@bike4mind/cli 0.18.4 → 0.20.0

package/dist/ProxyManager-ByuAHFMq.mjs

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import { t as ProxyManager } from "./ProxyManager-CV94yZUW.mjs";
-export { ProxyManager };

package/dist/store-DgzCTRkN.mjs

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import { n as useCliStore } from "./store-DV5s-qni.mjs";
-export { useCliStore };

package/dist/utils-Cdktpk_k.mjs

@@ -1,158 +0,0 @@
-#!/usr/bin/env node
-import { createHash, timingSafeEqual } from "crypto";
-import speakeasy from "speakeasy";
-import QRCode from "qrcode";
-//#region ../../b4m-core/auth/dist/mfaService/utils.mjs
-const originalEmitWarning = process.emitWarning;
-process.emitWarning = (warning, name) => {
-	if (name === "DeprecationWarning" && warning?.toString().includes("Buffer")) return;
-	return originalEmitWarning.call(process, warning, name);
-};
-process.emitWarning = originalEmitWarning;
-/**
-* Generate TOTP setup data including secret and QR code
-* Using the same implementation as polaris
-*/
-async function generateTOTPSetup(userEmail, appName = process.env.APP_NAME || "") {
-	const secret = speakeasy.generateSecret({ name: appName ? `${appName} (${userEmail})` : userEmail });
-	const qrCodeUrl = await QRCode.toDataURL(secret.otpauth_url);
-	return {
-		secret: secret.base32,
-		qrCodeUrl,
-		manualEntryKey: secret.base32
-	};
-}
-/**
-* Verify a TOTP token against a secret
-* Using industry-standard window to handle minor clock drift
-*/
-function verifyTOTPToken(secret, token, window = 1) {
-	return speakeasy.totp.verify({
-		secret,
-		encoding: "base32",
-		token,
-		window
-	});
-}
-/**
-* Hash a backup code for at-rest storage.
-* Codes are high-entropy random strings (speakeasy base32, ~50 bits), so a
-* fast SHA-256 is appropriate — no dictionary attack risk, and the migration
-* backfill over thousands of users stays instantaneous.
-*/
-function hashBackupCode(code) {
-	return createHash("sha256").update(code.trim().toUpperCase()).digest("hex");
-}
-/**
-* Generate cryptographically secure backup codes for MFA.
-* Returns plaintext codes for display to the user; callers are responsible for
-* hashing them (via hashBackupCode) before storing in the database.
-*/
-function generateBackupCodes(count = 10) {
-	return Array.from({ length: count }, () => {
-		return speakeasy.generateSecret({ length: 20 }).base32.substring(0, 10).toUpperCase();
-	});
-}
-/**
-* Verify a backup code against stored hashes.
-* Hashes the provided code and compares against stored SHA-256 hashes using
-* constant-time comparison to prevent timing attacks.
-*/
-function verifyBackupCode(userBackupCodes, providedCode) {
-	if (!userBackupCodes || !providedCode) return { isValid: false };
-	const providedHash = hashBackupCode(providedCode);
-	const providedBuf = Buffer.from(providedHash, "utf8");
-	let matchIdx = -1;
-	for (let i = 0; i < userBackupCodes.length; i++) {
-		const storedBuf = Buffer.from(userBackupCodes[i], "utf8");
-		if (storedBuf.length === providedBuf.length && timingSafeEqual(storedBuf, providedBuf)) {
-			matchIdx = i;
-			break;
-		}
-	}
-	if (matchIdx !== -1) return {
-		isValid: true,
-		usedBackupCode: userBackupCodes[matchIdx]
-	};
-	return { isValid: false };
-}
-/**
-* Check if a user requires MFA based on enforcement settings
-* In lumina5, when MFA is enforced, it applies to ALL users (unlike polaris)
-*/
-function userRequiresMFA(user, enforceMFASetting) {
-	return enforceMFASetting;
-}
-/**
-* Check if a user has MFA configured
-*/
-function userHasMFAConfigured(user) {
-	return !!(user.mfa && user.mfa.totpEnabled);
-}
-/**
-* Server-side attempt tracking to prevent bypass via refresh/cancel
-* Constants for lockout policy
-*/
-const MAX_FAILED_ATTEMPTS = 3;
-const LOCKOUT_DURATION_MS = 900 * 1e3;
-const ATTEMPT_RESET_WINDOW_MS = 3600 * 1e3;
-/**
-* Check if user is currently locked out from MFA attempts
-*/
-function isUserLockedOut(user) {
-	if (!user.mfa?.lockedUntil) return false;
-	return /* @__PURE__ */ new Date() < new Date(user.mfa.lockedUntil);
-}
-/**
-* Get remaining lockout time in minutes
-*/
-function getLockoutTimeRemaining(user) {
-	if (!user.mfa?.lockedUntil) return 0;
-	const remaining = new Date(user.mfa.lockedUntil).getTime() - Date.now();
-	return Math.max(0, Math.ceil(remaining / (60 * 1e3)));
-}
-/**
-* Reset failed attempts if enough time has passed since last failure
-*/
-function shouldResetFailedAttempts(user) {
-	if (!user.mfa?.lastFailedAttempt) return false;
-	return Date.now() - new Date(user.mfa.lastFailedAttempt).getTime() > ATTEMPT_RESET_WINDOW_MS;
-}
-/**
-* Record a failed MFA attempt and return updated MFA object
-*/
-function recordFailedAttempt(user) {
-	const newAttempts = (shouldResetFailedAttempts(user) ? 0 : user.mfa?.failedAttempts || 0) + 1;
-	const now = /* @__PURE__ */ new Date();
-	const updatedMFA = { ...user.mfa };
-	updatedMFA.failedAttempts = newAttempts;
-	updatedMFA.lastFailedAttempt = now;
-	if (newAttempts >= MAX_FAILED_ATTEMPTS) updatedMFA.lockedUntil = new Date(Date.now() + LOCKOUT_DURATION_MS);
-	return updatedMFA;
-}
-/**
-* Clear failed attempts on successful verification
-*/
-function clearFailedAttempts(user) {
-	if (!user.mfa) return null;
-	const updatedMFA = { ...user.mfa };
-	updatedMFA.failedAttempts = 0;
-	updatedMFA.lastFailedAttempt = void 0;
-	updatedMFA.lockedUntil = void 0;
-	return updatedMFA;
-}
-/**
-* Check if a user is eligible to set up MFA
-*/
-function userEligibleForMFA(user) {
-	return true;
-}
-/**
-* Check if a user can disable MFA based on enforcement settings
-* In lumina5, when MFA is enforced, NO user can disable it
-*/
-function userCanDisableMFA(user, enforceMFASetting) {
-	return !enforceMFASetting;
-}
-//#endregion
-export { hashBackupCode as a, shouldResetFailedAttempts as c, userHasMFAConfigured as d, userRequiresMFA as f, getLockoutTimeRemaining as i, userCanDisableMFA as l, verifyTOTPToken as m, generateBackupCodes as n, isUserLockedOut as o, verifyBackupCode as p, generateTOTPSetup as r, recordFailedAttempt as s, clearFailedAttempts as t, userEligibleForMFA as u };

package/dist/utils-DEizxshI.mjs

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import { m as verifyTOTPToken } from "./utils-Cdktpk_k.mjs";
-export { verifyTOTPToken };