@arthur.eudeline/payload-plugin-mfa 0.1.1

package/dist/components/mfa-panel.js

@@ -0,0 +1,94 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { Button, useAuth, useConfig, useDocumentInfo, useTranslation } from '@payloadcms/ui';
+import { useCallback, useEffect, useState } from 'react';
+import { format, resolveLabels } from '../i18n.js';
+import './mfa.css';
+const baseClass = 'mfa-panel';
+/**
+ * Panneau d'enrôlement TOTP, monté comme champ `ui` sur la collection protégée.
+ *
+ * Il n'apparaît que sur son propre compte : l'API MFA n'agit jamais que sur l'utilisateur de la
+ * session, donc l'afficher sur la fiche d'un autre utilisateur ne ferait que proposer des actions
+ * qui s'appliqueraient au mauvais compte.
+ */
+export const MfaPanel = ({ labels, language }) => {
+    const { config } = useConfig();
+    const { user } = useAuth();
+    const { collectionSlug, id: docID } = useDocumentInfo();
+    const { i18n } = useTranslation();
+    const t = resolveLabels(language ?? i18n.language, labels);
+    const apiRoute = config.routes.api;
+    const isSelf = Boolean(user?.id) && String(user?.id) === String(docID);
+    const [status, setStatus] = useState(null);
+    const [stage, setStage] = useState({ name: 'idle' });
+    const [code, setCode] = useState('');
+    const [backupCodes, setBackupCodes] = useState(null);
+    const [error, setError] = useState(null);
+    const [busy, setBusy] = useState(false);
+    const call = useCallback(async (path, body) => {
+        const response = await fetch(`${apiRoute}/${collectionSlug}/mfa/${path}`, {
+            ...(body ? { body: JSON.stringify(body) } : {}),
+            credentials: 'include',
+            headers: { 'Content-Type': 'application/json' },
+            method: body ? 'POST' : 'GET',
+        });
+        const json = await response.json();
+        if (!response.ok)
+            throw new Error(json?.message || t.unknownError);
+        return json;
+    }, [apiRoute, collectionSlug, t.unknownError]);
+    const refresh = useCallback(async () => {
+        setStatus(await call('status'));
+    }, [call]);
+    useEffect(() => {
+        if (!isSelf)
+            return;
+        refresh().catch((cause) => setError(cause.message));
+    }, [isSelf, refresh]);
+    if (!isSelf)
+        return null;
+    const run = async (action) => {
+        setBusy(true);
+        setError(null);
+        try {
+            await action();
+        }
+        catch (cause) {
+            setError(cause instanceof Error ? cause.message : t.unknownError);
+        }
+        finally {
+            setBusy(false);
+        }
+    };
+    const startSetup = () => run(async () => {
+        const { qrCode, secret } = await call('setup', {});
+        setBackupCodes(null);
+        setCode('');
+        setStage({ name: 'setup', qrCode, secret });
+    });
+    const activate = () => run(async () => {
+        const { backupCodes: codes } = await call('activate', { code });
+        setBackupCodes(codes);
+        setStage({ name: 'idle' });
+        setCode('');
+        await refresh();
+    });
+    const regenerate = () => run(async () => {
+        const { backupCodes: codes } = await call('backup-codes', { code });
+        setBackupCodes(codes);
+        setCode('');
+        await refresh();
+    });
+    const disable = () => run(async () => {
+        await call('disable', { code });
+        setBackupCodes(null);
+        setCode('');
+        await refresh();
+    });
+    return (_jsxs("div", { className: baseClass, children: [_jsx("h3", { className: `${baseClass}__title`, children: t.panelTitle }), stage.name === 'idle' &&
+                (status === null ? (_jsx("p", { className: `${baseClass}__hint`, children: t.loading })) : (_jsx("p", { className: `${baseClass}__hint`, children: status.enabled
+                        ? format(t.statusEnabled, { count: status.backupCodesRemaining })
+                        : t.statusDisabled }))), error && (_jsx("p", { className: `${baseClass}__error`, role: "alert", children: error })), backupCodes && (_jsxs("div", { className: `${baseClass}__codes`, children: [_jsxs("p", { className: `${baseClass}__hint`, children: [_jsx("strong", { children: t.backupCodesWarningLead }), " ", t.backupCodesWarning] }), _jsx("ul", { children: backupCodes.map((backupCode) => (_jsx("li", { children: backupCode }, backupCode))) })] })), status?.enabled === false && stage.name === 'idle' && (_jsx(Button, { buttonStyle: "primary", disabled: busy, onClick: startSetup, size: "small", children: t.enableButton })), stage.name === 'setup' && (_jsxs("div", { className: `${baseClass}__setup`, children: [_jsx("p", { className: `${baseClass}__hint`, children: t.setupInstructions }), _jsx("img", { alt: t.qrAlt, className: `${baseClass}__qr`, src: stage.qrCode }), _jsxs("p", { className: `${baseClass}__secret`, children: [t.manualEntry, " ", _jsx("code", { children: stage.secret })] })] })), (stage.name === 'setup' || status?.enabled) && (_jsxs("div", { className: `${baseClass}__confirm`, children: [_jsxs("div", { className: "field-type text", children: [_jsx("label", { className: "field-label", htmlFor: "mfa-panel-code", children: t.codeFieldLabel }), _jsx("input", { autoComplete: "one-time-code", id: "mfa-panel-code", inputMode: "numeric", onChange: (event) => setCode(event.target.value), type: "text", value: code })] }), _jsxs("div", { className: `${baseClass}__actions`, children: [stage.name === 'setup' && (_jsx(Button, { buttonStyle: "primary", disabled: busy, onClick: activate, size: "small", children: t.confirmButton })), status?.enabled && stage.name === 'idle' && (_jsxs(_Fragment, { children: [_jsx(Button, { buttonStyle: "secondary", disabled: busy, onClick: regenerate, size: "small", children: t.regenerateButton }), _jsx(Button, { buttonStyle: "secondary", className: `${baseClass}__danger`, disabled: busy, onClick: disable, size: "small", children: t.disableButton })] }))] })] }))] }));
+};
+//# sourceMappingURL=mfa-panel.js.map

package/dist/components/mfa-panel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-panel.js","sourceRoot":"","sources":["../../src/components/mfa-panel.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEhE,OAAO,EAAE,MAAM,EAAE,aAAa,EAA0B,MAAM,YAAY,CAAC;AAE3E,OAAO,WAAW,CAAC;AAWnB,MAAM,SAAS,GAAG,WAAW,CAAC;AAO9B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAA4B,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;IACxE,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC;IAC3B,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,eAAe,EAAE,CAAC;IACxD,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAElC,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC;IAEvE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAkB,IAAI,CAAC,CAAC;IACtE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAExC,MAAM,IAAI,GAAG,WAAW,CACtB,KAAK,EAAE,IAAY,EAAE,IAA8B,EAAE,EAAE;QACrD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,IAAI,cAAc,QAAQ,IAAI,EAAE,EAAE;YACxE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;SAC9B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC,EACD,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC,CAC3C,CAAC;IAEF,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,SAAS,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEX,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7D,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEtB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,GAAG,GAAG,KAAK,EAAE,MAA2B,EAAE,EAAE;QAChD,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACpE,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,GAAG,EAAE,CACtB,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACnD,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEL,MAAM,QAAQ,GAAG,GAAG,EAAE,CACpB,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,cAAc,CAAC,KAAK,CAAC,CAAC;QACtB,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3B,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEL,MAAM,UAAU,GAAG,GAAG,EAAE,CACtB,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,cAAc,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEL,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEL,OAAO,CACL,eAAK,SAAS,EAAE,SAAS,aACvB,aAAI,SAAS,EAAE,GAAG,SAAS,SAAS,YAAG,CAAC,CAAC,UAAU,GAAM,EAIxD,KAAK,CAAC,IAAI,KAAK,MAAM;gBACpB,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CACjB,YAAG,SAAS,EAAE,GAAG,SAAS,QAAQ,YAAG,CAAC,CAAC,OAAO,GAAK,CACpD,CAAC,CAAC,CAAC,CACF,YAAG,SAAS,EAAE,GAAG,SAAS,QAAQ,YAC/B,MAAM,CAAC,OAAO;wBACb,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,oBAAoB,EAAE,CAAC;wBACjE,CAAC,CAAC,CAAC,CAAC,cAAc,GAClB,CACL,CAAC,EAEH,KAAK,IAAI,CACR,YAAG,SAAS,EAAE,GAAG,SAAS,SAAS,EAAE,IAAI,EAAC,OAAO,YAC9C,KAAK,GACJ,CACL,EAEA,WAAW,IAAI,CACd,eAAK,SAAS,EAAE,GAAG,SAAS,SAAS,aACnC,aAAG,SAAS,EAAE,GAAG,SAAS,QAAQ,aAChC,2BAAS,CAAC,CAAC,sBAAsB,GAAU,OAAE,CAAC,CAAC,kBAAkB,IAC/D,EACJ,uBACG,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAC/B,uBAAsB,UAAU,IAAvB,UAAU,CAAmB,CACvC,CAAC,GACC,IACD,CACP,EAEA,MAAM,EAAE,OAAO,KAAK,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,CACrD,KAAC,MAAM,IAAC,WAAW,EAAC,SAAS,EAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAC,OAAO,YAC5E,CAAC,CAAC,YAAY,GACR,CACV,EAEA,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CACzB,eAAK,SAAS,EAAE,GAAG,SAAS,SAAS,aACnC,YAAG,SAAS,EAAE,GAAG,SAAS,QAAQ,YAAG,CAAC,CAAC,iBAAiB,GAAK,EAE7D,cAAK,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,GAAI,EACvE,aAAG,SAAS,EAAE,GAAG,SAAS,UAAU,aACjC,CAAC,CAAC,WAAW,OAAE,yBAAO,KAAK,CAAC,MAAM,GAAQ,IACzC,IACA,CACP,EAEA,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,EAAE,OAAO,CAAC,IAAI,CAC9C,eAAK,SAAS,EAAE,GAAG,SAAS,WAAW,aACrC,eAAK,SAAS,EAAC,iBAAiB,aAC9B,gBAAO,SAAS,EAAC,aAAa,EAAC,OAAO,EAAC,gBAAgB,YACpD,CAAC,CAAC,cAAc,GACX,EACR,gBACE,YAAY,EAAC,eAAe,EAC5B,EAAE,EAAC,gBAAgB,EACnB,SAAS,EAAC,SAAS,EACnB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAChD,IAAI,EAAC,MAAM,EACX,KAAK,EAAE,IAAI,GACX,IACE,EAEN,eAAK,SAAS,EAAE,GAAG,SAAS,WAAW,aACpC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CACzB,KAAC,MAAM,IAAC,WAAW,EAAC,SAAS,EAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAC,OAAO,YAC1E,CAAC,CAAC,aAAa,GACT,CACV,EACA,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,CAC3C,8BACE,KAAC,MAAM,IAAC,WAAW,EAAC,WAAW,EAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAC,OAAO,YAC9E,CAAC,CAAC,gBAAgB,GACZ,EAGT,KAAC,MAAM,IACL,WAAW,EAAC,WAAW,EACvB,SAAS,EAAE,GAAG,SAAS,UAAU,EACjC,QAAQ,EAAE,IAAI,EACd,OAAO,EAAE,OAAO,EAChB,IAAI,EAAC,OAAO,YAEX,CAAC,CAAC,aAAa,GACT,IACR,CACJ,IACG,IACF,CACP,IACG,CACP,CAAC;AACJ,CAAC,CAAC"}

package/dist/components/mfa.css

@@ -0,0 +1,92 @@
+.mfa-panel {
+  display: flex;
+  flex-direction: column;
+  gap: calc(var(--base) / 2);
+  padding: var(--base);
+  border: 1px solid var(--theme-elevation-150);
+  border-radius: var(--style-radius-m, 4px);
+  margin-block: var(--base);
+}
+
+.mfa-panel__title {
+  margin: 0;
+}
+
+.mfa-panel__hint {
+  margin: 0;
+  color: var(--theme-elevation-600);
+}
+
+.mfa-panel__error {
+  margin: 0;
+  color: var(--theme-error-500);
+}
+
+.mfa-panel__qr {
+  width: 240px;
+  height: 240px;
+  background: #fff;
+  padding: calc(var(--base) / 4);
+}
+
+.mfa-panel__secret code {
+  user-select: all;
+  word-break: break-all;
+}
+
+.mfa-panel__codes ul {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(9rem, 1fr));
+  gap: calc(var(--base) / 4);
+  padding: 0;
+  margin: calc(var(--base) / 2) 0 0;
+  list-style: none;
+  font-family: var(--font-mono, monospace);
+}
+
+.mfa-panel__actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: calc(var(--base) / 2);
+  align-items: center;
+}
+
+.mfa-panel__danger {
+  color: var(--theme-error-500);
+  border-color: var(--theme-error-500);
+}
+
+.mfa-panel__confirm .field-type {
+  max-width: 16rem;
+}
+
+/* Formulaire de connexion */
+.mfa-login {
+  display: flex;
+  flex-direction: column;
+  gap: calc(var(--base) / 2);
+}
+
+/* Les champs occupent toute la largeur ; seuls les liens se calent à gauche. */
+.mfa-login > a,
+.mfa-login__back {
+  align-self: flex-start;
+}
+.mfa-login .form-submit {
+  width: 100%;
+}
+
+.mfa-login__error {
+  margin: 0;
+  color: var(--theme-error-500);
+}
+
+.mfa-login__back {
+  align-self: flex-start;
+  padding: 0;
+  border: 0;
+  background: none;
+  color: var(--theme-text);
+  text-decoration: underline;
+  cursor: pointer;
+}

package/dist/endpoints.d.ts

@@ -0,0 +1,4 @@
+import type { Endpoint } from 'payload';
+import type { MfaContext } from './types.js';
+export declare function createMfaEndpoints(ctx: MfaContext): Endpoint[];
+//# sourceMappingURL=endpoints.d.ts.map

package/dist/endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../src/endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAkB,MAAM,SAAS,CAAC;AAaxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA+B7C,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,UAAU,GAAG,QAAQ,EAAE,CAgL9D"}

package/dist/endpoints.js

@@ -0,0 +1,190 @@
+import QRCode from 'qrcode';
+import { countRemainingBackupCodes, generateBackupCodes } from './backup-codes.js';
+import { resolveLabels } from './i18n.js';
+import { EMPTY_MFA_STATE, isMfaLocked, readMfaState, registerMfaFailure, writeMfaState, } from './state.js';
+import { buildOtpAuthUri, generateTotpSecret, verifyTotp } from './totp.js';
+function json(body, status = 200) {
+    return Response.json(body, { status });
+}
+async function readBody(req) {
+    try {
+        return ((await req.json?.()) ?? {});
+    }
+    catch {
+        return {};
+    }
+}
+function readCode(body) {
+    return typeof body.code === 'string' ? body.code.trim() : '';
+}
+/**
+ * Tous les endpoints agissent exclusivement sur l'utilisateur de la session : on ne prend jamais
+ * d'identifiant depuis la requête, pour qu'aucun compte ne puisse en enrôler ou en déverrouiller
+ * un autre.
+ */
+function requireSelf(req, ctx) {
+    const { user } = req;
+    if (!user || user.collection !== ctx.collection)
+        return null;
+    return { email: user.email ?? String(user.id), id: user.id };
+}
+export function createMfaEndpoints(ctx) {
+    /**
+     * Fabrique un handler déjà authentifié : les cinq endpoints partagent la vérification de session,
+     * la résolution des libellés et la lecture de l'état.
+     */
+    const authenticated = (handler) => async (req) => {
+        const t = resolveLabels(ctx.language ?? req.i18n?.language, ctx.labels);
+        const self = requireSelf(req, ctx);
+        if (!self)
+            return json({ message: t.authRequired }, 401);
+        return handler({ body: await readBody(req), req, self, t });
+    };
+    return [
+        /** État affiché par le panneau d'enrôlement. */
+        {
+            handler: authenticated(async ({ req, self }) => {
+                const state = await readMfaState(req.payload, ctx, self.id);
+                return json({
+                    backupCodesRemaining: countRemainingBackupCodes(state.backupCodes),
+                    confirmedAt: state.confirmedAt,
+                    enabled: state.enabled,
+                    hasPendingSecret: state.pendingSecret !== null,
+                });
+            }),
+            method: 'get',
+            path: '/mfa/status',
+        },
+        /**
+         * Génère un secret en attente et le QR code correspondant.
+         *
+         * Le secret n'est activé qu'après confirmation par `/mfa/activate` : tant que l'utilisateur n'a
+         * pas prouvé que son application génère les bons codes, la connexion reste possible sans second
+         * facteur.
+         */
+        {
+            handler: authenticated(async ({ req, self, t }) => {
+                const state = await readMfaState(req.payload, ctx, self.id);
+                if (state.enabled)
+                    return json({ message: t.alreadyEnabled }, 409);
+                const secret = generateTotpSecret();
+                await writeMfaState(req.payload, ctx, self.id, {
+                    failedAttempts: 0,
+                    lockedUntil: null,
+                    pendingSecret: secret,
+                });
+                const otpauthUri = buildOtpAuthUri(secret, {
+                    accountLabel: self.email,
+                    issuer: ctx.issuer,
+                });
+                return json({
+                    // Le QR code est rendu ici et renvoyé en data URL : l'URI `otpauth://` contient le secret
+                    // et ne doit jamais transiter par un service de génération tiers.
+                    qrCode: await QRCode.toDataURL(otpauthUri, {
+                        errorCorrectionLevel: 'M',
+                        margin: 1,
+                        width: 240,
+                    }),
+                    secret,
+                });
+            }),
+            method: 'post',
+            path: '/mfa/setup',
+        },
+        /** Confirme le secret en attente et délivre les codes de secours. */
+        {
+            handler: authenticated(async ({ body, req, self, t }) => {
+                const state = await readMfaState(req.payload, ctx, self.id);
+                if (!state.pendingSecret)
+                    return json({ message: t.noPendingSetup }, 409);
+                if (isMfaLocked(state))
+                    return json({ message: t.tooManyAttempts }, 429);
+                const result = verifyTotp({ secret: state.pendingSecret, token: readCode(body) });
+                if (!result.valid) {
+                    await registerMfaFailure(req.payload, ctx, self.id, state);
+                    return json({ message: t.setupCodeInvalid }, 400);
+                }
+                const backupCodes = generateBackupCodes(ctx.backupCodeCount);
+                await writeMfaState(req.payload, ctx, self.id, {
+                    backupCodes: backupCodes.stored,
+                    confirmedAt: new Date().toISOString(),
+                    enabled: true,
+                    failedAttempts: 0,
+                    lastCounter: result.counter,
+                    lockedUntil: null,
+                    pendingSecret: null,
+                    secret: state.pendingSecret,
+                });
+                // Seule et unique fois où les codes de secours sont lisibles : seules leurs empreintes sont
+                // stockées.
+                return json({ backupCodes: backupCodes.plain });
+            }),
+            method: 'post',
+            path: '/mfa/activate',
+        },
+        /**
+         * Régénère les codes de secours, en invalidant les anciens. Demande un code TOTP valide, pour
+         * qu'une session volée ne puisse pas se fabriquer des accès durables.
+         */
+        {
+            handler: authenticated(async ({ body, req, self, t }) => {
+                const state = await readMfaState(req.payload, ctx, self.id);
+                if (!state.enabled || !state.secret)
+                    return json({ message: t.notEnabled }, 409);
+                if (isMfaLocked(state))
+                    return json({ message: t.tooManyAttempts }, 429);
+                const result = verifyTotp({
+                    lastCounter: state.lastCounter,
+                    secret: state.secret,
+                    token: readCode(body),
+                });
+                if (!result.valid) {
+                    await registerMfaFailure(req.payload, ctx, self.id, state);
+                    return json({ message: t.codeInvalid }, 400);
+                }
+                const backupCodes = generateBackupCodes(ctx.backupCodeCount);
+                await writeMfaState(req.payload, ctx, self.id, {
+                    backupCodes: backupCodes.stored,
+                    failedAttempts: 0,
+                    lastCounter: result.counter,
+                    lockedUntil: null,
+                });
+                return json({ backupCodes: backupCodes.plain });
+            }),
+            method: 'post',
+            path: '/mfa/backup-codes',
+        },
+        /**
+         * Désactive le second facteur. Exige un code TOTP valide.
+         *
+         * On ne redemande pas le mot de passe : le vérifier hors du flux de connexion supposerait de
+         * réimplémenter le hachage interne de Payload (`authenticateLocalStrategy` n'est pas exporté),
+         * et `payload.login()` créerait une session parasite. Redemander le second facteur est la
+         * garantie qui compte ici : elle bloque une session volée, qui est justement ce contre quoi la
+         * MFA protège.
+         */
+        {
+            handler: authenticated(async ({ body, req, self, t }) => {
+                const state = await readMfaState(req.payload, ctx, self.id);
+                if (!state.enabled || !state.secret)
+                    return json({ message: t.notEnabled }, 409);
+                if (isMfaLocked(state))
+                    return json({ message: t.tooManyAttempts }, 429);
+                const result = verifyTotp({
+                    lastCounter: state.lastCounter,
+                    secret: state.secret,
+                    token: readCode(body),
+                });
+                if (!result.valid) {
+                    await registerMfaFailure(req.payload, ctx, self.id, state);
+                    return json({ message: t.codeInvalid }, 400);
+                }
+                await writeMfaState(req.payload, ctx, self.id, EMPTY_MFA_STATE);
+                return json({ enabled: false });
+            }),
+            method: 'post',
+            path: '/mfa/disable',
+        },
+    ];
+}
+//# sourceMappingURL=endpoints.js.map

package/dist/endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../src/endpoints.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,aAAa,EAAkB,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,eAAe,EACf,WAAW,EACX,YAAY,EACZ,kBAAkB,EAClB,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAK5E,SAAS,IAAI,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IACvC,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAmB;IACzC,IAAI,CAAC;QACH,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAA4B,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAA6B;IAC7C,OAAO,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,GAAmB,EAAE,GAAe;IACvD,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;IACrB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,EAAE,KAAK,EAAG,IAA2B,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAe;IAChD;;;OAGG;IACH,MAAM,aAAa,GACjB,CACE,OAKuB,EACvB,EAAE,CACJ,KAAK,EAAE,GAAmB,EAAqB,EAAE;QAC/C,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC;IAEJ,OAAO;QACL,gDAAgD;QAChD;YACE,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;gBAC7C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC5D,OAAO,IAAI,CAAC;oBACV,oBAAoB,EAAE,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC;oBAClE,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,gBAAgB,EAAE,KAAK,CAAC,aAAa,KAAK,IAAI;iBAC/C,CAAC,CAAC;YACL,CAAC,CAAC;YACF,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa;SACpB;QAED;;;;;;WAMG;QACH;YACE,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAChD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC5D,IAAI,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;gBAEnE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;gBACpC,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;oBAC7C,cAAc,EAAE,CAAC;oBACjB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,MAAM;iBACtB,CAAC,CAAC;gBAEH,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,EAAE;oBACzC,YAAY,EAAE,IAAI,CAAC,KAAK;oBACxB,MAAM,EAAE,GAAG,CAAC,MAAM;iBACnB,CAAC,CAAC;gBAEH,OAAO,IAAI,CAAC;oBACV,0FAA0F;oBAC1F,kEAAkE;oBAClE,MAAM,EAAE,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE;wBACzC,oBAAoB,EAAE,GAAG;wBACzB,MAAM,EAAE,CAAC;wBACT,KAAK,EAAE,GAAG;qBACX,CAAC;oBACF,MAAM;iBACP,CAAC,CAAC;YACL,CAAC,CAAC;YACF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,YAAY;SACnB;QAED,qEAAqE;QACrE;YACE,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBACtD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC5D,IAAI,CAAC,KAAK,CAAC,aAAa;oBAAE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC1E,IAAI,WAAW,CAAC,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;gBAEzE,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,MAAM,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;oBAC3D,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;gBACpD,CAAC;gBAED,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAE7D,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;oBAC7C,WAAW,EAAE,WAAW,CAAC,MAAM;oBAC/B,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACrC,OAAO,EAAE,IAAI;oBACb,cAAc,EAAE,CAAC;oBACjB,WAAW,EAAE,MAAM,CAAC,OAAO;oBAC3B,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,IAAI;oBACnB,MAAM,EAAE,KAAK,CAAC,aAAa;iBAC5B,CAAC,CAAC;gBAEH,4FAA4F;gBAC5F,YAAY;gBACZ,OAAO,IAAI,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;YAClD,CAAC,CAAC;YACF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,eAAe;SACtB;QAED;;;WAGG;QACH;YACE,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBACtD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;gBACjF,IAAI,WAAW,CAAC,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;gBAEzE,MAAM,MAAM,GAAG,UAAU,CAAC;oBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC;iBACtB,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,MAAM,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;oBAC3D,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC/C,CAAC;gBAED,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC7D,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;oBAC7C,WAAW,EAAE,WAAW,CAAC,MAAM;oBAC/B,cAAc,EAAE,CAAC;oBACjB,WAAW,EAAE,MAAM,CAAC,OAAO;oBAC3B,WAAW,EAAE,IAAI;iBAClB,CAAC,CAAC;gBAEH,OAAO,IAAI,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;YAClD,CAAC,CAAC;YACF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,mBAAmB;SAC1B;QAED;;;;;;;;WAQG;QACH;YACE,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBACtD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;gBACjF,IAAI,WAAW,CAAC,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;gBAEzE,MAAM,MAAM,GAAG,UAAU,CAAC;oBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC;iBACtB,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,MAAM,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;oBAC3D,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC/C,CAAC;gBAED,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;gBAChE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAClC,CAAC,CAAC;YACF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,cAAc;SACrB;KACF,CAAC;AACJ,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Codes renvoyés dans `errors[0].data.code` par le hook `beforeLogin`.
+ *
+ * Module sans dépendance : il est importé aussi bien par le formulaire de connexion (composant
+ * client) que par le hook côté serveur.
+ */
+export declare const MFA_ERROR_CODES: {
+    readonly invalid: "MFA_INVALID";
+    readonly locked: "MFA_LOCKED";
+    readonly required: "MFA_REQUIRED";
+};
+export type MfaErrorCode = (typeof MFA_ERROR_CODES)[keyof typeof MFA_ERROR_CODES];
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC"}

package/dist/errors.js

@@ -0,0 +1,12 @@
+/**
+ * Codes renvoyés dans `errors[0].data.code` par le hook `beforeLogin`.
+ *
+ * Module sans dépendance : il est importé aussi bien par le formulaire de connexion (composant
+ * client) que par le hook côté serveur.
+ */
+export const MFA_ERROR_CODES = {
+    invalid: 'MFA_INVALID',
+    locked: 'MFA_LOCKED',
+    required: 'MFA_REQUIRED',
+};
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,OAAO,EAAE,aAAa;IACtB,MAAM,EAAE,YAAY;IACpB,QAAQ,EAAE,cAAc;CAChB,CAAC"}

package/dist/exports/client.d.ts

@@ -0,0 +1,5 @@
+export { MfaLoginForm, type MfaLoginFormProps } from '../components/login-form.js';
+export { MfaPanel, type MfaPanelProps } from '../components/mfa-panel.js';
+export { MFA_ERROR_CODES, type MfaErrorCode } from '../errors.js';
+export { builtInLabels, format, resolveLabels, type MfaLabelOverrides, type MfaLabels, } from '../i18n.js';
+//# sourceMappingURL=client.d.ts.map

package/dist/exports/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/exports/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EACL,aAAa,EACb,MAAM,EACN,aAAa,EACb,KAAK,iBAAiB,EACtB,KAAK,SAAS,GACf,MAAM,YAAY,CAAC"}

package/dist/exports/client.js

@@ -0,0 +1,5 @@
+export { MfaLoginForm } from '../components/login-form.js';
+export { MfaPanel } from '../components/mfa-panel.js';
+export { MFA_ERROR_CODES } from '../errors.js';
+export { builtInLabels, format, resolveLabels, } from '../i18n.js';
+//# sourceMappingURL=client.js.map

package/dist/exports/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/exports/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0B,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAsB,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAqB,MAAM,cAAc,CAAC;AAClE,OAAO,EACL,aAAa,EACb,MAAM,EACN,aAAa,GAGd,MAAM,YAAY,CAAC"}

package/dist/exports/rsc.d.ts

@@ -0,0 +1,2 @@
+export { MfaLoginView, type MfaLoginViewProps } from '../components/login-view.js';
+//# sourceMappingURL=rsc.d.ts.map

package/dist/exports/rsc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsc.d.ts","sourceRoot":"","sources":["../../src/exports/rsc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/exports/rsc.js

@@ -0,0 +1,2 @@
+export { MfaLoginView } from '../components/login-view.js';
+//# sourceMappingURL=rsc.js.map

package/dist/exports/rsc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsc.js","sourceRoot":"","sources":["../../src/exports/rsc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0B,MAAM,6BAA6B,CAAC"}

package/dist/fields.d.ts

@@ -0,0 +1,4 @@
+import type { Field } from 'payload';
+import type { MfaContext, MfaPluginOptions } from './types.js';
+export declare function createMfaFields(ctx: MfaContext, options: MfaPluginOptions): Field[];
+//# sourceMappingURL=fields.d.ts.map

package/dist/fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fields.d.ts","sourceRoot":"","sources":["../src/fields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAkB/D,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,GAAG,KAAK,EAAE,CA4CnF"}

package/dist/fields.js

@@ -0,0 +1,60 @@
+/**
+ * Aucun champ MFA n'est modifiable par l'API : tout passe par les endpoints `/mfa/*`, qui écrivent
+ * en `overrideAccess`. Sans cela, un PATCH sur `/api/<collection>/:id` depuis une session volée
+ * suffirait à désactiver le second facteur ou à y substituer un secret choisi par l'attaquant.
+ */
+const readOnlyToApi = {
+    create: () => false,
+    update: () => false,
+};
+/** `hidden` retire le champ des réponses API et de l'admin ; `read: false` couvre le reste. */
+const secretAccess = {
+    ...readOnlyToApi,
+    read: () => false,
+};
+export function createMfaFields(ctx, options) {
+    return [
+        {
+            name: ctx.fieldName,
+            type: 'group',
+            // Le groupe ne contient que de l'état ; l'interface d'enrôlement est le champ `ui` ci-dessous.
+            admin: { hidden: true },
+            fields: [
+                { name: 'enabled', type: 'checkbox', access: readOnlyToApi, defaultValue: false },
+                { name: 'confirmedAt', type: 'date', access: readOnlyToApi },
+                // Secret TOTP validé, chiffré avec `PAYLOAD_SECRET`.
+                { name: 'secret', type: 'text', access: secretAccess, hidden: true },
+                // Secret en attente de confirmation par un premier code valide, chiffré lui aussi.
+                { name: 'pendingSecret', type: 'text', access: secretAccess, hidden: true },
+                // Tableau de `StoredBackupCode` : sel + empreinte scrypt + date de consommation.
+                { name: 'backupCodes', type: 'json', access: secretAccess, hidden: true },
+                // Dernier pas de temps TOTP accepté, pour refuser le rejeu d'un code déjà utilisé.
+                { name: 'lastCounter', type: 'number', access: secretAccess, hidden: true },
+                {
+                    name: 'failedAttempts',
+                    type: 'number',
+                    access: secretAccess,
+                    defaultValue: 0,
+                    hidden: true,
+                },
+                { name: 'lockedUntil', type: 'date', access: secretAccess, hidden: true },
+            ],
+        },
+        {
+            name: `${ctx.fieldName}Panel`,
+            type: 'ui',
+            admin: {
+                components: {
+                    Field: {
+                        // `clientProps` est le seul canal par lequel un composant client peut recevoir la
+                        // configuration du plugin : il n'a accès ni aux options ni au config serveur.
+                        clientProps: { labels: options.labels, language: options.language },
+                        exportName: 'MfaPanel',
+                        path: 'payload-plugin-mfa/client',
+                    },
+                },
+            },
+        },
+    ];
+}
+//# sourceMappingURL=fields.js.map

package/dist/fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fields.js","sourceRoot":"","sources":["../src/fields.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,MAAM,aAAa,GAAG;IACpB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;IACnB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;CACpB,CAAC;AAEF,+FAA+F;AAC/F,MAAM,YAAY,GAAG;IACnB,GAAG,aAAa;IAChB,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK;CAClB,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,GAAe,EAAE,OAAyB;IACxE,OAAO;QACL;YACE,IAAI,EAAE,GAAG,CAAC,SAAS;YACnB,IAAI,EAAE,OAAO;YACb,+FAA+F;YAC/F,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YACvB,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE;gBACjF,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE;gBAC5D,qDAAqD;gBACrD,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE;gBACpE,mFAAmF;gBACnF,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE;gBAC3E,iFAAiF;gBACjF,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE;gBACzE,mFAAmF;gBACnF,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE;gBAC3E;oBACE,IAAI,EAAE,gBAAgB;oBACtB,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,YAAY;oBACpB,YAAY,EAAE,CAAC;oBACf,MAAM,EAAE,IAAI;iBACb;gBACD,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE;aAC1E;SACF;QACD;YACE,IAAI,EAAE,GAAG,GAAG,CAAC,SAAS,OAAO;YAC7B,IAAI,EAAE,IAAI;YACV,KAAK,EAAE;gBACL,UAAU,EAAE;oBACV,KAAK,EAAE;wBACL,kFAAkF;wBAClF,8EAA8E;wBAC9E,WAAW,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;wBACnE,UAAU,EAAE,UAAU;wBACtB,IAAI,EAAE,2BAA2B;qBAClC;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/hooks.d.ts

@@ -0,0 +1,21 @@
+import type { CollectionAfterErrorHook, CollectionBeforeLoginHook } from 'payload';
+import type { MfaContext } from './types.js';
+/**
+ * Second facteur, appliqué après la vérification du mot de passe et avant l'émission du JWT.
+ *
+ * Les écritures du chemin nominal passent par `req`, donc par la transaction ouverte par
+ * `loginOperation` : écrire la ligne utilisateur depuis une transaction concurrente attendrait un
+ * verrou que seule la fin de la connexion libère, et la requête ne se terminerait jamais.
+ *
+ * Le compteur d'échecs, lui, doit survivre à l'annulation de cette transaction : il est écrit par
+ * `createMfaAfterErrorHook`, qui s'exécute après le `killTransaction`.
+ */
+export declare function createMfaBeforeLoginHook(ctx: MfaContext): CollectionBeforeLoginHook;
+/**
+ * Incrémente le compteur d'échecs, et pose le verrou au bout de `maxAttempts`.
+ *
+ * S'exécute depuis `routeError`, donc après que `loginOperation` a annulé sa transaction : les
+ * verrous sont retombés, l'écriture aboutit, et elle n'est plus emportée par l'annulation.
+ */
+export declare function createMfaAfterErrorHook(ctx: MfaContext): CollectionAfterErrorHook;
+//# sourceMappingURL=hooks.d.ts.map

package/dist/hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,yBAAyB,EAG1B,MAAM,SAAS,CAAC;AASjB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAmB7C;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,UAAU,GAAG,yBAAyB,CAwBnF;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,UAAU,GAAG,wBAAwB,CAejF"}