@better-forge/auth 0.0.0-stage → 0.1.1

package/dist/tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.d.ts","sourceRoot":"","sources":["../src/tables.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAchB,CAAA;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWvB,CAAA;AAEF,2HAA2H;AAC3H,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWpB,CAAA;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAavB,CAAA"}

package/dist/tables.js

@@ -0,0 +1,56 @@
+import { sqliteTable, integer, text } from 'drizzle-orm/sqlite-core';
+export const users = sqliteTable('users', {
+    id: integer('id').primaryKey({ autoIncrement: true }),
+    email: text('email').notNull().unique(),
+    passwordHash: text('password_hash').notNull(),
+    role: text('role').notNull().default('admin'),
+    createdAt: integer('created_at').notNull(),
+    // Additive columns (added via ALTER TABLE, must stay at end for sqlite-proxy position mapping)
+    mustChangePassword: integer('must_change_password').notNull().default(0),
+    totpSecret: text('totp_secret'),
+    totpEnabled: integer('totp_enabled').notNull().default(0),
+    totpRecoveryCodes: text('totp_recovery_codes'),
+    // SSO identity bound on the first OIDC sign-in; later sign-ins match on it instead of the email.
+    oidcIssuer: text('oidc_issuer'),
+    oidcSubject: text('oidc_subject'),
+});
+export const authSessions = sqliteTable('auth_sessions', {
+    id: text('id').primaryKey(),
+    userId: integer('user_id').notNull(),
+    csrfTokenHash: text('csrf_token_hash').notNull(),
+    createdAt: integer('created_at').notNull(),
+    lastSeenAt: integer('last_seen_at').notNull(),
+    expiresAt: integer('expires_at').notNull(),
+    // 'password' or 'oidc'. An SSO session never asks for the temporary password to be changed.
+    authMethod: text('auth_method').notNull().default('password'),
+    // When the user last proved who they are in this session: the sign-in, or a later SSO confirmation.
+    verifiedAt: integer('verified_at'),
+});
+/** Long-lived bearer credentials for scripts and CI. Only the SHA-256 of the token is stored; revoking deletes the row. */
+export const apiTokens = sqliteTable('api_tokens', {
+    id: integer('id').primaryKey({ autoIncrement: true }),
+    name: text('name').notNull(),
+    tokenHash: text('token_hash').notNull().unique(),
+    /** Leading characters of the token, so it can be recognised in the list. */
+    prefix: text('prefix').notNull(),
+    createdAt: integer('created_at').notNull(),
+    expiresAt: integer('expires_at'),
+    lastUsedAt: integer('last_used_at'),
+    /** JSON list of what the token may do, e.g. `["notes:write","tags:read"]` (the permissions are defined by the application). */
+    scopes: text('scopes').notNull(),
+});
+export const oidcSettings = sqliteTable('oidc_settings', {
+    id: integer('id').primaryKey(),
+    enabled: integer('enabled').notNull().default(0),
+    issuer: text('issuer').notNull().default(''),
+    clientId: text('client_id').notNull().default(''),
+    /** Stored encrypted by the application's secret box; empty when no secret is set. */
+    clientSecret: text('client_secret').notNull().default(''),
+    scopes: text('scopes').notNull().default(''),
+    redirectUri: text('redirect_uri').notNull().default(''),
+    buttonLabel: text('button_label').notNull().default(''),
+    allowUnverifiedEmail: integer('allow_unverified_email').notNull().default(0),
+    disablePasswordLogin: integer('disable_password_login').notNull().default(0),
+    updatedAt: integer('updated_at').notNull(),
+});
+//# sourceMappingURL=tables.js.map

package/dist/tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.js","sourceRoot":"","sources":["../src/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AAEpE,MAAM,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE;IACxC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACrD,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACvC,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAC7C,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,+FAA+F;IAC/F,kBAAkB,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC;IAC9C,iGAAiG;IACjG,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;CAClC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC,eAAe,EAAE;IACvD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACpC,aAAa,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IAChD,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,UAAU,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC7C,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,4FAA4F;IAC5F,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;IAC7D,oGAAoG;IACpG,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC;CACnC,CAAC,CAAA;AAEF,2HAA2H;AAC3H,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC,YAAY,EAAE;IACjD,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAChD,4EAA4E;IAC5E,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC;IAChC,UAAU,EAAE,OAAO,CAAC,cAAc,CAAC;IACnC,+HAA+H;IAC/H,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC,eAAe,EAAE;IACvD,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC9B,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,qFAAqF;IACrF,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,oBAAoB,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,oBAAoB,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CAC3C,CAAC,CAAA"}

package/dist/tokenCatalogue.d.ts

@@ -0,0 +1,21 @@
+import type { TokenPreset, TokenResource } from '@better-forge/contracts';
+export interface TokenCatalogue {
+    /** Every permission a token can hold, in the order they are listed: `<part>:read`, `<part>:write`, then the extra ones. */
+    readonly scopes: readonly string[];
+    readonly resources: readonly TokenResource[];
+    readonly presets: readonly TokenPreset[];
+    /** A clean list of known permissions (reading added wherever writing is granted), or null if one is unknown or none is given. */
+    normalize(input: unknown): string[] | null;
+    /** The permissions stored with a token. Anything that is not a known permission is dropped. */
+    parse(stored: string): string[];
+}
+/**
+ * The permissions an API token can be given. A part is a group of routes (`belongsTo(scope, part)` ties routes to
+ * it); `extraScopes` are single permissions that belong to no part, such as the one to use vault secrets.
+ */
+export declare function createTokenCatalogue(options: {
+    resources: readonly TokenResource[];
+    extraScopes?: readonly string[];
+    presets?: (scopes: readonly string[]) => readonly TokenPreset[];
+}): TokenCatalogue;
+//# sourceMappingURL=tokenCatalogue.d.ts.map

package/dist/tokenCatalogue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenCatalogue.d.ts","sourceRoot":"","sources":["../src/tokenCatalogue.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAGzE,MAAM,WAAW,cAAc;IAC7B,2HAA2H;IAC3H,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAA;IAC5C,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAA;IACxC,iIAAiI;IACjI,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAAA;IAC1C,+FAA+F;IAC/F,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAChC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAC5C,SAAS,EAAE,SAAS,aAAa,EAAE,CAAA;IACnC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,KAAK,SAAS,WAAW,EAAE,CAAA;CAChE,GAAG,cAAc,CAmBjB"}

package/dist/tokenCatalogue.js

@@ -0,0 +1,27 @@
+import { VAULT_USE_SCOPE, normalizeScopes } from '@better-forge/contracts';
+/**
+ * The permissions an API token can be given. A part is a group of routes (`belongsTo(scope, part)` ties routes to
+ * it); `extraScopes` are single permissions that belong to no part, such as the one to use vault secrets.
+ */
+export function createTokenCatalogue(options) {
+    const scopes = [
+        ...options.resources.flatMap((resource) => resource.levels.map((level) => `${resource.key}:${level}`)),
+        ...(options.extraScopes ?? [VAULT_USE_SCOPE]),
+    ];
+    return {
+        scopes,
+        resources: options.resources,
+        presets: options.presets?.(scopes) ?? [],
+        normalize: (input) => normalizeScopes(input, scopes),
+        parse(stored) {
+            try {
+                const parsed = JSON.parse(stored);
+                return Array.isArray(parsed) ? parsed.filter((scope) => typeof scope === 'string' && scopes.includes(scope)) : [];
+            }
+            catch {
+                return [];
+            }
+        },
+    };
+}
+//# sourceMappingURL=tokenCatalogue.js.map

package/dist/tokenCatalogue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenCatalogue.js","sourceRoot":"","sources":["../src/tokenCatalogue.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAa1E;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAIpC;IACC,MAAM,MAAM,GAAG;QACb,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QACtG,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,eAAe,CAAC,CAAC;KAC9C,CAAA;IACD,OAAO;QACL,MAAM;QACN,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE;QACxC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC;QACpD,KAAK,CAAC,MAAM;YACV,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gBAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YACpI,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAA;YACX,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/totp.d.ts

@@ -0,0 +1,12 @@
+export declare function generateTotpSecret(): string;
+export declare function verifyTotp(secret: string, input: string, now?: number): boolean;
+export declare function generateTotpCode(secret: string, now?: number): string;
+/** The `otpauth://` URI an authenticator app scans; `issuer` is the name it shows next to the account. */
+export declare function totpUri(secret: string, email: string, issuer: string): string;
+export declare function generateRecoveryCodes(): string[];
+export declare function hashRecoveryCode(code: string): string;
+export declare function consumeRecoveryCode(storedJson: string | null, input: string): {
+    valid: boolean;
+    remaining: string[];
+};
+//# sourceMappingURL=totp.d.ts.map

package/dist/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../src/totp.ts"],"names":[],"mappings":"AAyDA,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,OAAO,CAInF;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,MAAM,CAEzE;AAED,0GAA0G;AAC1G,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAG7E;AAED,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAKhD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAOrH"}

package/dist/totp.js

@@ -0,0 +1,93 @@
+import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+const ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+const PERIOD_SECONDS = 30;
+const DIGITS = 6;
+function encodeBase32(input) {
+    let bits = 0;
+    let value = 0;
+    let output = '';
+    for (const byte of input) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            output += ALPHABET[(value >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0)
+        output += ALPHABET[(value << (5 - bits)) & 31];
+    return output;
+}
+function decodeBase32(input) {
+    let bits = 0;
+    let value = 0;
+    const bytes = [];
+    for (const character of input.toUpperCase().replace(/=|\s|-/g, '')) {
+        const index = ALPHABET.indexOf(character);
+        if (index < 0)
+            throw new Error('Invalid base32 secret');
+        value = (value << 5) | index;
+        bits += 5;
+        if (bits >= 8) {
+            bytes.push((value >>> (bits - 8)) & 255);
+            bits -= 8;
+        }
+    }
+    return Buffer.from(bytes);
+}
+function codeAt(secret, counter) {
+    const buffer = Buffer.alloc(8);
+    buffer.writeBigUInt64BE(BigInt(counter));
+    const digest = createHmac('sha1', decodeBase32(secret)).update(buffer).digest();
+    const offset = digest[digest.length - 1] & 0x0f;
+    const binary = ((digest[offset] & 0x7f) << 24)
+        | ((digest[offset + 1] & 0xff) << 16)
+        | ((digest[offset + 2] & 0xff) << 8)
+        | (digest[offset + 3] & 0xff);
+    return String(binary % (10 ** DIGITS)).padStart(DIGITS, '0');
+}
+function safeEqual(left, right) {
+    const a = Buffer.from(left);
+    const b = Buffer.from(right);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+export function generateTotpSecret() {
+    return encodeBase32(randomBytes(20));
+}
+export function verifyTotp(secret, input, now = Date.now()) {
+    const normalized = input.replace(/\s/g, '');
+    const counter = Math.floor(now / 1000 / PERIOD_SECONDS);
+    return [-1, 0, 1].some((offset) => safeEqual(codeAt(secret, counter + offset), normalized));
+}
+export function generateTotpCode(secret, now = Date.now()) {
+    return codeAt(secret, Math.floor(now / 1000 / PERIOD_SECONDS));
+}
+/** The `otpauth://` URI an authenticator app scans; `issuer` is the name it shows next to the account. */
+export function totpUri(secret, email, issuer) {
+    const label = `${issuer}:${email}`;
+    return `otpauth://totp/${encodeURIComponent(label)}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=${DIGITS}&period=${PERIOD_SECONDS}`;
+}
+export function generateRecoveryCodes() {
+    return Array.from({ length: 8 }, () => {
+        const value = randomBytes(10).toString('hex').toUpperCase();
+        return value.match(/.{1,5}/g).join('-');
+    });
+}
+export function hashRecoveryCode(code) {
+    return createHash('sha256').update(code.replace(/\s|-/g, '').toUpperCase()).digest('hex');
+}
+export function consumeRecoveryCode(storedJson, input) {
+    let stored;
+    try {
+        stored = JSON.parse(storedJson ?? '[]');
+    }
+    catch {
+        return { valid: false, remaining: [] };
+    }
+    const candidate = hashRecoveryCode(input);
+    const index = stored.findIndex((hash) => safeEqual(hash, candidate));
+    if (index < 0)
+        return { valid: false, remaining: stored };
+    return { valid: true, remaining: stored.filter((_, itemIndex) => itemIndex !== index) };
+}
+//# sourceMappingURL=totp.js.map

package/dist/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../src/totp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElF,MAAM,QAAQ,GAAG,kCAAkC,CAAA;AACnD,MAAM,cAAc,GAAG,EAAE,CAAA;AACzB,MAAM,MAAM,GAAG,CAAC,CAAA;AAEhB,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;QAC3B,IAAI,IAAI,CAAC,CAAA;QACT,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,QAAQ,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;YAC/C,IAAI,IAAI,CAAC,CAAA;QACX,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;IAC5D,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACzC,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;QACvD,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAA;QAC5B,IAAI,IAAI,CAAC,CAAA;QACT,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAA;YACxC,IAAI,IAAI,CAAC,CAAA;QACX,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,OAAe;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC9B,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAA;IAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAA;IAChD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;UAC3C,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;UACpC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;UACnC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,CAAA;IAChC,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AACvD,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,KAAa,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACxE,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,GAAG,cAAc,CAAC,CAAA;IACvD,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,CAAA;AAC7F,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC/D,OAAO,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,GAAG,cAAc,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,OAAO,CAAC,MAAc,EAAE,KAAa,EAAE,MAAc;IACnE,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,KAAK,EAAE,CAAA;IAClC,OAAO,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,WAAW,MAAM,WAAW,kBAAkB,CAAC,MAAM,CAAC,0BAA0B,MAAM,WAAW,cAAc,EAAE,CAAA;AACrK,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE;QACpC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;QAC3D,OAAO,KAAK,CAAC,KAAK,CAAC,SAAS,CAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,UAAyB,EAAE,KAAa;IAC1E,IAAI,MAAgB,CAAA;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAa,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;IAAC,CAAC;IAC5G,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAA;IACpE,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IACzD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,CAAA;AACzF,CAAC"}

package/dist/twoFactor.d.ts

@@ -0,0 +1,10 @@
+import { users } from './tables.js';
+import type { AuthOptions } from './context.js';
+type TwoFactorUser = Pick<typeof users.$inferSelect, 'id' | 'totpEnabled' | 'totpSecret' | 'totpRecoveryCodes'>;
+export declare function createTwoFactor(ctx: AuthOptions): {
+    verifySecondFactor: (user: TwoFactorUser, code: string) => Promise<boolean>;
+    resetTwoFactor: (userId: number) => Promise<boolean>;
+};
+export type TwoFactor = ReturnType<typeof createTwoFactor>;
+export {};
+//# sourceMappingURL=twoFactor.d.ts.map

package/dist/twoFactor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"twoFactor.d.ts","sourceRoot":"","sources":["../src/twoFactor.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,KAAK,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,KAAK,aAAa,GAAG,IAAI,CAAC,OAAO,KAAK,CAAC,YAAY,EAAE,IAAI,GAAG,aAAa,GAAG,YAAY,GAAG,mBAAmB,CAAC,CAAA;AAE/G,wBAAgB,eAAe,CAAC,GAAG,EAAE,WAAW;+BAON,aAAa,QAAQ,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC;6BAgBhD,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC;EAehE;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAA"}

package/dist/twoFactor.js

@@ -0,0 +1,43 @@
+import { and, eq } from 'drizzle-orm';
+import { withImmediateTransaction } from '@better-forge/db';
+import { consumeRecoveryCode, verifyTotp } from './totp.js';
+import { authSessions, users } from './tables.js';
+export function createTwoFactor(ctx) {
+    const { db, sqlite, secretBox } = ctx;
+    /**
+     * Verify a TOTP or consume a recovery code. Recovery-code persistence uses a
+     * compare-and-swap update so the same code cannot win in concurrent requests.
+     */
+    async function verifySecondFactor(user, code) {
+        if (!user.totpEnabled || !user.totpSecret)
+            return false;
+        if (verifyTotp(secretBox.decrypt(user.totpSecret), code))
+            return true;
+        const storedCodes = user.totpRecoveryCodes;
+        const recovery = consumeRecoveryCode(storedCodes, code);
+        if (!storedCodes || !recovery.valid)
+            return false;
+        const updated = await db.update(users)
+            .set({ totpRecoveryCodes: JSON.stringify(recovery.remaining) })
+            .where(and(eq(users.id, user.id), eq(users.totpRecoveryCodes, storedCodes)))
+            .returning({ id: users.id });
+        return updated.length === 1;
+    }
+    /** Clear 2FA credentials and revoke every active session for the user. */
+    async function resetTwoFactor(userId) {
+        return withImmediateTransaction(sqlite, async () => {
+            const updated = await db.update(users).set({
+                totpSecret: null,
+                totpEnabled: 0,
+                totpRecoveryCodes: null,
+            }).where(and(eq(users.id, userId), eq(users.totpEnabled, 1)))
+                .returning({ id: users.id });
+            if (updated.length !== 1)
+                return false;
+            await db.delete(authSessions).where(eq(authSessions.userId, userId));
+            return true;
+        });
+    }
+    return { verifySecondFactor, resetTwoFactor };
+}
+//# sourceMappingURL=twoFactor.js.map

package/dist/twoFactor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"twoFactor.js","sourceRoot":"","sources":["../src/twoFactor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAKjD,MAAM,UAAU,eAAe,CAAC,GAAgB;IAC9C,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAA;IAErC;;;OAGG;IACH,KAAK,UAAU,kBAAkB,CAAC,IAAmB,EAAE,IAAY;QACjE,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAA;QACvD,IAAI,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAErE,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAA;QAC1C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QACvD,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,OAAO,KAAK,CAAA;QAEjD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;aACnC,GAAG,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;aAC9D,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC,CAAC;aAC3E,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QAC9B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAA;IAC7B,CAAC;IAED,0EAA0E;IAC1E,KAAK,UAAU,cAAc,CAAC,MAAc;QAC1C,OAAO,wBAAwB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;gBACzC,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,CAAC;gBACd,iBAAiB,EAAE,IAAI;aACxB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;iBAC1D,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;YAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;YACtC,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;YACpE,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,CAAA;AAC/C,CAAC"}

package/dist/userRoutes.d.ts

@@ -0,0 +1,13 @@
+import type { FastifyInstance } from 'fastify';
+import type { AuthOptions } from './context.js';
+import type { Sessions } from './sessions.js';
+import type { TwoFactor } from './twoFactor.js';
+import type { IdentityConfirmation } from './identityConfirmation.js';
+export declare function createUserRoutes(ctx: AuthOptions, parts: {
+    sessions: Sessions;
+    twoFactor: TwoFactor;
+    identityConfirmation: IdentityConfirmation;
+}): {
+    userRoutes: (app: FastifyInstance) => Promise<void>;
+};
+//# sourceMappingURL=userRoutes.d.ts.map

package/dist/userRoutes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userRoutes.d.ts","sourceRoot":"","sources":["../src/userRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAM9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AASrE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,SAAS,CAAC;IAAC,oBAAoB,EAAE,oBAAoB,CAAA;CAAE;sBASjH,eAAe;EAoH/C"}

package/dist/userRoutes.js

@@ -0,0 +1,135 @@
+import bcrypt from 'bcryptjs';
+import { randomInt } from 'node:crypto';
+import { eq } from 'drizzle-orm';
+import { users } from './tables.js';
+import { requestIdentity } from './middleware.js';
+function generateTempPassword() {
+    const chars = 'ABCDEFGHJKMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz23456789';
+    let result = '';
+    for (let i = 0; i < 12; i++)
+        result += chars[randomInt(chars.length)];
+    return result;
+}
+export function createUserRoutes(ctx, parts) {
+    const { db, roles, audit } = ctx;
+    const { revokeUserSessions } = parts.sessions;
+    const { resetTwoFactor } = parts.twoFactor;
+    const { confirmIdentity } = parts.identityConfirmation;
+    // These routes act on accounts and sign-ins, so a hijacked session alone must not be enough.
+    const sensitive = { config: { rateLimit: ctx.rateLimits.sensitiveAction } };
+    async function userRoutes(app) {
+        app.get('/', async () => {
+            const all = await db.select({
+                id: users.id,
+                email: users.email,
+                role: users.role,
+                mustChangePassword: users.mustChangePassword,
+                twoFactorEnabled: users.totpEnabled,
+                oidcIssuer: users.oidcIssuer,
+                createdAt: users.createdAt,
+            }).from(users);
+            return all.map(({ mustChangePassword, oidcIssuer, ...u }) => ({
+                ...u,
+                role: roles.normalize(u.role),
+                ssoLinked: !!oidcIssuer,
+                // An SSO sign-in revokes the temporary password, so the flag alone is accurate.
+                pendingTemporaryPassword: !!mustChangePassword,
+            }));
+        });
+        app.post('/', sensitive, async (req, reply) => {
+            const { email, role = roles.defaultForNewUsers } = req.body;
+            if (!email)
+                return reply.code(400).send({ error: 'Email is required' });
+            if (!roles.isValid(role))
+                return reply.code(400).send({ error: 'Invalid role' });
+            const actor = requestIdentity(req);
+            if (!await confirmIdentity(actor, req.body.currentPassword, reply))
+                return reply;
+            const existing = await db.select().from(users).where(eq(users.email, email));
+            if (existing.length > 0)
+                return reply.code(409).send({ error: 'User with this email already exists' });
+            const temporaryPassword = generateTempPassword();
+            const hash = await bcrypt.hash(temporaryPassword, 10);
+            const result = await db.insert(users).values({
+                email, passwordHash: hash, role, mustChangePassword: 1, createdAt: Date.now(),
+            }).returning({ id: users.id, email: users.email, role: users.role, createdAt: users.createdAt });
+            audit.write(audit.actor(actor), 'create', 'user', result[0].id, email, audit.snapshot({ email, role }));
+            return { ...result[0], temporaryPassword };
+        });
+        app.patch('/:id/role', sensitive, async (req, reply) => {
+            const id = Number(req.params.id);
+            const jwt = requestIdentity(req);
+            if (jwt.userId === id)
+                return reply.code(400).send({ error: 'Cannot change your own role' });
+            if (!roles.isValid(req.body.role)) {
+                return reply.code(400).send({ error: 'Invalid role' });
+            }
+            if (!await confirmIdentity(jwt, req.body.currentPassword, reply))
+                return reply;
+            const existing = (await db.select().from(users).where(eq(users.id, id)))[0];
+            const result = await db.update(users).set({ role: req.body.role }).where(eq(users.id, id))
+                .returning({ id: users.id, role: users.role });
+            if (!result.length)
+                return reply.code(404).send({ error: 'User not found' });
+            if (existing) {
+                await revokeUserSessions(id);
+                const actor = requestIdentity(req);
+                audit.write(audit.actor(actor), 'update', 'user', id, existing.email, { role: { from: existing.role, to: req.body.role } });
+            }
+            return result[0];
+        });
+        app.post('/:id/reset-password', sensitive, async (req, reply) => {
+            const id = Number(req.params.id);
+            const actor = requestIdentity(req);
+            if (!await confirmIdentity(actor, req.body?.currentPassword, reply))
+                return reply;
+            const user = (await db.select().from(users).where(eq(users.id, id)))[0];
+            if (!user)
+                return reply.code(404).send({ error: 'User not found' });
+            const temporaryPassword = generateTempPassword();
+            const hash = await bcrypt.hash(temporaryPassword, 10);
+            await db.update(users).set({
+                passwordHash: hash,
+                mustChangePassword: 1,
+            }).where(eq(users.id, id));
+            await revokeUserSessions(id);
+            audit.write(audit.actor(actor), 'update', 'user', id, user.email, { action: 'password_reset' });
+            return { temporaryPassword };
+        });
+        app.post('/:id/reset-2fa', sensitive, async (req, reply) => {
+            const id = Number(req.params.id);
+            const actor = requestIdentity(req);
+            if (!Number.isInteger(id))
+                return reply.code(400).send({ error: 'Invalid user ID' });
+            if (actor.userId === id) {
+                return reply.code(400).send({ error: 'Use account settings to disable your own two-factor authentication' });
+            }
+            if (!await confirmIdentity(actor, req.body?.currentPassword, reply))
+                return reply;
+            const target = (await db.select().from(users).where(eq(users.id, id)))[0];
+            if (!target)
+                return reply.code(404).send({ error: 'User not found' });
+            if (!target.totpEnabled)
+                return reply.code(409).send({ error: 'Two-factor authentication is not enabled for this user' });
+            if (!await resetTwoFactor(id))
+                return reply.code(409).send({ error: 'Two-factor authentication is already disabled' });
+            await audit.write(audit.actor(actor), 'update', 'user-security', id, target.email, { twoFactorReset: { from: true, to: false }, method: 'admin_recovery' });
+            return { twoFactorEnabled: false };
+        });
+        app.delete('/:id', async (req, reply) => {
+            const id = Number(req.params.id);
+            const actor = requestIdentity(req);
+            if (actor.userId === id)
+                return reply.code(400).send({ error: 'Cannot delete your own account' });
+            const existing = (await db.select().from(users).where(eq(users.id, id)))[0];
+            await revokeUserSessions(id);
+            await db.delete(users).where(eq(users.id, id));
+            if (existing) {
+                audit.write(audit.actor(actor), 'delete', 'user', id, existing.email, audit.snapshot({ email: existing.email, role: existing.role }));
+            }
+            return { success: true };
+        });
+    }
+    return { userRoutes };
+}
+//# sourceMappingURL=userRoutes.js.map

package/dist/userRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userRoutes.js","sourceRoot":"","sources":["../src/userRoutes.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,UAAU,CAAA;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAMjD,SAAS,oBAAoB;IAC3B,MAAM,KAAK,GAAG,wDAAwD,CAAA;IACtE,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;IACrE,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAgB,EAAE,KAA+F;IAChJ,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,GAAG,CAAA;IAChC,MAAM,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAA;IAC7C,MAAM,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC,SAAS,CAAA;IAC1C,MAAM,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC,oBAAoB,CAAA;IAEtD,6FAA6F;IAC7F,MAAM,SAAS,GAAG,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,eAAe,EAAE,EAAE,CAAA;IAE3E,KAAK,UAAU,UAAU,CAAC,GAAoB;QAC5C,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;YACtB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;gBAC1B,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;gBAC5C,gBAAgB,EAAE,KAAK,CAAC,WAAW;gBACnC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACd,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC5D,GAAG,CAAC;gBACJ,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC7B,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,gFAAgF;gBAChF,wBAAwB,EAAE,CAAC,CAAC,kBAAkB;aAC/C,CAAC,CAAC,CAAA;QACL,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,IAAI,CAAuE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAClH,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,KAAK,CAAC,kBAAkB,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAC3D,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;YACvE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;YAChF,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,IAAI,CAAC,MAAM,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;YAChF,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;YAC5E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAA;YACtG,MAAM,iBAAiB,GAAG,oBAAoB,EAAE,CAAA;YAChD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAA;YACrD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;gBAC3C,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aAC9E,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAA;YAChG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE,KAAK,EACpE,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAClC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAA;QAC5C,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,KAAK,CAA+E,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACnI,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YAChC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAA;YAC5F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;YACxD,CAAC;YACD,IAAI,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;YAC9E,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC3E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;iBACvF,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;YAChD,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;YAC5E,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAA;gBAC5B,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;gBAClC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,KAAK,EAClE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YACzD,CAAC;YACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAA;QAClB,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,IAAI,CAAiE,qBAAqB,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC9H,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,IAAI,CAAC,MAAM,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;YACjF,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACvE,IAAI,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;YACnE,MAAM,iBAAiB,GAAG,oBAAoB,EAAE,CAAA;YAChD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAA;YACrD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;gBACzB,YAAY,EAAE,IAAI;gBAClB,kBAAkB,EAAE,CAAC;aACtB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;YAC1B,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAA;YAC5B,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAC9D,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAA;YAC/B,OAAO,EAAE,iBAAiB,EAAE,CAAA;QAC9B,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,IAAI,CAAgE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACxH,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAA;YACpF,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oEAAoE,EAAE,CAAC,CAAA;YAC9G,CAAC;YAED,IAAI,CAAC,MAAM,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;YAEjF,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACzE,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;YACrE,IAAI,CAAC,MAAM,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC,CAAA;YACzH,IAAI,CAAC,MAAM,cAAc,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAA;YAEtH,MAAM,KAAK,CAAC,KAAK,CACf,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAClB,QAAQ,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,EAC3C,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CACxE,CAAA;YACD,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAA;QACpC,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,MAAM,CAA6B,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAClE,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAA;YACjG,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC3E,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAA;YAC5B,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;YAC9C,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,KAAK,EAClE,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;YACnE,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAC1B,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,CAAA;AACvB,CAAC"}

package/package.json

@@ -1,6 +1,68 @@
 {
   "name": "@better-forge/auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "Users, sessions, 2FA, SSO/OIDC, roles, API tokens and sign-in routes.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/BElluu/Better-Forge.git",
+    "directory": "packages/auth"
+  },
+  "homepage": "https://github.com/BElluu/Better-Forge/tree/main/packages/auth#readme",
+  "bugs": {
+    "url": "https://github.com/BElluu/Better-Forge/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "src",
+    "!src/**/*.test.*"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsc -p tsconfig.json --watch --preserveWatchOutput"
+  },
+  "peerDependencies": {
+    "@fastify/cookie": "^11.1.1",
+    "@fastify/jwt": "^10.1.0",
+    "bcryptjs": "^3.0.2",
+    "drizzle-orm": "^0.45.2",
+    "fastify": "^5.3.2",
+    "openid-client": "^6.8.8",
+    "qrcode": "^1.5.4",
+    "@fastify/rate-limit": "^10.3.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.2",
+    "@types/qrcode": "^1.5.6",
+    "@fastify/cookie": "^11.1.1",
+    "@fastify/jwt": "^10.1.0",
+    "bcryptjs": "^3.0.2",
+    "drizzle-orm": "^0.45.2",
+    "fastify": "^5.3.2",
+    "openid-client": "^6.8.8",
+    "qrcode": "^1.5.4",
+    "typescript": "^5.7.3",
+    "@fastify/rate-limit": "^10.3.0"
+  },
+  "dependencies": {
+    "@better-forge/audit": "0.1.1",
+    "@better-forge/contracts": "0.1.1",
+    "@better-forge/db": "0.1.1"
+  },
+  "engines": {
+    "node": ">=26.10.0"
+  }
+}