@crossauth/backend 0.0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (109) hide show
  1. package/LICENSE +203 -0
  2. package/README.md +14 -0
  3. package/dist/apikey.d.ts +100 -0
  4. package/dist/apikey.d.ts.map +1 -0
  5. package/dist/auth.d.ts +131 -0
  6. package/dist/auth.d.ts.map +1 -0
  7. package/dist/authenticators/dummyfactor2.d.ts +129 -0
  8. package/dist/authenticators/dummyfactor2.d.ts.map +1 -0
  9. package/dist/authenticators/emailauth.d.ts +176 -0
  10. package/dist/authenticators/emailauth.d.ts.map +1 -0
  11. package/dist/authenticators/ldapauth.d.ts +89 -0
  12. package/dist/authenticators/ldapauth.d.ts.map +1 -0
  13. package/dist/authenticators/passwordauth.d.ts +159 -0
  14. package/dist/authenticators/passwordauth.d.ts.map +1 -0
  15. package/dist/authenticators/smsauth.d.ts +160 -0
  16. package/dist/authenticators/smsauth.d.ts.map +1 -0
  17. package/dist/authenticators/tests/ldapauth.test.d.ts +2 -0
  18. package/dist/authenticators/tests/ldapauth.test.d.ts.map +1 -0
  19. package/dist/authenticators/totpauth.d.ts +117 -0
  20. package/dist/authenticators/totpauth.d.ts.map +1 -0
  21. package/dist/authenticators/twilioauth.d.ts +29 -0
  22. package/dist/authenticators/twilioauth.d.ts.map +1 -0
  23. package/dist/cookieauth.d.ts +269 -0
  24. package/dist/cookieauth.d.ts.map +1 -0
  25. package/dist/crypto.d.ts +196 -0
  26. package/dist/crypto.d.ts.map +1 -0
  27. package/dist/emailtokens.d.ts +178 -0
  28. package/dist/emailtokens.d.ts.map +1 -0
  29. package/dist/index.cjs +9107 -0
  30. package/dist/index.d.ts +46 -0
  31. package/dist/index.d.ts.map +1 -0
  32. package/dist/index.js +9090 -0
  33. package/dist/oauth/authserver.d.ts +490 -0
  34. package/dist/oauth/authserver.d.ts.map +1 -0
  35. package/dist/oauth/client.d.ts +72 -0
  36. package/dist/oauth/client.d.ts.map +1 -0
  37. package/dist/oauth/clientmanager.d.ts +73 -0
  38. package/dist/oauth/clientmanager.d.ts.map +1 -0
  39. package/dist/oauth/resserver.d.ts +43 -0
  40. package/dist/oauth/resserver.d.ts.map +1 -0
  41. package/dist/oauth/tests/common.d.ts +58 -0
  42. package/dist/oauth/tests/common.d.ts.map +1 -0
  43. package/dist/oauth/tests/oauthauthserver_authzcode.test.d.ts +2 -0
  44. package/dist/oauth/tests/oauthauthserver_authzcode.test.d.ts.map +1 -0
  45. package/dist/oauth/tests/oauthauthserver_clientcred.test.d.ts +2 -0
  46. package/dist/oauth/tests/oauthauthserver_clientcred.test.d.ts.map +1 -0
  47. package/dist/oauth/tests/oauthauthserver_device.test.d.ts +2 -0
  48. package/dist/oauth/tests/oauthauthserver_device.test.d.ts.map +1 -0
  49. package/dist/oauth/tests/oauthauthserver_mfa.test.d.ts +5 -0
  50. package/dist/oauth/tests/oauthauthserver_mfa.test.d.ts.map +1 -0
  51. package/dist/oauth/tests/oauthauthserver_password.test.d.ts +2 -0
  52. package/dist/oauth/tests/oauthauthserver_password.test.d.ts.map +1 -0
  53. package/dist/oauth/tests/oauthclient.test.d.ts +2 -0
  54. package/dist/oauth/tests/oauthclient.test.d.ts.map +1 -0
  55. package/dist/oauth/tests/oauthresserver.test.d.ts +2 -0
  56. package/dist/oauth/tests/oauthresserver.test.d.ts.map +1 -0
  57. package/dist/oauth/tokenconsumer.d.ts +80 -0
  58. package/dist/oauth/tokenconsumer.d.ts.map +1 -0
  59. package/dist/session.d.ts +491 -0
  60. package/dist/session.d.ts.map +1 -0
  61. package/dist/storage/dbconnection.d.ts +19 -0
  62. package/dist/storage/dbconnection.d.ts.map +1 -0
  63. package/dist/storage/dbstorage.d.ts +319 -0
  64. package/dist/storage/dbstorage.d.ts.map +1 -0
  65. package/dist/storage/inmemorystorage.d.ts +225 -0
  66. package/dist/storage/inmemorystorage.d.ts.map +1 -0
  67. package/dist/storage/ldapstorage.d.ts +143 -0
  68. package/dist/storage/ldapstorage.d.ts.map +1 -0
  69. package/dist/storage/postgresconnection.d.ts +27 -0
  70. package/dist/storage/postgresconnection.d.ts.map +1 -0
  71. package/dist/storage/postgresstorage.d.ts +83 -0
  72. package/dist/storage/postgresstorage.d.ts.map +1 -0
  73. package/dist/storage/prismastorage.d.ts +361 -0
  74. package/dist/storage/prismastorage.d.ts.map +1 -0
  75. package/dist/storage/sqliteconnection.d.ts +35 -0
  76. package/dist/storage/sqliteconnection.d.ts.map +1 -0
  77. package/dist/storage/sqlitestorage.d.ts +83 -0
  78. package/dist/storage/sqlitestorage.d.ts.map +1 -0
  79. package/dist/storage/tests/dbtests.d.ts +5 -0
  80. package/dist/storage/tests/dbtests.d.ts.map +1 -0
  81. package/dist/storage/tests/inmemorystorage.test.d.ts +5 -0
  82. package/dist/storage/tests/inmemorystorage.test.d.ts.map +1 -0
  83. package/dist/storage/tests/inmemorytestdata.d.ts +4 -0
  84. package/dist/storage/tests/inmemorytestdata.d.ts.map +1 -0
  85. package/dist/storage/tests/ldapstorage.test.d.ts +2 -0
  86. package/dist/storage/tests/ldapstorage.test.d.ts.map +1 -0
  87. package/dist/storage/tests/postgresstorage.test.d.ts +2 -0
  88. package/dist/storage/tests/postgresstorage.test.d.ts.map +1 -0
  89. package/dist/storage/tests/prismastorage.test.d.ts +4 -0
  90. package/dist/storage/tests/prismastorage.test.d.ts.map +1 -0
  91. package/dist/storage/tests/sqlitestorage.test.d.ts +2 -0
  92. package/dist/storage/tests/sqlitestorage.test.d.ts.map +1 -0
  93. package/dist/storage.d.ts +411 -0
  94. package/dist/storage.d.ts.map +1 -0
  95. package/dist/tests/cookieauth.test.d.ts +4 -0
  96. package/dist/tests/cookieauth.test.d.ts.map +1 -0
  97. package/dist/tests/crypto.test.d.ts +2 -0
  98. package/dist/tests/crypto.test.d.ts.map +1 -0
  99. package/dist/tests/email.test.d.ts +4 -0
  100. package/dist/tests/email.test.d.ts.map +1 -0
  101. package/dist/tests/password.test.d.ts +5 -0
  102. package/dist/tests/password.test.d.ts.map +1 -0
  103. package/dist/tests/tmp.test.d.ts +2 -0
  104. package/dist/tests/tmp.test.d.ts.map +1 -0
  105. package/dist/tests/utils.test.d.ts +2 -0
  106. package/dist/tests/utils.test.d.ts.map +1 -0
  107. package/dist/utils.d.ts +41 -0
  108. package/dist/utils.d.ts.map +1 -0
  109. package/package.json +71 -0
@@ -0,0 +1,491 @@
1
+ import { User, UserSecrets, Key, UserInputFields, UserSecretsInputFields } from '@crossauth/common';
2
+ import { UserStorage, KeyStorage } from './storage.ts';
3
+ import { AuthenticationParameters, Authenticator } from './auth.ts';
4
+ import { TokenEmailerOptions } from './emailtokens.ts';
5
+ import { Cookie, DoubleSubmitCsrfToken, DoubleSubmitCsrfTokenOptions, SessionCookieOptions } from './cookieauth.ts';
6
+
7
+ /**
8
+ * Options for {@link SessionManager}
9
+ */
10
+ export interface SessionManagerOptions extends TokenEmailerOptions {
11
+ /**
12
+ * If user login is enabled, you must provide the object where users
13
+ * are stored.
14
+ */
15
+ userStorage?: UserStorage;
16
+ /** options for csrf cookie manager */
17
+ doubleSubmitCookieOptions?: DoubleSubmitCsrfTokenOptions;
18
+ /** options for session cookie manager */
19
+ sessionCookieOptions?: SessionCookieOptions;
20
+ /** If true, users will have to verify their email address before account is created or when changing their email address.
21
+ * See class description for details.. Default true
22
+ */
23
+ enableEmailVerification?: boolean;
24
+ /** If true, allow password reset by email token.
25
+ * See class description for details.. Default true
26
+ */
27
+ enablePasswordReset?: boolean;
28
+ /** Server secret. Needed for emailing tokens and for csrf tokens */
29
+ secret?: string;
30
+ /**
31
+ * Store for password reset and email vcerification tokens. If not passed, the same store as
32
+ * for sessions is used.
33
+ */
34
+ emailTokenStorage?: KeyStorage;
35
+ /**
36
+ * Base URL for the site.
37
+ *
38
+ * This is used when constructing URLs, eg for sending password reset
39
+ * tokens.
40
+ */
41
+ siteUrl?: string;
42
+ /**
43
+ * Set of 2FA factor names a user is allowed to set.
44
+ *
45
+ * The name corresponds to the key you give when adding authenticators.
46
+ * See `authentiators` in {@link SessionManager.constructor}.
47
+ */
48
+ allowedFactor2?: string[];
49
+ }
50
+ /**
51
+ * Class for managing sessions.
52
+ */
53
+ export declare class SessionManager {
54
+ userStorage?: UserStorage;
55
+ keyStorage: KeyStorage;
56
+ emailTokenStorage: KeyStorage;
57
+ readonly csrfTokens: DoubleSubmitCsrfToken;
58
+ private session;
59
+ readonly authenticators: {
60
+ [key: string]: Authenticator;
61
+ };
62
+ private enableEmailVerification;
63
+ private enablePasswordReset;
64
+ private tokenEmailer?;
65
+ allowedFactor2: string[];
66
+ /**
67
+ * Constructor
68
+ * @param keyStorage the {@link KeyStorage} instance to use, eg {@link PrismaKeyStorage}.
69
+ * @param authenticators authenticators used to validate users, eg {@link LocalPasswordAuthenticatorOptions }.
70
+ * @param options optional parameters for authentication. See {@link SessionManagerOptions }.
71
+ */
72
+ constructor(keyStorage: KeyStorage, authenticators: {
73
+ [key: string]: Authenticator;
74
+ }, options?: SessionManagerOptions);
75
+ /**
76
+ * Returns the name used for session ID cookies.
77
+ */
78
+ get sessionCookieName(): string;
79
+ /**
80
+ * Returns the name used for session ID cookies.
81
+ */
82
+ get sessionCookiePath(): string;
83
+ /**
84
+ * Returns the name used for CSRF token cookies.
85
+ */
86
+ get csrfCookieName(): string;
87
+ /**
88
+ * Returns the name used for CSRF token cookies.
89
+ */
90
+ get csrfCookiePath(): string;
91
+ /**
92
+ * Returns the name used for CSRF token cookies.
93
+ */
94
+ get csrfHeaderName(): string;
95
+ /**
96
+ * Performs a user login
97
+ *
98
+ * * Authenticates the username and password
99
+ * * Creates a session key - if 2FA is enabled, this is an anonymous session,
100
+ * otherwise it is bound to the user
101
+ * * Returns the user (without the password hash) and the session cookie.
102
+ * If the user object is defined, authentication (and 2FA) is bypassed
103
+ * @param username the username to validate
104
+ * @param params user-provided credentials (eg password) to authenticate with
105
+ * @param extraFields add these extra fields to the session key if authentication is successful
106
+ * @param persist if passed, overrides the persistSessionId setting.
107
+ * @param user if this is defined, the username and password are ignored and the given user is logged in.
108
+ * The 2FA step is also skipped
109
+ * @param bypass2FA if true, the 2FA step will be skipped
110
+ * @returns the user, user secrets, and session cookie and CSRF cookie and token.
111
+ * if a 2fa step is needed, it will be an anonymouos session, otherwise bound to the user
112
+ * @throws {@link @crossauth/common!CrossauthError} with
113
+ * {@link @crossauth/common!ErrorCode} of `Connection`, `UserNotValid`,
114
+ * `PasswordNotMatch` or `UserNotExist`.
115
+ */
116
+ login(username: string, params: AuthenticationParameters, extraFields?: {
117
+ [key: string]: any;
118
+ }, persist?: boolean, user?: User, bypass2FA?: boolean): Promise<{
119
+ sessionCookie: Cookie;
120
+ csrfCookie: Cookie;
121
+ csrfFormOrHeaderValue: string;
122
+ user: User;
123
+ secrets: UserSecrets;
124
+ }>;
125
+ /**
126
+ * If a valid session key does not exist, create and store an anonymous one.
127
+ *
128
+ * @param extraFields these will be added to the created session object.
129
+ * @returns a cookie with the session ID, a cookie with the CSRF token
130
+ * and the CSRF value to put in the form or header value.
131
+ */
132
+ createAnonymousSession(extraFields?: {
133
+ [key: string]: any;
134
+ }): Promise<{
135
+ sessionCookie: Cookie;
136
+ csrfCookie: Cookie;
137
+ csrfFormOrHeaderValue: string;
138
+ }>;
139
+ /**
140
+ * Logs a user out.
141
+ *
142
+ * Removes the given session ID from the session storage.
143
+ *
144
+ * @param sessionId the session ID to remove.
145
+ * @throws {@link @crossauth/common!CrossauthError} with
146
+ * {@link @crossauth/common!ErrorCode} of `Connection`
147
+ */
148
+ logout(sessionId: string): Promise<void>;
149
+ /**
150
+ * Logs a user out from all sessions.
151
+ *
152
+ * Removes the given session ID from the session storage.
153
+ *
154
+ * @param except Don't log out from the matching session.
155
+ * @throws {@link @crossauth/common!CrossauthError} with
156
+ * {@link @crossauth/common!ErrorCode} of `Connection`
157
+ */
158
+ logoutFromAll(userid: string | number, except?: string | undefined): Promise<void>;
159
+ /**
160
+ * Returns the user (without secrets) matching the given session key.
161
+ *
162
+ * If the user is undefined, or the key has expired, returns undefined.
163
+ *
164
+ * @param sessionId the session key to look up in session storage
165
+ * @returns the {@link User} (without password hash) matching the session key
166
+ * @throws {@link @crossauth/common!CrossauthError} with
167
+ * {@link @crossauth/common!ErrorCode} of `Connection`,
168
+ * `InvalidSessionId`
169
+ * `UserNotExist` or `Expired`.
170
+ */
171
+ userForSessionId(sessionId: string): Promise<{
172
+ key: Key;
173
+ user: User | undefined;
174
+ }>;
175
+ /**
176
+ * Returns the data object for a session key, or undefined, as a JSON string
177
+ * (which is how it is stored in the session table)
178
+ *
179
+ * If the user is undefined, or the key has expired, returns undefined.
180
+ *
181
+ * @param sessionId the session id to look up in session storage
182
+ * @returns a string from the data field
183
+ * @throws {@link @crossauth/common!CrossauthError} with
184
+ * {@link @crossauth/common!ErrorCode} of `Connection`, `InvalidSessionId`
185
+ * `UserNotExist` or `Expired`.
186
+ */
187
+ dataStringForSessionId(sessionId: string): Promise<string | undefined>;
188
+ /**
189
+ * Returns the data object for a session id, or undefined, as an object.
190
+ *
191
+ * If the user is undefined, or the key has expired, returns undefined.
192
+ *
193
+ * @param sessionId the session key to look up in session storage
194
+ * @returns a string from the data field
195
+ * @throws {@link @crossauth/common!CrossauthError} with
196
+ * {@link @crossauth/common!ErrorCode} of `Connection`, `InvalidSessionId`
197
+ * `UserNotExist` or `Expired`.
198
+ */
199
+ dataForSessionId(sessionId: string): Promise<{
200
+ [key: string]: any;
201
+ }>;
202
+ /**
203
+ * Creates and returns a signed CSRF token based on the session ID
204
+ * @returns a CSRF cookie and value to put in the form or CSRF header
205
+ */
206
+ createCsrfToken(): Promise<{
207
+ csrfCookie: Cookie;
208
+ csrfFormOrHeaderValue: string;
209
+ }>;
210
+ /**
211
+ * Validates the signature on the CSRF cookie value and returns a
212
+ * value that can be put in the form or CSRF header value.
213
+ *
214
+ * @param csrfCookieValue the value from the CSRF cookie
215
+ * @returns the value to put in the form or CSRF header
216
+ */
217
+ createCsrfFormOrHeaderValue(csrfCookieValue: string): Promise<string>;
218
+ /**
219
+ * Returns the session ID from the signed session cookie value
220
+ *
221
+ * @param sessionCookieValue value from the session ID cookie
222
+ * @returns the usigned cookie value.
223
+ * @throws {@link @crossauth/common!CrossauthError} with `InvalidKey`
224
+ * if the signature is invalid.
225
+ */
226
+ getSessionId(sessionCookieValue: string): string;
227
+ /**
228
+ * Throws {@link @crossauth/common!CrossauthError} with
229
+ * `InvalidKey` if the passed CSRF token is not valid for the given
230
+ * session ID. Otherwise returns without error
231
+ *
232
+ * @param csrfCookieValue the CSRF cookie value
233
+ * @param csrfFormOrHeaderValue the value from the form field or
234
+ * CSRF header
235
+ */
236
+ validateDoubleSubmitCsrfToken(csrfCookieValue: string | undefined, csrfFormOrHeaderValue: string | undefined): void;
237
+ /**
238
+ * Throws {@link @crossauth/common!CrossauthError} with `InvalidKey` if
239
+ * the passed CSRF cookie value is not valid (ie invalid signature)
240
+ * @param csrfCookieValue the CSRF cookie value
241
+ */
242
+ validateCsrfCookie(csrfCookieValue: string): void;
243
+ /**
244
+ * If sessionIdleTimeout is set, update the last activcity time in key
245
+ * storage to current time.
246
+ *
247
+ * @param sessionId the session Id to update.
248
+ */
249
+ updateSessionActivity(sessionId: string): Promise<void>;
250
+ /**
251
+ * Update a field in the session data.
252
+ *
253
+ * The `data` field in the session entry is assumed to be a JSON string.
254
+ * The field with the given name is updated or set if not already set.
255
+ * @param sessionId the session Id to update.
256
+ * @param name of the field.
257
+ * @param value new value to store
258
+ */
259
+ updateSessionData(sessionId: string, name: string, value: {
260
+ [key: string]: any;
261
+ }): Promise<void>;
262
+ /**
263
+ * Update field sin the session data.
264
+ *
265
+ * The `data` field in the session entry is assumed to be a JSON string.
266
+ * The field with the given name is updated or set if not already set.
267
+ * @param sessionId the session Id to update.
268
+ * @param name of the field.
269
+ * @param value new value to store
270
+ */
271
+ updateManySessionData(sessionId: string, dataArray: {
272
+ dataName: string;
273
+ value: any;
274
+ }[]): Promise<void>;
275
+ /**
276
+ * Deletes a field from the session data.
277
+ *
278
+ * The `data` field in the session entry is assumed to be a JSON string.
279
+ * The field with the given name is updated or set if not already set.
280
+ * @param sessionId the session Id to update.
281
+ * @param name of the field.
282
+ */
283
+ deleteSessionData(sessionId: string, name: string): Promise<void>;
284
+ /**
285
+ * Deletes the given session ID from the key storage (not the cookie)
286
+ *
287
+ * @param sessionId the session Id to delete
288
+ */
289
+ deleteSession(sessionId: string): Promise<void>;
290
+ /**
291
+ * Creates a new user, sending an email verification message if necessary.
292
+ *
293
+ * If email verification is enabled, the user's state is set to
294
+ * `awaitingemailverification`. Otherwise it is set to `active`.
295
+ *
296
+ * @param user fields to put in the new entry
297
+ * @param params parameters to pass to the relevant factor 1 authenticator.
298
+ * @param repeatParams if this is set, an exception will be raised if
299
+ * the values here to not match those in `params`.
300
+ * @param skipEmailVerification if true, email verification will not be
301
+ * performed
302
+ * @returns the new user
303
+ */
304
+ createUser(user: UserInputFields, params: AuthenticationParameters, repeatParams?: AuthenticationParameters, skipEmailVerification?: boolean, emptyPassword?: boolean): Promise<User>;
305
+ /**
306
+ * Deletes the user matching the given username
307
+ * @param username user to delete
308
+ */
309
+ deleteUserByUsername(username: string): Promise<void>;
310
+ /** Creates a user with 2FA enabled.
311
+ *
312
+ * The user storage entry will be createed, with the state set to
313
+ * `awaitingtwofactorsetup`. The passed session key will be updated to
314
+ * include the username and details needed by 2FA during the configure step.
315
+ * @param user : details to save in the user table
316
+ * @param params : params the parameters needed to authenticate with factor1
317
+ * (eg password)
318
+ * @param sessionId the anonymous session cookie
319
+ * @param repeatParams if passed, these will be compared with `params` and
320
+ * if they don't match, `PasswordMatch` is thrown.
321
+ * @return `userid` the id of the created user.
322
+ * `userData` data that can be displayed to the user in the page to
323
+ * complete 2FA set up (eg the secret key and QR codee for TOTP),
324
+ *
325
+ */
326
+ initiateTwoFactorSignup(user: UserInputFields, params: AuthenticationParameters, sessionId: string, repeatParams?: AuthenticationParameters): Promise<{
327
+ userid: string | number;
328
+ userData: {
329
+ [key: string]: any;
330
+ };
331
+ }>;
332
+ /**
333
+ * Begins the process of setting up 2FA for a user which has already been
334
+ * created and activated. Called when changing 2FA or changing its parameters.
335
+ * @param user the logged in user
336
+ * @param newFactor2 new second factor to change user to
337
+ * @param sessionId the session cookie for the user
338
+ * @returns the 2FA data that can be displayed to the user in the confifugre 2FA
339
+ * step (such as the secret and QR code for TOTP).
340
+ */
341
+ initiateTwoFactorSetup(user: User, newFactor2: string | undefined, sessionId: string): Promise<{
342
+ [key: string]: any;
343
+ }>;
344
+ /**
345
+ * This can be called if the user has finished signing up with factor1 but
346
+ * closed the browser before completing factor2 setup. Call it if the user
347
+ * signs up again with the same factor1 credentials.
348
+ * @param sessionId the anonymous session ID for the user
349
+ * @returns `userid` the id of the created user
350
+ * `userData` data that can be displayed to the user in the page to
351
+ * complete 2FA set up (eg the secret key and QR codee for TOTP),
352
+ * `secrets` data that is saved in the session for factor2. In the
353
+ * case of TOTP, both `userData` and `secrets` contain the shared
354
+ * secret but only `userData` has the QR code, since it can be
355
+ * generated from the shared secret.
356
+ */
357
+ repeatTwoFactorSignup(sessionId: string): Promise<{
358
+ userid: string | number;
359
+ userData: {
360
+ [key: string]: any;
361
+ };
362
+ secrets: Partial<UserSecretsInputFields>;
363
+ }>;
364
+ /**
365
+ * Authenticates with the second factor.
366
+ *
367
+ * If successful, the new user object is returned. Otherwise an exception
368
+ * is thrown,
369
+ * @param params the parameters from user input needed to authenticate (eg TOTP code)
370
+ * @param sessionId the session cookie value (ie still signed)
371
+ * @returns the user object
372
+ * @throws {@link @crossauth/common!CrossauthError} if authentication fails.
373
+ */
374
+ completeTwoFactorSetup(params: AuthenticationParameters, sessionId: string): Promise<User>;
375
+ /**
376
+ * Initiates the two factor login process.
377
+ *
378
+ * Creates an anonymous session and coorresponding CSRF token
379
+ * @param user the user, which should aleady have been authenticated with factor1
380
+ * @returns a new anonymous session cookie and corresponding CSRF cookie and token.
381
+ */
382
+ private initiateTwoFactorLogin;
383
+ /**
384
+ * Initiates the two factor process when visiting a protected page.
385
+ *
386
+ * Creates an anonymous session and coorresponding CSRF token
387
+ * @param user the user, which should aleady have been authenticated with factor1
388
+ * @param sessionId the logged in session associated with the user
389
+ * @param requestBody the parameters from the request made before being redirected to factor2 authentication
390
+ * @param url the requested url, including path and query parameters
391
+ * @returns If a token was passed a new anonymous session cookie and
392
+ * corresponding CSRF cookie and token.
393
+ */
394
+ initiateTwoFactorPageVisit(user: User, sessionId: string, requestBody: {
395
+ [key: string]: any;
396
+ }, url: string | undefined, contentType?: string): Promise<{
397
+ sessionCookie: Cookie | undefined;
398
+ csrfCookie: Cookie | undefined;
399
+ csrfFormOrHeaderValue: string | undefined;
400
+ }>;
401
+ /**
402
+ * Completes 2FA when visiting a protected page.
403
+ *
404
+ * If successful, returns. Otherwise an exception is thrown.
405
+ * @param params the parameters from user input needed to authenticate
406
+ * (eg TOTP code). Passed to the authenticator
407
+ * @param sessionId the session cookie value (ie still signed)
408
+ * @throws {@link @crossauth/common!CrossauthError} if authentication fails.
409
+ */
410
+ completeTwoFactorPageVisit(params: AuthenticationParameters, sessionId: string): Promise<void>;
411
+ /**
412
+ * Cancels the 2FA that was previously initiated but not completed..
413
+ *
414
+ * If successful, returns. Otherwise an exception is thrown.
415
+ * @param sessionId the session id (unsigned)
416
+ * @returns the 2FA data that was created on initiation
417
+ * @throws {@link @crossauth/common!CrossauthError} of `Unauthorized`
418
+ * if 2FA was not initiated.
419
+ */
420
+ cancelTwoFactorPageVisit(sessionId: string): Promise<{
421
+ [key: string]: any;
422
+ }>;
423
+ /**
424
+ * Performs the second factor authentication as the second step of the login
425
+ * process
426
+ *
427
+ * If authentication is successful, the user's state will be set to active
428
+ * and a new session will be created, bound to the user. The anonymous session
429
+ * will be deleted.
430
+ * @param params the user-provided parameters to authenticate with (eg TOTP code).
431
+ * @param sessionId the user's anonymous session
432
+ * @param extraFields extra fields to add to the user-bound new session table entry
433
+ * @param persist if true, the cookie will be perstisted (with an expiry value);
434
+ * otberwise it will be a session-only cookie.
435
+ * @returns `sessionCookie` the new session cookie
436
+ * `csrfCookie` the new CSRF cookie
437
+ * `csrfToken` the new CSRF token corresponding to the cookie
438
+ * `user` the newly-logged in user.
439
+ */
440
+ completeTwoFactorLogin(params: AuthenticationParameters, sessionId: string, extraFields?: {
441
+ [key: string]: any;
442
+ }, persist?: boolean): Promise<{
443
+ sessionCookie: Cookie;
444
+ csrfCookie: Cookie;
445
+ csrfFormOrHeaderValue: string;
446
+ user: User;
447
+ }>;
448
+ /**
449
+ * Sends a password reset token
450
+ * @param email the user's email (where the token will be sent)
451
+ . */
452
+ requestPasswordReset(email: string): Promise<void>;
453
+ /**
454
+ * Takes an email verification token as input and applies it to the user storage.
455
+ *
456
+ * The state is reset to active. If the token was for changing the password, the new
457
+ * password is saved to the user in user storage.
458
+ *
459
+ * @param token the token to apply
460
+ * @returns the new user record
461
+ */
462
+ applyEmailVerificationToken(token: string): Promise<User>;
463
+ /**
464
+ * Returns the user associated with a password reset token
465
+ * @param token the token that was emailed
466
+ * @returns the user
467
+ * @throws {@link @crossauth/common!CrossauthError} if the token is not valid.
468
+ */
469
+ userForPasswordResetToken(token: string): Promise<User>;
470
+ changeSecrets(username: string, factorNumber: 1 | 2, newParams: AuthenticationParameters, repeatParams?: AuthenticationParameters, oldParams?: AuthenticationParameters): Promise<User>;
471
+ /**
472
+ * Updates a user entry in storage
473
+ * @param currentUser the current user details
474
+ * @param newUser the new user details
475
+ * @returns true if email verification is now needed, false otherwise
476
+ */
477
+ updateUser(currentUser: User, newUser: User, skipEmailVerification?: boolean): Promise<boolean>;
478
+ /**
479
+ * Resets the secret for factor1 or 2 (eg reset password)
480
+ * @param token the reset password token that was emailed
481
+ * @param factorNumber which factor to reset (1 or 2)
482
+ * @param params the new secrets entered by the user (eg new password)
483
+ * @param repeatParams optionally, repeat of the secrets. If passed,
484
+ * an exception will be thrown if they do not match
485
+ * @returns the user object
486
+ * @throws {@link @crossauth/common!CrossauthError} if the repeatParams don't match params,
487
+ * the token is invalid or the user storage cannot be updated.
488
+ */
489
+ resetSecret(token: string, factorNumber: 1 | 2, params: AuthenticationParameters, repeatParams?: AuthenticationParameters): Promise<User>;
490
+ }
491
+ //# sourceMappingURL=session.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACR,IAAI,EACJ,WAAW,EACX,GAAG,EACH,eAAe,EACf,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAMtD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,KAAK,wBAAwB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAEzE,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE1E,OAAO,EAAE,KAAK,MAAM,EAAE,qBAAqB,EAAiB,MAAM,iBAAiB,CAAC;AACpF,OAAO,KAAK,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAI1F;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,mBAAmB;IAE9D;;;OAGG;IACH,WAAW,CAAC,EAAG,WAAW,CAAC;IAE3B,sCAAsC;IACtC,yBAAyB,CAAC,EAAG,4BAA4B,CAAC;IAE1D,yCAAyC;IACzC,oBAAoB,CAAC,EAAG,oBAAoB,CAAC;IAE7C;;OAEG;IACH,uBAAuB,CAAC,EAAG,OAAO,CAAC;IAEnC;;OAEG;IACH,mBAAmB,CAAC,EAAG,OAAO,CAAC;IAE/B,qEAAqE;IACrE,MAAM,CAAC,EAAG,MAAM,CAAC;IAEjB;;;OAGG;IACH,iBAAiB,CAAC,EAAG,UAAU,CAAC;IAEhC;;;;;OAKG;IACH,OAAO,CAAC,EAAG,MAAM,CAAC;IAElB;;;;;OAKG;IACH,cAAc,CAAC,EAAG,MAAM,EAAE,CAAC;CAC9B;AAED;;GAEG;AACH,qBAAa,cAAc;IACvB,WAAW,CAAC,EAAG,WAAW,CAAC;IAC3B,UAAU,EAAG,UAAU,CAAC;IACxB,iBAAiB,EAAG,UAAU,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAG,qBAAqB,CAAC;IAC5C,OAAO,CAAC,OAAO,CAAiB;IAChC,QAAQ,CAAC,cAAc,EAAG;QAAC,CAAC,GAAG,EAAC,MAAM,GAAI,aAAa,CAAA;KAAC,CAAC;IAGzD,OAAO,CAAC,uBAAuB,CAAmB;IAClD,OAAO,CAAC,mBAAmB,CAAmB;IAC9C,OAAO,CAAC,YAAY,CAAC,CAAgB;IACrC,cAAc,EAAG,MAAM,EAAE,CAAM;IAE/B;;;;;OAKG;gBAEC,UAAU,EAAG,UAAU,EACvB,cAAc,EAAG;QAAC,CAAC,GAAG,EAAC,MAAM,GAAI,aAAa,CAAA;KAAC,EAC/C,OAAO,GAAG,qBAA0B;IAwBxC;;OAEG;IACH,IAAI,iBAAiB,IAAK,MAAM,CAE/B;IAED;;OAEG;IACC,IAAI,iBAAiB,IAAK,MAAM,CAE/B;IAEL;;OAEG;IACH,IAAI,cAAc,IAAK,MAAM,CAE5B;IAED;;OAEG;IACH,IAAI,cAAc,IAAK,MAAM,CAE5B;IAED;;OAEG;IACH,IAAI,cAAc,IAAK,MAAM,CAE5B;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EACxB,MAAM,EAAE,wBAAwB,EAChC,WAAW,GAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAO,EACxC,OAAO,CAAC,EAAE,OAAO,EACjB,IAAI,CAAC,EAAE,IAAI,EACX,SAAS,GAAG,OAAe,GACzB,OAAO,CAAC;QACN,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,IAAI,EAAE,IAAI,CAAC;QACX,OAAO,EAAE,WAAW,CAAC;KACxB,CAAC;IA2DN;;;;;;OAMG;IACG,sBAAsB,CAAC,WAAW,GAAE;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAM,GACjE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,qBAAqB,EAAE,MAAM,CAAA;KAAC,CAAC;IAYrF;;;;;;;;OAQG;IACG,MAAM,CAAC,SAAS,EAAG,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;IAKhD;;;;;;;;OAQG;IACG,aAAa,CAAC,MAAM,EAAG,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,EAAG,MAAM,GAAC,SAAS,GACpE,OAAO,CAAC,IAAI,CAAC;IAIjB;;;;;;;;;;;OAWG;IACG,gBAAgB,CAAC,SAAS,EAAG,MAAM,GACrC,OAAO,CAAC;QAAC,GAAG,EAAE,GAAG,CAAC;QAAC,IAAI,EAAE,IAAI,GAAC,SAAS,CAAA;KAAC,CAAC;IAI7C;;;;;;;;;;;OAWG;IACG,sBAAsB,CAAC,SAAS,EAAG,MAAM,GAC3C,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC;IAiB7B;;;;;;;;;;OAUG;IACG,gBAAgB,CAAC,SAAS,EAAG,MAAM,GAAI,OAAO,CAAC;QAAC,CAAC,GAAG,EAAC,MAAM,GAAE,GAAG,CAAA;KAAC,CAAC;IAOxE;;;OAGG;IACG,eAAe,IACjB,OAAO,CAAC;QAAC,UAAU,EAAG,MAAM,CAAC;QAAC,qBAAqB,EAAG,MAAM,CAAA;KAAC,CAAC;IAWlE;;;;;;OAMG;IACG,2BAA2B,CAAC,eAAe,EAAG,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC;IAK7E;;;;;;;OAOG;IACH,YAAY,CAAC,kBAAkB,EAAG,MAAM,GAAI,MAAM;IAIlD;;;;;;;;OAQG;IACH,6BAA6B,CAAC,eAAe,EAAG,MAAM,GAAC,SAAS,EAAE,qBAAqB,EAAG,MAAM,GAAC,SAAS;IAK1G;;;;OAIG;IACH,kBAAkB,CAAC,eAAe,EAAG,MAAM;IAI3C;;;;;OAKG;IACG,qBAAqB,CAAC,SAAS,EAAG,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;IAU/D;;;;;;;;OAQG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,EACrC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,GAAI,OAAO,CAAC,IAAI,CAAC;IAOlD;;;;;;;;OAQG;IACO,qBAAqB,CAAC,SAAS,EAAE,MAAM,EACzC,SAAS,EAAE;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,GAAG,CAAA;KAAE,EAAE,GAAI,OAAO,CAAC,IAAI,CAAC;IASrE;;;;;;;MAOE;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,EACrC,IAAI,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;IAOhC;;;;OAIG;IACG,aAAa,CAAC,SAAS,EAAG,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;IAKvD;;;;;;;;;;;;;OAaG;IACG,UAAU,CAAC,IAAI,EAAE,eAAe,EAClC,MAAM,EAAE,wBAAwB,EAChC,YAAY,CAAC,EAAE,wBAAwB,EACvC,qBAAqB,GAAE,OAAe,EACtC,aAAa,UAAQ,GACnB,OAAO,CAAC,IAAI,CAAC;IAenB;;;OAGG;IACG,oBAAoB,CAAC,QAAQ,EAAG,MAAM;IAK5C;;;;;;;;;;;;;;;OAeG;IACG,uBAAuB,CACzB,IAAI,EAAG,eAAe,EACtB,MAAM,EAAG,wBAAwB,EACjC,SAAS,EAAG,MAAM,EAClB,YAAY,CAAC,EAAG,wBAAwB,GACpC,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,GAAC,MAAM,CAAC;QAAC,QAAQ,EAAG;YAAC,CAAC,GAAG,EAAC,MAAM,GAAI,GAAG,CAAA;SAAC,CAAA;KAAC,CAAC;IAqBzE;;;;;;;;OAQG;IACG,sBAAsB,CACxB,IAAI,EAAG,IAAI,EACX,UAAU,EAAG,MAAM,GAAC,SAAS,EAC7B,SAAS,EAAG,MAAM,GAAI,OAAO,CAAC;QAAC,CAAC,GAAG,EAAC,MAAM,GAAI,GAAG,CAAA;KAAC,CAAC;IA6BvD;;;;;;;;;;;;OAYG;IACG,qBAAqB,CAAC,SAAS,EAAE,MAAM,GACzC,OAAO,CAAC;QACJ,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;QACxB,QAAQ,EAAE;YAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;SAAE,CAAC;QACjC,OAAO,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAA;KAC3C,CAAC;IAsBN;;;;;;;;;OASG;IACG,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,EACzD,SAAS,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;IA4CtC;;;;;;OAMG;YACW,sBAAsB;IAqBpC;;;;;;;;;;OAUG;IACG,0BAA0B,CAC5B,IAAI,EAAG,IAAI,EACX,SAAS,EAAG,MAAM,EAClB,WAAW,EAAG;QAAC,CAAC,GAAG,EAAC,MAAM,GAAG,GAAG,CAAA;KAAC,EACjC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,WAAW,CAAC,EAAG,MAAM,GAAG,OAAO,CAAC;QAC5B,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;QAClC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;QAC/B,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAA;KAC5C,CAAC;IAsBN;;;;;;;;OAQG;IACG,0BAA0B,CAAC,MAAM,EAAE,wBAAwB,EAC7D,SAAS,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;IAqBtC;;;;;;;;OAQG;IACG,wBAAwB,CAAC,SAAS,EAAG,MAAM,GAAI,OAAO,CAAC;QAAC,CAAC,GAAG,EAAC,MAAM,GAAE,GAAG,CAAA;KAAC,CAAC;IAUhF;;;;;;;;;;;;;;;;OAgBG;IACG,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,EACzD,SAAS,EAAE,MAAM,EACjB,WAAW,GAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAO,EACxC,OAAO,CAAC,EAAE,OAAO,GACjB,OAAO,CAAC;QACJ,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,IAAI,EAAE,IAAI,CAAA;KACb,CAAC;IAmCN;;;QAGI;IACE,oBAAoB,CAAC,KAAK,EAAG,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;IAW1D;;;;;;;;OAQG;IACG,2BAA2B,CAAC,KAAK,EAAG,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;IAgCjE;;;;;OAKG;IACG,yBAAyB,CAAC,KAAK,EAAG,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;IAMzD,aAAa,CAAC,QAAQ,EAAE,MAAM,EAChC,YAAY,EAAE,CAAC,GAAG,CAAC,EACnB,SAAS,EAAE,wBAAwB,EACnC,YAAY,CAAC,EAAE,wBAAwB,EACvC,SAAS,CAAC,EAAE,wBAAwB,GAAI,OAAO,CAAC,IAAI,CAAC;IAwBzD;;;;;OAKG;IACG,UAAU,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,EAAG,IAAI,EAAE,qBAAqB,UAAQ,GAAI,OAAO,CAAC,OAAO,CAAC;IAoCrG;;;;;;;;;;OAUG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,EAC3B,YAAY,EAAE,CAAC,GAAG,CAAC,EACnB,MAAM,EAAE,wBAAwB,EAChC,YAAY,CAAC,EAAE,wBAAwB,GAAI,OAAO,CAAC,IAAI,CAAC;CA0B/D"}
@@ -0,0 +1,19 @@
1
+ export declare abstract class DbPool {
2
+ constructor();
3
+ abstract connect(): Promise<DbConnection>;
4
+ abstract parameters(): DbParameter;
5
+ }
6
+ export declare abstract class DbParameter {
7
+ constructor();
8
+ abstract nextParameter(): string;
9
+ }
10
+ export declare abstract class DbConnection {
11
+ abstract execute(query: string, values: any[]): Promise<{
12
+ [key: string]: any;
13
+ }[]>;
14
+ abstract startTransaction(): Promise<void>;
15
+ abstract commit(): Promise<void>;
16
+ abstract rollback(): Promise<void>;
17
+ abstract release(): void;
18
+ }
19
+ //# sourceMappingURL=dbconnection.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"dbconnection.d.ts","sourceRoot":"","sources":["../../src/storage/dbconnection.ts"],"names":[],"mappings":"AACA,8BAAsB,MAAM;;IAExB,QAAQ,CAAC,OAAO,IAAK,OAAO,CAAC,YAAY,CAAC;IAC1C,QAAQ,CAAC,UAAU,IAAK,WAAW;CACtC;AAED,8BAAsB,WAAW;;IAE7B,QAAQ,CAAC,aAAa,IAAK,MAAM;CACpC;AAED,8BAAsB,YAAY;IAC9B,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAG,MAAM,EAAE,MAAM,EAAG,GAAG,EAAE,GAAI,OAAO,CAAC;QAAC,CAAC,GAAG,EAAC,MAAM,GAAE,GAAG,CAAA;KAAC,EAAE,CAAC;IAChF,QAAQ,CAAC,gBAAgB,IAAK,OAAO,CAAC,IAAI,CAAC;IAC3C,QAAQ,CAAC,MAAM,IAAK,OAAO,CAAC,IAAI,CAAC;IACjC,QAAQ,CAAC,QAAQ,IAAK,OAAO,CAAC,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,IAAK,IAAI;CAE5B"}