@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/core/entities/user-authenticator/service.mjs

@@ -0,0 +1,731 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { userAuthenticatorSchema } from "./schema.mjs";
+import { appendQueryConditions, decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
+import { isRealmCipherBlobError } from "../../key/check.mjs";
+import "../../key/index.mjs";
+import { USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX } from "./constants.mjs";
+import { generateNumericCode, generateRecoveryCode } from "./helpers.mjs";
+import { MailTemplateName } from "../../mail/template/types.mjs";
+import "../../mail/index.mjs";
+import { buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, verifyWebauthnAuthentication, verifyWebauthnRegistration } from "./webauthn.mjs";
+import { ValidatorGroup } from "@authup/kit";
+import { EventName, EventRefType, EventScope, IdentityType, PermissionName, UserAuthenticatorKind, UserAuthenticatorValidator } from "@authup/core-kit";
+import { AbstractEntityService, buildCacheKey, compare, hash } from "@authup/server-kit";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
+import { AuthupError, EntityCredentialsInvalidError, EntityNotFoundError, ErrorCode, MfaThrottledError, ValidationError, isMfaThrottledError } from "@authup/errors";
+import { eq, inArray, or } from "@rapiq/core";
+import { randomUUID } from "node:crypto";
+import { Secret, TOTP } from "otpauth";
+import QRCode from "qrcode";
+//#region src/core/entities/user-authenticator/service.ts
+var UserAuthenticatorService = class extends AbstractEntityService {
+	repository;
+	userRepository;
+	cache;
+	cipher;
+	eventService;
+	mailClient;
+	mailTemplateRenderer;
+	options;
+	validator;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.userRepository = ctx.userRepository;
+		this.cache = ctx.cache;
+		this.cipher = ctx.cipher;
+		this.eventService = ctx.eventService;
+		this.mailClient = ctx.mailClient;
+		this.mailTemplateRenderer = ctx.mailTemplateRenderer;
+		this.options = ctx.options ?? {};
+		this.validator = new UserAuthenticatorValidator();
+	}
+	isOwnedBy(entity, actor) {
+		return !!actor.identity && actor.identity.type === IdentityType.USER && entity.userId === actor.identity.data.id;
+	}
+	/**
+	* The secret/codes columns never leave the service — reads return the
+	* row with both nulled (defense in depth on top of select:false).
+	*/ sanitize(entity) {
+		return {
+			...entity,
+			secret: null,
+			codes: null
+		};
+	}
+	async getMany(query, actor, options = {}) {
+		const isSelf = !!options.userId && !!actor.identity && actor.identity.type === IdentityType.USER && actor.identity.data.id === options.userId;
+		if (!isSelf) await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_AUTHENTICATOR_READ });
+		const parsed = await decodeQuery(query, {
+			schema: userAuthenticatorSchema,
+			actor
+		});
+		const findManyOptions = options.userId ? { owner: { userId: options.userId } } : {};
+		const compiled = isSelf ? { verdict: "allow" } : await actor.permissionEvaluator.compile({ name: PermissionName.USER_AUTHENTICATOR_READ });
+		if (compiled.verdict !== "post") {
+			const ownership = actor.identity && actor.identity.type === IdentityType.USER ? eq("userId", actor.identity.data.id) : null;
+			let scoped = parsed;
+			if (compiled.verdict === "deny") scoped = appendQueryConditions(parsed, ownership ?? inArray("id", []));
+			else if (compiled.verdict === "conditional") scoped = appendQueryConditions(parsed, ownership ? or(ownership, compiled.condition) : compiled.condition);
+			const { data, meta } = await this.repository.findMany(scoped, findManyOptions);
+			return {
+				data: data.map((entity) => this.sanitize(entity)),
+				meta
+			};
+		}
+		const { data: entities, meta } = await this.repository.findMany(parsed, findManyOptions);
+		const data = [];
+		let { total } = meta;
+		for (const entity of entities) {
+			if (this.isOwnedBy(entity, actor)) {
+				data.push(this.sanitize(entity));
+				continue;
+			}
+			try {
+				await actor.permissionEvaluator.evaluate({
+					name: PermissionName.USER_AUTHENTICATOR_READ,
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: entity,
+						...this.resourceRealmMatch(entity)
+					})
+				});
+				data.push(this.sanitize(entity));
+			} catch {
+				total -= 1;
+			}
+		}
+		return {
+			data,
+			meta: {
+				...meta,
+				total
+			}
+		};
+	}
+	async getOne(id, actor, options = {}) {
+		const entity = await this.resolveOne(id, options.userId);
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_AUTHENTICATOR_READ });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.USER_AUTHENTICATOR_READ,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+		}
+		return this.sanitize(entity);
+	}
+	async resolveOne(id, userId) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity || userId && entity.userId !== userId) throw new EntityNotFoundError();
+		return entity;
+	}
+	async enroll(data, actor) {
+		this.assertEnabled();
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		const user = await this.resolveTargetUser(validated.userId, actor, validated);
+		if (!(!!actor.identity && actor.identity.type === IdentityType.USER && actor.identity.data.id === user.id) && validated.kind !== UserAuthenticatorKind.EMAIL) throw new ValidationError(`A ${validated.kind} authenticator can only be enrolled by the account owner.`);
+		switch (validated.kind) {
+			case UserAuthenticatorKind.TOTP: return this.enrollTotp(user, validated.name ?? null);
+			case UserAuthenticatorKind.RECOVERY: return this.enrollRecovery(user, validated.name ?? null);
+			case UserAuthenticatorKind.EMAIL: return this.enrollEmail(user, validated.name ?? null);
+			case UserAuthenticatorKind.WEBAUTHN: return this.enrollWebauthn(user, validated.name ?? null);
+			default: throw new ValidationError(`The authenticator kind ${validated.kind} can not be enrolled yet.`);
+		}
+	}
+	async enrollWebauthn(user, name) {
+		const ctx = this.assertWebauthn();
+		const excludeCredentials = (await this.repository.findAllWithSecretsByUser(user.id, {
+			kind: UserAuthenticatorKind.WEBAUTHN,
+			confirmed: true
+		})).map((device) => this.parseWebauthnParameters(device)).filter((parameters) => !!parameters).map((parameters) => ({
+			id: parameters.credential_id,
+			transports: parameters.transports
+		}));
+		const { options, challenge } = await buildWebauthnRegistrationOptions(ctx, {
+			id: user.id,
+			name: user.name
+		}, excludeCredentials);
+		let entity = this.repository.create({
+			kind: UserAuthenticatorKind.WEBAUTHN,
+			name,
+			confirmed: false,
+			userId: user.id,
+			realmId: user.realmId
+		});
+		entity = await this.repository.save(entity);
+		await this.cache.set(this.buildWebauthnCacheKey(USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, entity.id), {
+			challenge,
+			expiresAt: Date.now() + 300 * 1e3
+		}, { ttl: 300 * 1e3 });
+		return {
+			data: this.sanitize(entity),
+			meta: { webauthn: options }
+		};
+	}
+	async enrollEmail(user, name) {
+		this.assertMail();
+		if (!(user.email ?? (await this.userRepository.findOneByWithEmail({ id: user.id }))?.email)) throw new ValidationError("The user has no email address to receive codes.");
+		const existing = (await this.repository.findAllByUser(user.id)).filter((device) => device.kind === UserAuthenticatorKind.EMAIL);
+		let entity;
+		if (existing.length > 0) {
+			const [primary, ...duplicates] = existing;
+			primary.name = name;
+			primary.confirmed = true;
+			entity = await this.repository.save(primary);
+			for (const duplicate of duplicates) await this.repository.remove(duplicate);
+		} else {
+			entity = this.repository.create({
+				kind: UserAuthenticatorKind.EMAIL,
+				name,
+				confirmed: true,
+				userId: user.id,
+				realmId: user.realmId
+			});
+			entity = await this.repository.save(entity);
+		}
+		await this.recordEvent(EventName.MFA_ENROLLED, entity);
+		return {
+			data: this.sanitize(entity),
+			meta: {}
+		};
+	}
+	async resolveTargetUser(userId, actor, validated) {
+		const actorUser = actor.identity && actor.identity.type === IdentityType.USER ? actor.identity.data : void 0;
+		if (!userId || actorUser && actorUser.id === userId) {
+			if (!actorUser) throw new AuthupError({
+				code: ErrorCode.IDENTITY_UNAUTHORIZED,
+				message: "Authentication required."
+			});
+			return actorUser;
+		}
+		const target = await this.userRepository.findOneById(userId);
+		if (!target) throw new EntityNotFoundError();
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_AUTHENTICATOR_CREATE });
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.USER_AUTHENTICATOR_CREATE,
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: {
+					...validated,
+					realmId: target.realmId
+				},
+				...this.resourceRealmMatch(target)
+			})
+		});
+		return target;
+	}
+	async enrollTotp(user, name) {
+		const secret = new Secret({ size: 20 });
+		const parameters = {
+			algorithm: USER_AUTHENTICATOR_TOTP_ALGORITHM,
+			digits: 6,
+			period: 30
+		};
+		const uri = new TOTP({
+			issuer: this.options.issuer ?? "authup",
+			label: user.name,
+			algorithm: parameters.algorithm,
+			digits: parameters.digits,
+			period: parameters.period,
+			secret
+		}).toString();
+		let entity = this.repository.create({
+			kind: UserAuthenticatorKind.TOTP,
+			name,
+			secret: await this.cipher.encrypt(secret.base32, user.realmId),
+			parameters: JSON.stringify(parameters),
+			confirmed: false,
+			userId: user.id,
+			realmId: user.realmId
+		});
+		entity = await this.repository.save(entity);
+		return {
+			data: this.sanitize(entity),
+			meta: {
+				secret: secret.base32,
+				uri,
+				qr: await QRCode.toDataURL(uri)
+			}
+		};
+	}
+	async enrollRecovery(user, name) {
+		const codes = [];
+		const stored = [];
+		for (let i = 0; i < 10; i++) {
+			const code = generateRecoveryCode();
+			codes.push(code);
+			stored.push({
+				hash: await hash(code),
+				used_at: null
+			});
+		}
+		const [existing] = await this.repository.findAllWithSecretsByUser(user.id, { kind: UserAuthenticatorKind.RECOVERY });
+		let entity;
+		if (existing) {
+			existing.name = name;
+			existing.codes = JSON.stringify(stored);
+			existing.confirmed = true;
+			entity = await this.repository.save(existing);
+		} else {
+			entity = this.repository.create({
+				kind: UserAuthenticatorKind.RECOVERY,
+				name,
+				codes: JSON.stringify(stored),
+				confirmed: true,
+				userId: user.id,
+				realmId: user.realmId
+			});
+			entity = await this.repository.save(entity);
+		}
+		await this.recordEvent(EventName.MFA_ENROLLED, entity);
+		return {
+			data: this.sanitize(entity),
+			meta: { codes }
+		};
+	}
+	async confirm(id, code, actor, options = {}) {
+		const entity = await this.resolveOne(id, options.userId);
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_AUTHENTICATOR_UPDATE });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.USER_AUTHENTICATOR_UPDATE,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+		}
+		if (entity.confirmed) return this.sanitize(entity);
+		if (entity.kind === UserAuthenticatorKind.WEBAUTHN) return this.confirmWebauthn(entity, code);
+		if (entity.kind !== UserAuthenticatorKind.TOTP) throw new ValidationError(`The authenticator kind ${entity.kind} can not be confirmed with a code.`);
+		await this.assertNotThrottledOrRetry(entity.userId);
+		const withSecrets = await this.repository.findOneWithSecretsById(entity.id);
+		if (!withSecrets) throw new EntityNotFoundError();
+		if (!await this.verifyTotp(withSecrets, code)) {
+			await this.bumpAttempts(entity.userId);
+			throw new EntityCredentialsInvalidError();
+		}
+		await this.resetAttempts(entity.userId);
+		entity.confirmed = true;
+		const output = await this.repository.save(entity);
+		await this.recordEvent(EventName.MFA_ENROLLED, output);
+		return this.sanitize(output);
+	}
+	async confirmWebauthn(entity, response) {
+		const ctx = this.assertWebauthn();
+		await this.assertNotThrottledOrRetry(entity.userId);
+		const cacheKey = this.buildWebauthnCacheKey(USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, entity.id);
+		const state = await this.cache.get(cacheKey);
+		if (!state || state.expiresAt < Date.now()) {
+			await this.bumpAttempts(entity.userId);
+			throw new EntityCredentialsInvalidError();
+		}
+		let parsed;
+		try {
+			parsed = JSON.parse(response);
+		} catch {
+			throw new ValidationError("The registration response is malformed.");
+		}
+		const credential = await verifyWebauthnRegistration(ctx, parsed, state.challenge);
+		if (!credential) {
+			await this.bumpAttempts(entity.userId);
+			throw new EntityCredentialsInvalidError();
+		}
+		await this.resetAttempts(entity.userId);
+		await this.cache.drop(cacheKey);
+		entity.parameters = JSON.stringify(credential);
+		entity.confirmed = true;
+		const output = await this.repository.save(entity);
+		await this.recordEvent(EventName.MFA_ENROLLED, output);
+		return this.sanitize(output);
+	}
+	async delete(id, actor, options = {}) {
+		const entity = await this.resolveOne(id, options.userId);
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_AUTHENTICATOR_DELETE });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.USER_AUTHENTICATOR_DELETE,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+		}
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		await this.recordEvent(EventName.MFA_REMOVED, entity);
+		return this.sanitize(entity);
+	}
+	async verify(userId, input, ctx = {}) {
+		try {
+			await this.assertNotThrottled(userId);
+		} catch (e) {
+			if (isMfaThrottledError(e)) throw e;
+			return false;
+		}
+		const lockKey = this.buildVerifyLockCacheKey(userId);
+		const lock = await this.acquireVerifyLock(lockKey);
+		if (lock.status !== "acquired") return false;
+		const lease = this.maintainVerifyLock(lockKey, lock.value);
+		try {
+			const devices = await this.repository.findAllWithSecretsByUser(userId, {
+				kind: input.kind,
+				confirmed: true
+			});
+			let matched;
+			for (const device of devices) {
+				if (input.kind === UserAuthenticatorKind.TOTP) {
+					if (await this.verifyTotp(device, input.response)) matched = device;
+				}
+				if (input.kind === UserAuthenticatorKind.RECOVERY) {
+					if (await this.verifyRecovery(device, input.response)) matched = device;
+				}
+				if (input.kind === UserAuthenticatorKind.EMAIL) {
+					if (await this.verifyEmail(userId, input.response)) matched = device;
+				}
+				if (input.kind === UserAuthenticatorKind.WEBAUTHN) {
+					const newCounter = await this.verifyWebauthnDevice(userId, device, input.response);
+					if (newCounter !== null) {
+						const parameters = this.parseWebauthnParameters(device);
+						if (parameters) device.parameters = JSON.stringify({
+							...parameters,
+							counter: newCounter
+						});
+						matched = device;
+					}
+				}
+				if (matched) break;
+			}
+			if (!matched) {
+				await this.bumpAttempts(userId);
+				await this.recordChallengeEvent(EventName.MFA_CHALLENGE_FAILED, userId, input.kind, ctx);
+				return false;
+			}
+			if (!await lease.renew()) return false;
+			if (ctx.onVerified) await ctx.onVerified();
+			if (!await lease.renew()) return false;
+			matched.lastUsedAt = (/* @__PURE__ */ new Date()).toISOString();
+			await this.repository.save(matched);
+			if (input.kind === UserAuthenticatorKind.EMAIL) await this.cache.drop(this.buildEmailCodeCacheKey(userId));
+			if (input.kind === UserAuthenticatorKind.WEBAUTHN) await this.cache.drop(this.buildWebauthnCacheKey(USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, userId));
+			await this.resetAttempts(userId);
+			await this.recordChallengeEvent(EventName.MFA_VERIFIED, userId, input.kind, ctx, matched);
+			return true;
+		} finally {
+			await lease.stop();
+			await this.releaseVerifyLock(lockKey, lock.value);
+		}
+	}
+	async verifyTotp(device, token) {
+		if (!device.secret) return false;
+		let seed;
+		try {
+			seed = await this.cipher.decrypt(device.secret, device.realmId);
+		} catch (e) {
+			if (isRealmCipherBlobError(e)) return false;
+			throw e;
+		}
+		let parameters = {
+			algorithm: USER_AUTHENTICATOR_TOTP_ALGORITHM,
+			digits: 6,
+			period: 30
+		};
+		if (device.parameters) parameters = {
+			...parameters,
+			...JSON.parse(device.parameters)
+		};
+		const delta = new TOTP({
+			algorithm: parameters.algorithm,
+			digits: parameters.digits,
+			period: parameters.period,
+			secret: Secret.fromBase32(seed)
+		}).validate({
+			token: token.trim(),
+			window: 1
+		});
+		if (delta === null) return false;
+		const step = Math.floor(Date.now() / 1e3 / parameters.period) + delta;
+		if (typeof parameters.counter === "number" && step <= parameters.counter) return false;
+		device.parameters = JSON.stringify({
+			...parameters,
+			counter: step
+		});
+		return true;
+	}
+	async verifyRecovery(device, code) {
+		if (!device.codes) return false;
+		const entries = JSON.parse(device.codes);
+		const normalized = code.trim().toLowerCase();
+		for (const entry of entries) {
+			if (entry.used_at) continue;
+			if (await compare(normalized, entry.hash)) {
+				entry.used_at = (/* @__PURE__ */ new Date()).toISOString();
+				device.codes = JSON.stringify(entries);
+				return true;
+			}
+		}
+		return false;
+	}
+	parseWebauthnParameters(device) {
+		if (!device.parameters) return null;
+		try {
+			return JSON.parse(device.parameters);
+		} catch {
+			return null;
+		}
+	}
+	async verifyWebauthnDevice(userId, device, response) {
+		const ctx = this.assertWebauthn();
+		const parameters = this.parseWebauthnParameters(device);
+		if (!parameters) return null;
+		let parsed;
+		try {
+			parsed = JSON.parse(response);
+		} catch {
+			return null;
+		}
+		if (parsed.id !== parameters.credential_id) return null;
+		const state = await this.cache.get(this.buildWebauthnCacheKey(USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, userId));
+		if (!state || state.expiresAt < Date.now()) return null;
+		try {
+			const result = await verifyWebauthnAuthentication(ctx, parsed, state.challenge, parameters);
+			return result.verified ? result.newCounter : null;
+		} catch {
+			return null;
+		}
+	}
+	async verifyEmail(userId, response) {
+		const key = this.buildEmailCodeCacheKey(userId);
+		const state = await this.cache.get(key);
+		if (!state || state.expiresAt < Date.now()) return false;
+		return compare(response.trim(), state.hash);
+	}
+	async sendChallenge(userId, kind, ctx = {}) {
+		if (kind !== UserAuthenticatorKind.EMAIL) return;
+		this.assertMail();
+		await this.assertNotThrottledOrRetry(userId);
+		if ((await this.repository.findAllWithSecretsByUser(userId, {
+			kind: UserAuthenticatorKind.EMAIL,
+			confirmed: true
+		})).length === 0) return;
+		const user = await this.userRepository.findOneByWithEmail({ id: userId });
+		if (!user || !user.email) return;
+		let withinCooldown;
+		try {
+			withinCooldown = !await this.cache.add(this.buildEmailSendCacheKey(userId), 1, { ttl: 60 * 1e3 });
+		} catch {
+			withinCooldown = false;
+		}
+		if (withinCooldown) throw new MfaThrottledError({ retryAfter: 60 });
+		const codeValue = generateNumericCode(6);
+		await this.cache.set(this.buildEmailCodeCacheKey(userId), {
+			hash: await hash(codeValue),
+			expiresAt: Date.now() + 600 * 1e3
+		}, { ttl: 600 * 1e3 });
+		const mail = await this.mailTemplateRenderer.render({
+			template: MailTemplateName.MFA_EMAIL_OTP,
+			params: {
+				code: codeValue,
+				expiresInMinutes: 10
+			},
+			locale: ctx.locale
+		});
+		await this.mailClient.send({
+			to: user.email,
+			...mail
+		});
+	}
+	async hasConfirmed(userId) {
+		return this.repository.hasConfirmedByUser(userId);
+	}
+	async challenge(userId, options = {}) {
+		if (!this.options.enabled) return {
+			required: false,
+			enrollmentRequired: false,
+			kinds: []
+		};
+		const confirmed = (await this.repository.findAllByUser(userId)).filter((device) => device.confirmed);
+		const kinds = Array.from(new Set(confirmed.map((device) => device.kind)));
+		const status = {
+			required: confirmed.length > 0,
+			enrollmentRequired: !!this.options.required && confirmed.length === 0,
+			kinds
+		};
+		if ((options.issueMaterial ?? true) && kinds.includes(UserAuthenticatorKind.WEBAUTHN) && this.options.webauthn) {
+			const credentials = (await this.repository.findAllWithSecretsByUser(userId, {
+				kind: UserAuthenticatorKind.WEBAUTHN,
+				confirmed: true
+			})).map((device) => this.parseWebauthnParameters(device)).filter((parameters) => !!parameters).map((parameters) => ({
+				id: parameters.credential_id,
+				transports: parameters.transports
+			}));
+			const { options, challenge } = await buildWebauthnAuthenticationOptions(this.options.webauthn, credentials);
+			await this.cache.set(this.buildWebauthnCacheKey(USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, userId), {
+				challenge,
+				expiresAt: Date.now() + 300 * 1e3
+			}, { ttl: 300 * 1e3 });
+			status.challenge = { webauthn: options };
+		}
+		return status;
+	}
+	assertEnabled() {
+		if (!this.options.enabled) throw new AuthupError({
+			code: ErrorCode.MFA_NOT_CONFIGURABLE,
+			message: "Multi-factor authentication is not enabled."
+		});
+	}
+	assertMail() {
+		if (!this.mailClient || !this.mailTemplateRenderer) throw new AuthupError({
+			code: ErrorCode.MFA_NOT_CONFIGURABLE,
+			message: "Email-based multi-factor authentication requires a configured mail transport."
+		});
+	}
+	assertWebauthn() {
+		if (!this.options.webauthn) throw new AuthupError({
+			code: ErrorCode.MFA_NOT_CONFIGURABLE,
+			message: "WebAuthn requires a configured public URL (relying-party origin)."
+		});
+		return this.options.webauthn;
+	}
+	buildAttemptCacheKey(userId) {
+		return buildCacheKey({
+			prefix: USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX,
+			key: userId
+		});
+	}
+	buildThrottleCacheKey(userId) {
+		return buildCacheKey({
+			prefix: USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX,
+			key: userId
+		});
+	}
+	buildEmailCodeCacheKey(userId) {
+		return buildCacheKey({
+			prefix: USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX,
+			key: userId
+		});
+	}
+	buildEmailSendCacheKey(userId) {
+		return buildCacheKey({
+			prefix: USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX,
+			key: userId
+		});
+	}
+	buildWebauthnCacheKey(prefix, userId) {
+		return buildCacheKey({
+			prefix,
+			key: userId
+		});
+	}
+	buildVerifyLockCacheKey(userId) {
+		return buildCacheKey({
+			prefix: USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX,
+			key: userId
+		});
+	}
+	async acquireVerifyLock(key) {
+		const value = randomUUID();
+		try {
+			return await this.cache.add(key, value, { ttl: 1e4 }) ? {
+				status: "acquired",
+				value
+			} : { status: "busy" };
+		} catch {
+			return { status: "unavailable" };
+		}
+	}
+	maintainVerifyLock(key, value) {
+		let owned = true;
+		let pending;
+		const queueRenewal = () => {
+			if (!owned || pending) return pending;
+			pending = this.cache.renewIfValue(key, value, USER_AUTHENTICATOR_VERIFY_LOCK_TTL).then((renewed) => {
+				owned = renewed;
+			}).catch(() => {
+				owned = false;
+			}).finally(() => {
+				pending = void 0;
+			});
+			return pending;
+		};
+		const timer = setInterval(queueRenewal, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL);
+		return {
+			renew: async () => {
+				await queueRenewal();
+				return owned;
+			},
+			stop: async () => {
+				clearInterval(timer);
+				await pending;
+			}
+		};
+	}
+	async releaseVerifyLock(key, value) {
+		try {
+			await this.cache.dropIfValue(key, value);
+		} catch {}
+	}
+	async assertNotThrottled(userId) {
+		const lockedUntil = await this.cache.get(this.buildThrottleCacheKey(userId));
+		if (typeof lockedUntil === "number" && lockedUntil > Date.now()) throw new MfaThrottledError({ retryAfter: Math.ceil((lockedUntil - Date.now()) / 1e3) });
+	}
+	async assertNotThrottledOrRetry(userId) {
+		try {
+			await this.assertNotThrottled(userId);
+		} catch (e) {
+			if (isMfaThrottledError(e)) throw e;
+			throw new MfaThrottledError({ retryAfter: 1 });
+		}
+	}
+	async bumpAttempts(userId) {
+		const key = this.buildAttemptCacheKey(userId);
+		let count;
+		try {
+			count = await this.cache.increment(key, 1, { ttl: USER_AUTHENTICATOR_ATTEMPT_WINDOW * 1e3 });
+		} catch {
+			await this.cache.drop(key);
+			count = await this.cache.increment(key, 1, { ttl: USER_AUTHENTICATOR_ATTEMPT_WINDOW * 1e3 });
+		}
+		const delay = Math.min(300, 1 * 2 ** (count - 1));
+		await this.cache.set(this.buildThrottleCacheKey(userId), Date.now() + delay * 1e3, { ttl: delay * 1e3 });
+	}
+	async resetAttempts(userId) {
+		await this.cache.dropMany([this.buildAttemptCacheKey(userId), this.buildThrottleCacheKey(userId)]);
+	}
+	async recordEvent(name, entity) {
+		await this.eventService?.record({
+			scope: EventScope.IDENTITY,
+			name,
+			refType: EventRefType.USER_AUTHENTICATOR,
+			refId: entity.id,
+			actorType: IdentityType.USER,
+			actorId: entity.userId,
+			realmId: entity.realmId,
+			data: { kind: entity.kind }
+		});
+	}
+	async recordChallengeEvent(name, userId, kind, ctx, entity) {
+		await this.eventService?.record({
+			scope: EventScope.IDENTITY,
+			name,
+			refType: EventRefType.USER,
+			refId: userId,
+			actorType: IdentityType.USER,
+			actorId: userId,
+			clientId: ctx.clientId ?? null,
+			realmId: entity?.realmId ?? null,
+			requestIpAddress: ctx.ipAddress ?? null,
+			requestUserAgent: ctx.userAgent ?? null,
+			data: { kind }
+		});
+	}
+};
+//#endregion
+export { UserAuthenticatorService };
+
+//# sourceMappingURL=service.mjs.map