js';
+import { resolveLabels } from '../i18n.js';
+import './mfa.css';
+/** `login__form` porte la mise en forme native des champs ; `mfa-login` la nôtre. */
+const baseClass = 'login__form';
+/**
+ * Formulaire de connexion en deux temps.
+ *
+ * Le premier envoi ne contient qu'email + mot de passe. Si le compte a la double authentification
+ * activée, le hook `beforeLogin` répond `MFA_REQUIRED` et le formulaire révèle le champ du code,
+ * puis rejoue la requête complète — le mot de passe n'est jamais validé « à moitié » côté serveur,
+ * il n'existe pas d'état intermédiaire de session.
+ *
+ * Il remplace le formulaire natif de Payload, qui ne sait pas envoyer de champ supplémentaire.
+ */
+export const MfaLoginForm = ({ labels, language, searchParams }) => {
+    const { config } = useConfig();
+    const { setUser } = useAuth();
+    const { i18n, t } = useTranslation();
+    const router = useRouter();
+    const { admin: { routes: { forgot: forgotRoute } = {}, user: userSlug }, routes: { admin: adminRoute, api: apiRoute }, } = config;
+    const labelsForLanguage = resolveLabels(language ?? i18n.language, labels);
+    const [step, setStep] = useState('credentials');
+    const [email, setEmail] = useState('');
+    const [password, setPassword] = useState('');
+    const [mfaCode, setMfaCode] = useState('');
+    const [error, setError] = useState(null);
+    const [processing, setProcessing] = useState(false);
+    const codeRef = useRef(null);
+    useEffect(() => {
+        if (step === 'mfa')
+            codeRef.current?.focus();
+    }, [step]);
+    const redirectUrl = getSafeRedirect({
+        fallbackTo: adminRoute,
+        redirectTo: searchParams?.redirect ?? '',
+    });
+    const handleSubmit = async (event) => {
+        event.preventDefault();
+        if (processing)
+            return;
+        setProcessing(true);
+        setError(null);
+        try {
+            const response = await fetch(formatAdminURL({ apiRoute, path: `/${userSlug}/login` }), {
+                body: JSON.stringify({
+                    email,
+                    password,
+                    ...(step === 'mfa' ? { mfaCode } : {}),
+                }),
+                credentials: 'include',
+                headers: { 'Content-Type': 'application/json' },
+                method: 'POST',
+            });
+            const json = await response.json();
+            if (response.ok) {
+                setUser(json);
+                router.push(redirectUrl);
+                return;
+            }
+            const failure = json?.errors?.[0] ?? {};
+            if (failure.data?.code === MFA_ERROR_CODES.required) {
+                setStep('mfa');
+                setMfaCode('');
+                return;
+            }
+            if (failure.data?.code === MFA_ERROR_CODES.invalid) {
+                setStep('mfa');
+                setMfaCode('');
+            }
+            setError(failure.message || labelsForLanguage.unknownError);
+        }
+        catch {
+            setError(labelsForLanguage.unknownError);
+        }
+        finally {
+            setProcessing(false);
+        }
+    };
+    return (_jsxs("form", { className: `${baseClass} mfa-login`, onSubmit: handleSubmit, children: [_jsxs("div", { className: `${baseClass}__inputWrap`, children: [_jsxs("div", { hidden: step === 'mfa', children: [_jsxs("div", { className: "field-type email", children: [_jsx("label", { className: "field-label", htmlFor: "mfa-login-email", children: t('general:email') }), _jsx("input", { autoComplete: "email", id: "mfa-login-email", name: "email", onChange: (event) => setEmail(event.target.value), required: true, type: "email", value: email })] }), _jsxs("div", { className: "field-type password", children: [_jsx("label", { className: "field-label", htmlFor: "mfa-login-password", children: t('general:password') }), _jsx("input", { autoComplete: "current-password", id: "mfa-login-password", name: "password", onChange: (event) => setPassword(event.target.value), required: true, type: "password", value: password })] })] }), step === 'mfa' && (_jsxs("div", { className: "field-type text", children: [_jsx("label", { className: "field-label", htmlFor: "mfa-login-code", children: labelsForLanguage.loginCodeLabel }), _jsx("input", { autoComplete: "one-time-code", id: "mfa-login-code", inputMode: "text", name: "mfaCode", onChange: (event) => setMfaCode(event.target.value), ref: codeRef, required: true, type: "text", value: mfaCode }), _jsx("p", { className: "field-description", children: labelsForLanguage.loginCodeDescription })] }))] }), error && (_jsx("p", { className: "mfa-login__error", role: "alert", children: error })), step === 'credentials' && forgotRoute && (_jsx(Link, { href: formatAdminURL({ adminRoute, path: forgotRoute }), prefetch: false, children: t('authentication:forgotPasswordQuestion') })), step === 'mfa' && (_jsx("button", { className: "mfa-login__back", onClick: () => {
+                    setStep('credentials');
+                    setError(null);
+                }, type: "button", children: labelsForLanguage.loginBack })), _jsx("div", { className: "form-submit", children: _jsx(Button, { disabled: processing, size: "large", type: "submit", children: processing ? t('general:loading') : t('authentication:login') }) })] }));
+};
+//# sourceMappingURL=login-form.js.map

package/dist/components/login-form.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-form.js","sourceRoot":"","sources":["../../src/components/login-form.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAc,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAE3D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,aAAa,EAA0B,MAAM,YAAY,CAAC;AAEnE,OAAO,WAAW,CAAC;AAMnB,qFAAqF;AACrF,MAAM,SAAS,GAAG,aAAa,CAAC;AAQhC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAgC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE;IAC9F,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;IAC9B,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,EACJ,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAC/D,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,GAC7C,GAAG,MAAM,CAAC;IAEX,MAAM,iBAAiB,GAAG,aAAa,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAE3E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAO,aAAa,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEpD,MAAM,OAAO,GAAG,MAAM,CAAmB,IAAI,CAAC,CAAC;IAE/C,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;IAC/C,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEX,MAAM,WAAW,GAAG,eAAe,CAAC;QAClC,UAAU,EAAE,UAAU;QACtB,UAAU,EAAE,YAAY,EAAE,QAAQ,IAAI,EAAE;KACzC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,KAAK,EAAE,KAAsB,EAAE,EAAE;QACpD,KAAK,CAAC,cAAc,EAAE,CAAC;QACvB,IAAI,UAAU;YAAE,OAAO;QAEvB,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,QAAQ,QAAQ,EAAE,CAAC,EAAE;gBACrF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK;oBACL,QAAQ;oBACR,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvC,CAAC;gBACF,WAAW,EAAE,SAAS;gBACtB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEnC,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACzB,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAiB,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAEtD,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,eAAe,CAAC,QAAQ,EAAE,CAAC;gBACpD,OAAO,CAAC,KAAK,CAAC,CAAC;gBACf,UAAU,CAAC,EAAE,CAAC,CAAC;gBACf,OAAO;YACT,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,eAAe,CAAC,OAAO,EAAE,CAAC;gBACnD,OAAO,CAAC,KAAK,CAAC,CAAC;gBACf,UAAU,CAAC,EAAE,CAAC,CAAC;YACjB,CAAC;YAED,QAAQ,CAAC,OAAO,CAAC,OAAO,IAAI,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,CACL,gBAAM,SAAS,EAAE,GAAG,SAAS,YAAY,EAAE,QAAQ,EAAE,YAAY,aAC/D,eAAK,SAAS,EAAE,GAAG,SAAS,aAAa,aAEvC,eAAK,MAAM,EAAE,IAAI,KAAK,KAAK,aACzB,eAAK,SAAS,EAAC,kBAAkB,aAC/B,gBAAO,SAAS,EAAC,aAAa,EAAC,OAAO,EAAC,iBAAiB,YACrD,CAAC,CAAC,eAAe,CAAC,GACb,EACR,gBACE,YAAY,EAAC,OAAO,EACpB,EAAE,EAAC,iBAAiB,EACpB,IAAI,EAAC,OAAO,EACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EACjD,QAAQ,QACR,IAAI,EAAC,OAAO,EACZ,KAAK,EAAE,KAAK,GACZ,IACE,EAEN,eAAK,SAAS,EAAC,qBAAqB,aAClC,gBAAO,SAAS,EAAC,aAAa,EAAC,OAAO,EAAC,oBAAoB,YACxD,CAAC,CAAC,kBAAkB,CAAC,GAChB,EACR,gBACE,YAAY,EAAC,kBAAkB,EAC/B,EAAE,EAAC,oBAAoB,EACvB,IAAI,EAAC,UAAU,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EACpD,QAAQ,QACR,IAAI,EAAC,UAAU,EACf,KAAK,EAAE,QAAQ,GACf,IACE,IACF,EAEL,IAAI,KAAK,KAAK,IAAI,CACjB,eAAK,SAAS,EAAC,iBAAiB,aAC9B,gBAAO,SAAS,EAAC,aAAa,EAAC,OAAO,EAAC,gBAAgB,YACpD,iBAAiB,CAAC,cAAc,GAC3B,EACR,gBACE,YAAY,EAAC,eAAe,EAC5B,EAAE,EAAC,gBAAgB,EACnB,SAAS,EAAC,MAAM,EAChB,IAAI,EAAC,SAAS,EACd,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EACnD,GAAG,EAAE,OAAO,EACZ,QAAQ,QACR,IAAI,EAAC,MAAM,EACX,KAAK,EAAE,OAAO,GACd,EACF,YAAG,SAAS,EAAC,mBAAmB,YAAE,iBAAiB,CAAC,oBAAoB,GAAK,IACzE,CACP,IACG,EAEL,KAAK,IAAI,CACR,YAAG,SAAS,EAAC,kBAAkB,EAAC,IAAI,EAAC,OAAO,YACzC,KAAK,GACJ,CACL,EAEA,IAAI,KAAK,aAAa,IAAI,WAAW,IAAI,CACxC,KAAC,IAAI,IAAC,IAAI,EAAE,cAAc,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,YAC3E,CAAC,CAAC,uCAAuC,CAAC,GACtC,CACR,EAEA,IAAI,KAAK,KAAK,IAAI,CACjB,iBACE,SAAS,EAAC,iBAAiB,EAC3B,OAAO,EAAE,GAAG,EAAE;oBACZ,OAAO,CAAC,aAAa,CAAC,CAAC;oBACvB,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACjB,CAAC,EACD,IAAI,EAAC,QAAQ,YAEZ,iBAAiB,CAAC,SAAS,GACrB,CACV,EAID,cAAK,SAAS,EAAC,aAAa,YAC1B,KAAC,MAAM,IAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAC,OAAO,EAAC,IAAI,EAAC,QAAQ,YACrD,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,GACvD,GACL,IACD,CACR,CAAC;AACJ,CAAC,CAAC"}

package/dist/components/login-view.d.ts

@@ -0,0 +1,15 @@
+import type { AdminViewServerProps } from 'payload';
+import React from 'react';
+import type { MfaLabelOverrides } from '../i18n.js';
+export type MfaLoginViewProps = AdminViewServerProps & {
+    labels?: MfaLabelOverrides;
+    language?: string;
+};
+/**
+ * Remplace la vue de connexion native (`admin.components.views.login`).
+ *
+ * Reprend la structure d'origine — logo, points d'extension `beforeLogin` / `afterLogin` — et
+ * n'échange que le formulaire, pour pouvoir envoyer le code du second facteur.
+ */
+export declare const MfaLoginView: React.FC<MfaLoginViewProps>;
+//# sourceMappingURL=login-view.d.ts.map

package/dist/components/login-view.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-view.d.ts","sourceRoot":"","sources":["../../src/components/login-view.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAEpD,OAAO,KAAmB,MAAM,OAAO,CAAC;AAExC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAGpD,MAAM,MAAM,iBAAiB,GAAG,oBAAoB,GAAG;IACrD,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAyDpD,CAAC"}

package/dist/components/login-view.js

@@ -0,0 +1,43 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Logo } from '@payloadcms/next/rsc';
+import { RenderServerComponent } from '@payloadcms/ui/elements/RenderServerComponent';
+import { redirect } from 'next/navigation.js';
+import { getSafeRedirect } from 'payload/shared';
+import { Fragment } from 'react';
+import { MfaLoginForm } from './login-form.js';
+/**
+ * Remplace la vue de connexion native (`admin.components.views.login`).
+ *
+ * Reprend la structure d'origine — logo, points d'extension `beforeLogin` / `afterLogin` — et
+ * n'échange que le formulaire, pour pouvoir envoyer le code du second facteur.
+ */
+export const MfaLoginView = ({ initPageResult, labels, language, params, searchParams, }) => {
+    const { locale, permissions, req } = initPageResult;
+    const { i18n, payload, payload: { config }, user, } = req;
+    const { admin: { components: { afterLogin, beforeLogin } = {} }, routes: { admin: adminRoute }, } = config;
+    if (user) {
+        redirect(getSafeRedirect({
+            fallbackTo: adminRoute,
+            redirectTo: searchParams?.redirect ?? '',
+        }));
+    }
+    const serverProps = {
+        i18n,
+        locale,
+        params,
+        payload,
+        permissions,
+        searchParams,
+        user: user ?? undefined,
+    };
+    return (_jsxs(Fragment, { children: [_jsx("div", { className: "login__brand", children: _jsx(Logo, { ...serverProps }) }), RenderServerComponent({
+                Component: beforeLogin,
+                importMap: payload.importMap,
+                serverProps,
+            }), _jsx(MfaLoginForm, { labels: labels, language: language, searchParams: searchParams }), RenderServerComponent({
+                Component: afterLogin,
+                importMap: payload.importMap,
+                serverProps,
+            })] }));
+};
+//# sourceMappingURL=login-view.js.map

package/dist/components/login-view.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-view.js","sourceRoot":"","sources":["../../src/components/login-view.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAc,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAGxC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAO/C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAgC,CAAC,EACxD,cAAc,EACd,MAAM,EACN,QAAQ,EACR,MAAM,EACN,YAAY,GACb,EAAE,EAAE;IACH,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC;IACpD,MAAM,EACJ,IAAI,EACJ,OAAO,EACP,OAAO,EAAE,EAAE,MAAM,EAAE,EACnB,IAAI,GACL,GAAG,GAAG,CAAC;IAER,MAAM,EACJ,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,EACvD,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,GAC9B,GAAG,MAAM,CAAC;IAEX,IAAI,IAAI,EAAE,CAAC;QACT,QAAQ,CACN,eAAe,CAAC;YACd,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,YAAY,EAAE,QAAQ,IAAI,EAAE;SACzC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG;QAClB,IAAI;QACJ,MAAM;QACN,MAAM;QACN,OAAO;QACP,WAAW;QACX,YAAY;QACZ,IAAI,EAAE,IAAI,IAAI,SAAS;KACxB,CAAC;IAEF,OAAO,CACL,MAAC,QAAQ,eACP,cAAK,SAAS,EAAC,cAAc,YAC3B,KAAC,IAAI,OAAK,WAAW,GAAI,GACrB,EACL,qBAAqB,CAAC;gBACrB,SAAS,EAAE,WAAW;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,WAAW;aACZ,CAAC,EACF,KAAC,YAAY,IAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,GAAI,EAC/E,qBAAqB,CAAC;gBACrB,SAAS,EAAE,UAAU;gBACrB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,WAAW;aACZ,CAAC,IACO,CACZ,CAAC;AACJ,CAAC,CAAC"}

package/dist/components/mfa-panel.d.ts

@@ -0,0 +1,16 @@
+import React from 'react';
+import { type MfaLabelOverrides } from '../i18n.js';
+import './mfa.css';
+export type MfaPanelProps = {
+    labels?: MfaLabelOverrides;
+    language?: string;
+};
+/**
+ * Panneau d'enrôlement TOTP, monté comme champ `ui` sur la collection protégée.
+ *
+ * Il n'apparaît que sur son propre compte : l'API MFA n'agit jamais que sur l'utilisateur de la
+ * session, donc l'afficher sur la fiche d'un autre utilisateur ne ferait que proposer des actions
+ * qui s'appliqueraient au mauvais compte.
+ */
+export declare const MfaPanel: React.FC<MfaPanelProps>;
+//# sourceMappingURL=mfa-panel.d.ts.map

package/dist/components/mfa-panel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-panel.d.ts","sourceRoot":"","sources":["../../src/components/mfa-panel.tsx"],"names":[],"mappings":"AAGA,OAAO,KAA2C,MAAM,OAAO,CAAC;AAEhE,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE3E,OAAO,WAAW,CAAC;AAanB,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,aAAa,CA0L5C,CAAC"}