@cairs-npm/express-auth-2fa 0.1.3 → 0.1.4

package/dist/index.d.cts

@@ -209,11 +209,16 @@ declare const configSchema: z.ZodObject<{
         type?: string;
     }) => boolean | Promise<boolean>>]>>;
     /**
-     * Project-wide 2-Step Verification switch. False: password sign-in never asks for a code
-     * (whatever each user chose) and the two-step setting can't be turned on. Passwordless
-     * sign-in still sends a code — it's the only factor there.
+     * 2-Step Verification switch above each user's own choice. False: password sign-in never
+     * asks for a code and the two-step setting can't be turned on. Passwordless sign-in still
+     * sends a code — it's the only factor there. Pass a function to decide per user, e.g. from
+     * an organization setting.
      */
-    twoStepEnabled: z.ZodDefault<z.ZodBoolean>;
+    twoStepEnabled: z.ZodDefault<z.ZodUnion<[z.ZodBoolean, z.ZodType<(input: {
+        userId: string;
+    }) => boolean | Promise<boolean>, z.ZodTypeDef, (input: {
+        userId: string;
+    }) => boolean | Promise<boolean>>]>>;
     /** 2-Step Verification state for users who have not chosen one yet. */
     twoStepDefault: z.ZodDefault<z.ZodBoolean>;
     limits: z.ZodDefault<z.ZodObject<{
@@ -339,7 +344,9 @@ declare const configSchema: z.ZodObject<{
         username: string;
         type?: string;
     }) => boolean | Promise<boolean>);
-    twoStepEnabled: boolean;
+    twoStepEnabled: boolean | ((input: {
+        userId: string;
+    }) => boolean | Promise<boolean>);
     twoStepDefault: boolean;
     limits: {
         loginMaxAttempts: number;
@@ -409,7 +416,9 @@ declare const configSchema: z.ZodObject<{
         username: string;
         type?: string;
     }) => boolean | Promise<boolean>) | undefined;
-    twoStepEnabled?: boolean | undefined;
+    twoStepEnabled?: boolean | ((input: {
+        userId: string;
+    }) => boolean | Promise<boolean>) | undefined;
     twoStepDefault?: boolean | undefined;
     limits?: {
         loginMaxAttempts?: number | undefined;

package/dist/index.d.ts

@@ -209,11 +209,16 @@ declare const configSchema: z.ZodObject<{
         type?: string;
     }) => boolean | Promise<boolean>>]>>;
     /**
-     * Project-wide 2-Step Verification switch. False: password sign-in never asks for a code
-     * (whatever each user chose) and the two-step setting can't be turned on. Passwordless
-     * sign-in still sends a code — it's the only factor there.
+     * 2-Step Verification switch above each user's own choice. False: password sign-in never
+     * asks for a code and the two-step setting can't be turned on. Passwordless sign-in still
+     * sends a code — it's the only factor there. Pass a function to decide per user, e.g. from
+     * an organization setting.
      */
-    twoStepEnabled: z.ZodDefault<z.ZodBoolean>;
+    twoStepEnabled: z.ZodDefault<z.ZodUnion<[z.ZodBoolean, z.ZodType<(input: {
+        userId: string;
+    }) => boolean | Promise<boolean>, z.ZodTypeDef, (input: {
+        userId: string;
+    }) => boolean | Promise<boolean>>]>>;
     /** 2-Step Verification state for users who have not chosen one yet. */
     twoStepDefault: z.ZodDefault<z.ZodBoolean>;
     limits: z.ZodDefault<z.ZodObject<{
@@ -339,7 +344,9 @@ declare const configSchema: z.ZodObject<{
         username: string;
         type?: string;
     }) => boolean | Promise<boolean>);
-    twoStepEnabled: boolean;
+    twoStepEnabled: boolean | ((input: {
+        userId: string;
+    }) => boolean | Promise<boolean>);
     twoStepDefault: boolean;
     limits: {
         loginMaxAttempts: number;
@@ -409,7 +416,9 @@ declare const configSchema: z.ZodObject<{
         username: string;
         type?: string;
     }) => boolean | Promise<boolean>) | undefined;
-    twoStepEnabled?: boolean | undefined;
+    twoStepEnabled?: boolean | ((input: {
+        userId: string;
+    }) => boolean | Promise<boolean>) | undefined;
     twoStepDefault?: boolean | undefined;
     limits?: {
         loginMaxAttempts?: number | undefined;

package/dist/index.js

@@ -100,11 +100,15 @@ var configSchema = z.object({
     )
   ]).default(false),
   /**
-   * Project-wide 2-Step Verification switch. False: password sign-in never asks for a code
-   * (whatever each user chose) and the two-step setting can't be turned on. Passwordless
-   * sign-in still sends a code — it's the only factor there.
+   * 2-Step Verification switch above each user's own choice. False: password sign-in never
+   * asks for a code and the two-step setting can't be turned on. Passwordless sign-in still
+   * sends a code — it's the only factor there. Pass a function to decide per user, e.g. from
+   * an organization setting.
    */
-  twoStepEnabled: z.boolean().default(true),
+  twoStepEnabled: z.union([
+    z.boolean(),
+    z.custom((v) => typeof v === "function")
+  ]).default(true),
   /** 2-Step Verification state for users who have not chosen one yet. */
   twoStepDefault: z.boolean().default(false),
   limits: limitSchema.default({}),
@@ -305,6 +309,12 @@ async function migrate(db, prefix = "auth_", auditDays = 365) {
   return c;
 }
 
+// src/config/twoStep.ts
+async function twoStepAvailableFor(config, userId) {
+  const v = config.twoStepEnabled;
+  return typeof v === "function" ? Boolean(await v({ userId })) : v;
+}
+
 // src/middleware/errors.ts
 import { ZodError } from "zod";
 var ApiErrorException = class extends Error {
@@ -561,14 +571,14 @@ var MethodService = class {
     const cred = await this.cols.credentials.findOne({ userId });
     const docs = await this.cols.methods.find({ userId, status: "active" }).toArray();
     const methods = docs.sort((a, b) => Number(b.isDefault) - Number(a.isDefault) || a.createdAt.getTime() - b.createdAt.getTime()).map(toApiMethod);
-    const available = this.config.twoStepEnabled;
+    const available = await twoStepAvailableFor(this.config, userId);
     const twoStepEnabled = available && (cred?.twoStepEnabled ?? this.config.twoStepDefault);
     return { twoStepEnabled, twoStepAvailable: available, methods };
   }
   /** BR-15 — enable needs ≥1 active method; disable needs step-up + revokes trusted devices. */
   async setTwoStep(userId, sid, enabled, stepUpToken) {
     const now = this.config.clock();
-    if (enabled && !this.config.twoStepEnabled) {
+    if (enabled && !await twoStepAvailableFor(this.config, userId)) {
       throw apiError(409, "VALIDATION_ERROR", "2-Step Verification is turned off for this application.");
     }
     if (enabled) {
@@ -810,7 +820,7 @@ var AuthService = class {
       throw apiError(423, "LOCKED", "Too many attempts. Try again later.", { retryAt: cred.lockedUntil });
     }
     await this.resetFailedLogins(cred, now);
-    const twoStep = this.config.twoStepEnabled && cred.twoStepEnabled;
+    const twoStep = cred.twoStepEnabled && await twoStepAvailableFor(this.config, user.id);
     const trustedOk = twoStep && await this.checkTrustedDevice(req, user.id);
     if (!twoStep || trustedOk) {
       await this.audit.record(user.id, "login_success", ctx);