npm - @authup/server-core - Versions diffs - 1.0.0-beta.52 → 1.0.0-beta.54 - Mend

@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1541) hide show

package/dist/core/entities/user-authenticator/service.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"service.mjs","names":["randomUUID","BuiltInPolicyType","definePolicyData","ValidatorGroup","eq","inArray","or","EventName","EventRefType","EventScope","IdentityType","PermissionName","UserAuthenticatorKind","UserAuthenticatorValidator","AuthupError","EntityCredentialsInvalidError","EntityNotFoundError","ErrorCode","MfaThrottledError","ValidationError","isMfaThrottledError","AbstractEntityService","buildCacheKey","compare","hash","Secret","TOTP","QRCode","isRealmCipherBlobError","MailTemplateName","buildWebauthnAuthenticationOptions","buildWebauthnRegistrationOptions","verifyWebauthnAuthentication","verifyWebauthnRegistration","USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX","USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR","USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX","USER_AUTHENTICATOR_ATTEMPT_WINDOW","USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX","USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES","USER_AUTHENTICATOR_EMAIL_CODE_LENGTH","USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX","USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN","USER_AUTHENTICATOR_RECOVERY_CODE_COUNT","USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX","USER_AUTHENTICATOR_TOTP_ALGORITHM","USER_AUTHENTICATOR_TOTP_DIGITS","USER_AUTHENTICATOR_TOTP_PERIOD","USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX","USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL","USER_AUTHENTICATOR_VERIFY_LOCK_TTL","USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX","USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW","USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX","generateNumericCode","generateRecoveryCode","appendQueryConditions","decodeQuery","userAuthenticatorSchema","UserAuthenticatorService","repository","userRepository","cache","cipher","eventService","mailClient","mailTemplateRenderer","options","validator","ctx","isOwnedBy","entity","actor","identity","type","USER","userId","data","id","sanitize","secret","codes","getMany","query","isSelf","permissionEvaluator","preEvaluate","name","USER_AUTHENTICATOR_READ","parsed","schema","findManyOptions","owner","compiled","verdict","compile","ownership","scoped","condition","meta","findMany","map","entities","total","push","evaluate","ATTRIBUTES","resourceRealmMatch","getOne","resolveOne","findOneById","enroll","assertEnabled","validated","run","group","CREATE","user","resolveTargetUser","isSelfEnrollment","kind","EMAIL","enrollTotp","RECOVERY","enrollRecovery","enrollEmail","WEBAUTHN","enrollWebauthn","assertWebauthn","existing","findAllWithSecretsByUser","confirmed","excludeCredentials","device","parseWebauthnParameters","filter","parameters","credential_id","transports","challenge","create","realmId","save","set","buildWebauthnCacheKey","expiresAt","Date","now","ttl","webauthn","assertMail","email","findOneByWithEmail","findAllByUser","length","primary","duplicates","duplicate","remove","recordEvent","MFA_ENROLLED","actorUser","undefined","code","IDENTITY_UNAUTHORIZED","message","target","USER_AUTHENTICATOR_CREATE","size","algorithm","digits","period","totp","issuer","label","uri","toString","encrypt","base32","JSON","stringify","qr","toDataURL","stored","i","used_at","confirm","USER_AUTHENTICATOR_UPDATE","confirmWebauthn","assertNotThrottledOrRetry","withSecrets","findOneWithSecretsById","verifyTotp","bumpAttempts","resetAttempts","output","response","cacheKey","state","get","parse","credential","drop","delete","USER_AUTHENTICATOR_DELETE","entityId","MFA_REMOVED","verify","input","assertNotThrottled","e","lockKey","buildVerifyLockCacheKey","lock","acquireVerifyLock","status","lease","maintainVerifyLock","value","devices","matched","verifyRecovery","verifyEmail","newCounter","verifyWebauthnDevice","counter","recordChallengeEvent","MFA_CHALLENGE_FAILED","renew","onVerified","lastUsedAt","toISOString","buildEmailCodeCacheKey","MFA_VERIFIED","stop","releaseVerifyLock","token","seed","decrypt","fromBase32","delta","validate","trim","window","step","Math","floor","entries","normalized","toLowerCase","entry","result","verified","key","sendChallenge","withinCooldown","add","buildEmailSendCacheKey","retryAfter","codeValue","mail","render","template","MFA_EMAIL_OTP","params","expiresInMinutes","locale","send","to","hasConfirmed","hasConfirmedByUser","enabled","required","enrollmentRequired","kinds","Array","from","Set","issueMaterial","includes","credentials","MFA_NOT_CONFIGURABLE","buildAttemptCacheKey","prefix","buildThrottleCacheKey","owned","pending","queueRenewal","renewIfValue","then","renewed","catch","finally","timer","setInterval","clearInterval","dropIfValue","lockedUntil","ceil","count","increment","delay","min","dropMany","record","scope","IDENTITY","refType","USER_AUTHENTICATOR","refId","actorType","actorId","clientId","requestIpAddress","ipAddress","requestUserAgent","userAgent"],"sources":["../../../../src/core/entities/user-authenticator/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup } from '@authup/kit';\nimport { eq, inArray, or } from '@rapiq/core';\nimport {\n EventName, \n EventRefType, \n EventScope, \n IdentityType, \n PermissionName, \n UserAuthenticatorKind, \n UserAuthenticatorValidator,\n} from '@authup/core-kit';\nimport type { User, UserAuthenticator } from '@authup/core-kit';\nimport {\n AuthupError,\n EntityCredentialsInvalidError,\n EntityNotFoundError,\n ErrorCode,\n MfaThrottledError,\n ValidationError,\n isMfaThrottledError,\n} from '@authup/errors';\nimport { \n AbstractEntityService, \n buildCacheKey, \n compare, \n hash, \n} from '@authup/server-kit';\nimport type {\n ActorContext,\n EntityRepositoryFindManyResult,\n ICache,\n} from '@authup/server-kit';\nimport { Secret, TOTP } from 'otpauth';\nimport QRCode from 'qrcode';\nimport type { AuthenticationResponseJSON, RegistrationResponseJSON } from '@simplewebauthn/server';\nimport { isRealmCipherBlobError } from '../../key/index.ts';\nimport type { IRealmCipher } from '../../key/index.ts';\nimport type { IEventService } from '../event/index.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/index.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IUserRepository } from '../user/index.ts';\nimport {\n buildWebauthnAuthenticationOptions,\n buildWebauthnRegistrationOptions,\n verifyWebauthnAuthentication,\n verifyWebauthnRegistration,\n} from './webauthn.ts';\nimport {\n USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX,\n USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR,\n USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX,\n USER_AUTHENTICATOR_ATTEMPT_WINDOW,\n USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX,\n USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES,\n USER_AUTHENTICATOR_EMAIL_CODE_LENGTH,\n USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX,\n USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN,\n USER_AUTHENTICATOR_RECOVERY_CODE_COUNT,\n USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX,\n USER_AUTHENTICATOR_TOTP_ALGORITHM,\n USER_AUTHENTICATOR_TOTP_DIGITS,\n USER_AUTHENTICATOR_TOTP_PERIOD,\n USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX,\n USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL,\n USER_AUTHENTICATOR_VERIFY_LOCK_TTL,\n USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX,\n USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW,\n USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX,\n} from './constants.ts';\nimport { generateNumericCode, generateRecoveryCode } from './helpers.ts';\nimport type {\n IUserAuthenticatorRepository,\n IUserAuthenticatorService,\n UserAuthenticatorChallengeStatus,\n UserAuthenticatorEnrollResult,\n UserAuthenticatorRecoveryCode,\n UserAuthenticatorSendContext,\n UserAuthenticatorServiceContext,\n UserAuthenticatorServiceOptions,\n UserAuthenticatorTotpParameters,\n UserAuthenticatorVerifyContext,\n UserAuthenticatorVerifyInput,\n UserAuthenticatorWebauthnParameters,\n} from './types.ts';\nimport type { WebauthnContext } from './webauthn.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { userAuthenticatorSchema } from './schema.ts';\n\ntype EmailCodeState = {\n hash: string,\n expiresAt: number,\n};\n\ntype WebauthnChallengeState = {\n challenge: string,\n expiresAt: number,\n};\n\ntype VerifyLock = {\n status: 'acquired',\n value: string,\n} | {\n status: 'busy' | 'unavailable',\n};\n\ntype VerifyLockLease = {\n renew: () => Promise<boolean>,\n stop: () => Promise<void>,\n};\n\nexport class UserAuthenticatorService extends AbstractEntityService implements IUserAuthenticatorService {\n protected repository: IUserAuthenticatorRepository;\n\n protected userRepository: IUserRepository;\n\n protected cache: ICache;\n\n protected cipher: IRealmCipher;\n\n protected eventService?: IEventService;\n\n protected mailClient?: IMailClient;\n\n protected mailTemplateRenderer?: IMailTemplateRenderer;\n\n protected options: UserAuthenticatorServiceOptions;\n\n protected validator: UserAuthenticatorValidator;\n\n constructor(ctx: UserAuthenticatorServiceContext) {\n super();\n\n this.repository = ctx.repository;\n this.userRepository = ctx.userRepository;\n this.cache = ctx.cache;\n this.cipher = ctx.cipher;\n this.eventService = ctx.eventService;\n this.mailClient = ctx.mailClient;\n this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n this.options = ctx.options ?? {};\n this.validator = new UserAuthenticatorValidator();\n }\n\n protected isOwnedBy(entity: UserAuthenticator, actor: ActorContext): boolean {\n return !!actor.identity &&\n actor.identity.type === IdentityType.USER &&\n entity.userId === actor.identity.data.id;\n }\n\n /**\n * The secret/codes columns never leave the service — reads return the\n * row with both nulled (defense in depth on top of select:false).\n */\n protected sanitize(entity: UserAuthenticator): UserAuthenticator {\n return {\n ...entity,\n secret: null,\n codes: null,\n };\n }\n\n // ------------------------------------------------------------------\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n options: { userId?: string } = {},\n ): Promise<EntityRepositoryFindManyResult<UserAuthenticator>> {\n const isSelf = !!options.userId &&\n !!actor.identity &&\n actor.identity.type === IdentityType.USER &&\n actor.identity.data.id === options.userId;\n\n if (!isSelf) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_AUTHENTICATOR_READ });\n }\n\n const parsed = await decodeQuery(query, { schema: userAuthenticatorSchema, actor });\n const findManyOptions = options.userId ? { owner: { userId: options.userId } } : {};\n\n // Own devices are ungated: the nested self read is already owner-scoped,\n // and on the wider mounts ownership composes as an OR-alternative with\n // the compiled USER_AUTHENTICATOR_READ condition (#3286 phase 3) — the\n // whole gate runs as WHERE and pagination/totals stay exact. A\n // non-expressible policy falls back to the per-row loop below.\n const compiled = isSelf ?\n { verdict: 'allow' as const } :\n await actor.permissionEvaluator.compile({ name: PermissionName.USER_AUTHENTICATOR_READ });\n if (compiled.verdict !== 'post') {\n const ownership = actor.identity && actor.identity.type === IdentityType.USER ?\n eq('userId', actor.identity.data.id) :\n null;\n\n let scoped = parsed;\n if (compiled.verdict === 'deny') {\n scoped = appendQueryConditions(parsed, ownership ?? inArray('id', []));\n } else if (compiled.verdict === 'conditional') {\n scoped = appendQueryConditions(\n parsed,\n ownership ? or(ownership, compiled.condition) : compiled.condition,\n );\n }\n\n const { data, meta } = await this.repository.findMany(scoped, findManyOptions);\n\n return {\n data: data.map((entity) => this.sanitize(entity)),\n meta,\n };\n }\n\n const { data: entities, meta } = await this.repository.findMany(\n parsed,\n findManyOptions,\n );\n\n const data: UserAuthenticator[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n if (this.isOwnedBy(entity, actor)) {\n data.push(this.sanitize(entity));\n continue;\n }\n\n try {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_AUTHENTICATOR_READ,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n data.push(this.sanitize(entity));\n } catch {\n total -= 1;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total,\n },\n };\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n options: { userId?: string } = {},\n ): Promise<UserAuthenticator> {\n const entity = await this.resolveOne(id, options.userId);\n\n if (!this.isOwnedBy(entity, actor)) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_AUTHENTICATOR_READ });\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_AUTHENTICATOR_READ,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n }\n\n return this.sanitize(entity);\n }\n\n protected async resolveOne(id: string, userId?: string): Promise<UserAuthenticator> {\n const entity = await this.repository.findOneById(id);\n // a device of another user is a 404 on the nested route — never\n // an existence oracle across users.\n if (!entity || (userId && entity.userId !== userId)) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n // ------------------------------------------------------------------\n\n async enroll(data: Record<string, any>, actor: ActorContext): Promise<UserAuthenticatorEnrollResult> {\n this.assertEnabled();\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n const user = await this.resolveTargetUser(validated.userId, actor, validated);\n\n // Only EMAIL may be provisioned FOR another user: its code is mailed to\n // the user's own (already-verified) mailbox, so the enroller never\n // obtains a factor it controls. Every other kind would let an admin plant\n // a second factor they hold, defeating MFA — TOTP/recovery return the\n // seed/codes to the caller, and a WebAuthn ceremony can be completed on\n // the enroller's OWN authenticator (the server can't tell whose device\n // signed). Those are self-enrollment only (Keycloak/Okta/Authentik don't\n // hand a user's factor secret to an admin either); an admin resets another\n // user's MFA by DELETING it, and the user re-enrolls.\n const isSelfEnrollment = !!actor.identity &&\n actor.identity.type === IdentityType.USER &&\n actor.identity.data.id === user.id;\n if (!isSelfEnrollment && validated.kind !== UserAuthenticatorKind.EMAIL) {\n throw new ValidationError(\n `A ${validated.kind} authenticator can only be enrolled by the account owner.`,\n );\n }\n\n switch (validated.kind) {\n case UserAuthenticatorKind.TOTP: {\n return this.enrollTotp(user, validated.name ?? null);\n }\n case UserAuthenticatorKind.RECOVERY: {\n return this.enrollRecovery(user, validated.name ?? null);\n }\n case UserAuthenticatorKind.EMAIL: {\n return this.enrollEmail(user, validated.name ?? null);\n }\n case UserAuthenticatorKind.WEBAUTHN: {\n return this.enrollWebauthn(user, validated.name ?? null);\n }\n default: {\n throw new ValidationError(`The authenticator kind ${validated.kind} can not be enrolled yet.`);\n }\n }\n }\n\n protected async enrollWebauthn(user: User, name: string | null): Promise<UserAuthenticatorEnrollResult> {\n const ctx = this.assertWebauthn();\n\n // exclude already-registered credentials from a fresh ceremony\n const existing = await this.repository.findAllWithSecretsByUser(user.id, {\n kind: UserAuthenticatorKind.WEBAUTHN,\n confirmed: true,\n });\n const excludeCredentials = existing\n .map((device) => this.parseWebauthnParameters(device))\n .filter((parameters): parameters is UserAuthenticatorWebauthnParameters => !!parameters)\n .map((parameters) => ({ id: parameters.credential_id, transports: parameters.transports }));\n\n const { options, challenge } = await buildWebauthnRegistrationOptions(\n ctx,\n { id: user.id, name: user.name },\n excludeCredentials,\n );\n\n let entity = this.repository.create({\n kind: UserAuthenticatorKind.WEBAUTHN,\n name,\n confirmed: false,\n userId: user.id,\n realmId: user.realmId,\n });\n entity = await this.repository.save(entity);\n\n // Key the challenge by the newly created (unconfirmed) row id, NOT the\n // user id — overlapping enrollment ceremonies (a second tab, a retry\n // after a cancelled prompt) would otherwise overwrite each other's\n // challenge and make the first confirmation fail spuriously.\n await this.cache.set(\n this.buildWebauthnCacheKey(USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, entity.id),\n {\n challenge,\n expiresAt: Date.now() + (USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW * 1_000),\n } satisfies WebauthnChallengeState,\n { ttl: USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW * 1_000 },\n );\n\n return {\n data: this.sanitize(entity),\n meta: { webauthn: options },\n };\n }\n\n protected async enrollEmail(user: User, name: string | null): Promise<UserAuthenticatorEnrollResult> {\n this.assertMail();\n\n // The actor identity may not carry `email` (the User entity's email\n // column is select:false) — force-load it to confirm the mailbox\n // exists. The email is presumed verified (activation); the row marks\n // the mailbox as an enrolled factor, codes are transient (cache).\n const email = user.email ?? (await this.userRepository.findOneByWithEmail({ id: user.id }))?.email;\n if (!email) {\n throw new ValidationError('The user has no email address to receive codes.');\n }\n\n // one email factor per user — update the existing marker row in place\n // rather than remove-then-create, so a failed save never leaves the user\n // with no email factor (the row is a pure marker: no secret/codes).\n const existing = (await this.repository.findAllByUser(user.id))\n .filter((device) => device.kind === UserAuthenticatorKind.EMAIL);\n\n let entity: UserAuthenticator;\n if (existing.length > 0) {\n const [primary, ...duplicates] = existing;\n primary.name = name;\n primary.confirmed = true;\n entity = await this.repository.save(primary);\n // best-effort cleanup of any stray duplicates (invariant anomaly);\n // a failure here still leaves the primary factor intact.\n for (const duplicate of duplicates) {\n await this.repository.remove(duplicate);\n }\n } else {\n entity = this.repository.create({\n kind: UserAuthenticatorKind.EMAIL,\n name,\n confirmed: true,\n userId: user.id,\n realmId: user.realmId,\n });\n entity = await this.repository.save(entity);\n }\n\n await this.recordEvent(EventName.MFA_ENROLLED, entity);\n\n return { data: this.sanitize(entity), meta: {} };\n }\n\n protected async resolveTargetUser(\n userId: string | undefined,\n actor: ActorContext,\n validated: Record<string, any>,\n ): Promise<User> {\n const actorUser : User | undefined = actor.identity && actor.identity.type === IdentityType.USER ?\n actor.identity.data as User :\n undefined;\n\n if (!userId || (actorUser && actorUser.id === userId)) {\n if (!actorUser) {\n throw new AuthupError({ code: ErrorCode.IDENTITY_UNAUTHORIZED, message: 'Authentication required.' });\n }\n\n return actorUser;\n }\n\n const target = await this.userRepository.findOneById(userId);\n if (!target) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_AUTHENTICATOR_CREATE });\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_AUTHENTICATOR_CREATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: { ...validated, realmId: target.realmId },\n ...this.resourceRealmMatch(target),\n }),\n });\n\n return target;\n }\n\n protected async enrollTotp(user: User, name: string | null): Promise<UserAuthenticatorEnrollResult> {\n const secret = new Secret({ size: 20 });\n const parameters : UserAuthenticatorTotpParameters = {\n algorithm: USER_AUTHENTICATOR_TOTP_ALGORITHM,\n digits: USER_AUTHENTICATOR_TOTP_DIGITS,\n period: USER_AUTHENTICATOR_TOTP_PERIOD,\n };\n\n const totp = new TOTP({\n issuer: this.options.issuer ?? 'authup',\n label: user.name,\n algorithm: parameters.algorithm,\n digits: parameters.digits,\n period: parameters.period,\n secret,\n });\n const uri = totp.toString();\n\n let entity = this.repository.create({\n kind: UserAuthenticatorKind.TOTP,\n name,\n secret: await this.cipher.encrypt(secret.base32, user.realmId),\n parameters: JSON.stringify(parameters),\n confirmed: false,\n userId: user.id,\n realmId: user.realmId,\n });\n entity = await this.repository.save(entity);\n\n return {\n data: this.sanitize(entity),\n meta: {\n secret: secret.base32,\n uri,\n qr: await QRCode.toDataURL(uri),\n },\n };\n }\n\n protected async enrollRecovery(user: User, name: string | null): Promise<UserAuthenticatorEnrollResult> {\n const codes : string[] = [];\n const stored : UserAuthenticatorRecoveryCode[] = [];\n for (let i = 0; i < USER_AUTHENTICATOR_RECOVERY_CODE_COUNT; i++) {\n const code = generateRecoveryCode();\n codes.push(code);\n stored.push({ hash: await hash(code), used_at: null });\n }\n\n // regenerate semantics: a user holds ONE recovery-code set. Reuse the\n // existing row via a single atomic save instead of delete-then-insert,\n // so a mid-operation failure can never leave the user with no codes.\n const [existing] = await this.repository.findAllWithSecretsByUser(user.id, { kind: UserAuthenticatorKind.RECOVERY });\n\n let entity : UserAuthenticator;\n if (existing) {\n existing.name = name;\n existing.codes = JSON.stringify(stored);\n existing.confirmed = true;\n entity = await this.repository.save(existing);\n } else {\n entity = this.repository.create({\n kind: UserAuthenticatorKind.RECOVERY,\n name,\n codes: JSON.stringify(stored),\n confirmed: true,\n userId: user.id,\n realmId: user.realmId,\n });\n entity = await this.repository.save(entity);\n }\n\n await this.recordEvent(EventName.MFA_ENROLLED, entity);\n\n return {\n data: this.sanitize(entity),\n meta: { codes },\n };\n }\n\n // ------------------------------------------------------------------\n\n async confirm(\n id: string,\n code: string,\n actor: ActorContext,\n options: { userId?: string } = {},\n ): Promise<UserAuthenticator> {\n const entity = await this.resolveOne(id, options.userId);\n\n if (!this.isOwnedBy(entity, actor)) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_AUTHENTICATOR_UPDATE });\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_AUTHENTICATOR_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n }\n\n if (entity.confirmed) {\n return this.sanitize(entity);\n }\n\n if (entity.kind === UserAuthenticatorKind.WEBAUTHN) {\n return this.confirmWebauthn(entity, code);\n }\n\n if (entity.kind !== UserAuthenticatorKind.TOTP) {\n throw new ValidationError(`The authenticator kind ${entity.kind} can not be confirmed with a code.`);\n }\n\n await this.assertNotThrottledOrRetry(entity.userId);\n\n const withSecrets = await this.repository.findOneWithSecretsById(entity.id);\n if (!withSecrets) {\n throw new EntityNotFoundError();\n }\n\n if (!await this.verifyTotp(withSecrets, code)) {\n await this.bumpAttempts(entity.userId);\n throw new EntityCredentialsInvalidError();\n }\n\n await this.resetAttempts(entity.userId);\n\n entity.confirmed = true;\n // The consumed step is tracked only on the login-verify path (below),\n // NOT here — so a legitimate first login in the same window as the\n // confirmation is still accepted; only a repeat of an already-used\n // LOGIN code is rejected.\n const output = await this.repository.save(entity);\n\n await this.recordEvent(EventName.MFA_ENROLLED, output);\n\n return this.sanitize(output);\n }\n\n protected async confirmWebauthn(entity: UserAuthenticator, response: string): Promise<UserAuthenticator> {\n const ctx = this.assertWebauthn();\n\n // brute-force throttle, same lifecycle as the TOTP confirm branch — the\n // attestation verify is a real crypto call and must not be retryable\n // without backoff.\n await this.assertNotThrottledOrRetry(entity.userId);\n\n // challenge is keyed by the enrollment row id (see enrollWebauthn), so\n // overlapping ceremonies do not collide.\n const cacheKey = this.buildWebauthnCacheKey(USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, entity.id);\n\n const state = await this.cache.get<WebauthnChallengeState>(cacheKey);\n if (!state || state.expiresAt < Date.now()) {\n await this.bumpAttempts(entity.userId);\n throw new EntityCredentialsInvalidError();\n }\n\n let parsed : RegistrationResponseJSON;\n try {\n parsed = JSON.parse(response) as RegistrationResponseJSON;\n } catch {\n throw new ValidationError('The registration response is malformed.');\n }\n\n const credential = await verifyWebauthnRegistration(ctx, parsed, state.challenge);\n if (!credential) {\n await this.bumpAttempts(entity.userId);\n throw new EntityCredentialsInvalidError();\n }\n\n await this.resetAttempts(entity.userId);\n await this.cache.drop(cacheKey);\n\n entity.parameters = JSON.stringify(credential);\n entity.confirmed = true;\n const output = await this.repository.save(entity);\n\n await this.recordEvent(EventName.MFA_ENROLLED, output);\n\n return this.sanitize(output);\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n options: { userId?: string } = {},\n ): Promise<UserAuthenticator> {\n const entity = await this.resolveOne(id, options.userId);\n\n if (!this.isOwnedBy(entity, actor)) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_AUTHENTICATOR_DELETE });\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_AUTHENTICATOR_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n }\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n await this.recordEvent(EventName.MFA_REMOVED, entity);\n\n return this.sanitize(entity);\n }\n\n // ------------------------------------------------------------------\n\n async verify(\n userId: string,\n input: UserAuthenticatorVerifyInput,\n ctx: UserAuthenticatorVerifyContext = {},\n ): Promise<boolean> {\n try {\n await this.assertNotThrottled(userId);\n } catch (e) {\n if (isMfaThrottledError(e)) {\n throw e;\n }\n\n return false;\n }\n\n // Serialize the read-verify-save critical section per user so a single\n // factor (TOTP step / recovery / email code / webauthn counter) is\n // consumed exactly once even under concurrent verifies. A held lock\n // means another verify is mid-flight — bail without penalty rather than\n // risk a double-consume; that request owns the outcome.\n const lockKey = this.buildVerifyLockCacheKey(userId);\n const lock = await this.acquireVerifyLock(lockKey);\n if (lock.status !== 'acquired') {\n return false;\n }\n\n const lease = this.maintainVerifyLock(lockKey, lock.value);\n\n try {\n const devices = await this.repository.findAllWithSecretsByUser(userId, {\n kind: input.kind,\n confirmed: true,\n });\n\n let matched : UserAuthenticator | undefined;\n\n for (const device of devices) {\n if (input.kind === UserAuthenticatorKind.TOTP) {\n if (await this.verifyTotp(device, input.response)) {\n matched = device;\n }\n }\n\n if (input.kind === UserAuthenticatorKind.RECOVERY) {\n if (await this.verifyRecovery(device, input.response)) {\n matched = device;\n }\n }\n\n if (input.kind === UserAuthenticatorKind.EMAIL) {\n if (await this.verifyEmail(userId, input.response)) {\n matched = device;\n }\n }\n\n if (input.kind === UserAuthenticatorKind.WEBAUTHN) {\n const newCounter = await this.verifyWebauthnDevice(userId, device, input.response);\n if (newCounter !== null) {\n // persist the signature counter (replay defense)\n const parameters = this.parseWebauthnParameters(device);\n if (parameters) {\n device.parameters = JSON.stringify({ ...parameters, counter: newCounter });\n }\n matched = device;\n }\n }\n\n if (matched) {\n break;\n }\n }\n\n if (!matched) {\n await this.bumpAttempts(userId);\n await this.recordChallengeEvent(EventName.MFA_CHALLENGE_FAILED, userId, input.kind, ctx);\n return false;\n }\n\n if (!await lease.renew()) {\n return false;\n }\n\n // Bind the proof to the caller's aggregate (the session mfaAt\n // stamp) BEFORE any consumption persists: a hook failure aborts\n // the verify with nothing consumed — never a burned single-use\n // code without a completed MFA. The residual (a failure AFTER the\n // hook) leaves a stamped session plus a still-valid code — a\n // bounded server-error window, not a lost factor.\n if (ctx.onVerified) {\n await ctx.onVerified();\n }\n\n if (!await lease.renew()) {\n return false;\n }\n\n matched.lastUsedAt = new Date().toISOString();\n await this.repository.save(matched);\n\n // cache-borne single-use artifacts (email code, webauthn challenge\n // nonce) are consumed only once the unit of work committed — the\n // verify lock keeps the deferral race-free.\n if (input.kind === UserAuthenticatorKind.EMAIL) {\n await this.cache.drop(this.buildEmailCodeCacheKey(userId));\n }\n if (input.kind === UserAuthenticatorKind.WEBAUTHN) {\n await this.cache.drop(\n this.buildWebauthnCacheKey(USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, userId),\n );\n }\n\n await this.resetAttempts(userId);\n\n await this.recordChallengeEvent(EventName.MFA_VERIFIED, userId, input.kind, ctx, matched);\n return true;\n } finally {\n await lease.stop();\n await this.releaseVerifyLock(lockKey, lock.value);\n }\n }\n\n protected async verifyTotp(device: UserAuthenticator, token: string): Promise<boolean> {\n if (!device.secret) {\n return false;\n }\n\n let seed : string;\n try {\n // key-id-addressed blob; one referencing an unknown or foreign\n // key fails closed as a verification failure, never a 500.\n seed = await this.cipher.decrypt(device.secret, device.realmId);\n } catch (e) {\n // ... but ONLY for blob-semantics failures. Infrastructure errors\n // (database outage, KEK misconfiguration) must bubble — mapping\n // them to `false` would burn throttle attempts on a blip.\n if (isRealmCipherBlobError(e)) {\n return false;\n }\n\n throw e;\n }\n\n let parameters : UserAuthenticatorTotpParameters = {\n algorithm: USER_AUTHENTICATOR_TOTP_ALGORITHM,\n digits: USER_AUTHENTICATOR_TOTP_DIGITS,\n period: USER_AUTHENTICATOR_TOTP_PERIOD,\n };\n if (device.parameters) {\n parameters = { ...parameters, ...JSON.parse(device.parameters) };\n }\n\n const totp = new TOTP({\n algorithm: parameters.algorithm,\n digits: parameters.digits,\n period: parameters.period,\n secret: Secret.fromBase32(seed),\n });\n\n const delta = totp.validate({ token: token.trim(), window: 1 });\n if (delta === null) {\n return false;\n }\n\n // Reject replay: the accepted step must strictly advance past the last\n // consumed one (RFC 6238 §5.2), so a captured code can't be reused\n // within its ±1 validation window. The per-user verify lock makes the\n // concurrent case (two verifies advancing the same step) safe.\n const step = Math.floor(Date.now() / 1000 / parameters.period) + delta;\n if (typeof parameters.counter === 'number' && step <= parameters.counter) {\n return false;\n }\n\n // persist the consumed step onto the device — the caller saves the row.\n device.parameters = JSON.stringify({ ...parameters, counter: step });\n return true;\n }\n\n protected async verifyRecovery(device: UserAuthenticator, code: string): Promise<boolean> {\n if (!device.codes) {\n return false;\n }\n\n const entries = JSON.parse(device.codes) as UserAuthenticatorRecoveryCode[];\n const normalized = code.trim().toLowerCase();\n\n for (const entry of entries) {\n if (entry.used_at) {\n continue;\n }\n\n if (await compare(normalized, entry.hash)) {\n entry.used_at = new Date().toISOString();\n device.codes = JSON.stringify(entries);\n return true;\n }\n }\n\n return false;\n }\n\n protected parseWebauthnParameters(device: UserAuthenticator): UserAuthenticatorWebauthnParameters | null {\n if (!device.parameters) {\n return null;\n }\n try {\n return JSON.parse(device.parameters) as UserAuthenticatorWebauthnParameters;\n } catch {\n return null;\n }\n }\n\n protected async verifyWebauthnDevice(\n userId: string,\n device: UserAuthenticator,\n response: string,\n ): Promise<number | null> {\n const ctx = this.assertWebauthn();\n\n const parameters = this.parseWebauthnParameters(device);\n if (!parameters) {\n return null;\n }\n\n let parsed : AuthenticationResponseJSON;\n try {\n parsed = JSON.parse(response) as AuthenticationResponseJSON;\n } catch {\n return null;\n }\n\n // the assertion identifies the credential — only verify against its row\n if (parsed.id !== parameters.credential_id) {\n return null;\n }\n\n const state = await this.cache.get<WebauthnChallengeState>(\n this.buildWebauthnCacheKey(USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, userId),\n );\n if (!state || state.expiresAt < Date.now()) {\n return null;\n }\n\n try {\n const result = await verifyWebauthnAuthentication(ctx, parsed, state.challenge, parameters);\n return result.verified ? result.newCounter : null;\n } catch {\n return null;\n }\n }\n\n protected async verifyEmail(userId: string, response: string): Promise<boolean> {\n const key = this.buildEmailCodeCacheKey(userId);\n const state = await this.cache.get<EmailCodeState>(key);\n if (!state || state.expiresAt < Date.now()) {\n return false;\n }\n\n // single-use — but the drop is deferred to the verify success block,\n // AFTER the onVerified hook ran, so a hook failure does not burn the\n // code (the verify lock keeps the deferral race-free).\n return compare(response.trim(), state.hash);\n }\n\n // ------------------------------------------------------------------\n\n async sendChallenge(\n userId: string,\n kind: `${UserAuthenticatorKind}`,\n ctx: UserAuthenticatorSendContext = {},\n ): Promise<void> {\n // Only email needs a server-issued challenge; TOTP/recovery are\n // client-derived (no-op keeps the endpoint uniform).\n if (kind !== UserAuthenticatorKind.EMAIL) {\n return;\n }\n\n this.assertMail();\n await this.assertNotThrottledOrRetry(userId);\n\n // require a CONFIRMED email factor — never mail a code to a user who\n // did not enroll email (no code-spray oracle).\n const devices = await this.repository.findAllWithSecretsByUser(userId, {\n kind: UserAuthenticatorKind.EMAIL,\n confirmed: true,\n });\n if (devices.length === 0) {\n return;\n }\n\n // email column is select:false — force-load it for the recipient.\n const user = await this.userRepository.findOneByWithEmail({ id: userId });\n if (!user || !user.email) {\n return;\n }\n\n // per-user send cooldown — an authenticated caller must not be able to\n // spray unlimited OTP mails. `add` is atomic set-if-absent, so the first\n // send stores the key and any resend within the window returns false.\n // Fails open on a cache error (a transient outage must not block a\n // legitimate code).\n let withinCooldown: boolean;\n try {\n withinCooldown = !(await this.cache.add(\n this.buildEmailSendCacheKey(userId),\n 1,\n { ttl: USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN * 1_000 },\n ));\n } catch {\n withinCooldown = false;\n }\n if (withinCooldown) {\n throw new MfaThrottledError({ retryAfter: USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN });\n }\n\n const codeValue = generateNumericCode(USER_AUTHENTICATOR_EMAIL_CODE_LENGTH);\n await this.cache.set(\n this.buildEmailCodeCacheKey(userId),\n {\n hash: await hash(codeValue),\n expiresAt: Date.now() + (USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES * 60 * 1_000),\n } satisfies EmailCodeState,\n { ttl: USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES * 60 * 1_000 },\n );\n\n const mail = await this.mailTemplateRenderer!.render({\n template: MailTemplateName.MFA_EMAIL_OTP,\n params: {\n code: codeValue,\n expiresInMinutes: USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES,\n },\n locale: ctx.locale,\n });\n\n await this.mailClient!.send({\n to: user.email,\n ...mail,\n });\n }\n\n // ------------------------------------------------------------------\n\n async hasConfirmed(userId: string): Promise<boolean> {\n return this.repository.hasConfirmedByUser(userId);\n }\n\n async challenge(\n userId: string,\n options: { issueMaterial?: boolean } = {},\n ): Promise<UserAuthenticatorChallengeStatus> {\n if (!this.options.enabled) {\n return {\n required: false,\n enrollmentRequired: false,\n kinds: [],\n };\n }\n\n const devices = await this.repository.findAllByUser(userId);\n const confirmed = devices.filter((device) => device.confirmed);\n\n const kinds = Array.from(new Set(confirmed.map((device) => device.kind)));\n\n const status : UserAuthenticatorChallengeStatus = {\n required: confirmed.length > 0,\n enrollmentRequired: !!this.options.required && confirmed.length === 0,\n kinds,\n };\n\n // WebAuthn needs server-issued request options as the challenge — build\n // them (and store the nonce) when the subject holds a webauthn factor.\n // Skipped when the caller only needs the requirement flags (issueMaterial\n // false): the enforcement chokepoints must not rotate an in-flight\n // ceremony's nonce nor run this extra query on every request.\n const issueMaterial = options.issueMaterial ?? true;\n if (issueMaterial && kinds.includes(UserAuthenticatorKind.WEBAUTHN) && this.options.webauthn) {\n const credentials = (await this.repository.findAllWithSecretsByUser(userId, {\n kind: UserAuthenticatorKind.WEBAUTHN,\n confirmed: true,\n }))\n .map((device) => this.parseWebauthnParameters(device))\n .filter((parameters): parameters is UserAuthenticatorWebauthnParameters => !!parameters)\n .map((parameters) => ({ id: parameters.credential_id, transports: parameters.transports }));\n\n const { options, challenge } = await buildWebauthnAuthenticationOptions(this.options.webauthn, credentials);\n\n await this.cache.set(\n this.buildWebauthnCacheKey(USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, userId),\n {\n challenge,\n expiresAt: Date.now() + (USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW * 1_000),\n } satisfies WebauthnChallengeState,\n { ttl: USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW * 1_000 },\n );\n\n status.challenge = { webauthn: options };\n }\n\n return status;\n }\n\n // ------------------------------------------------------------------\n\n protected assertEnabled(): void {\n if (!this.options.enabled) {\n throw new AuthupError({\n code: ErrorCode.MFA_NOT_CONFIGURABLE,\n message: 'Multi-factor authentication is not enabled.',\n });\n }\n }\n\n protected assertMail(): void {\n if (!this.mailClient || !this.mailTemplateRenderer) {\n throw new AuthupError({\n code: ErrorCode.MFA_NOT_CONFIGURABLE,\n message: 'Email-based multi-factor authentication requires a configured mail transport.',\n });\n }\n }\n\n protected assertWebauthn(): WebauthnContext {\n if (!this.options.webauthn) {\n throw new AuthupError({\n code: ErrorCode.MFA_NOT_CONFIGURABLE,\n message: 'WebAuthn requires a configured public URL (relying-party origin).',\n });\n }\n\n return this.options.webauthn;\n }\n\n // ------------------------------------------------------------------\n\n protected buildAttemptCacheKey(userId: string): string {\n return buildCacheKey({\n prefix: USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX,\n key: userId,\n });\n }\n\n protected buildThrottleCacheKey(userId: string): string {\n return buildCacheKey({\n prefix: USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX,\n key: userId,\n });\n }\n\n protected buildEmailCodeCacheKey(userId: string): string {\n return buildCacheKey({\n prefix: USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX,\n key: userId,\n });\n }\n\n protected buildEmailSendCacheKey(userId: string): string {\n return buildCacheKey({\n prefix: USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX,\n key: userId,\n });\n }\n\n protected buildWebauthnCacheKey(prefix: string, userId: string): string {\n return buildCacheKey({ prefix, key: userId });\n }\n\n protected buildVerifyLockCacheKey(userId: string): string {\n return buildCacheKey({\n prefix: USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX,\n key: userId,\n });\n }\n\n protected async acquireVerifyLock(key: string): Promise<VerifyLock> {\n const value = randomUUID();\n\n try {\n return (await this.cache.add(key, value, { ttl: USER_AUTHENTICATOR_VERIFY_LOCK_TTL })) ?\n { status: 'acquired', value } :\n { status: 'busy' };\n } catch {\n return { status: 'unavailable' };\n }\n }\n\n protected maintainVerifyLock(key: string, value: string): VerifyLockLease {\n let owned = true;\n let pending : Promise<void> | undefined;\n\n const queueRenewal = () => {\n if (!owned || pending) {\n return pending;\n }\n\n pending = this.cache\n .renewIfValue(key, value, USER_AUTHENTICATOR_VERIFY_LOCK_TTL)\n .then((renewed) => {\n owned = renewed;\n })\n .catch(() => {\n owned = false;\n })\n .finally(() => {\n pending = undefined;\n });\n\n return pending;\n };\n\n const timer = setInterval(queueRenewal, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL);\n\n return {\n renew: async () => {\n await queueRenewal();\n return owned;\n },\n stop: async () => {\n clearInterval(timer);\n await pending;\n },\n };\n }\n\n protected async releaseVerifyLock(key: string, value: string): Promise<void> {\n try {\n await this.cache.dropIfValue(key, value);\n } catch {\n // Best-effort release; the renewable lock TTL bounds a stranded key.\n }\n }\n\n protected async assertNotThrottled(userId: string): Promise<void> {\n const lockedUntil = await this.cache.get<number>(this.buildThrottleCacheKey(userId));\n if (typeof lockedUntil === 'number' && lockedUntil > Date.now()) {\n throw new MfaThrottledError({ retryAfter: Math.ceil((lockedUntil - Date.now()) / 1_000) });\n }\n }\n\n // Throttle gate for the throwing entry points (confirm / confirmWebauthn /\n // sendChallenge). Mirrors verify()'s fail-closed posture: a genuine lockout\n // surfaces unchanged, while an unreadable throttle counter (cache outage) is\n // treated as a lockout — the caller is told to retry (429) rather than the\n // outage bubbling up as an internal 500.\n protected async assertNotThrottledOrRetry(userId: string): Promise<void> {\n try {\n await this.assertNotThrottled(userId);\n } catch (e) {\n if (isMfaThrottledError(e)) {\n throw e;\n }\n\n throw new MfaThrottledError({ retryAfter: USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR });\n }\n }\n\n protected async bumpAttempts(userId: string): Promise<void> {\n const key = this.buildAttemptCacheKey(userId);\n\n // Atomic increment — concurrent failures (verify OR confirm) each get\n // a distinct count, so the exponential backoff never under-counts.\n let count : number;\n try {\n count = await this.cache.increment(key, 1, { ttl: USER_AUTHENTICATOR_ATTEMPT_WINDOW * 1_000 });\n } catch {\n // a non-numeric value at the key (legacy JSON state) — reset and\n // re-count; a genuine cache outage rethrows from the drop.\n await this.cache.drop(key);\n count = await this.cache.increment(key, 1, { ttl: USER_AUTHENTICATOR_ATTEMPT_WINDOW * 1_000 });\n }\n\n const delay = Math.min(\n USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX,\n USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR * (2 ** (count - 1)),\n );\n\n await this.cache.set(\n this.buildThrottleCacheKey(userId),\n Date.now() + (delay * 1_000),\n { ttl: delay * 1_000 },\n );\n }\n\n protected async resetAttempts(userId: string): Promise<void> {\n await this.cache.dropMany([\n this.buildAttemptCacheKey(userId),\n this.buildThrottleCacheKey(userId),\n ]);\n }\n\n // ------------------------------------------------------------------\n\n protected async recordEvent(\n name: `${EventName}`,\n entity: UserAuthenticator,\n ): Promise<void> {\n await this.eventService?.record({\n scope: EventScope.IDENTITY,\n name,\n refType: EventRefType.USER_AUTHENTICATOR,\n refId: entity.id,\n actorType: IdentityType.USER,\n actorId: entity.userId,\n realmId: entity.realmId,\n data: { kind: entity.kind },\n });\n }\n\n protected async recordChallengeEvent(\n name: `${EventName}`,\n userId: string,\n kind: string,\n ctx: UserAuthenticatorVerifyContext,\n entity?: UserAuthenticator,\n ): Promise<void> {\n await this.eventService?.record({\n scope: EventScope.IDENTITY,\n name,\n refType: EventRefType.USER,\n refId: userId,\n actorType: IdentityType.USER,\n actorId: userId,\n clientId: ctx.clientId ?? null,\n realmId: entity?.realmId ?? null,\n requestIpAddress: ctx.ipAddress ?? null,\n requestUserAgent: ctx.userAgent ?? null,\n data: { kind },\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAuHA,IAAa2D,2BAAb,cAA8CtC,sBAAAA;CAChCuC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAsC;EAC9C,MAAK;EAEL,KAAKT,aAAaS,IAAIT;EACtB,KAAKC,iBAAiBQ,IAAIR;EAC1B,KAAKC,QAAQO,IAAIP;EACjB,KAAKC,SAASM,IAAIN;EAClB,KAAKC,eAAeK,IAAIL;EACxB,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,UAAUE,IAAIF,WAAW,CAAC;EAC/B,KAAKC,YAAY,IAAIvD,2BAAAA;CACzB;CAEUyD,UAAUC,QAA2BC,OAA8B;EACzE,OAAO,CAAC,CAACA,MAAMC,YACXD,MAAMC,SAASC,SAAShE,aAAaiE,QACrCJ,OAAOK,WAAWJ,MAAMC,SAASI,KAAKC;CAC9C;;;;IAMA,SAAmBP,QAA8C;EAC7D,OAAO;GACH,GAAGA;GACHS,QAAQ;GACRC,OAAO;EACX;CACJ;CAIA,MAAMC,QACFC,OACAX,OACAL,UAA+B,CAAC,GAC0B;EAC1D,MAAMiB,SAAS,CAAC,CAACjB,QAAQS,UACrB,CAAC,CAACJ,MAAMC,YACRD,MAAMC,SAASC,SAAShE,aAAaiE,QACrCH,MAAMC,SAASI,KAAKC,OAAOX,QAAQS;EAEvC,IAAI,CAACQ,QACD,MAAMZ,MAAMa,oBAAoBC,YAAY,EAAEC,MAAM5E,eAAe6E,wBAAwB,CAAA;EAG/F,MAAMC,SAAS,MAAMhC,YAAY0B,OAAO;GAAEO,QAAQhC;GAAyBc;EAAM,CAAA;EACjF,MAAMmB,kBAAkBxB,QAAQS,SAAS,EAAEgB,OAAO,EAAEhB,QAAQT,QAAQS,OAAO,EAAE,IAAI,CAAC;EAOlF,MAAMiB,WAAWT,SACb,EAAEU,SAAS,QAAiB,IAC5B,MAAMtB,MAAMa,oBAAoBU,QAAQ,EAAER,MAAM5E,eAAe6E,wBAAwB,CAAA;EAC3F,IAAIK,SAASC,YAAY,QAAQ;GAC7B,MAAME,YAAYxB,MAAMC,YAAYD,MAAMC,SAASC,SAAShE,aAAaiE,OACrEvE,GAAG,UAAUoE,MAAMC,SAASI,KAAKC,EAAE,IACnC;GAEJ,IAAImB,SAASR;GACb,IAAII,SAASC,YAAY,QACrBG,SAASzC,sBAAsBiC,QAAQO,aAAa3F,QAAQ,MAAM,CAAA,CAAE,CAAA;QACjE,IAAIwF,SAASC,YAAY,eAC5BG,SAASzC,sBACLiC,QACAO,YAAY1F,GAAG0F,WAAWH,SAASK,SAAS,IAAIL,SAASK,SAAS;GAI1E,MAAM,EAAErB,MAAMsB,SAAS,MAAM,KAAKvC,WAAWwC,SAASH,QAAQN,eAAAA;GAE9D,OAAO;IACHd,MAAMA,KAAKwB,KAAK9B,WAAW,KAAKQ,SAASR,MAAAA,CAAAA;IACzC4B;GACJ;EACJ;EAEA,MAAM,EAAEtB,MAAMyB,UAAUH,SAAS,MAAM,KAAKvC,WAAWwC,SACnDX,QACAE,eAAAA;EAGJ,MAAMd,OAA4B,CAAA;EAClC,IAAI,EAAE0B,UAAUJ;EAEhB,KAAK,MAAM5B,UAAU+B,UAAU;GAC3B,IAAI,KAAKhC,UAAUC,QAAQC,KAAAA,GAAQ;IAC/BK,KAAK2B,KAAK,KAAKzB,SAASR,MAAAA,CAAAA;IACxB;GACJ;GAEA,IAAI;IACA,MAAMC,MAAMa,oBAAoBoB,SAAS;KACrClB,MAAM5E,eAAe6E;KACrBX,MAAM3E,iBAAiB;OAClBD,kBAAkByG,aAAanC;MAChC,GAAG,KAAKoC,mBAAmBpC,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAM,KAAK2B,KAAK,KAAKzB,SAASR,MAAAA,CAAAA;GAC5B,QAAQ;IACJgC,SAAS;GACb;EACJ;EAEA,OAAO;GACH1B;GACAsB,MAAM;IACF,GAAGA;IACHI;GACJ;EACJ;CACJ;CAEA,MAAMK,OACF9B,IACAN,OACAL,UAA+B,CAAC,GACN;EAC1B,MAAMI,SAAS,MAAM,KAAKsC,WAAW/B,IAAIX,QAAQS,MAAM;EAEvD,IAAI,CAAC,KAAKN,UAAUC,QAAQC,KAAAA,GAAQ;GAChC,MAAMA,MAAMa,oBAAoBC,YAAY,EAAEC,MAAM5E,eAAe6E,wBAAwB,CAAA;GAC3F,MAAMhB,MAAMa,oBAAoBoB,SAAS;IACrClB,MAAM5E,eAAe6E;IACrBX,MAAM3E,iBAAiB;MAClBD,kBAAkByG,aAAanC;KAChC,GAAG,KAAKoC,mBAAmBpC,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAO,KAAKQ,SAASR,MAAAA;CACzB;CAEA,MAAgBsC,WAAW/B,IAAYF,QAA6C;EAChF,MAAML,SAAS,MAAM,KAAKX,WAAWkD,YAAYhC,EAAAA;EAGjD,IAAI,CAACP,UAAWK,UAAUL,OAAOK,WAAWA,QACxC,MAAM,IAAI5D,oBAAAA;EAGd,OAAOuD;CACX;CAIA,MAAMwC,OAAOlC,MAA2BL,OAA6D;EACjG,KAAKwC,cAAa;EAElB,MAAMC,YAAY,MAAM,KAAK7C,UAAU8C,IAAIrC,MAAM,EAAEsC,OAAOhH,eAAeiH,OAAO,CAAA;EAEhF,MAAMC,OAAO,MAAM,KAAKC,kBAAkBL,UAAUrC,QAAQJ,OAAOyC,SAAAA;EAcnE,IAAI,EAHqB,CAAC,CAACzC,MAAMC,YAC7BD,MAAMC,SAASC,SAAShE,aAAaiE,QACrCH,MAAMC,SAASI,KAAKC,OAAOuC,KAAKvC,OACXmC,UAAUO,SAAS5G,sBAAsB6G,OAC9D,MAAM,IAAItG,gBACN,KAAK8F,UAAUO,KAAK,0DAA0D;EAItF,QAAQP,UAAUO,MAAlB;GACI,KAAK5G,sBAAsBc,MACvB,OAAO,KAAKgG,WAAWL,MAAMJ,UAAU1B,QAAQ,IAAA;GAEnD,KAAK3E,sBAAsB+G,UACvB,OAAO,KAAKC,eAAeP,MAAMJ,UAAU1B,QAAQ,IAAA;GAEvD,KAAK3E,sBAAsB6G,OACvB,OAAO,KAAKI,YAAYR,MAAMJ,UAAU1B,QAAQ,IAAA;GAEpD,KAAK3E,sBAAsBkH,UACvB,OAAO,KAAKC,eAAeV,MAAMJ,UAAU1B,QAAQ,IAAA;GAEvD,SACI,MAAM,IAAIpE,gBAAgB,0BAA0B8F,UAAUO,KAAK,0BAA0B;EAErG;CACJ;CAEA,MAAgBO,eAAeV,MAAY9B,MAA6D;EACpG,MAAMlB,MAAM,KAAK2D,eAAc;EAO/B,MAAMI,sBAAqBH,MAJJ,KAAKrE,WAAWsE,yBAAyBb,KAAKvC,IAAI;GACrE0C,MAAM5G,sBAAsBkH;GAC5BK,WAAW;EACf,CAAA,EAAA,CAEK9B,KAAKgC,WAAW,KAAKC,wBAAwBD,MAAAA,CAAAA,CAAAA,CAC7CE,QAAQC,eAAkE,CAAC,CAACA,UAAAA,CAAAA,CAC5EnC,KAAKmC,gBAAgB;GAAE1D,IAAI0D,WAAWC;GAAeC,YAAYF,WAAWE;EAAW,EAAA;EAE5F,MAAM,EAAEvE,SAASwE,cAAc,MAAM5G,iCACjCsC,KACA;GAAES,IAAIuC,KAAKvC;GAAIS,MAAM8B,KAAK9B;EAAK,GAC/B6C,kBAAAA;EAGJ,IAAI7D,SAAS,KAAKX,WAAWgF,OAAO;GAChCpB,MAAM5G,sBAAsBkH;GAC5BvC;GACA4C,WAAW;GACXvD,QAAQyC,KAAKvC;GACb+D,SAASxB,KAAKwB;EAClB,CAAA;EACAtE,SAAS,MAAM,KAAKX,WAAWkF,KAAKvE,MAAAA;EAMpC,MAAM,KAAKT,MAAMiF,IACb,KAAKC,sBAAsB3F,8CAA8CkB,OAAOO,EAAE,GAClF;GACI6D;GACAM,WAAWC,KAAKC,IAAG,IAAA,MAAqD;EAC5E,GACA,EAAEC,KAAAA,MAAoD,IAAM,CAAA;EAGhE,OAAO;GACHvE,MAAM,KAAKE,SAASR,MAAAA;GACpB4B,MAAM,EAAEkD,UAAUlF,QAAQ;EAC9B;CACJ;CAEA,MAAgB0D,YAAYR,MAAY9B,MAA6D;EACjG,KAAK+D,WAAU;EAOf,IAAI,EADUjC,KAAKkC,UAAU,MAAM,KAAK1F,eAAe2F,mBAAmB,EAAE1E,IAAIuC,KAAKvC,GAAG,CAAA,EAAA,EAAKyE,QAEzF,MAAM,IAAIpI,gBAAgB,iDAAA;EAM9B,MAAM8G,YAAY,MAAM,KAAKrE,WAAW6F,cAAcpC,KAAKvC,EAAE,EAAA,CACxDyD,QAAQF,WAAWA,OAAOb,SAAS5G,sBAAsB6G,KAAK;EAEnE,IAAIlD;EACJ,IAAI0D,SAASyB,SAAS,GAAG;GACrB,MAAM,CAACC,SAAS,GAAGC,cAAc3B;GACjC0B,QAAQpE,OAAOA;GACfoE,QAAQxB,YAAY;GACpB5D,SAAS,MAAM,KAAKX,WAAWkF,KAAKa,OAAAA;GAGpC,KAAK,MAAME,aAAaD,YACpB,MAAM,KAAKhG,WAAWkG,OAAOD,SAAAA;EAErC,OAAO;GACHtF,SAAS,KAAKX,WAAWgF,OAAO;IAC5BpB,MAAM5G,sBAAsB6G;IAC5BlC;IACA4C,WAAW;IACXvD,QAAQyC,KAAKvC;IACb+D,SAASxB,KAAKwB;GAClB,CAAA;GACAtE,SAAS,MAAM,KAAKX,WAAWkF,KAAKvE,MAAAA;EACxC;EAEA,MAAM,KAAKwF,YAAYxJ,UAAUyJ,cAAczF,MAAAA;EAE/C,OAAO;GAAEM,MAAM,KAAKE,SAASR,MAAAA;GAAS4B,MAAM,CAAC;EAAE;CACnD;CAEA,MAAgBmB,kBACZ1C,QACAJ,OACAyC,WACa;EACb,MAAMgD,YAA+BzF,MAAMC,YAAYD,MAAMC,SAASC,SAAShE,aAAaiE,OACxFH,MAAMC,SAASI,OACfqF,KAAAA;EAEJ,IAAI,CAACtF,UAAWqF,aAAaA,UAAUnF,OAAOF,QAAS;GACnD,IAAI,CAACqF,WACD,MAAM,IAAInJ,YAAY;IAAEqJ,MAAMlJ,UAAUmJ;IAAuBC,SAAS;GAA2B,CAAA;GAGvG,OAAOJ;EACX;EAEA,MAAMK,SAAS,MAAM,KAAKzG,eAAeiD,YAAYlC,MAAAA;EACrD,IAAI,CAAC0F,QACD,MAAM,IAAItJ,oBAAAA;EAGd,MAAMwD,MAAMa,oBAAoBC,YAAY,EAAEC,MAAM5E,eAAe4J,0BAA0B,CAAA;EAC7F,MAAM/F,MAAMa,oBAAoBoB,SAAS;GACrClB,MAAM5E,eAAe4J;GACrB1F,MAAM3E,iBAAiB;KAClBD,kBAAkByG,aAAa;KAAE,GAAGO;KAAW4B,SAASyB,OAAOzB;IAAQ;IACxE,GAAG,KAAKlC,mBAAmB2D,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,OAAOA;CACX;CAEA,MAAgB5C,WAAWL,MAAY9B,MAA6D;EAChG,MAAMP,SAAS,IAAIvD,OAAO,EAAE+I,MAAM,GAAG,CAAA;EACrC,MAAMhC,aAA+C;GACjDiC,WAAW5H;GACX6H,QAAAA;GACAC,QAAAA;EACJ;EAUA,MAAMI,MAAMH,IARKlJ,KAAK;GAClBmJ,QAAQ,KAAK1G,QAAQ0G,UAAU;GAC/BC,OAAOzD,KAAK9B;GACZkF,WAAWjC,WAAWiC;GACtBC,QAAQlC,WAAWkC;GACnBC,QAAQnC,WAAWmC;GACnB3F;EACJ,CACY4F,CAAAA,CAAKI,SAAQ;EAEzB,IAAIzG,SAAS,KAAKX,WAAWgF,OAAO;GAChCpB,MAAM5G,sBAAsBc;GAC5B6D;GACAP,QAAQ,MAAM,KAAKjB,OAAOkH,QAAQjG,OAAOkG,QAAQ7D,KAAKwB,OAAO;GAC7DL,YAAY2C,KAAKC,UAAU5C,UAAAA;GAC3BL,WAAW;GACXvD,QAAQyC,KAAKvC;GACb+D,SAASxB,KAAKwB;EAClB,CAAA;EACAtE,SAAS,MAAM,KAAKX,WAAWkF,KAAKvE,MAAAA;EAEpC,OAAO;GACHM,MAAM,KAAKE,SAASR,MAAAA;GACpB4B,MAAM;IACFnB,QAAQA,OAAOkG;IACfH;IACAM,IAAI,MAAM1J,OAAO2J,UAAUP,GAAAA;GAC/B;EACJ;CACJ;CAEA,MAAgBnD,eAAeP,MAAY9B,MAA6D;EACpG,MAAMN,QAAmB,CAAA;EACzB,MAAMsG,SAA2C,CAAA;EACjD,KAAK,IAAIC,IAAI,GAAGA,IAAAA,IAA4CA,KAAK;GAC7D,MAAMrB,OAAO5G,qBAAAA;GACb0B,MAAMuB,KAAK2D,IAAAA;GACXoB,OAAO/E,KAAK;IAAEhF,MAAM,MAAMA,KAAK2I,IAAAA;IAAOsB,SAAS;GAAK,CAAA;EACxD;EAKA,MAAM,CAACxD,YAAY,MAAM,KAAKrE,WAAWsE,yBAAyBb,KAAKvC,IAAI,EAAE0C,MAAM5G,sBAAsB+G,SAAS,CAAA;EAElH,IAAIpD;EACJ,IAAI0D,UAAU;GACVA,SAAS1C,OAAOA;GAChB0C,SAAShD,QAAQkG,KAAKC,UAAUG,MAAAA;GAChCtD,SAASE,YAAY;GACrB5D,SAAS,MAAM,KAAKX,WAAWkF,KAAKb,QAAAA;EACxC,OAAO;GACH1D,SAAS,KAAKX,WAAWgF,OAAO;IAC5BpB,MAAM5G,sBAAsB+G;IAC5BpC;IACAN,OAAOkG,KAAKC,UAAUG,MAAAA;IACtBpD,WAAW;IACXvD,QAAQyC,KAAKvC;IACb+D,SAASxB,KAAKwB;GAClB,CAAA;GACAtE,SAAS,MAAM,KAAKX,WAAWkF,KAAKvE,MAAAA;EACxC;EAEA,MAAM,KAAKwF,YAAYxJ,UAAUyJ,cAAczF,MAAAA;EAE/C,OAAO;GACHM,MAAM,KAAKE,SAASR,MAAAA;GACpB4B,MAAM,EAAElB,MAAM;EAClB;CACJ;CAIA,MAAMyG,QACF5G,IACAqF,MACA3F,OACAL,UAA+B,CAAC,GACN;EAC1B,MAAMI,SAAS,MAAM,KAAKsC,WAAW/B,IAAIX,QAAQS,MAAM;EAEvD,IAAI,CAAC,KAAKN,UAAUC,QAAQC,KAAAA,GAAQ;GAChC,MAAMA,MAAMa,oBAAoBC,YAAY,EAAEC,MAAM5E,eAAegL,0BAA0B,CAAA;GAC7F,MAAMnH,MAAMa,oBAAoBoB,SAAS;IACrClB,MAAM5E,eAAegL;IACrB9G,MAAM3E,iBAAiB;MAClBD,kBAAkByG,aAAanC;KAChC,GAAG,KAAKoC,mBAAmBpC,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,IAAIA,OAAO4D,WACP,OAAO,KAAKpD,SAASR,MAAAA;EAGzB,IAAIA,OAAOiD,SAAS5G,sBAAsBkH,UACtC,OAAO,KAAK8D,gBAAgBrH,QAAQ4F,IAAAA;EAGxC,IAAI5F,OAAOiD,SAAS5G,sBAAsBc,MACtC,MAAM,IAAIP,gBAAgB,0BAA0BoD,OAAOiD,KAAK,mCAAmC;EAGvG,MAAM,KAAKqE,0BAA0BtH,OAAOK,MAAM;EAElD,MAAMkH,cAAc,MAAM,KAAKlI,WAAWmI,uBAAuBxH,OAAOO,EAAE;EAC1E,IAAI,CAACgH,aACD,MAAM,IAAI9K,oBAAAA;EAGd,IAAI,CAAC,MAAM,KAAKgL,WAAWF,aAAa3B,IAAAA,GAAO;GAC3C,MAAM,KAAK8B,aAAa1H,OAAOK,MAAM;GACrC,MAAM,IAAI7D,8BAAAA;EACd;EAEA,MAAM,KAAKmL,cAAc3H,OAAOK,MAAM;EAEtCL,OAAO4D,YAAY;EAKnB,MAAMgE,SAAS,MAAM,KAAKvI,WAAWkF,KAAKvE,MAAAA;EAE1C,MAAM,KAAKwF,YAAYxJ,UAAUyJ,cAAcmC,MAAAA;EAE/C,OAAO,KAAKpH,SAASoH,MAAAA;CACzB;CAEA,MAAgBP,gBAAgBrH,QAA2B6H,UAA8C;EACrG,MAAM/H,MAAM,KAAK2D,eAAc;EAK/B,MAAM,KAAK6D,0BAA0BtH,OAAOK,MAAM;EAIlD,MAAMyH,WAAW,KAAKrD,sBAAsB3F,8CAA8CkB,OAAOO,EAAE;EAEnG,MAAMwH,QAAQ,MAAM,KAAKxI,MAAMyI,IAA4BF,QAAAA;EAC3D,IAAI,CAACC,SAASA,MAAMrD,YAAYC,KAAKC,IAAG,GAAI;GACxC,MAAM,KAAK8C,aAAa1H,OAAOK,MAAM;GACrC,MAAM,IAAI7D,8BAAAA;EACd;EAEA,IAAI0E;EACJ,IAAI;GACAA,SAAS0F,KAAKqB,MAAMJ,QAAAA;EACxB,QAAQ;GACJ,MAAM,IAAIjL,gBAAgB,yCAAA;EAC9B;EAEA,MAAMsL,aAAa,MAAMxK,2BAA2BoC,KAAKoB,QAAQ6G,MAAM3D,SAAS;EAChF,IAAI,CAAC8D,YAAY;GACb,MAAM,KAAKR,aAAa1H,OAAOK,MAAM;GACrC,MAAM,IAAI7D,8BAAAA;EACd;EAEA,MAAM,KAAKmL,cAAc3H,OAAOK,MAAM;EACtC,MAAM,KAAKd,MAAM4I,KAAKL,QAAAA;EAEtB9H,OAAOiE,aAAa2C,KAAKC,UAAUqB,UAAAA;EACnClI,OAAO4D,YAAY;EACnB,MAAMgE,SAAS,MAAM,KAAKvI,WAAWkF,KAAKvE,MAAAA;EAE1C,MAAM,KAAKwF,YAAYxJ,UAAUyJ,cAAcmC,MAAAA;EAE/C,OAAO,KAAKpH,SAASoH,MAAAA;CACzB;CAEA,MAAMQ,OACF7H,IACAN,OACAL,UAA+B,CAAC,GACN;EAC1B,MAAMI,SAAS,MAAM,KAAKsC,WAAW/B,IAAIX,QAAQS,MAAM;EAEvD,IAAI,CAAC,KAAKN,UAAUC,QAAQC,KAAAA,GAAQ;GAChC,MAAMA,MAAMa,oBAAoBC,YAAY,EAAEC,MAAM5E,eAAeiM,0BAA0B,CAAA;GAC7F,MAAMpI,MAAMa,oBAAoBoB,SAAS;IACrClB,MAAM5E,eAAeiM;IACrB/H,MAAM3E,iBAAiB;MAClBD,kBAAkByG,aAAanC;KAChC,GAAG,KAAKoC,mBAAmBpC,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,MAAM,EAAEO,IAAI+H,aAAatI;EACzB,MAAM,KAAKX,WAAWkG,OAAOvF,MAAAA;EAC7BA,OAAOO,KAAK+H;EAEZ,MAAM,KAAK9C,YAAYxJ,UAAUuM,aAAavI,MAAAA;EAE9C,OAAO,KAAKQ,SAASR,MAAAA;CACzB;CAIA,MAAMwI,OACFnI,QACAoI,OACA3I,MAAsC,CAAC,GACvB;EAChB,IAAI;GACA,MAAM,KAAK4I,mBAAmBrI,MAAAA;EAClC,SAASsI,GAAG;GACR,IAAI9L,oBAAoB8L,CAAAA,GACpB,MAAMA;GAGV,OAAO;EACX;EAOA,MAAMC,UAAU,KAAKC,wBAAwBxI,MAAAA;EAC7C,MAAMyI,OAAO,MAAM,KAAKC,kBAAkBH,OAAAA;EAC1C,IAAIE,KAAKE,WAAW,YAChB,OAAO;EAGX,MAAMC,QAAQ,KAAKC,mBAAmBN,SAASE,KAAKK,KAAK;EAEzD,IAAI;GACA,MAAMC,UAAU,MAAM,KAAK/J,WAAWsE,yBAAyBtD,QAAQ;IACnE4C,MAAMwF,MAAMxF;IACZW,WAAW;GACf,CAAA;GAEA,IAAIyF;GAEJ,KAAK,MAAMvF,UAAUsF,SAAS;IAC1B,IAAIX,MAAMxF,SAAS5G,sBAAsBc;SACjC,MAAM,KAAKsK,WAAW3D,QAAQ2E,MAAMZ,QAAQ,GAC5CwB,UAAUvF;IAAAA;IAIlB,IAAI2E,MAAMxF,SAAS5G,sBAAsB+G;SACjC,MAAM,KAAKkG,eAAexF,QAAQ2E,MAAMZ,QAAQ,GAChDwB,UAAUvF;IAAAA;IAIlB,IAAI2E,MAAMxF,SAAS5G,sBAAsB6G;SACjC,MAAM,KAAKqG,YAAYlJ,QAAQoI,MAAMZ,QAAQ,GAC7CwB,UAAUvF;IAAAA;IAIlB,IAAI2E,MAAMxF,SAAS5G,sBAAsBkH,UAAU;KAC/C,MAAMiG,aAAa,MAAM,KAAKC,qBAAqBpJ,QAAQyD,QAAQ2E,MAAMZ,QAAQ;KACjF,IAAI2B,eAAe,MAAM;MAErB,MAAMvF,aAAa,KAAKF,wBAAwBD,MAAAA;MAChD,IAAIG,YACAH,OAAOG,aAAa2C,KAAKC,UAAU;OAAE,GAAG5C;OAAYyF,SAASF;MAAW,CAAA;MAE5EH,UAAUvF;KACd;IACJ;IAEA,IAAIuF,SACA;GAER;GAEA,IAAI,CAACA,SAAS;IACV,MAAM,KAAK3B,aAAarH,MAAAA;IACxB,MAAM,KAAKsJ,qBAAqB3N,UAAU4N,sBAAsBvJ,QAAQoI,MAAMxF,MAAMnD,GAAAA;IACpF,OAAO;GACX;GAEA,IAAI,CAAC,MAAMmJ,MAAMY,MAAK,GAClB,OAAO;GASX,IAAI/J,IAAIgK,YACJ,MAAMhK,IAAIgK,WAAU;GAGxB,IAAI,CAAC,MAAMb,MAAMY,MAAK,GAClB,OAAO;GAGXR,QAAQU,8BAAa,IAAIpF,KAAAA,EAAAA,CAAOqF,YAAW;GAC3C,MAAM,KAAK3K,WAAWkF,KAAK8E,OAAAA;GAK3B,IAAIZ,MAAMxF,SAAS5G,sBAAsB6G,OACrC,MAAM,KAAK3D,MAAM4I,KAAK,KAAK8B,uBAAuB5J,MAAAA,CAAAA;GAEtD,IAAIoI,MAAMxF,SAAS5G,sBAAsBkH,UACrC,MAAM,KAAKhE,MAAM4I,KACb,KAAK1D,sBAAsB7F,+CAA+CyB,MAAAA,CAAAA;GAIlF,MAAM,KAAKsH,cAActH,MAAAA;GAEzB,MAAM,KAAKsJ,qBAAqB3N,UAAUkO,cAAc7J,QAAQoI,MAAMxF,MAAMnD,KAAKuJ,OAAAA;GACjF,OAAO;EACX,UAAU;GACN,MAAMJ,MAAMkB,KAAI;GAChB,MAAM,KAAKC,kBAAkBxB,SAASE,KAAKK,KAAK;EACpD;CACJ;CAEA,MAAgB1B,WAAW3D,QAA2BuG,OAAiC;EACnF,IAAI,CAACvG,OAAOrD,QACR,OAAO;EAGX,IAAI6J;EACJ,IAAI;GAGAA,OAAO,MAAM,KAAK9K,OAAO+K,QAAQzG,OAAOrD,QAAQqD,OAAOQ,OAAO;EAClE,SAASqE,GAAG;GAIR,IAAItL,uBAAuBsL,CAAAA,GACvB,OAAO;GAGX,MAAMA;EACV;EAEA,IAAI1E,aAA+C;GAC/CiC,WAAW5H;GACX6H,QAAAA;GACAC,QAAAA;EACJ;EACA,IAAItC,OAAOG,YACPA,aAAa;GAAE,GAAGA;GAAY,GAAG2C,KAAKqB,MAAMnE,OAAOG,UAAU;EAAE;EAUnE,MAAMwG,QAAQpE,IAPGlJ,KAAK;GAClB+I,WAAWjC,WAAWiC;GACtBC,QAAQlC,WAAWkC;GACnBC,QAAQnC,WAAWmC;GACnB3F,QAAQvD,OAAOsN,WAAWF,IAAAA;EAC9B,CAEcjE,CAAAA,CAAKqE,SAAS;GAAEL,OAAOA,MAAMM,KAAI;GAAIC,QAAQ;EAAE,CAAA;EAC7D,IAAIH,UAAU,MACV,OAAO;EAOX,MAAMI,OAAOC,KAAKC,MAAMpG,KAAKC,IAAG,IAAK,MAAOX,WAAWmC,MAAM,IAAIqE;EACjE,IAAI,OAAOxG,WAAWyF,YAAY,YAAYmB,QAAQ5G,WAAWyF,SAC7D,OAAO;EAIX5F,OAAOG,aAAa2C,KAAKC,UAAU;GAAE,GAAG5C;GAAYyF,SAASmB;EAAK,CAAA;EAClE,OAAO;CACX;CAEA,MAAgBvB,eAAexF,QAA2B8B,MAAgC;EACtF,IAAI,CAAC9B,OAAOpD,OACR,OAAO;EAGX,MAAMsK,UAAUpE,KAAKqB,MAAMnE,OAAOpD,KAAK;EACvC,MAAMuK,aAAarF,KAAK+E,KAAI,CAAA,CAAGO,YAAW;EAE1C,KAAK,MAAMC,SAASH,SAAS;GACzB,IAAIG,MAAMjE,SACN;GAGJ,IAAI,MAAMlK,QAAQiO,YAAYE,MAAMlO,IAAI,GAAG;IACvCkO,MAAMjE,2BAAU,IAAIvC,KAAAA,EAAAA,CAAOqF,YAAW;IACtClG,OAAOpD,QAAQkG,KAAKC,UAAUmE,OAAAA;IAC9B,OAAO;GACX;EACJ;EAEA,OAAO;CACX;CAEUjH,wBAAwBD,QAAuE;EACrG,IAAI,CAACA,OAAOG,YACR,OAAO;EAEX,IAAI;GACA,OAAO2C,KAAKqB,MAAMnE,OAAOG,UAAU;EACvC,QAAQ;GACJ,OAAO;EACX;CACJ;CAEA,MAAgBwF,qBACZpJ,QACAyD,QACA+D,UACsB;EACtB,MAAM/H,MAAM,KAAK2D,eAAc;EAE/B,MAAMQ,aAAa,KAAKF,wBAAwBD,MAAAA;EAChD,IAAI,CAACG,YACD,OAAO;EAGX,IAAI/C;EACJ,IAAI;GACAA,SAAS0F,KAAKqB,MAAMJ,QAAAA;EACxB,QAAQ;GACJ,OAAO;EACX;EAGA,IAAI3G,OAAOX,OAAO0D,WAAWC,eACzB,OAAO;EAGX,MAAM6D,QAAQ,MAAM,KAAKxI,MAAMyI,IAC3B,KAAKvD,sBAAsB7F,+CAA+CyB,MAAAA,CAAAA;EAE9E,IAAI,CAAC0H,SAASA,MAAMrD,YAAYC,KAAKC,IAAG,GACpC,OAAO;EAGX,IAAI;GACA,MAAMwG,SAAS,MAAM3N,6BAA6BqC,KAAKoB,QAAQ6G,MAAM3D,WAAWH,UAAAA;GAChF,OAAOmH,OAAOC,WAAWD,OAAO5B,aAAa;EACjD,QAAQ;GACJ,OAAO;EACX;CACJ;CAEA,MAAgBD,YAAYlJ,QAAgBwH,UAAoC;EAC5E,MAAMyD,MAAM,KAAKrB,uBAAuB5J,MAAAA;EACxC,MAAM0H,QAAQ,MAAM,KAAKxI,MAAMyI,IAAoBsD,GAAAA;EACnD,IAAI,CAACvD,SAASA,MAAMrD,YAAYC,KAAKC,IAAG,GACpC,OAAO;EAMX,OAAO5H,QAAQ6K,SAAS8C,KAAI,GAAI5C,MAAM9K,IAAI;CAC9C;CAIA,MAAMsO,cACFlL,QACA4C,MACAnD,MAAoC,CAAC,GACxB;EAGb,IAAImD,SAAS5G,sBAAsB6G,OAC/B;EAGJ,KAAK6B,WAAU;EACf,MAAM,KAAKuC,0BAA0BjH,MAAAA;EAQrC,KAAI+I,MAJkB,KAAK/J,WAAWsE,yBAAyBtD,QAAQ;GACnE4C,MAAM5G,sBAAsB6G;GAC5BU,WAAW;EACf,CAAA,EAAA,CACYuB,WAAW,GACnB;EAIJ,MAAMrC,OAAO,MAAM,KAAKxD,eAAe2F,mBAAmB,EAAE1E,IAAIF,OAAO,CAAA;EACvE,IAAI,CAACyC,QAAQ,CAACA,KAAKkC,OACf;EAQJ,IAAIwG;EACJ,IAAI;GACAA,iBAAiB,CAAE,MAAM,KAAKjM,MAAMkM,IAChC,KAAKC,uBAAuBrL,MAAAA,GAC5B,GACA,EAAEwE,KAAAA,KAA8C,IAAM,CAAA;EAE9D,QAAQ;GACJ2G,iBAAiB;EACrB;EACA,IAAIA,gBACA,MAAM,IAAI7O,kBAAkB,EAAEgP,YAAAA,GAAmD,CAAA;EAGrF,MAAMC,YAAY7M,oBAAAA,CAAoBd;EACtC,MAAM,KAAKsB,MAAMiF,IACb,KAAKyF,uBAAuB5J,MAAAA,GAC5B;GACIpD,MAAM,MAAMA,KAAK2O,SAAAA;GACjBlH,WAAWC,KAAKC,IAAG,IAAA,MAA8D;EACrF,GACA,EAAEC,KAAAA,MAA6D,IAAM,CAAA;EAGzE,MAAMgH,OAAO,MAAM,KAAKlM,qBAAsBmM,OAAO;GACjDC,UAAUzO,iBAAiB0O;GAC3BC,QAAQ;IACJrG,MAAMgG;IACNM,kBAAAA;GACJ;GACAC,QAAQrM,IAAIqM;EAChB,CAAA;EAEA,MAAM,KAAKzM,WAAY0M,KAAK;GACxBC,IAAIvJ,KAAKkC;GACT,GAAG6G;EACP,CAAA;CACJ;CAIA,MAAMS,aAAajM,QAAkC;EACjD,OAAO,KAAKhB,WAAWkN,mBAAmBlM,MAAAA;CAC9C;CAEA,MAAM+D,UACF/D,QACAT,UAAuC,CAAC,GACC;EACzC,IAAI,CAAC,KAAKA,QAAQ4M,SACd,OAAO;GACHC,UAAU;GACVC,oBAAoB;GACpBC,OAAO,CAAA;EACX;EAIJ,MAAM/I,aAAYwF,MADI,KAAK/J,WAAW6F,cAAc7E,MAAAA,EAAAA,CAC1B2D,QAAQF,WAAWA,OAAOF,SAAS;EAE7D,MAAM+I,QAAQC,MAAMC,KAAK,IAAIC,IAAIlJ,UAAU9B,KAAKgC,WAAWA,OAAOb,IAAI,CAAA,CAAA;EAEtE,MAAM+F,SAA4C;GAC9CyD,UAAU7I,UAAUuB,SAAS;GAC7BuH,oBAAoB,CAAC,CAAC,KAAK9M,QAAQ6M,YAAY7I,UAAUuB,WAAW;GACpEwH;EACJ;EAQA,KADsB/M,QAAQmN,iBAAiB,SAC1BJ,MAAMK,SAAS3Q,sBAAsBkH,QAAQ,KAAK,KAAK3D,QAAQkF,UAAU;GAC1F,MAAMmI,eAAe,MAAM,KAAK5N,WAAWsE,yBAAyBtD,QAAQ;IACxE4C,MAAM5G,sBAAsBkH;IAC5BK,WAAW;GACf,CAAA,EAAA,CACK9B,KAAKgC,WAAW,KAAKC,wBAAwBD,MAAAA,CAAAA,CAAAA,CAC7CE,QAAQC,eAAkE,CAAC,CAACA,UAAAA,CAAAA,CAC5EnC,KAAKmC,gBAAgB;IAAE1D,IAAI0D,WAAWC;IAAeC,YAAYF,WAAWE;GAAW,EAAA;GAE5F,MAAM,EAAEvE,SAASwE,cAAc,MAAM7G,mCAAmC,KAAKqC,QAAQkF,UAAUmI,WAAAA;GAE/F,MAAM,KAAK1N,MAAMiF,IACb,KAAKC,sBAAsB7F,+CAA+CyB,MAAAA,GAC1E;IACI+D;IACAM,WAAWC,KAAKC,IAAG,IAAA,MAAqD;GAC5E,GACA,EAAEC,KAAAA,MAAoD,IAAM,CAAA;GAGhEmE,OAAO5E,YAAY,EAAEU,UAAUlF,QAAQ;EAC3C;EAEA,OAAOoJ;CACX;CAIUvG,gBAAsB;EAC5B,IAAI,CAAC,KAAK7C,QAAQ4M,SACd,MAAM,IAAIjQ,YAAY;GAClBqJ,MAAMlJ,UAAUwQ;GAChBpH,SAAS;EACb,CAAA;CAER;CAEUf,aAAmB;EACzB,IAAI,CAAC,KAAKrF,cAAc,CAAC,KAAKC,sBAC1B,MAAM,IAAIpD,YAAY;GAClBqJ,MAAMlJ,UAAUwQ;GAChBpH,SAAS;EACb,CAAA;CAER;CAEUrC,iBAAkC;EACxC,IAAI,CAAC,KAAK7D,QAAQkF,UACd,MAAM,IAAIvI,YAAY;GAClBqJ,MAAMlJ,UAAUwQ;GAChBpH,SAAS;EACb,CAAA;EAGJ,OAAO,KAAKlG,QAAQkF;CACxB;CAIUqI,qBAAqB9M,QAAwB;EACnD,OAAOtD,cAAc;GACjBqQ,QAAQzP;GACR2N,KAAKjL;EACT,CAAA;CACJ;CAEUgN,sBAAsBhN,QAAwB;EACpD,OAAOtD,cAAc;GACjBqQ,QAAQ/O;GACRiN,KAAKjL;EACT,CAAA;CACJ;CAEU4J,uBAAuB5J,QAAwB;EACrD,OAAOtD,cAAc;GACjBqQ,QAAQrP;GACRuN,KAAKjL;EACT,CAAA;CACJ;CAEUqL,uBAAuBrL,QAAwB;EACrD,OAAOtD,cAAc;GACjBqQ,QAAQlP;GACRoN,KAAKjL;EACT,CAAA;CACJ;CAEUoE,sBAAsB2I,QAAgB/M,QAAwB;EACpE,OAAOtD,cAAc;GAAEqQ;GAAQ9B,KAAKjL;EAAO,CAAA;CAC/C;CAEUwI,wBAAwBxI,QAAwB;EACtD,OAAOtD,cAAc;GACjBqQ,QAAQ3O;GACR6M,KAAKjL;EACT,CAAA;CACJ;CAEA,MAAgB0I,kBAAkBuC,KAAkC;EAChE,MAAMnC,QAAQ1N,WAAAA;EAEd,IAAI;GACA,OAAO,MAAO,KAAK8D,MAAMkM,IAAIH,KAAKnC,OAAO,EAAEtE,KAAAA,IAAwC,CAAA,IAC/E;IAAEmE,QAAQ;IAAYG;GAAM,IAC5B,EAAEH,QAAQ,OAAO;EACzB,QAAQ;GACJ,OAAO,EAAEA,QAAQ,cAAc;EACnC;CACJ;CAEUE,mBAAmBoC,KAAanC,OAAgC;EACtE,IAAImE,QAAQ;EACZ,IAAIC;EAEJ,MAAMC,qBAAe;GACjB,IAAI,CAACF,SAASC,SACV,OAAOA;GAGXA,UAAU,KAAKhO,MACVkO,aAAanC,KAAKnC,OAAOxK,kCAAAA,CAAAA,CACzB+O,MAAMC,YAAAA;IACHL,QAAQK;GACZ,CAAA,CAAA,CACCC,YAAM;IACHN,QAAQ;GACZ,CAAA,CAAA,CACCO,cAAQ;IACLN,UAAU5H,KAAAA;GACd,CAAA;GAEJ,OAAO4H;EACX;EAEA,MAAMO,QAAQC,YAAYP,cAAc9O,6CAAAA;EAExC,OAAO;GACHmL,OAAO,YAAA;IACH,MAAM2D,aAAAA;IACN,OAAOF;GACX;GACAnD,MAAM,YAAA;IACF6D,cAAcF,KAAAA;IACd,MAAMP;GACV;EACJ;CACJ;CAEA,MAAgBnD,kBAAkBkB,KAAanC,OAA8B;EACzE,IAAI;GACA,MAAM,KAAK5J,MAAM0O,YAAY3C,KAAKnC,KAAAA;EACtC,QAAQ,CAER;CACJ;CAEA,MAAgBT,mBAAmBrI,QAA+B;EAC9D,MAAM6N,cAAc,MAAM,KAAK3O,MAAMyI,IAAY,KAAKqF,sBAAsBhN,MAAAA,CAAAA;EAC5E,IAAI,OAAO6N,gBAAgB,YAAYA,cAAcvJ,KAAKC,IAAG,GACzD,MAAM,IAAIjI,kBAAkB,EAAEgP,YAAYb,KAAKqD,MAAMD,cAAcvJ,KAAKC,IAAG,KAAM,GAAA,EAAO,CAAA;CAEhG;CAOA,MAAgB0C,0BAA0BjH,QAA+B;EACrE,IAAI;GACA,MAAM,KAAKqI,mBAAmBrI,MAAAA;EAClC,SAASsI,GAAG;GACR,IAAI9L,oBAAoB8L,CAAAA,GACpB,MAAMA;GAGV,MAAM,IAAIhM,kBAAkB,EAAEgP,YAAAA,EAAmD,CAAA;EACrF;CACJ;CAEA,MAAgBjE,aAAarH,QAA+B;EACxD,MAAMiL,MAAM,KAAK6B,qBAAqB9M,MAAAA;EAItC,IAAI+N;EACJ,IAAI;GACAA,QAAQ,MAAM,KAAK7O,MAAM8O,UAAU/C,KAAK,GAAG,EAAEzG,KAAK/G,oCAAoC,IAAM,CAAA;EAChG,QAAQ;GAGJ,MAAM,KAAKyB,MAAM4I,KAAKmD,GAAAA;GACtB8C,QAAQ,MAAM,KAAK7O,MAAM8O,UAAU/C,KAAK,GAAG,EAAEzG,KAAK/G,oCAAoC,IAAM,CAAA;EAChG;EAEA,MAAMwQ,QAAQxD,KAAKyD,IAAAA,KAAAA,IAE2B,MAAMH,QAAQ,EAAA;EAG5D,MAAM,KAAK7O,MAAMiF,IACb,KAAK6I,sBAAsBhN,MAAAA,GAC3BsE,KAAKC,IAAG,IAAM0J,QAAQ,KACtB,EAAEzJ,KAAKyJ,QAAQ,IAAM,CAAA;CAE7B;CAEA,MAAgB3G,cAActH,QAA+B;EACzD,MAAM,KAAKd,MAAMiP,SAAS,CACtB,KAAKrB,qBAAqB9M,MAAAA,GAC1B,KAAKgN,sBAAsBhN,MAAAA,CAAAA,CAC9B;CACL;CAIA,MAAgBmF,YACZxE,MACAhB,QACa;EACb,MAAM,KAAKP,cAAcgP,OAAO;GAC5BC,OAAOxS,WAAWyS;GAClB3N;GACA4N,SAAS3S,aAAa4S;GACtBC,OAAO9O,OAAOO;GACdwO,WAAW5S,aAAaiE;GACxB4O,SAAShP,OAAOK;GAChBiE,SAAStE,OAAOsE;GAChBhE,MAAM,EAAE2C,MAAMjD,OAAOiD,KAAK;EAC9B,CAAA;CACJ;CAEA,MAAgB0G,qBACZ3I,MACAX,QACA4C,MACAnD,KACAE,QACa;EACb,MAAM,KAAKP,cAAcgP,OAAO;GAC5BC,OAAOxS,WAAWyS;GAClB3N;GACA4N,SAAS3S,aAAamE;GACtB0O,OAAOzO;GACP0O,WAAW5S,aAAaiE;GACxB4O,SAAS3O;GACT4O,UAAUnP,IAAImP,YAAY;GAC1B3K,SAAStE,QAAQsE,WAAW;GAC5B4K,kBAAkBpP,IAAIqP,aAAa;GACnCC,kBAAkBtP,IAAIuP,aAAa;GACnC/O,MAAM,EAAE2C,KAAK;EACjB,CAAA;CACJ;AACJ"}

package/dist/core/entities/user-authenticator/types.d.ts ADDED Viewed

@@ -0,0 +1,222 @@
+import type { UserAuthenticator, UserAuthenticatorKind } from '@authup/core-kit';
+import type { IQuery } from '@rapiq/core';
+import type { ActorContext, EntityRepositoryFindManyResult, ICache } from '@authup/server-kit';
+import type { IRealmCipher } from '../../key/index.ts';
+import type { IEventService } from '../event/index.ts';
+import type { IMailClient, IMailTemplateRenderer } from '../../mail/index.ts';
+import type { IUserRepository } from '../user/index.ts';
+export declare const USER_AUTHENTICATOR_FILTER_KEYS: readonly ["id", "kind", "confirmed", "userId", "realmId"];
+export type UserAuthenticatorOwner = {
+    userId: string;
+};
+export type UserAuthenticatorFindManyOptions = {
+    owner?: UserAuthenticatorOwner;
+};
+export type UserAuthenticatorSecretsFilter = {
+    kind?: `${UserAuthenticatorKind}`;
+    confirmed?: boolean;
+};
+export interface IUserAuthenticatorRepository {
+    findMany(query: IQuery, options?: UserAuthenticatorFindManyOptions): Promise<EntityRepositoryFindManyResult<UserAuthenticator>>;
+    findOneById(id: string): Promise<UserAuthenticator | null>;
+    /**
+     * Like findOneById, but force-selects the secret/codes columns
+     * (select:false). Verification-path only — never for read endpoints.
+     */
+    findOneWithSecretsById(id: string): Promise<UserAuthenticator | null>;
+    findAllByUser(userId: string): Promise<UserAuthenticator[]>;
+    findAllWithSecretsByUser(userId: string, filter?: UserAuthenticatorSecretsFilter): Promise<UserAuthenticator[]>;
+    hasConfirmedByUser(userId: string): Promise<boolean>;
+    create(data: Partial<UserAuthenticator>): UserAuthenticator;
+    save(entity: UserAuthenticator): Promise<UserAuthenticator>;
+    remove(entity: UserAuthenticator): Promise<void>;
+    removeAllByUser(userId: string, kind: `${UserAuthenticatorKind}`): Promise<void>;
+}
+/**
+ * Stored on a recovery row's `codes` column as a JSON array.
+ */
+export type UserAuthenticatorRecoveryCode = {
+    hash: string;
+    used_at: string | null;
+};
+/**
+ * Stored on a TOTP row's `parameters` column as JSON.
+ */
+export type UserAuthenticatorTotpParameters = {
+    algorithm: string;
+    digits: number;
+    period: number;
+    /**
+     * Last accepted TOTP step (absolute period counter). A verify only
+     * succeeds for a strictly greater step — rejects replay within the
+     * validation window (RFC 6238 §5.2).
+     */
+    counter?: number;
+};
+/**
+ * Stored on a WebAuthn row's `parameters` column as JSON — the registered
+ * credential (base64url id + public key, signature counter, transports).
+ */
+export type UserAuthenticatorWebauthnParameters = {
+    rp_id: string;
+    credential_id: string;
+    public_key: string;
+    counter: number;
+    transports?: string[];
+};
+/**
+ * Kind-specific shown-once provisioning material — returned alongside the
+ * enrolled entity exactly once, never in a subsequent read.
+ */
+export type UserAuthenticatorEnrollResultMeta = {
+    /**
+     * TOTP: the raw base32 seed — present in the enroll response only,
+     * never in a subsequent read.
+     */
+    secret?: string;
+    /**
+     * TOTP: the otpauth:// provisioning URI.
+     */
+    uri?: string;
+    /**
+     * TOTP: the provisioning URI rendered as a PNG data-URI (QR code).
+     */
+    qr?: string;
+    /**
+     * Recovery: the raw single-use codes — shown once (download/print).
+     */
+    codes?: string[];
+    /**
+     * WebAuthn: the registration ceremony options the client passes to
+     * `navigator.credentials.create()` (SimpleWebAuthn `startRegistration`).
+     */
+    webauthn?: Record<string, unknown>;
+};
+export type UserAuthenticatorEnrollResult = {
+    data: UserAuthenticator;
+    meta: UserAuthenticatorEnrollResultMeta;
+};
+export type UserAuthenticatorChallengeStatus = {
+    /**
+     * The subject holds at least one confirmed device (and MFA is enabled)
+     * — a second factor must be presented.
+     */
+    required: boolean;
+    /**
+     * MFA is enforced org-wide (mfaRequired) and the subject has no
+     * confirmed device — the UI routes to inline enrollment.
+     */
+    enrollmentRequired: boolean;
+    /**
+     * Device kinds the subject can be challenged with.
+     */
+    kinds: `${UserAuthenticatorKind}`[];
+    /**
+     * Kind-specific challenge payload (absent for TOTP/recovery;
+     * WebAuthn request options in a later stage).
+     */
+    challenge?: Record<string, unknown>;
+};
+export type UserAuthenticatorVerifyInput = {
+    kind: `${UserAuthenticatorKind}`;
+    response: string;
+};
+export type UserAuthenticatorVerifyContext = {
+    ipAddress?: string | null;
+    userAgent?: string | null;
+    clientId?: string | null;
+    /**
+     * Runs inside the verify critical section once the factor matched,
+     * BEFORE the consumption (TOTP step / recovery used_at / email code)
+     * is persisted. A throw aborts the verify without consuming the factor
+     * — the seam for binding the proof to another aggregate (the session
+     * mfaAt stamp) so a stamp failure never burns a single-use code.
+     */
+    onVerified?: () => Promise<void>;
+};
+export type UserAuthenticatorChallengeOptions = {
+    /**
+     * Issue kind-specific challenge material as a side effect (e.g. mint +
+     * cache the WebAuthn request nonce). Only the interactive status endpoint
+     * needs it; the enforcement chokepoints (authorize backstop, password
+     * grant) read `required`/`enrollmentRequired`/`kinds` only and pass
+     * `false` so they don't rotate an in-flight ceremony's nonce or run the
+     * extra query on every request. Defaults to `true`.
+     */
+    issueMaterial?: boolean;
+};
+/**
+ * The login-time seam: computes whether (and how) a subject must be
+ * challenged. Consumed by the authorize backstop and the password grant.
+ */
+export interface IUserAuthenticatorChallengeProvider {
+    challenge(userId: string, options?: UserAuthenticatorChallengeOptions): Promise<UserAuthenticatorChallengeStatus>;
+}
+export interface IUserAuthenticatorService extends IUserAuthenticatorChallengeProvider {
+    getMany(query: Record<string, any>, actor: ActorContext, options?: {
+        userId?: string;
+    }): Promise<EntityRepositoryFindManyResult<UserAuthenticator>>;
+    getOne(id: string, actor: ActorContext, options?: {
+        userId?: string;
+    }): Promise<UserAuthenticator>;
+    enroll(data: Record<string, any>, actor: ActorContext): Promise<UserAuthenticatorEnrollResult>;
+    confirm(id: string, code: string, actor: ActorContext, options?: {
+        userId?: string;
+    }): Promise<UserAuthenticator>;
+    delete(id: string, actor: ActorContext, options?: {
+        userId?: string;
+    }): Promise<UserAuthenticator>;
+    verify(userId: string, input: UserAuthenticatorVerifyInput, ctx?: UserAuthenticatorVerifyContext): Promise<boolean>;
+    /**
+     * Issue a kind-specific challenge (email OTP: generate + mail a code).
+     * A no-op for kinds whose challenge material is client-derived (TOTP).
+     */
+    sendChallenge(userId: string, kind: `${UserAuthenticatorKind}`, ctx?: UserAuthenticatorSendContext): Promise<void>;
+    hasConfirmed(userId: string): Promise<boolean>;
+}
+export type UserAuthenticatorSendContext = {
+    locale?: string;
+};
+export type UserAuthenticatorServiceOptions = {
+    /**
+     * Org-wide MFA feature toggle (config: mfaEnabled).
+     */
+    enabled?: boolean;
+    /**
+     * Enforce MFA for every user (config: mfaRequired) — users without a
+     * confirmed device are routed to inline enrollment at next login.
+     */
+    required?: boolean;
+    /**
+     * Issuer label for otpauth:// provisioning URIs.
+     */
+    issuer?: string;
+    /**
+     * WebAuthn relying-party context, derived from publicUrl (the hosted
+     * login origin). Absent = WebAuthn enrollment/verification is refused.
+     */
+    webauthn?: {
+        rpId: string;
+        rpName: string;
+        origin: string;
+    };
+};
+export type UserAuthenticatorServiceContext = {
+    repository: IUserAuthenticatorRepository;
+    userRepository: IUserRepository;
+    cache: ICache;
+    /**
+     * Realm-scoped seed cipher over the key store's per-realm enc keys
+     * (auto-generated on first use — no operator-provided key).
+     */
+    cipher: IRealmCipher;
+    eventService?: IEventService;
+    /**
+     * Mail dependencies for the email-OTP kind (absent = email OTP
+     * enrollment/send is refused).
+     */
+    mailClient?: IMailClient;
+    mailTemplateRenderer?: IMailTemplateRenderer;
+    options?: UserAuthenticatorServiceOptions;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/user-authenticator/types.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-authenticator/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EACR,YAAY,EACZ,8BAA8B,EAC9B,MAAM,EACT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,eAAO,MAAM,8BAA8B,2DAMjC,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG;IACjC,MAAM,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC3C,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,IAAI,CAAC,EAAE,GAAG,qBAAqB,EAAE,CAAC;IAClC,SAAS,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,WAAW,4BAA4B;IACzC,QAAQ,CACJ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,gCAAgC,GAC3C,OAAO,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAE9D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAE3D;;;OAGG;IACH,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAEtE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAE5D,wBAAwB,CACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,8BAA8B,GACxC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAEhC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;IAE5D,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAE5D,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,qBAAqB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpF;AAED;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,mCAAmC,GAAG;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC5C;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IACxC,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,iCAAiC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC3C;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;OAEG;IACH,KAAK,EAAE,GAAG,qBAAqB,EAAE,EAAE,CAAC;IACpC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACvC,IAAI,EAAE,GAAG,qBAAqB,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC5C;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,mCAAmC;IAChD,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iCAAiC,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAAC;CACrH;AAED,MAAM,WAAW,yBAA0B,SAAQ,mCAAmC;IAClF,OAAO,CACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAE9D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAEnG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAE/F,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAElH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAEnG,MAAM,CACF,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,4BAA4B,EACnC,GAAG,CAAC,EAAE,8BAA8B,GACrC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;OAGG;IACH,aAAa,CACT,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,GAAG,qBAAqB,EAAE,EAChC,GAAG,CAAC,EAAE,4BAA4B,GACnC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClD;AAED,MAAM,MAAM,4BAA4B,GAAG;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC1C;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,QAAQ,CAAC,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;KAClB,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC1C,UAAU,EAAE,4BAA4B,CAAC;IACzC,cAAc,EAAE,eAAe,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,EAAE,YAAY,CAAC;IACrB,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B;;;OAGG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,OAAO,CAAC,EAAE,+BAA+B,CAAC;CAC7C,CAAC"}

package/dist/core/entities/user-authenticator/types.mjs ADDED Viewed

@@ -0,0 +1,15 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/entities/user-authenticator/types.ts
+const USER_AUTHENTICATOR_FILTER_KEYS = [
+	"id",
+	"kind",
+	"confirmed",
+	"userId",
+	"realmId"
+];
+//#endregion
+export { USER_AUTHENTICATOR_FILTER_KEYS };
+//# sourceMappingURL=types.mjs.map

package/dist/core/entities/user-authenticator/types.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"types.mjs","names":["USER_AUTHENTICATOR_FILTER_KEYS"],"sources":["../../../../src/core/entities/user-authenticator/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { UserAuthenticator, UserAuthenticatorKind } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type {\n ActorContext,\n EntityRepositoryFindManyResult,\n ICache,\n} from '@authup/server-kit';\nimport type { IRealmCipher } from '../../key/index.ts';\nimport type { IEventService } from '../event/index.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/index.ts';\nimport type { IUserRepository } from '../user/index.ts';\n\nexport const USER_AUTHENTICATOR_FILTER_KEYS = [\n 'id',\n 'kind',\n 'confirmed',\n 'userId',\n 'realmId',\n] as const;\n\nexport type UserAuthenticatorOwner = {\n userId: string,\n};\n\nexport type UserAuthenticatorFindManyOptions = {\n owner?: UserAuthenticatorOwner,\n};\n\nexport type UserAuthenticatorSecretsFilter = {\n kind?: `${UserAuthenticatorKind}`,\n confirmed?: boolean,\n};\n\nexport interface IUserAuthenticatorRepository {\n findMany(\n query: IQuery,\n options?: UserAuthenticatorFindManyOptions\n ): Promise<EntityRepositoryFindManyResult<UserAuthenticator>>;\n\n findOneById(id: string): Promise<UserAuthenticator | null>;\n\n /**\n * Like findOneById, but force-selects the secret/codes columns\n * (select:false). Verification-path only — never for read endpoints.\n */\n findOneWithSecretsById(id: string): Promise<UserAuthenticator | null>;\n\n findAllByUser(userId: string): Promise<UserAuthenticator[]>;\n\n findAllWithSecretsByUser(\n userId: string,\n filter?: UserAuthenticatorSecretsFilter\n ): Promise<UserAuthenticator[]>;\n\n hasConfirmedByUser(userId: string): Promise<boolean>;\n\n create(data: Partial<UserAuthenticator>): UserAuthenticator;\n\n save(entity: UserAuthenticator): Promise<UserAuthenticator>;\n\n remove(entity: UserAuthenticator): Promise<void>;\n\n removeAllByUser(userId: string, kind: `${UserAuthenticatorKind}`): Promise<void>;\n}\n\n/**\n * Stored on a recovery row's `codes` column as a JSON array.\n */\nexport type UserAuthenticatorRecoveryCode = {\n hash: string,\n used_at: string | null,\n};\n\n/**\n * Stored on a TOTP row's `parameters` column as JSON.\n */\nexport type UserAuthenticatorTotpParameters = {\n algorithm: string,\n digits: number,\n period: number,\n /**\n * Last accepted TOTP step (absolute period counter). A verify only\n * succeeds for a strictly greater step — rejects replay within the\n * validation window (RFC 6238 §5.2).\n */\n counter?: number,\n};\n\n/**\n * Stored on a WebAuthn row's `parameters` column as JSON — the registered\n * credential (base64url id + public key, signature counter, transports).\n */\nexport type UserAuthenticatorWebauthnParameters = {\n rp_id: string,\n credential_id: string,\n public_key: string,\n counter: number,\n transports?: string[],\n};\n\n/**\n * Kind-specific shown-once provisioning material — returned alongside the\n * enrolled entity exactly once, never in a subsequent read.\n */\nexport type UserAuthenticatorEnrollResultMeta = {\n /**\n * TOTP: the raw base32 seed — present in the enroll response only,\n * never in a subsequent read.\n */\n secret?: string,\n /**\n * TOTP: the otpauth:// provisioning URI.\n */\n uri?: string,\n /**\n * TOTP: the provisioning URI rendered as a PNG data-URI (QR code).\n */\n qr?: string,\n /**\n * Recovery: the raw single-use codes — shown once (download/print).\n */\n codes?: string[],\n /**\n * WebAuthn: the registration ceremony options the client passes to\n * `navigator.credentials.create()` (SimpleWebAuthn `startRegistration`).\n */\n webauthn?: Record<string, unknown>,\n};\n\nexport type UserAuthenticatorEnrollResult = {\n data: UserAuthenticator,\n meta: UserAuthenticatorEnrollResultMeta,\n};\n\nexport type UserAuthenticatorChallengeStatus = {\n /**\n * The subject holds at least one confirmed device (and MFA is enabled)\n * — a second factor must be presented.\n */\n required: boolean,\n /**\n * MFA is enforced org-wide (mfaRequired) and the subject has no\n * confirmed device — the UI routes to inline enrollment.\n */\n enrollmentRequired: boolean,\n /**\n * Device kinds the subject can be challenged with.\n */\n kinds: `${UserAuthenticatorKind}`[],\n /**\n * Kind-specific challenge payload (absent for TOTP/recovery;\n * WebAuthn request options in a later stage).\n */\n challenge?: Record<string, unknown>,\n};\n\nexport type UserAuthenticatorVerifyInput = {\n kind: `${UserAuthenticatorKind}`,\n response: string,\n};\n\nexport type UserAuthenticatorVerifyContext = {\n ipAddress?: string | null,\n userAgent?: string | null,\n clientId?: string | null,\n /**\n * Runs inside the verify critical section once the factor matched,\n * BEFORE the consumption (TOTP step / recovery used_at / email code)\n * is persisted. A throw aborts the verify without consuming the factor\n * — the seam for binding the proof to another aggregate (the session\n * mfaAt stamp) so a stamp failure never burns a single-use code.\n */\n onVerified?: () => Promise<void>,\n};\n\nexport type UserAuthenticatorChallengeOptions = {\n /**\n * Issue kind-specific challenge material as a side effect (e.g. mint +\n * cache the WebAuthn request nonce). Only the interactive status endpoint\n * needs it; the enforcement chokepoints (authorize backstop, password\n * grant) read `required`/`enrollmentRequired`/`kinds` only and pass\n * `false` so they don't rotate an in-flight ceremony's nonce or run the\n * extra query on every request. Defaults to `true`.\n */\n issueMaterial?: boolean,\n};\n\n/**\n * The login-time seam: computes whether (and how) a subject must be\n * challenged. Consumed by the authorize backstop and the password grant.\n */\nexport interface IUserAuthenticatorChallengeProvider {\n challenge(userId: string, options?: UserAuthenticatorChallengeOptions): Promise<UserAuthenticatorChallengeStatus>;\n}\n\nexport interface IUserAuthenticatorService extends IUserAuthenticatorChallengeProvider {\n getMany(\n query: Record<string, any>,\n actor: ActorContext,\n options?: { userId?: string }\n ): Promise<EntityRepositoryFindManyResult<UserAuthenticator>>;\n\n getOne(id: string, actor: ActorContext, options?: { userId?: string }): Promise<UserAuthenticator>;\n\n enroll(data: Record<string, any>, actor: ActorContext): Promise<UserAuthenticatorEnrollResult>;\n\n confirm(id: string, code: string, actor: ActorContext, options?: { userId?: string }): Promise<UserAuthenticator>;\n\n delete(id: string, actor: ActorContext, options?: { userId?: string }): Promise<UserAuthenticator>;\n\n verify(\n userId: string,\n input: UserAuthenticatorVerifyInput,\n ctx?: UserAuthenticatorVerifyContext\n ): Promise<boolean>;\n\n /**\n * Issue a kind-specific challenge (email OTP: generate + mail a code).\n * A no-op for kinds whose challenge material is client-derived (TOTP).\n */\n sendChallenge(\n userId: string,\n kind: `${UserAuthenticatorKind}`,\n ctx?: UserAuthenticatorSendContext\n ): Promise<void>;\n\n hasConfirmed(userId: string): Promise<boolean>;\n}\n\nexport type UserAuthenticatorSendContext = {\n locale?: string,\n};\n\nexport type UserAuthenticatorServiceOptions = {\n /**\n * Org-wide MFA feature toggle (config: mfaEnabled).\n */\n enabled?: boolean,\n /**\n * Enforce MFA for every user (config: mfaRequired) — users without a\n * confirmed device are routed to inline enrollment at next login.\n */\n required?: boolean,\n /**\n * Issuer label for otpauth:// provisioning URIs.\n */\n issuer?: string,\n /**\n * WebAuthn relying-party context, derived from publicUrl (the hosted\n * login origin). Absent = WebAuthn enrollment/verification is refused.\n */\n webauthn?: {\n rpId: string,\n rpName: string,\n origin: string,\n },\n};\n\nexport type UserAuthenticatorServiceContext = {\n repository: IUserAuthenticatorRepository,\n userRepository: IUserRepository,\n cache: ICache,\n /**\n * Realm-scoped seed cipher over the key store's per-realm enc keys\n * (auto-generated on first use — no operator-provided key).\n */\n cipher: IRealmCipher,\n eventService?: IEventService,\n /**\n * Mail dependencies for the email-OTP kind (absent = email OTP\n * enrollment/send is refused).\n */\n mailClient?: IMailClient,\n mailTemplateRenderer?: IMailTemplateRenderer,\n options?: UserAuthenticatorServiceOptions,\n};\n"],"mappings":";;;;AAmBA,MAAaA,iCAAiC;CAC1C;CACA;CACA;CACA;CACA"}

package/dist/core/entities/user-authenticator/webauthn.d.ts ADDED Viewed

@@ -0,0 +1,28 @@
+import type { AuthenticationResponseJSON, RegistrationResponseJSON } from '@simplewebauthn/server';
+import type { UserAuthenticatorWebauthnParameters } from './types.ts';
+export type WebauthnContext = {
+    rpId: string;
+    rpName: string;
+    origin: string;
+};
+export type WebauthnCredentialRef = {
+    id: string;
+    transports?: string[];
+};
+export declare function buildWebauthnRegistrationOptions(ctx: WebauthnContext, user: {
+    id: string;
+    name: string;
+}, existing: WebauthnCredentialRef[]): Promise<{
+    options: Record<string, unknown>;
+    challenge: string;
+}>;
+export declare function verifyWebauthnRegistration(ctx: WebauthnContext, response: RegistrationResponseJSON, challenge: string): Promise<UserAuthenticatorWebauthnParameters | null>;
+export declare function buildWebauthnAuthenticationOptions(ctx: WebauthnContext, credentials: WebauthnCredentialRef[]): Promise<{
+    options: Record<string, unknown>;
+    challenge: string;
+}>;
+export declare function verifyWebauthnAuthentication(ctx: WebauthnContext, response: AuthenticationResponseJSON, challenge: string, credential: UserAuthenticatorWebauthnParameters): Promise<{
+    verified: boolean;
+    newCounter: number;
+}>;
+//# sourceMappingURL=webauthn.d.ts.map

package/dist/core/entities/user-authenticator/webauthn.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-authenticator/webauthn.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACR,0BAA0B,EAE1B,wBAAwB,EAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,MAAM,eAAe,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAChC,EAAE,EAAE,MAAM,CAAC;IAGX,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AAeF,wBAAsB,gCAAgC,CAClD,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAClC,QAAQ,EAAE,qBAAqB,EAAE,GAClC,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAqBlE;AAED,wBAAsB,0BAA0B,CAC5C,GAAG,EAAE,eAAe,EACpB,QAAQ,EAAE,wBAAwB,EAClC,SAAS,EAAE,MAAM,GAClB,OAAO,CAAC,mCAAmC,GAAG,IAAI,CAAC,CAsBrD;AAED,wBAAsB,kCAAkC,CACpD,GAAG,EAAE,eAAe,EACpB,WAAW,EAAE,qBAAqB,EAAE,GACrC,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAclE;AAED,wBAAsB,4BAA4B,CAC9C,GAAG,EAAE,eAAe,EACpB,QAAQ,EAAE,0BAA0B,EACpC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,mCAAmC,GAChD,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBpD"}

package/dist/core/entities/user-authenticator/webauthn.mjs ADDED Viewed

@@ -0,0 +1,88 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from "@simplewebauthn/server";
+import { isoBase64URL } from "@simplewebauthn/server/helpers";
+//#region src/core/entities/user-authenticator/webauthn.ts
+function asOpaqueOptions(options) {
+	return options;
+}
+function asTransports(transports) {
+	return transports;
+}
+async function buildWebauthnRegistrationOptions(ctx, user, existing) {
+	const options = await generateRegistrationOptions({
+		rpName: ctx.rpName,
+		rpID: ctx.rpId,
+		userID: new TextEncoder().encode(user.id),
+		userName: user.name,
+		attestationType: "none",
+		excludeCredentials: existing.map((credential) => ({
+			id: credential.id,
+			transports: asTransports(credential.transports)
+		})),
+		authenticatorSelection: {
+			residentKey: "discouraged",
+			userVerification: "preferred"
+		}
+	});
+	return {
+		options: asOpaqueOptions(options),
+		challenge: options.challenge
+	};
+}
+async function verifyWebauthnRegistration(ctx, response, challenge) {
+	const verification = await verifyRegistrationResponse({
+		response,
+		expectedChallenge: challenge,
+		expectedOrigin: ctx.origin,
+		expectedRPID: ctx.rpId,
+		requireUserVerification: false
+	});
+	if (!verification.verified || !verification.registrationInfo) return null;
+	const { credential } = verification.registrationInfo;
+	return {
+		rp_id: ctx.rpId,
+		credential_id: credential.id,
+		public_key: isoBase64URL.fromBuffer(credential.publicKey),
+		counter: credential.counter,
+		transports: credential.transports
+	};
+}
+async function buildWebauthnAuthenticationOptions(ctx, credentials) {
+	const options = await generateAuthenticationOptions({
+		rpID: ctx.rpId,
+		userVerification: "preferred",
+		allowCredentials: credentials.map((credential) => ({
+			id: credential.id,
+			transports: asTransports(credential.transports)
+		}))
+	});
+	return {
+		options: asOpaqueOptions(options),
+		challenge: options.challenge
+	};
+}
+async function verifyWebauthnAuthentication(ctx, response, challenge, credential) {
+	const verification = await verifyAuthenticationResponse({
+		response,
+		expectedChallenge: challenge,
+		expectedOrigin: ctx.origin,
+		expectedRPID: ctx.rpId,
+		requireUserVerification: false,
+		credential: {
+			id: credential.credential_id,
+			publicKey: isoBase64URL.toBuffer(credential.public_key),
+			counter: credential.counter,
+			transports: asTransports(credential.transports)
+		}
+	});
+	return {
+		verified: verification.verified,
+		newCounter: verification.authenticationInfo?.newCounter ?? credential.counter
+	};
+}
+//#endregion
+export { buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, verifyWebauthnAuthentication, verifyWebauthnRegistration };
+//# sourceMappingURL=webauthn.mjs.map

package/dist/core/entities/user-authenticator/webauthn.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"webauthn.mjs","names":["generateAuthenticationOptions","generateRegistrationOptions","verifyAuthenticationResponse","verifyRegistrationResponse","isoBase64URL","asOpaqueOptions","options","asTransports","transports","buildWebauthnRegistrationOptions","ctx","user","existing","rpName","rpID","rpId","userID","TextEncoder","encode","id","userName","name","attestationType","excludeCredentials","map","credential","authenticatorSelection","residentKey","userVerification","challenge","verifyWebauthnRegistration","response","verification","expectedChallenge","expectedOrigin","origin","expectedRPID","requireUserVerification","verified","registrationInfo","rp_id","credential_id","public_key","fromBuffer","publicKey","counter","buildWebauthnAuthenticationOptions","credentials","allowCredentials","verifyWebauthnAuthentication","toBuffer","newCounter","authenticationInfo"],"sources":["../../../../src/core/entities/user-authenticator/webauthn.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n generateAuthenticationOptions,\n generateRegistrationOptions,\n verifyAuthenticationResponse,\n verifyRegistrationResponse,\n} from '@simplewebauthn/server';\nimport { isoBase64URL } from '@simplewebauthn/server/helpers';\nimport type {\n AuthenticationResponseJSON,\n AuthenticatorTransportFuture,\n RegistrationResponseJSON,\n} from '@simplewebauthn/server';\nimport type { UserAuthenticatorWebauthnParameters } from './types.ts';\n\nexport type WebauthnContext = {\n rpId: string,\n rpName: string,\n origin: string,\n};\n\nexport type WebauthnCredentialRef = {\n id: string,\n // persisted as a plain string[] on the credential row (JSON column); the\n // SimpleWebAuthn API narrows it to its transport string-literal union.\n transports?: string[],\n};\n\n// The SimpleWebAuthn option objects are serialized verbatim to the browser\n// (navigator.credentials.*). They cross the wire as an opaque JSON blob, so the\n// public DTO deliberately keeps them as `Record<string, unknown>` rather than\n// leaking @simplewebauthn/server types into the shared HTTP contract — hence the\n// single boundary conversion below.\nfunction asOpaqueOptions(options: object): Record<string, unknown> {\n return options as unknown as Record<string, unknown>;\n}\n\nfunction asTransports(transports?: string[]): AuthenticatorTransportFuture[] | undefined {\n return transports as AuthenticatorTransportFuture[] | undefined;\n}\n\nexport async function buildWebauthnRegistrationOptions(\n ctx: WebauthnContext,\n user: { id: string, name: string },\n existing: WebauthnCredentialRef[],\n): Promise<{ options: Record<string, unknown>, challenge: string }> {\n const options = await generateRegistrationOptions({\n rpName: ctx.rpName,\n rpID: ctx.rpId,\n userID: new TextEncoder().encode(user.id),\n userName: user.name,\n attestationType: 'none',\n excludeCredentials: existing.map((credential) => ({\n id: credential.id,\n transports: asTransports(credential.transports),\n })),\n authenticatorSelection: {\n residentKey: 'discouraged',\n userVerification: 'preferred',\n },\n });\n\n return {\n options: asOpaqueOptions(options),\n challenge: options.challenge,\n };\n}\n\nexport async function verifyWebauthnRegistration(\n ctx: WebauthnContext,\n response: RegistrationResponseJSON,\n challenge: string,\n): Promise<UserAuthenticatorWebauthnParameters | null> {\n const verification = await verifyRegistrationResponse({\n response,\n expectedChallenge: challenge,\n expectedOrigin: ctx.origin,\n expectedRPID: ctx.rpId,\n requireUserVerification: false,\n });\n\n if (!verification.verified || !verification.registrationInfo) {\n return null;\n }\n\n const { credential } = verification.registrationInfo;\n\n return {\n rp_id: ctx.rpId,\n credential_id: credential.id,\n public_key: isoBase64URL.fromBuffer(credential.publicKey),\n counter: credential.counter,\n transports: credential.transports,\n };\n}\n\nexport async function buildWebauthnAuthenticationOptions(\n ctx: WebauthnContext,\n credentials: WebauthnCredentialRef[],\n): Promise<{ options: Record<string, unknown>, challenge: string }> {\n const options = await generateAuthenticationOptions({\n rpID: ctx.rpId,\n userVerification: 'preferred',\n allowCredentials: credentials.map((credential) => ({\n id: credential.id,\n transports: asTransports(credential.transports),\n })),\n });\n\n return {\n options: asOpaqueOptions(options),\n challenge: options.challenge,\n };\n}\n\nexport async function verifyWebauthnAuthentication(\n ctx: WebauthnContext,\n response: AuthenticationResponseJSON,\n challenge: string,\n credential: UserAuthenticatorWebauthnParameters,\n): Promise<{ verified: boolean, newCounter: number }> {\n const verification = await verifyAuthenticationResponse({\n response,\n expectedChallenge: challenge,\n expectedOrigin: ctx.origin,\n expectedRPID: ctx.rpId,\n requireUserVerification: false,\n credential: {\n id: credential.credential_id,\n publicKey: isoBase64URL.toBuffer(credential.public_key),\n counter: credential.counter,\n transports: asTransports(credential.transports),\n },\n });\n\n return {\n verified: verification.verified,\n newCounter: verification.authenticationInfo?.newCounter ?? credential.counter,\n };\n}\n"],"mappings":";;;;;;AAuCA,SAASK,gBAAgBC,SAAe;CACpC,OAAOA;AACX;AAEA,SAASC,aAAaC,YAAqB;CACvC,OAAOA;AACX;AAEA,eAAsBC,iCAClBC,KACAC,MACAC,UAAiC;CAEjC,MAAMN,UAAU,MAAML,4BAA4B;EAC9CY,QAAQH,IAAIG;EACZC,MAAMJ,IAAIK;EACVC,QAAQ,IAAIC,YAAAA,CAAAA,CAAcC,OAAOP,KAAKQ,EAAE;EACxCC,UAAUT,KAAKU;EACfC,iBAAiB;EACjBC,oBAAoBX,SAASY,KAAKC,gBAAgB;GAC9CN,IAAIM,WAAWN;GACfX,YAAYD,aAAakB,WAAWjB,UAAU;EAClD,EAAA;EACAkB,wBAAwB;GACpBC,aAAa;GACbC,kBAAkB;EACtB;CACJ,CAAA;CAEA,OAAO;EACHtB,SAASD,gBAAgBC,OAAAA;EACzBuB,WAAWvB,QAAQuB;CACvB;AACJ;AAEA,eAAsBC,2BAClBpB,KACAqB,UACAF,WAAiB;CAEjB,MAAMG,eAAe,MAAM7B,2BAA2B;EAClD4B;EACAE,mBAAmBJ;EACnBK,gBAAgBxB,IAAIyB;EACpBC,cAAc1B,IAAIK;EAClBsB,yBAAyB;CAC7B,CAAA;CAEA,IAAI,CAACL,aAAaM,YAAY,CAACN,aAAaO,kBACxC,OAAO;CAGX,MAAM,EAAEd,eAAeO,aAAaO;CAEpC,OAAO;EACHC,OAAO9B,IAAIK;EACX0B,eAAehB,WAAWN;EAC1BuB,YAAYtC,aAAauC,WAAWlB,WAAWmB,SAAS;EACxDC,SAASpB,WAAWoB;EACpBrC,YAAYiB,WAAWjB;CAC3B;AACJ;AAEA,eAAsBsC,mCAClBpC,KACAqC,aAAoC;CAEpC,MAAMzC,UAAU,MAAMN,8BAA8B;EAChDc,MAAMJ,IAAIK;EACVa,kBAAkB;EAClBoB,kBAAkBD,YAAYvB,KAAKC,gBAAgB;GAC/CN,IAAIM,WAAWN;GACfX,YAAYD,aAAakB,WAAWjB,UAAU;EAClD,EAAA;CACJ,CAAA;CAEA,OAAO;EACHF,SAASD,gBAAgBC,OAAAA;EACzBuB,WAAWvB,QAAQuB;CACvB;AACJ;AAEA,eAAsBoB,6BAClBvC,KACAqB,UACAF,WACAJ,YAA+C;CAE/C,MAAMO,eAAe,MAAM9B,6BAA6B;EACpD6B;EACAE,mBAAmBJ;EACnBK,gBAAgBxB,IAAIyB;EACpBC,cAAc1B,IAAIK;EAClBsB,yBAAyB;EACzBZ,YAAY;GACRN,IAAIM,WAAWgB;GACfG,WAAWxC,aAAa8C,SAASzB,WAAWiB,UAAU;GACtDG,SAASpB,WAAWoB;GACpBrC,YAAYD,aAAakB,WAAWjB,UAAU;EAClD;CACJ,CAAA;CAEA,OAAO;EACH8B,UAAUN,aAAaM;EACvBa,YAAYnB,aAAaoB,oBAAoBD,cAAc1B,WAAWoB;CAC1E;AACJ"}

package/dist/core/entities/user-permission/index.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
 export * from './service.ts';
 export * from './types.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/user-permission/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/user-permission/index.mjs CHANGED Viewed

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { userPermissionSchema } from "./schema.mjs";
 import { UserPermissionService } from "./service.mjs";
-export { UserPermissionService };
+export { UserPermissionService, userPermissionSchema };

package/dist/core/entities/user-permission/schema.d.ts ADDED Viewed

@@ -0,0 +1,3 @@
+import type { UserPermission } from '@authup/core-kit';
+export declare const userPermissionSchema: import("@rapiq/core").Schema<UserPermission, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/user-permission/schema.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-permission/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAMvD,eAAO,MAAM,oBAAoB,mDAqB/B,CAAC"}