@lacrous/omnicloud 0.2.7 → 0.2.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lacrous/omnicloud",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "SDK and core building blocks for OmniCloud — self-hosted cloud storage powered by your Telegram account.",
   "license": "MIT",
   "type": "module",
@@ -48,9 +48,9 @@
     "prisma": "^6.2.0"
   },
   "devDependencies": {
-    "@omnicloud/core": "0.2.7",
-    "@omnicloud/shared": "0.2.7",
-    "@omnicloud/telegram": "0.2.7",
+    "@omnicloud/core": "0.2.9",
+    "@omnicloud/shared": "0.2.9",
+    "@omnicloud/telegram": "0.2.9",
     "@types/node": "^22.10.0",
     "esbuild": "0.25.12",
     "tsup": "^8.3.0",

package/server/index.js

@@ -2912,10 +2912,13 @@ var TelegramStorageProvider = class {
 };
 
 // ../telegram/src/connection.ts
+import { randomUUID } from "node:crypto";
 import { Api as Api3 } from "telegram";
 import { computeCheck } from "telegram/Password.js";
 var TELEGRAM_PROVIDER = "telegram";
 var LOGIN_FLOW_TTL_MS = 5 * 60 * 1e3;
+var QR_FLOW_TTL_MS = 5 * 60 * 1e3;
+var QR_APPROVAL_POLL_MS = 2e3;
 var TelegramConnectionService = class {
   constructor(repos, clientManager, credentials) {
     this.repos = repos;
@@ -2923,6 +2926,7 @@ var TelegramConnectionService = class {
     this.credentials = credentials;
   }
   flows = /* @__PURE__ */ new Map();
+  qrFlows = /* @__PURE__ */ new Map();
   /** Sends the Telegram confirmation code for the phone number. */
   async startLogin(phone) {
     this.sweepExpiredFlows();
@@ -2971,6 +2975,167 @@ var TelegramConnectionService = class {
     }
     return this.finalizeLogin(flow);
   }
+  /**
+   * Starts a QR sign-in. Returns a flow id and the first login token. The phone
+   * approves the token in the Telegram app; `pollQrLogin` reports the result.
+   */
+  async startQrLogin() {
+    this.sweepExpiredQrFlows();
+    const client = newTelegramClient(this.credentials);
+    try {
+      await client.connect();
+      const flow = {
+        client,
+        createdAt: Date.now(),
+        approved: false,
+        needsPassword: false,
+        failure: null
+      };
+      const flowId = randomUUID();
+      const token = await this.exportQrToken(client);
+      this.qrFlows.set(flowId, flow);
+      this.watchQrApproval(flowId, flow);
+      return { flowId, token };
+    } catch (error) {
+      await this.disconnectQuietly(client);
+      throw mapTelegramError(error, "Could not start Telegram QR sign-in");
+    }
+  }
+  /**
+   * Reports where a QR sign-in stands. While waiting, returns a fresh token
+   * (Telegram rotates them every few seconds). On approval, completes the login.
+   */
+  async pollQrLogin(flowId) {
+    const flow = this.requireQrFlow(flowId);
+    if (flow.failure) {
+      this.qrFlows.delete(flowId);
+      await this.disconnectQuietly(flow.client);
+      throw new TelegramConnectionError(flow.failure);
+    }
+    if (flow.needsPassword) return { status: "password_required" };
+    if (!flow.approved) {
+      const token = await this.exportQrToken(flow.client).catch((error) => {
+        this.qrFlows.delete(flowId);
+        void this.disconnectQuietly(flow.client);
+        throw mapTelegramError(error, "Could not refresh the Telegram QR code");
+      });
+      return { status: "waiting", token };
+    }
+    return this.completeQrLogin(flowId, flow);
+  }
+  /** Completes a QR sign-in for an account with two-factor authentication. */
+  async submitQrPassword(flowId, password) {
+    const flow = this.requireQrFlow(flowId);
+    try {
+      const passwordInfo = await flow.client.invoke(new Api3.account.GetPassword());
+      const check = await computeCheck(passwordInfo, password);
+      await flow.client.invoke(new Api3.auth.CheckPassword({ password: check }));
+    } catch (error) {
+      throw mapTelegramError(error, "Telegram sign-in failed");
+    }
+    return this.completeQrLogin(flowId, flow);
+  }
+  async exportQrToken(client) {
+    const result = await client.invoke(
+      new Api3.auth.ExportLoginToken({
+        apiId: this.credentials.apiId,
+        apiHash: this.credentials.apiHash,
+        exceptIds: []
+      })
+    );
+    if (!(result instanceof Api3.auth.LoginToken)) {
+      throw new TelegramConnectionError("Telegram did not issue a QR login token");
+    }
+    const tokenBase64 = Buffer.from(result.token).toString("base64url");
+    return {
+      url: `tg://login?token=${tokenBase64}`,
+      expiresAt: result.expires * 1e3
+    };
+  }
+  /** Waits for the phone to approve the token, then marks the flow approved. */
+  watchQrApproval(flowId, flow) {
+    const timer = setInterval(() => {
+      if (Date.now() - flow.createdAt > QR_FLOW_TTL_MS) {
+        clearInterval(timer);
+        this.qrFlows.delete(flowId);
+        void this.disconnectQuietly(flow.client);
+        return;
+      }
+      if (flow.approved || flow.needsPassword || flow.failure) {
+        clearInterval(timer);
+        return;
+      }
+      this.probeQrApproval(flow).then(
+        (state) => {
+          if (state === "approved") {
+            flow.approved = true;
+            clearInterval(timer);
+          } else if (state === "password") {
+            flow.needsPassword = true;
+            clearInterval(timer);
+          }
+        },
+        (error) => {
+          flow.failure = mapTelegramError(error, "Telegram QR sign-in failed").message;
+          clearInterval(timer);
+        }
+      );
+    }, QR_APPROVAL_POLL_MS);
+    timer.unref();
+  }
+  /**
+   * Asks Telegram whether the token was approved. Approval is observed by
+   * `ExportLoginToken` returning `LoginTokenSuccess` (or a DC migration).
+   */
+  async probeQrApproval(flow) {
+    try {
+      const result = await flow.client.invoke(
+        new Api3.auth.ExportLoginToken({
+          apiId: this.credentials.apiId,
+          apiHash: this.credentials.apiHash,
+          exceptIds: []
+        })
+      );
+      if (result instanceof Api3.auth.LoginTokenSuccess) return "approved";
+      if (result instanceof Api3.auth.LoginTokenMigrateTo) {
+        await flow.client._switchDC(result.dcId);
+        const migrated = await flow.client.invoke(
+          new Api3.auth.ImportLoginToken({ token: result.token })
+        );
+        if (migrated instanceof Api3.auth.LoginTokenSuccess) return "approved";
+      }
+      return "pending";
+    } catch (error) {
+      if (isPasswordRequiredError(error)) return "password";
+      throw error;
+    }
+  }
+  async completeQrLogin(flowId, flow) {
+    this.qrFlows.delete(flowId);
+    const user = await this.finalizeConnectedClient(flow.client, null);
+    return { status: "approved", user };
+  }
+  requireQrFlow(flowId) {
+    const flow = this.qrFlows.get(flowId);
+    if (!flow) {
+      throw new NotFoundError("This Telegram QR sign-in has ended. Start again.");
+    }
+    if (Date.now() - flow.createdAt > QR_FLOW_TTL_MS) {
+      this.qrFlows.delete(flowId);
+      void this.disconnectQuietly(flow.client);
+      throw new ValidationError("The QR sign-in expired. Start again.");
+    }
+    return flow;
+  }
+  sweepExpiredQrFlows() {
+    const now = Date.now();
+    for (const [flowId, flow] of this.qrFlows) {
+      if (now - flow.createdAt > QR_FLOW_TTL_MS) {
+        this.qrFlows.delete(flowId);
+        void this.disconnectQuietly(flow.client);
+      }
+    }
+  }
   /** Aborts a pending login flow (disconnects the client). */
   async cancelLogin(phone) {
     const flow = this.flows.get(phone);
@@ -3032,11 +3197,20 @@ var TelegramConnectionService = class {
   }
   async finalizeLogin(flow) {
     this.flows.delete(flow.phone);
+    const user = await this.finalizeConnectedClient(flow.client, flow.phone);
+    return { status: "ok", user };
+  }
+  /**
+   * Saves an authorized client's session, upserts the user and creates storage.
+   * `phone` is the number the user typed; QR sign-in passes null and relies on
+   * the number Telegram reports.
+   */
+  async finalizeConnectedClient(client, phone) {
     let stringSession;
     let user;
     try {
-      stringSession = flow.client.session.save();
-      const me = await flow.client.getMe();
+      stringSession = client.session.save();
+      const me = await client.getMe();
       if (!(me instanceof Api3.User)) {
         throw new Error("Telegram did not return the authenticated user");
       }
@@ -3045,16 +3219,16 @@ var TelegramConnectionService = class {
         username: me.username ?? null,
         firstName: me.firstName ?? null,
         lastName: me.lastName ?? null,
-        phone: me.phone ?? flow.phone
+        phone: me.phone ?? phone ?? ""
       });
     } catch (error) {
-      await this.disconnectQuietly(flow.client);
+      await this.disconnectQuietly(client);
       throw mapTelegramError(error, "Could not complete the Telegram connection");
     }
     await this.repos.sessions.save(user.id, stringSession);
-    await this.ensureStorageForClient(user.id, flow.client);
-    this.clientManager.cacheClient(user.id, flow.client);
-    return { status: "ok", user };
+    await this.ensureStorageForClient(user.id, client);
+    this.clientManager.cacheClient(user.id, client);
+    return user;
   }
   sweepExpiredFlows() {
     const now = Date.now();
@@ -3975,11 +4149,11 @@ var LOGGER_OPTIONS = (level) => ({
 });
 
 // ../../apps/api/src/http.ts
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 function resolveRequestId(headers) {
   const inbound = headers[REQUEST_ID_HEADER];
   const candidate = Array.isArray(inbound) ? inbound[0] : inbound;
-  return typeof candidate === "string" && candidate.length > 0 && candidate.length <= 128 ? candidate : randomUUID();
+  return typeof candidate === "string" && candidate.length > 0 && candidate.length <= 128 ? candidate : randomUUID2();
 }
 function attachRequestId(request, reply) {
   reply.header(REQUEST_ID_HEADER, request.id);
@@ -4298,6 +4472,42 @@ function registerAuthRoutes(app2, container2) {
     );
     return reply.send({ status: "ok", user: toUserDTO(result.user) });
   });
+  app2.post("/api/auth/telegram/qr/start", async (request, reply) => {
+    limiter(request.ip);
+    const started = await container2.connection.startQrLogin();
+    return reply.send({ flowId: started.flowId, token: started.token });
+  });
+  app2.get("/api/auth/telegram/qr/status", async (request, reply) => {
+    limiter(request.ip);
+    const flowId = requireString(request.query, "flowId");
+    const result = await container2.connection.pollQrLogin(flowId);
+    if (result.status === "approved") {
+      await issueSessionCookie(
+        container2.authSessions,
+        request,
+        reply,
+        result.user.id,
+        container2.config.cookieSecure
+      );
+      return reply.send({ status: "ok", user: toUserDTO(result.user) });
+    }
+    return reply.send(result);
+  });
+  app2.post("/api/auth/telegram/qr/password", async (request, reply) => {
+    limiter(request.ip);
+    const body = requireBody(request);
+    const flowId = requireString(body, "flowId");
+    const password = requireString(body, "password");
+    const result = await container2.connection.submitQrPassword(flowId, password);
+    await issueSessionCookie(
+      container2.authSessions,
+      request,
+      reply,
+      result.user.id,
+      container2.config.cookieSecure
+    );
+    return reply.send({ status: "ok", user: toUserDTO(result.user) });
+  });
   app2.get("/api/auth/me", async (request) => {
     const user = await currentUser(container2.repos, container2.authSessions, request.cookies);
     if (!user) return { user: null, storage: null, health: null };
@@ -4685,7 +4895,7 @@ function encryptionCheck(configured) {
 }
 
 // ../../apps/api/src/routes/storage.ts
-var VERSION = "0.2.7";
+var VERSION = "0.2.9";
 function registerStorageRoutes(app2, container2) {
   app2.get("/api/health", async () => {
     const database = await probeDatabase(container2);