@jsango/auth 1.0.0

package/dist/public/authentication/manager.d.ts

@@ -0,0 +1,23 @@
+import type { HttpRequest, RequestContext } from '@jsango/http';
+import type { AuthenticationResult, IAuthenticationStrategy } from '../types.js';
+export interface AuthenticationManagerOptions {
+    /**
+     * Deterministic list of strategies to evaluate in order.
+     */
+    readonly strategies?: readonly IAuthenticationStrategy[] | undefined;
+    /**
+     * If true (default), when a strategy detects credentials intended for it but they are
+     * invalid, expired, or malformed, the manager immediately halts and returns that failure,
+     * preventing silent fall-through to weaker strategies.
+     */
+    readonly failOnError?: boolean | undefined;
+}
+export declare class AuthenticationManager {
+    private readonly strategies;
+    private readonly failOnError;
+    constructor(options?: AuthenticationManagerOptions);
+    registerStrategy(strategy: IAuthenticationStrategy): this;
+    getStrategies(): readonly IAuthenticationStrategy[];
+    authenticate(request: HttpRequest, context: RequestContext): Promise<AuthenticationResult>;
+}
+//# sourceMappingURL=manager.d.ts.map

package/dist/public/authentication/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../../src/public/authentication/manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,KAAK,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEjF,MAAM,WAAW,4BAA4B;IAC3C;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,CAAC;IAErE;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC5C;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiC;IAC5D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAU;gBAEnB,OAAO,GAAE,4BAAiC;IAOtD,gBAAgB,CAAC,QAAQ,EAAE,uBAAuB,GAAG,IAAI;IAOzD,aAAa,IAAI,SAAS,uBAAuB,EAAE;IAI7C,YAAY,CACvB,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,oBAAoB,CAAC;CAiDjC"}

package/dist/public/authentication/manager.js

@@ -0,0 +1,64 @@
+import { AnonymousIdentity } from '../identity.js';
+export class AuthenticationManager {
+    strategies = [];
+    failOnError;
+    constructor(options = {}) {
+        if (options.strategies) {
+            this.strategies.push(...options.strategies);
+        }
+        this.failOnError = options.failOnError ?? true;
+    }
+    registerStrategy(strategy) {
+        if (!this.strategies.some((s) => s.name === strategy.name)) {
+            this.strategies.push(strategy);
+        }
+        return this;
+    }
+    getStrategies() {
+        return Object.freeze([...this.strategies]);
+    }
+    async authenticate(request, context) {
+        if (this.strategies.length === 0) {
+            return {
+                status: 'unauthenticated',
+                identity: new AnonymousIdentity(),
+            };
+        }
+        let lastFailure;
+        for (const strategy of this.strategies) {
+            try {
+                const result = await strategy.authenticate(request, context);
+                if (result.status === 'authenticated') {
+                    return result;
+                }
+                if (result.status !== 'unauthenticated') {
+                    // A strategy found credentials intended for it but they failed (invalid, expired, malformed)
+                    lastFailure = result;
+                    if (this.failOnError) {
+                        return result;
+                    }
+                }
+            }
+            catch (error) {
+                const failureResult = {
+                    status: 'invalid_credentials',
+                    identity: new AnonymousIdentity(),
+                    strategy: strategy.name,
+                    error: error instanceof Error ? error : new Error(String(error)),
+                };
+                if (this.failOnError) {
+                    return failureResult;
+                }
+                lastFailure = failureResult;
+            }
+        }
+        if (lastFailure) {
+            return lastFailure;
+        }
+        return {
+            status: 'unauthenticated',
+            identity: new AnonymousIdentity(),
+        };
+    }
+}
+//# sourceMappingURL=manager.js.map

package/dist/public/authentication/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../../src/public/authentication/manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiBnD,MAAM,OAAO,qBAAqB;IACf,UAAU,GAA8B,EAAE,CAAC;IAC3C,WAAW,CAAU;IAEtC,YAAmB,UAAwC,EAAE;QAC3D,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;IACjD,CAAC;IAEM,gBAAgB,CAAC,QAAiC;QACvD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,aAAa;QAClB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,YAAY,CACvB,OAAoB,EACpB,OAAuB;QAEvB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL,MAAM,EAAE,iBAAiB;gBACzB,QAAQ,EAAE,IAAI,iBAAiB,EAAE;aAClC,CAAC;QACJ,CAAC;QAED,IAAI,WAA6C,CAAC;QAElD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAE7D,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;oBACtC,OAAO,MAAM,CAAC;gBAChB,CAAC;gBAED,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;oBACxC,6FAA6F;oBAC7F,WAAW,GAAG,MAAM,CAAC;oBACrB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;wBACrB,OAAO,MAAM,CAAC;oBAChB,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,GAAyB;oBAC1C,MAAM,EAAE,qBAAqB;oBAC7B,QAAQ,EAAE,IAAI,iBAAiB,EAAE;oBACjC,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;iBACjE,CAAC;gBAEF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBACrB,OAAO,aAAa,CAAC;gBACvB,CAAC;gBACD,WAAW,GAAG,aAAa,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,OAAO;YACL,MAAM,EAAE,iBAAiB;YACzB,QAAQ,EAAE,IAAI,iBAAiB,EAAE;SAClC,CAAC;IACJ,CAAC;CACF"}

package/dist/public/authentication/password.d.ts

@@ -0,0 +1,24 @@
+export interface IPasswordHasher {
+    hash(password: string): Promise<string>;
+    verify(password: string, hash: string): Promise<boolean>;
+    needsRehash(hash: string): boolean;
+}
+export interface ScryptOptions {
+    readonly cost?: number | undefined;
+    readonly blockSize?: number | undefined;
+    readonly parallelization?: number | undefined;
+    readonly keyLength?: number | undefined;
+    readonly saltLength?: number | undefined;
+}
+export declare class ScryptPasswordHasher implements IPasswordHasher {
+    readonly cost: number;
+    readonly blockSize: number;
+    readonly parallelization: number;
+    readonly keyLength: number;
+    readonly saltLength: number;
+    constructor(options?: ScryptOptions);
+    hash(password: string): Promise<string>;
+    verify(password: string, hash: string): Promise<boolean>;
+    needsRehash(hash: string): boolean;
+}
+//# sourceMappingURL=password.d.ts.map

package/dist/public/authentication/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../src/public/authentication/password.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,qBAAa,oBAAqB,YAAW,eAAe;IAC1D,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,eAAe,EAAE,MAAM,CAAC;IACxC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,UAAU,EAAE,MAAM,CAAC;gBAEhB,OAAO,GAAE,aAAkB;IAQjC,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAavC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiD9D,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;CA4B1C"}

package/dist/public/authentication/password.js

@@ -0,0 +1,108 @@
+import * as crypto from 'node:crypto';
+function scryptAsync(password, salt, keyLength, options) {
+    return new Promise((resolve, reject) => {
+        crypto.scrypt(password, salt, keyLength, options, (err, derivedKey) => {
+            if (err) {
+                reject(err);
+            }
+            else {
+                resolve(derivedKey);
+            }
+        });
+    });
+}
+export class ScryptPasswordHasher {
+    cost;
+    blockSize;
+    parallelization;
+    keyLength;
+    saltLength;
+    constructor(options = {}) {
+        this.cost = options.cost ?? 16384; // 2^14
+        this.blockSize = options.blockSize ?? 8;
+        this.parallelization = options.parallelization ?? 1;
+        this.keyLength = options.keyLength ?? 32;
+        this.saltLength = options.saltLength ?? 16;
+    }
+    async hash(password) {
+        const salt = crypto.randomBytes(this.saltLength);
+        const derivedKey = await scryptAsync(password, salt, this.keyLength, {
+            N: this.cost,
+            r: this.blockSize,
+            p: this.parallelization,
+            maxmem: 32 * 1024 * 1024,
+        });
+        const log2N = Math.log2(this.cost);
+        return `$scrypt$ln=${log2N},r=${this.blockSize},p=${this.parallelization}$${salt.toString('base64')}$${derivedKey.toString('base64')}`;
+    }
+    async verify(password, hash) {
+        const parts = hash.split('$');
+        // Expected format: $scrypt$ln=...,r=...,p=...$<salt>$<key> -> 5 elements when split by $
+        if (parts.length !== 5 || parts[1] !== 'scrypt') {
+            return false;
+        }
+        const paramsStr = parts[2];
+        const saltB64 = parts[3];
+        const keyB64 = parts[4];
+        let cost = this.cost;
+        let blockSize = this.blockSize;
+        let parallelization = this.parallelization;
+        for (const param of paramsStr.split(',')) {
+            const [k, v] = param.split('=');
+            if (k === 'ln') {
+                cost = Math.pow(2, parseInt(v, 10));
+            }
+            else if (k === 'r') {
+                blockSize = parseInt(v, 10);
+            }
+            else if (k === 'p') {
+                parallelization = parseInt(v, 10);
+            }
+        }
+        const salt = Buffer.from(saltB64, 'base64');
+        const expectedKey = Buffer.from(keyB64, 'base64');
+        try {
+            const actualKey = (await scryptAsync(password, salt, expectedKey.length, {
+                N: cost,
+                r: blockSize,
+                p: parallelization,
+                maxmem: 32 * 1024 * 1024,
+            }));
+            if (actualKey.length !== expectedKey.length) {
+                // Equalize time before failing
+                crypto.timingSafeEqual(expectedKey, expectedKey);
+                return false;
+            }
+            return crypto.timingSafeEqual(actualKey, expectedKey);
+        }
+        catch {
+            return false;
+        }
+    }
+    needsRehash(hash) {
+        const parts = hash.split('$');
+        if (parts.length !== 5 || parts[1] !== 'scrypt') {
+            return true;
+        }
+        const paramsStr = parts[2];
+        let hashCost = 0;
+        let hashBlockSize = 0;
+        let hashParallelization = 0;
+        for (const param of paramsStr.split(',')) {
+            const [k, v] = param.split('=');
+            if (k === 'ln') {
+                hashCost = Math.pow(2, parseInt(v, 10));
+            }
+            else if (k === 'r') {
+                hashBlockSize = parseInt(v, 10);
+            }
+            else if (k === 'p') {
+                hashParallelization = parseInt(v, 10);
+            }
+        }
+        return (hashCost < this.cost ||
+            hashBlockSize < this.blockSize ||
+            hashParallelization < this.parallelization);
+    }
+}
+//# sourceMappingURL=password.js.map

package/dist/public/authentication/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../../src/public/authentication/password.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,SAAS,WAAW,CAClB,QAAyB,EACzB,IAAqB,EACrB,SAAiB,EACjB,OAA6B;IAE7B,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE;YACpE,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,UAAU,CAAC,CAAC;YACtB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAgBD,MAAM,OAAO,oBAAoB;IACf,IAAI,CAAS;IACb,SAAS,CAAS;IAClB,eAAe,CAAS;IACxB,SAAS,CAAS;IAClB,UAAU,CAAS;IAEnC,YAAmB,UAAyB,EAAE;QAC5C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,OAAO;QAC1C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,QAAgB;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE;YACnE,CAAC,EAAE,IAAI,CAAC,IAAI;YACZ,CAAC,EAAE,IAAI,CAAC,SAAS;YACjB,CAAC,EAAE,IAAI,CAAC,eAAe;YACvB,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SACzB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,cAAc,KAAK,MAAM,IAAI,CAAC,SAAS,MAAM,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACzI,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,IAAY;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,yFAAyF;QACzF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAEzB,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACrB,IAAI,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,IAAI,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAE3C,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YACvC,CAAC;iBAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACrB,SAAS,GAAG,QAAQ,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;YAC/B,CAAC;iBAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACrB,eAAe,GAAG,QAAQ,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAElD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;gBACvE,CAAC,EAAE,IAAI;gBACP,CAAC,EAAE,SAAS;gBACZ,CAAC,EAAE,eAAe;gBAClB,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;aACzB,CAAC,CAAW,CAAC;YAEd,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;gBAC5C,+BAA+B;gBAC/B,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;gBACjD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEM,WAAW,CAAC,IAAY;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAC5B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,mBAAmB,GAAG,CAAC,CAAC;QAE5B,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAC3C,CAAC;iBAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACrB,aAAa,GAAG,QAAQ,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;YACnC,CAAC;iBAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACrB,mBAAmB,GAAG,QAAQ,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAED,OAAO,CACL,QAAQ,GAAG,IAAI,CAAC,IAAI;YACpB,aAAa,GAAG,IAAI,CAAC,SAAS;YAC9B,mBAAmB,GAAG,IAAI,CAAC,eAAe,CAC3C,CAAC;IACJ,CAAC;CACF"}

package/dist/public/authentication/session.d.ts

@@ -0,0 +1,31 @@
+import type { AuthenticationResult, CreateSessionData, IAuthenticationStrategy, ISessionStore, Session } from '../types.js';
+import type { HttpRequest, RequestContext } from '@jsango/http';
+export declare class MemorySessionStore implements ISessionStore {
+    private readonly sessions;
+    private readonly defaultTtlMs;
+    constructor(defaultTtlMs?: number);
+    get(id: string): Promise<Session | undefined>;
+    create(data: CreateSessionData): Promise<Session>;
+    update(id: string, data: Partial<Session>): Promise<Session | undefined>;
+    delete(id: string): Promise<boolean>;
+    touch(id: string, ttlMs?: number): Promise<boolean>;
+    listByIdentity(identityId: string): Promise<Session[]>;
+    deleteByIdentity(identityId: string, excludeSessionId?: string): Promise<number>;
+    clear(): void;
+}
+export interface SessionAuthStrategyOptions {
+    readonly store: ISessionStore;
+    readonly cookieName?: string | undefined;
+}
+export declare class SessionAuthenticationStrategy implements IAuthenticationStrategy {
+    readonly name = "session";
+    readonly store: ISessionStore;
+    readonly cookieName: string;
+    constructor(options: SessionAuthStrategyOptions);
+    authenticate(request: HttpRequest, _context: RequestContext): Promise<AuthenticationResult>;
+    /**
+     * Rotates a session identifier to prevent session fixation attacks.
+     */
+    rotate(oldSessionId: string): Promise<Session | undefined>;
+}
+//# sourceMappingURL=session.d.ts.map

package/dist/public/authentication/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/public/authentication/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,aAAa,EACb,OAAO,EACR,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEhE,qBAAa,kBAAmB,YAAW,aAAa;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8B;IACvD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;gBAEnB,YAAY,SAAsB;IAIxC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAc7C,MAAM,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBjD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAmBxE,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIpC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBnD,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAetD,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAWtF,KAAK,IAAI,IAAI;CAGrB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,qBAAa,6BAA8B,YAAW,uBAAuB;IAC3E,SAAgB,IAAI,aAAa;IACjC,SAAgB,KAAK,EAAE,aAAa,CAAC;IACrC,SAAgB,UAAU,EAAE,MAAM,CAAC;gBAEhB,OAAO,EAAE,0BAA0B;IAKzC,YAAY,CACvB,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,oBAAoB,CAAC;IA2ChC;;OAEG;IACU,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;CAoBxE"}

package/dist/public/authentication/session.js

@@ -0,0 +1,165 @@
+import { CryptoUtils } from '../../internal/crypto-utils.js';
+import { UserIdentity } from '../identity.js';
+export class MemorySessionStore {
+    sessions = new Map();
+    defaultTtlMs;
+    constructor(defaultTtlMs = 24 * 60 * 60 * 1000) {
+        this.defaultTtlMs = defaultTtlMs;
+    }
+    async get(id) {
+        const session = this.sessions.get(id);
+        if (!session) {
+            return undefined;
+        }
+        if (Date.now() > session.expiresAt) {
+            this.sessions.delete(id);
+            return undefined;
+        }
+        return session;
+    }
+    async create(data) {
+        const id = CryptoUtils.generateSecureToken(32);
+        const now = Date.now();
+        const ttl = data.ttlMs ?? this.defaultTtlMs;
+        const session = {
+            id,
+            identityId: data.identityId,
+            roles: Object.freeze([...(data.roles ?? [])]),
+            tenantId: data.tenantId,
+            createdAt: now,
+            updatedAt: now,
+            expiresAt: now + ttl,
+            data: Object.freeze({ ...(data.data ?? {}) }),
+        };
+        this.sessions.set(id, session);
+        return session;
+    }
+    async update(id, data) {
+        const existing = await this.get(id);
+        if (!existing) {
+            return undefined;
+        }
+        const updated = {
+            ...existing,
+            ...data,
+            id: existing.id, // prevent ID overwrite
+            identityId: existing.identityId,
+            updatedAt: Date.now(),
+            data: data.data ? Object.freeze({ ...existing.data, ...data.data }) : existing.data,
+        };
+        this.sessions.set(id, updated);
+        return updated;
+    }
+    async delete(id) {
+        return this.sessions.delete(id);
+    }
+    async touch(id, ttlMs) {
+        const session = await this.get(id);
+        if (!session) {
+            return false;
+        }
+        const ttl = ttlMs ?? this.defaultTtlMs;
+        const touched = {
+            ...session,
+            updatedAt: Date.now(),
+            expiresAt: Date.now() + ttl,
+        };
+        this.sessions.set(id, touched);
+        return true;
+    }
+    async listByIdentity(identityId) {
+        const now = Date.now();
+        const result = [];
+        for (const [id, session] of this.sessions.entries()) {
+            if (now > session.expiresAt) {
+                this.sessions.delete(id);
+                continue;
+            }
+            if (session.identityId === identityId) {
+                result.push(session);
+            }
+        }
+        return result;
+    }
+    async deleteByIdentity(identityId, excludeSessionId) {
+        let deletedCount = 0;
+        for (const [id, session] of this.sessions.entries()) {
+            if (session.identityId === identityId && id !== excludeSessionId) {
+                this.sessions.delete(id);
+                deletedCount++;
+            }
+        }
+        return deletedCount;
+    }
+    clear() {
+        this.sessions.clear();
+    }
+}
+export class SessionAuthenticationStrategy {
+    name = 'session';
+    store;
+    cookieName;
+    constructor(options) {
+        this.store = options.store;
+        this.cookieName = options.cookieName ?? 'session_id';
+    }
+    async authenticate(request, _context) {
+        const sessionId = request.cookies[this.cookieName];
+        if (!sessionId) {
+            return {
+                status: 'unauthenticated',
+                identity: new (await import('../identity.js')).AnonymousIdentity(),
+                strategy: this.name,
+            };
+        }
+        const session = await this.store.get(sessionId);
+        if (!session) {
+            return {
+                status: 'invalid_credentials',
+                identity: new (await import('../identity.js')).AnonymousIdentity(),
+                strategy: this.name,
+            };
+        }
+        if (Date.now() > session.expiresAt) {
+            await this.store.delete(sessionId);
+            return {
+                status: 'expired_credentials',
+                identity: new (await import('../identity.js')).AnonymousIdentity(),
+                strategy: this.name,
+            };
+        }
+        const identity = new UserIdentity({
+            id: session.identityId,
+            roles: session.roles,
+            tenantId: session.tenantId,
+            metadata: { sessionId: session.id, ...session.data },
+        });
+        return {
+            status: 'authenticated',
+            identity,
+            strategy: this.name,
+            metadata: { sessionId: session.id },
+        };
+    }
+    /**
+     * Rotates a session identifier to prevent session fixation attacks.
+     */
+    async rotate(oldSessionId) {
+        const oldSession = await this.store.get(oldSessionId);
+        if (!oldSession) {
+            return undefined;
+        }
+        // Create new session with identical data
+        const newSession = await this.store.create({
+            identityId: oldSession.identityId,
+            roles: oldSession.roles,
+            tenantId: oldSession.tenantId,
+            data: { ...oldSession.data },
+            ttlMs: oldSession.expiresAt - Date.now(),
+        });
+        // Invalidate old session
+        await this.store.delete(oldSessionId);
+        return newSession;
+    }
+}
+//# sourceMappingURL=session.js.map

package/dist/public/authentication/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/public/authentication/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAU9C,MAAM,OAAO,kBAAkB;IACZ,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IACtC,YAAY,CAAS;IAEtC,YAAmB,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QACnD,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,EAAU;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,IAAuB;QACzC,MAAM,EAAE,GAAG,WAAW,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC;QAE5C,MAAM,OAAO,GAAY;YACvB,EAAE;YACF,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG,GAAG,GAAG;YACpB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;SAC9C,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,IAAsB;QACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,OAAO,GAAY;YACvB,GAAG,QAAQ;YACX,GAAG,IAAI;YACP,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,uBAAuB;YACxC,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI;SACpF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,EAAU;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,KAAc;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC;QACvC,MAAM,OAAO,GAAY;YACvB,GAAG,OAAO;YACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG;SAC5B,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,UAAkB;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACpD,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,UAAkB,EAAE,gBAAyB;QACzE,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACpD,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,IAAI,EAAE,KAAK,gBAAgB,EAAE,CAAC;gBACjE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACzB,YAAY,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAEM,KAAK;QACV,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACF;AAOD,MAAM,OAAO,6BAA6B;IACxB,IAAI,GAAG,SAAS,CAAC;IACjB,KAAK,CAAgB;IACrB,UAAU,CAAS;IAEnC,YAAmB,OAAmC;QACpD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;IACvD,CAAC;IAEM,KAAK,CAAC,YAAY,CACvB,OAAoB,EACpB,QAAwB;QAExB,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,iBAAiB;gBACzB,QAAQ,EAAE,IAAI,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,EAAE;gBAClE,QAAQ,EAAE,IAAI,CAAC,IAAI;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,MAAM,EAAE,qBAAqB;gBAC7B,QAAQ,EAAE,IAAI,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,EAAE;gBAClE,QAAQ,EAAE,IAAI,CAAC,IAAI;aACpB,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACnC,OAAO;gBACL,MAAM,EAAE,qBAAqB;gBAC7B,QAAQ,EAAE,IAAI,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,EAAE;gBAClE,QAAQ,EAAE,IAAI,CAAC,IAAI;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAC;YAChC,EAAE,EAAE,OAAO,CAAC,UAAU;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE;SACrD,CAAC,CAAC;QAEH,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,QAAQ;YACR,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,QAAQ,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE;SACpC,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,MAAM,CAAC,YAAoB;QACtC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,yCAAyC;QACzC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACzC,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE;YAC5B,KAAK,EAAE,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;SACzC,CAAC,CAAC;QAEH,yBAAyB;QACzB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAEtC,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}

package/dist/public/authentication/totp.d.ts

@@ -0,0 +1,52 @@
+export interface TotpSecretResult {
+    readonly secret: string;
+    readonly uri: string;
+    readonly qrCodeUrl: string;
+}
+export interface TotpSetupOptions {
+    readonly issuer: string;
+    readonly accountName: string;
+    readonly secretLength?: number | undefined;
+}
+export interface TotpVerifyOptions {
+    readonly window?: number | undefined;
+    readonly stepSeconds?: number | undefined;
+    readonly digits?: number | undefined;
+}
+/**
+ * Base32 encoder according to RFC 4648.
+ */
+export declare function base32Encode(buffer: Buffer): string;
+/**
+ * Base32 decoder according to RFC 4648.
+ */
+export declare function base32Decode(base32: string): Buffer;
+/**
+ * TOTP (Time-Based One-Time Password) Service implementing RFC 6238 and RFC 4226.
+ */
+export declare class TotpService {
+    /**
+     * Generates a new cryptographic TOTP secret and corresponding otpauth:// URI.
+     */
+    generateSecret(options: TotpSetupOptions): TotpSecretResult;
+    /**
+     * Generates a TOTP code for the given secret at a specific timestamp.
+     */
+    generateToken(secret: string, timestampMs?: number, options?: TotpVerifyOptions): string;
+    /**
+     * Verifies a user-provided 6-digit TOTP code against the secret, allowing clock drift.
+     */
+    verifyToken(token: string, secret: string, options?: TotpVerifyOptions): boolean;
+    /**
+     * Generates a set of cryptographically secure emergency backup recovery codes.
+     */
+    generateBackupCodes(count?: number): string[];
+    /**
+     * Verifies and burns a backup recovery code.
+     */
+    verifyAndConsumeBackupCode(providedCode: string, storedCodes: string[]): {
+        valid: boolean;
+        remainingCodes: string[];
+    };
+}
+//# sourceMappingURL=totp.d.ts.map

package/dist/public/authentication/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../../src/public/authentication/totp.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAID;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAoBnD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAsBnD;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB;;OAEG;IACI,cAAc,CAAC,OAAO,EAAE,gBAAgB,GAAG,gBAAgB;IAmBlE;;OAEG;IACI,aAAa,CAClB,MAAM,EAAE,MAAM,EACd,WAAW,SAAa,EACxB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,MAAM;IAwBT;;OAEG;IACI,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO;IAyBvF;;OAEG;IACI,mBAAmB,CAAC,KAAK,SAAI,GAAG,MAAM,EAAE;IAU/C;;OAEG;IACI,0BAA0B,CAC/B,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EAAE,GACpB;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAA;KAAE;CAYhD"}

package/dist/public/authentication/totp.js

@@ -0,0 +1,138 @@
+import { createHmac, randomBytes } from 'node:crypto';
+import { timingSafeEqualString } from '../../internal/timing.js';
+const BASE32_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+/**
+ * Base32 encoder according to RFC 4648.
+ */
+export function base32Encode(buffer) {
+    let bits = 0;
+    let value = 0;
+    let output = '';
+    for (let i = 0; i < buffer.length; i++) {
+        value = (value << 8) | buffer[i];
+        bits += 8;
+        while (bits >= 5) {
+            output += BASE32_ALPHABET[(value >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0) {
+        output += BASE32_ALPHABET[(value << (5 - bits)) & 31];
+    }
+    return output;
+}
+/**
+ * Base32 decoder according to RFC 4648.
+ */
+export function base32Decode(base32) {
+    const cleaned = base32.toUpperCase().replace(/=+$/, '').replace(/\s+/g, '');
+    let bits = 0;
+    let value = 0;
+    const bytes = [];
+    for (let i = 0; i < cleaned.length; i++) {
+        const idx = BASE32_ALPHABET.indexOf(cleaned[i]);
+        if (idx === -1) {
+            continue; // skip unknown chars
+        }
+        value = (value << 5) | idx;
+        bits += 5;
+        if (bits >= 8) {
+            bytes.push((value >>> (bits - 8)) & 255);
+            bits -= 8;
+        }
+    }
+    return Buffer.from(bytes);
+}
+/**
+ * TOTP (Time-Based One-Time Password) Service implementing RFC 6238 and RFC 4226.
+ */
+export class TotpService {
+    /**
+     * Generates a new cryptographic TOTP secret and corresponding otpauth:// URI.
+     */
+    generateSecret(options) {
+        const length = options.secretLength ?? 20; // 160-bit key recommended by RFC 4226
+        const randomBuffer = randomBytes(length);
+        const secret = base32Encode(randomBuffer);
+        const encodedIssuer = encodeURIComponent(options.issuer);
+        const encodedAccount = encodeURIComponent(options.accountName);
+        const uri = `otpauth://totp/${encodedIssuer}:${encodedAccount}?secret=${secret}&issuer=${encodedIssuer}&algorithm=SHA1&digits=6&period=30`;
+        // SVG / QR representation URL (standard compatible format)
+        const qrCodeUrl = `https://api.qrserver.com/v1/create-qr-code/?size=200x200&data=${encodeURIComponent(uri)}`;
+        return {
+            secret,
+            uri,
+            qrCodeUrl,
+        };
+    }
+    /**
+     * Generates a TOTP code for the given secret at a specific timestamp.
+     */
+    generateToken(secret, timestampMs = Date.now(), options) {
+        const step = options?.stepSeconds ?? 30;
+        const digits = options?.digits ?? 6;
+        const counter = Math.floor(timestampMs / 1000 / step);
+        const counterBuffer = Buffer.alloc(8);
+        counterBuffer.writeBigInt64BE(BigInt(counter));
+        const key = base32Decode(secret);
+        const hmac = createHmac('sha1', key);
+        hmac.update(counterBuffer);
+        const digest = hmac.digest();
+        const offset = digest[digest.length - 1] & 0x0f;
+        const binary = ((digest[offset] & 0x7f) << 24) |
+            ((digest[offset + 1] & 0xff) << 16) |
+            ((digest[offset + 2] & 0xff) << 8) |
+            (digest[offset + 3] & 0xff);
+        const otp = binary % 10 ** digits;
+        return otp.toString().padStart(digits, '0');
+    }
+    /**
+     * Verifies a user-provided 6-digit TOTP code against the secret, allowing clock drift.
+     */
+    verifyToken(token, secret, options) {
+        if (!token || typeof token !== 'string') {
+            return false;
+        }
+        const cleanToken = token.trim().replace(/\s+/g, '');
+        if (cleanToken.length !== (options?.digits ?? 6)) {
+            return false;
+        }
+        const window = options?.window ?? 1;
+        const step = options?.stepSeconds ?? 30;
+        const now = Date.now();
+        for (let i = -window; i <= window; i++) {
+            const checkTime = now + i * step * 1000;
+            const expectedToken = this.generateToken(secret, checkTime, options);
+            if (timingSafeEqualString(cleanToken, expectedToken)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Generates a set of cryptographically secure emergency backup recovery codes.
+     */
+    generateBackupCodes(count = 8) {
+        const codes = [];
+        for (let i = 0; i < count; i++) {
+            const part1 = randomBytes(2).toString('hex').toUpperCase();
+            const part2 = randomBytes(2).toString('hex').toUpperCase();
+            codes.push(`${part1}-${part2}`);
+        }
+        return codes;
+    }
+    /**
+     * Verifies and burns a backup recovery code.
+     */
+    verifyAndConsumeBackupCode(providedCode, storedCodes) {
+        const clean = providedCode.trim().toUpperCase();
+        const index = storedCodes.findIndex((c) => timingSafeEqualString(c.toUpperCase(), clean));
+        if (index === -1) {
+            return { valid: false, remainingCodes: storedCodes };
+        }
+        const remaining = [...storedCodes];
+        remaining.splice(index, 1);
+        return { valid: true, remainingCodes: remaining };
+    }
+}
+//# sourceMappingURL=totp.js.map