@camstack/server 1.1.52 → 1.1.53

package/dist/api/core/auth.router.js

@@ -77,6 +77,8 @@ const FinishDiscoverableAuthenticationSchema = zod_1.z.object({
     userId: zod_1.z.string().nullable(),
 });
 const RemovePasskeySchema = zod_1.z.object({ success: zod_1.z.literal(true) });
+const SecondFactorPreferenceSchema = zod_1.z.object({ enabled: zod_1.z.boolean() });
+const SetSecondFactorPreferenceSchema = zod_1.z.object({ success: zod_1.z.literal(true) });
 function proxyPasskeyProvider(proxy) {
     const call = async (method, params) => {
         const fn = proxy[method];
@@ -93,6 +95,8 @@ function proxyPasskeyProvider(proxy) {
         finishDiscoverableAuthentication: async (input) => FinishDiscoverableAuthenticationSchema.parse(await call('finishDiscoverableAuthentication', input)),
         listPasskeys: async (input) => zod_1.z.array(types_1.PasskeySummarySchema).parse(await call('listPasskeys', input)),
         removePasskey: async (input) => RemovePasskeySchema.parse(await call('removePasskey', input)),
+        getSecondFactorPreference: async (input) => SecondFactorPreferenceSchema.parse(await call('getSecondFactorPreference', input)),
+        setSecondFactorPreference: async (input) => SetSecondFactorPreferenceSchema.parse(await call('setSecondFactorPreference', input)),
     };
 }
 function resolvePasskeyProvider(registry, moleculer) {
@@ -118,6 +122,26 @@ async function userHasPasskey(userId, provider) {
         return false;
     }
 }
+/**
+ * Whether the user OPTED IN to their passkey doubling as a mandatory
+ * second factor after a password login. Enrolling a passkey alone only
+ * enables passkey-FIRST sign-in — this flag (default OFF, stored by the
+ * `user-passkeys` provider) is what re-arms the 2FA gate. Never throws:
+ * a missing provider, a provider predating the method, or a transport
+ * hiccup all read as `false` so the preference lookup can never lock a
+ * user out of the password flow.
+ */
+async function passkeySecondFactorOptedIn(userId, provider) {
+    if (!provider || typeof provider.getSecondFactorPreference !== 'function')
+        return false;
+    try {
+        const pref = await provider.getSecondFactorPreference({ userId });
+        return pref.enabled;
+    }
+    catch {
+        return false;
+    }
+}
 // ── Login-method aggregation (login-method cap) ──────────────────────
 //
 // The PUBLIC `listLoginMethods` procedure walks the `login-method`
@@ -241,7 +265,12 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
      * scopes / allowedDevices reflect any admin change made mid-flow —
      * signing from stale claims could mint a stale-scope session.
      */
-    const mintSessionForUserId = async (userId) => {
+    /**
+     * Fresh user record for `userId` via `user-management` — shared by the
+     * session-mint tail and the second-factor challenge legs (both need
+     * live identity claims, never stale ones).
+     */
+    const findUserById = async (userId) => {
         const userMgmt = registry?.getSingleton('user-management');
         if (!userMgmt) {
             throw new Error('Login unavailable — `user-management` capability not registered');
@@ -252,6 +281,10 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         if (!fresh) {
             throw new Error('User no longer exists');
         }
+        return fresh;
+    };
+    const mintSessionForUserId = async (userId) => {
+        const fresh = await findUserById(userId);
         const sessionToken = auth.signToken({
             userId: fresh.id,
             username: fresh.username,
@@ -284,6 +317,39 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             throw error;
         }
     };
+    /**
+     * The second factors `userId` must still satisfy after a successful
+     * PRIMARY factor. 2FA applies uniformly to every primary method:
+     *
+     *   • `totp` — whenever enrolled, regardless of how the user signed in.
+     *   • `passkey` — ONLY when the user both has an enrolled passkey AND
+     *     explicitly opted in (`getSecondFactorPreference`, default OFF —
+     *     enrolling a passkey alone just enables passkey-first sign-in),
+     *     and NEVER when the primary factor already WAS the passkey
+     *     (re-proving the factor that just signed in adds nothing).
+     *
+     * Passkey introspection is resilient (missing provider / transport
+     * error ⇒ no passkey factor) so it can never block a login; a TOTP
+     * status failure still propagates — fail-open there would silently
+     * skip an enrolled factor.
+     */
+    const collectSecondFactors = async (userId, primary) => {
+        const userMgmt = registry?.getSingleton('user-management');
+        const totpStatus = userMgmt && typeof userMgmt.getTotpStatus === 'function'
+            ? await userMgmt.getTotpStatus({ userId })
+            : { enabled: false };
+        const factors = [];
+        if (totpStatus.enabled)
+            factors.push('totp');
+        if (primary !== 'passkey') {
+            const provider = resolvePasskeyProvider(registry, moleculer);
+            const enrolled = await userHasPasskey(userId, provider);
+            if (enrolled && (await passkeySecondFactorOptedIn(userId, provider))) {
+                factors.push('passkey');
+            }
+        }
+        return factors;
+    };
     return (0, trpc_middleware_js_1.trpcRouter)({
         login: trpc_middleware_js_1.publicProcedure
             .input(zod_1.z.object({ username: zod_1.z.string(), password: zod_1.z.string() }))
@@ -307,23 +373,17 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             if (!user)
                 throw new Error('Invalid credentials');
             // ── Second-factor gate ───────────────────────────────────────
-            // After credentials validate, check every enrolled second
-            // factor. If ANY is present, mint a SHORT-LIVED challenge token
-            // instead of the real session — the client must complete one
-            // factor before we hand out the actual JWT. The challenge token
-            // carries `kind: 'totp-challenge'` so it can't be replayed
-            // against protected endpoints (the auth middleware rejects
-            // anything without the standard session shape); the same token
-            // binds both the TOTP and the passkey second legs (same userId).
-            const totpStatus = typeof userMgmt.getTotpStatus === 'function'
-                ? await userMgmt.getTotpStatus({ userId: user.id })
-                : { enabled: false };
-            const passkeyEnrolled = await userHasPasskey(user.id, resolvePasskeyProvider(registry, moleculer));
-            const secondFactors = [];
-            if (totpStatus.enabled)
-                secondFactors.push('totp');
-            if (passkeyEnrolled)
-                secondFactors.push('passkey');
+            // After credentials validate, collect every ACTIVE second
+            // factor (TOTP when enrolled; passkey only when enrolled AND
+            // the user opted in — see `collectSecondFactors`). If ANY is
+            // present, mint a SHORT-LIVED challenge token instead of the
+            // real session — the client must complete one factor before we
+            // hand out the actual JWT. The challenge token carries
+            // `kind: 'totp-challenge'` so it can't be replayed against
+            // protected endpoints (the auth middleware rejects anything
+            // without the standard session shape); the same token binds
+            // both the TOTP and the passkey second legs (same userId).
+            const secondFactors = await collectSecondFactors(user.id, 'password');
             if (secondFactors.length > 0) {
                 const challengeToken = auth.signTotpChallengeToken({
                     userId: user.id,
@@ -333,7 +393,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 return {
                     token: challengeToken,
                     user: { id: user.id, username: user.username, isAdmin: user.isAdmin },
-                    requiresTotp: totpStatus.enabled,
+                    requiresTotp: secondFactors.includes('totp'),
                     secondFactors,
                 };
             }
@@ -467,9 +527,12 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * `auth.login` mints — via the shared `mintSessionForUserId` tail
          * (fresh user re-fetch for up-to-date scopes).
          *
-         * NO second-factor bounce: a discoverable passkey assertion with
-         * user verification is already a strong (possession + inherence/
-         * knowledge) factor — enrolled TOTP is irrelevant on this path.
+         * Second-factor gate — SAME rules as `auth.login`: 2FA applies
+         * uniformly after any primary method, so an enrolled TOTP bounces
+         * this leg to the challenge stage (same challenge-token LoginResult
+         * shape, completed via `loginVerifyTotp`). The passkey factor
+         * itself is skipped here — the primary factor WAS the passkey, and
+         * re-proving it adds nothing.
          */
         passkeyLoginFinish: trpc_middleware_js_1.publicProcedure
             .input(zod_1.z.object({ response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) }))
@@ -484,6 +547,25 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             if (!result.verified || !result.userId) {
                 throw new server_1.TRPCError({ code: 'UNAUTHORIZED', message: 'Passkey verification failed' });
             }
+            const secondFactors = await collectSecondFactors(result.userId, 'passkey');
+            if (secondFactors.length > 0) {
+                const challenged = await findUserById(result.userId);
+                const challengeToken = auth.signTotpChallengeToken({
+                    userId: challenged.id,
+                    username: challenged.username,
+                    isAdmin: challenged.isAdmin,
+                });
+                return {
+                    token: challengeToken,
+                    user: {
+                        id: challenged.id,
+                        username: challenged.username,
+                        isAdmin: challenged.isAdmin,
+                    },
+                    requiresTotp: secondFactors.includes('totp'),
+                    secondFactors,
+                };
+            }
             return mintSessionForUserId(result.userId);
         }),
         /**
@@ -713,6 +795,44 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 throw new Error('Passkey management is not available');
             return provider.removePasskey({ userId: ctx.user.id, credentialId: input.credentialId });
         }),
+        /**
+         * Own passkey second-factor preference (opt-in, default OFF).
+         * Enrolling a passkey only enables passkey-first sign-in; flipping
+         * this on additionally demands the passkey as a second factor after
+         * every password login. Bound to `ctx.user.id` like the rest of the
+         * self-service block; reads degrade to `enabled: false` so the "My
+         * access" page renders even while the provider is booting.
+         */
+        getOwnPasskeySecondFactorPreference: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.void())
+            .output(SecondFactorPreferenceSchema)
+            .query(async ({ ctx }) => {
+            if (!ctx.user)
+                return { enabled: false };
+            const provider = resolvePasskeyProvider(registry, moleculer);
+            if (!provider)
+                return { enabled: false };
+            try {
+                return await provider.getSecondFactorPreference({ userId: ctx.user.id });
+            }
+            catch {
+                return { enabled: false };
+            }
+        }),
+        setOwnPasskeySecondFactorPreference: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ enabled: zod_1.z.boolean() }))
+            .output(SetSecondFactorPreferenceSchema)
+            .mutation(async ({ input, ctx }) => {
+            if (!ctx.user)
+                throw new Error('Not authenticated');
+            const provider = resolvePasskeyProvider(registry, moleculer);
+            if (!provider)
+                throw new Error('Passkey management is not available');
+            return provider.setSecondFactorPreference({
+                userId: ctx.user.id,
+                enabled: input.enabled,
+            });
+        }),
         // ── Share tokens — scoped, TTL'd view tokens for standalone share
         //    links (grid rework R6). Minted by any REAL user session (admin
         //    or regular); the resulting `csv_*` token authenticates as a

package/dist/api/trpc/generated-cap-routers.js

@@ -7559,6 +7559,24 @@ function createCapRouter_userPasskeys(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.removePasskey(methodInput);
         }),
+        getSecondFactorPreference: trpc_middleware_js_1.adminProcedure
+            .input(types_105.userPasskeysCapability.methods.getSecondFactorPreference.input.loose())
+            .output(types_105.userPasskeysCapability.methods.getSecondFactorPreference.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, addonId, ...methodInput } = input;
+            const p = resolveProvider('user-passkeys', nodeId, () => getProvider(ctx, addonId), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.getSecondFactorPreference(methodInput);
+        }),
+        setSecondFactorPreference: trpc_middleware_js_1.adminProcedure
+            .input(types_105.userPasskeysCapability.methods.setSecondFactorPreference.input.loose())
+            .output(types_105.userPasskeysCapability.methods.setSecondFactorPreference.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, addonId, ...methodInput } = input;
+            const p = resolveProvider('user-passkeys', nodeId, () => getProvider(ctx, addonId), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.setSecondFactorPreference(methodInput);
+        }),
     });
 }
 function createCapRouter_vacuumControl(getProvider, createRemoteProxy) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.1.52",
+  "version": "1.1.53",
   "private": false,
   "files": [
     "dist",
@@ -23,18 +23,18 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.1.44",
+    "@camstack/addon-admin-ui": "1.1.45",
     "@camstack/addon-advanced-notifier": "1.1.21",
-    "@camstack/addon-auth": "1.1.5",
+    "@camstack/addon-auth": "1.1.6",
     "@camstack/addon-decoder-nodeav": "1.1.9",
     "@camstack/addon-notifiers": "1.1.21",
     "@camstack/addon-pipeline": "1.1.51",
     "@camstack/addon-pipeline-orchestrator": "1.1.39",
     "@camstack/addon-post-analysis": "1.1.23",
-    "@camstack/sdk": "1.1.21",
+    "@camstack/sdk": "1.1.22",
     "@camstack/shm-ring": "1.0.21",
-    "@camstack/system": "1.1.40",
-    "@camstack/types": "1.1.38",
+    "@camstack/system": "1.1.41",
+    "@camstack/types": "1.1.39",
     "@camstack/ui-library": "1.1.31",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",