@korajs/auth 0.5.0 → 1.0.0-beta.0

package/dist/server.d.cts

@@ -3602,6 +3602,13 @@ interface TotpSecret {
     createdAt: number;
     /** When MFA was verified (confirmed with first valid code) */
     verifiedAt: number | null;
+    /**
+     * The most recent TOTP time-step counter that was successfully consumed
+     * during authentication. Used to enforce single-use of codes (RFC 6238 §5.2):
+     * a code at or before this time-step is rejected as a replay. `undefined`
+     * until the first code is consumed.
+     */
+    lastUsedTimeStep?: number;
 }
 /**
  * Setup result returned when enabling TOTP MFA.
@@ -3702,6 +3709,11 @@ declare class TotpManager {
     /**
      * Verify a TOTP code during login.
      * Returns true if the code is valid, false otherwise.
+     *
+     * Enforces single-use: a code is rejected if its time-step has already
+     * been consumed (or predates a previously consumed time-step). This
+     * prevents an attacker who observes one valid code from replaying it
+     * within the acceptance window (RFC 6238 §5.2).
      */
     verify(userId: string, code: string): Promise<boolean>;
     /**
@@ -3728,6 +3740,18 @@ declare class TotpManager {
      */
     remainingRecoveryCodes(userId: string): Promise<number>;
     private validateCode;
+    /**
+     * Find the TOTP time-step counter (within the acceptance window) whose
+     * generated code matches `code`, or null if none matches. Comparison is
+     * timing-safe.
+     */
+    private matchTimeStep;
+    /**
+     * Validate a code AND consume its time-step so it (and any earlier code in
+     * the window) cannot be reused. Returns false for an invalid code or a
+     * replay of an already-consumed time-step. Persists the consumed time-step.
+     */
+    private consumeCode;
 }
 /**
  * Encode bytes to base32 string (RFC 4648, no padding).

package/dist/server.d.ts

@@ -3602,6 +3602,13 @@ interface TotpSecret {
     createdAt: number;
     /** When MFA was verified (confirmed with first valid code) */
     verifiedAt: number | null;
+    /**
+     * The most recent TOTP time-step counter that was successfully consumed
+     * during authentication. Used to enforce single-use of codes (RFC 6238 §5.2):
+     * a code at or before this time-step is rejected as a replay. `undefined`
+     * until the first code is consumed.
+     */
+    lastUsedTimeStep?: number;
 }
 /**
  * Setup result returned when enabling TOTP MFA.
@@ -3702,6 +3709,11 @@ declare class TotpManager {
     /**
      * Verify a TOTP code during login.
      * Returns true if the code is valid, false otherwise.
+     *
+     * Enforces single-use: a code is rejected if its time-step has already
+     * been consumed (or predates a previously consumed time-step). This
+     * prevents an attacker who observes one valid code from replaying it
+     * within the acceptance window (RFC 6238 §5.2).
      */
     verify(userId: string, code: string): Promise<boolean>;
     /**
@@ -3728,6 +3740,18 @@ declare class TotpManager {
      */
     remainingRecoveryCodes(userId: string): Promise<number>;
     private validateCode;
+    /**
+     * Find the TOTP time-step counter (within the acceptance window) whose
+     * generated code matches `code`, or null if none matches. Comparison is
+     * timing-safe.
+     */
+    private matchTimeStep;
+    /**
+     * Validate a code AND consume its time-step so it (and any earlier code in
+     * the window) cannot be reused. Returns false for an invalid code or a
+     * replay of an already-consumed time-step. Persists the consumed time-step.
+     */
+    private consumeCode;
 }
 /**
  * Encode bytes to base32 string (RFC 4648, no padding).

package/dist/server.js

@@ -3783,6 +3783,13 @@ var OrgRoutes = class {
         body: { error: "Cannot assign owner role directly. Use ownership transfer." }
       };
     }
+    const org = await this.store.getOrg(orgId);
+    if (org && org.ownerId === params.targetUserId) {
+      return {
+        status: 403,
+        body: { error: "The organization owner's role cannot be changed. Use ownership transfer." }
+      };
+    }
     const callerMembership = await this.store.getMembership(orgId, userId);
     if (callerMembership && callerMembership.role !== "owner" && params.role === "admin") {
       return { status: 403, body: { error: "Only the owner can assign admin role." } };
@@ -5358,9 +5365,9 @@ var TotpManager = class {
       throw new TotpNotEnabledError(userId);
     }
     if (stored.verified) {
-      return this.validateCode(stored.secret, code);
+      return this.consumeCode(stored, code);
     }
-    const valid = this.validateCode(stored.secret, code);
+    const valid = await this.consumeCode(stored, code);
     if (!valid) {
       throw new TotpInvalidCodeError();
     }
@@ -5372,6 +5379,11 @@ var TotpManager = class {
   /**
    * Verify a TOTP code during login.
    * Returns true if the code is valid, false otherwise.
+   *
+   * Enforces single-use: a code is rejected if its time-step has already
+   * been consumed (or predates a previously consumed time-step). This
+   * prevents an attacker who observes one valid code from replaying it
+   * within the acceptance window (RFC 6238 §5.2).
    */
   async verify(userId, code) {
     const stored = await this.store.getByUserId(userId);
@@ -5381,7 +5393,7 @@ var TotpManager = class {
     if (!stored.verified) {
       throw new TotpNotVerifiedError(userId);
     }
-    return this.validateCode(stored.secret, code);
+    return this.consumeCode(stored, code);
   }
   /**
    * Verify a recovery code as an alternative to TOTP.
@@ -5465,16 +5477,41 @@ var TotpManager = class {
   }
   // --- Private ---
   validateCode(base32Secret, code) {
+    return this.matchTimeStep(base32Secret, code) !== null;
+  }
+  /**
+   * Find the TOTP time-step counter (within the acceptance window) whose
+   * generated code matches `code`, or null if none matches. Comparison is
+   * timing-safe.
+   */
+  matchTimeStep(base32Secret, code) {
     const secretBytes = base32Decode(base32Secret);
     const now = Math.floor(Date.now() / 1e3);
     for (let offset = -this.window; offset <= this.window; offset++) {
       const timeCounter = Math.floor((now + offset * this.period) / this.period);
       const expected = generateTotpCode(secretBytes, timeCounter, this.digits, this.algorithm);
       if (timingSafeEqual(code, expected)) {
-        return true;
+        return timeCounter;
       }
     }
-    return false;
+    return null;
+  }
+  /**
+   * Validate a code AND consume its time-step so it (and any earlier code in
+   * the window) cannot be reused. Returns false for an invalid code or a
+   * replay of an already-consumed time-step. Persists the consumed time-step.
+   */
+  async consumeCode(stored, code) {
+    const matched = this.matchTimeStep(stored.secret, code);
+    if (matched === null) {
+      return false;
+    }
+    if (stored.lastUsedTimeStep !== void 0 && matched <= stored.lastUsedTimeStep) {
+      return false;
+    }
+    stored.lastUsedTimeStep = matched;
+    await this.store.save(stored);
+    return true;
   }
 };
 function generateTotpCode(secret, counter, digits, algorithm) {