@luckystack/login 0.5.0 → 0.6.0

package/dist/index.js

@@ -14,7 +14,7 @@ import {
   registerOAuthProviderFactory,
   registerOAuthProviders,
   registerUserAdapter
-} from "./chunk-K5Z5KKKT.js";
+} from "./chunk-HJHCX2JO.js";
 import {
   activeUsersKeyFor,
   deleteSession,
@@ -29,7 +29,7 @@ import {
   revokeUserSessions,
   saveSession,
   sessionKeyFor
-} from "./chunk-W6C2J7AW.js";
+} from "./chunk-5WBFVSMW.js";
 
 // src/index.ts
 import { registerSessionProvider } from "@luckystack/core";
@@ -141,7 +141,7 @@ var registerPostLoginRedirect = (resolver) => {
 var getPostLoginRedirect = () => activeResolver;
 
 // src/login.ts
-import { URLSearchParams } from "url";
+import { URLSearchParams as URLSearchParams2 } from "url";
 import { tryCatch as tryCatch2, tryCatchSync, redis as redisClient, getUploadsDir, dispatchHook, getLogger as getLogger3, formatKey, getProjectConfig as getProjectConfig4, getCookieValue } from "@luckystack/core";
 import bcrypt from "bcryptjs";
 import { randomBytes, createHash, timingSafeEqual } from "crypto";
@@ -512,7 +512,7 @@ var resolveUploadedAvatar = async (userId) => {
   return avatarStat ? `${userId}.webp` : null;
 };
 var sanitizeUserForSession = (user) => {
-  const { password: _password, ...safeUser } = user;
+  const { password: _password, totpSecret: _totpSecret, recoveryCodes: _recoveryCodes, ...safeUser } = user;
   return safeUser;
 };
 var emitLoginFailed = (payload) => {
@@ -645,6 +645,41 @@ var registerWithCredentials = async ({
     session: newUser
   };
 };
+var twoFactorGate = null;
+var registerTwoFactorGate = (gate) => {
+  twoFactorGate = gate;
+};
+var applyTwoFactorGate = async (user, context) => twoFactorGate ? twoFactorGate(user, context) : null;
+var finalizeLogin = async (user, options) => {
+  const newToken = randomBytes(32).toString("hex");
+  const previousLogin = user.lastLogin ?? null;
+  const nowLogin = /* @__PURE__ */ new Date();
+  await tryCatch2(() => getUserAdapter().update(user.id, { lastLogin: nowLogin }));
+  const newUser = {
+    ...sanitizeUserForSession(user),
+    token: newToken,
+    lastLogin: nowLogin,
+    previousLogin
+  };
+  const uploadedAvatar = await resolveUploadedAvatar(newUser.id);
+  if (uploadedAvatar) {
+    newUser.avatar = uploadedAvatar;
+  }
+  const saved = await saveSession(newToken, newUser, true, { supersedeToken: options.supersedeToken });
+  if (!saved.ok) {
+    emitLoginFailed({ email: options.email, userId: newUser.id, provider: options.provider, reason: saved.errorCode, stage: "login", requesterIp: options.requesterIp });
+    return { status: false, reason: saved.errorCode };
+  }
+  await dispatchHook("postLogin", { userId: newUser.id, provider: options.provider, isNewUser: false, token: newToken });
+  if (options.email) {
+    void clearAuthFailures(options.email, options.requesterIp);
+    if (options.requesterIp) void clearAuthFailures(options.email);
+  }
+  if (isDevMode()) {
+    getLogger3().debug(`${options.provider} login success for user ${newUser.id}`);
+  }
+  return { status: true, reason: "login.loggedIn", newToken, session: newUser };
+};
 var loginWithCredentialsCore = async ({ email, password }, options) => {
   const requesterIp = options?.requesterIp;
   const preLoginResult = await dispatchHook("preLogin", { email, provider: "credentials" });
@@ -686,32 +721,14 @@ var loginWithCredentialsCore = async ({ email, password }, options) => {
     await dispatchHook("loginFailed", { email, userId: findUserResponse.id, provider: "credentials", reason: "login.wrongPassword", stage: "login", requesterIp });
     return { status: false, reason: "login.wrongPassword" };
   }
-  const newToken = randomBytes(32).toString("hex");
-  const previousLogin = findUserResponse.lastLogin ?? null;
-  const nowLogin = /* @__PURE__ */ new Date();
-  await tryCatch2(() => userAdapter.update(findUserResponse.id, { lastLogin: nowLogin }));
-  const newUser = {
-    ...sanitizeUserForSession(findUserResponse),
-    token: newToken,
-    lastLogin: nowLogin,
-    previousLogin
-  };
-  const uploadedAvatar = await resolveUploadedAvatar(newUser.id);
-  if (uploadedAvatar) {
-    newUser.avatar = uploadedAvatar;
-  }
-  const saved = await saveSession(newToken, newUser, true, { supersedeToken: options?.supersedeToken });
-  if (!saved.ok) {
-    emitLoginFailed({ email, userId: newUser.id, provider: "credentials", reason: saved.errorCode, stage: "login", requesterIp });
-    return { status: false, reason: saved.errorCode };
-  }
-  await dispatchHook("postLogin", { userId: newUser.id, provider: "credentials", isNewUser: false, token: newToken });
-  void clearAuthFailures(email, requesterIp);
-  if (requesterIp) void clearAuthFailures(email);
-  if (isDevMode()) {
-    getLogger3().debug(`credentials login success for user ${newUser.id}`);
-  }
-  return { status: true, reason: "login.loggedIn", newToken, session: newUser };
+  const challenge = await applyTwoFactorGate(findUserResponse, { requesterIp });
+  if (challenge) return challenge;
+  return finalizeLogin(findUserResponse, {
+    provider: "credentials",
+    email,
+    supersedeToken: options?.supersedeToken,
+    requesterIp
+  });
 };
 var loginWithCredentials = async (params, options) => {
   const creds = normalizeCredentials(params);
@@ -777,7 +794,7 @@ var exchangeOAuthToken = async (provider, code, codeVerifier) => {
       }
       return await response3.json();
     }
-    const formParams = new URLSearchParams();
+    const formParams = new URLSearchParams2();
     formParams.append("client_id", provider.clientID);
     formParams.append("client_secret", provider.clientSecret);
     formParams.append("code", values.code);
@@ -1020,7 +1037,7 @@ var loginCallback = async (pathname, req, _res, options = {}) => {
   if (!providerResolution) return false;
   const { provider, providerName } = providerResolution;
   const queryString = (req.url ?? "").split("?")[1] ?? "";
-  const params = new URLSearchParams(queryString);
+  const params = new URLSearchParams2(queryString);
   const code = params.get("code");
   const state = params.get("state");
   const cookieNonce = getCookieValue(req.headers.cookie, OAUTH_STATE_COOKIE_NAME) ?? "";
@@ -1238,6 +1255,500 @@ var sendEmailChangeConfirmation = async ({ userId, newEmail, userName, brand })
   return result.ok ? { ok: true, token } : { ok: false, reason: result.reason, token };
 };
 
+// src/twoFactor.ts
+import crypto3 from "crypto";
+import { acquireLease, dispatchHook as dispatchHook3, formatKey as formatKey5, getLogger as getLogger5, getProjectConfig as getProjectConfig9, getProjectName, redis as redis4, releaseLease, tryCatch as tryCatch3 } from "@luckystack/core";
+
+// src/emailOtp.ts
+import crypto from "crypto";
+import { formatKey as formatKey4, redis as redis3 } from "@luckystack/core";
+var normalizeIdentity = (identity) => identity.trim().toLowerCase();
+var codeKey = (purpose, identity) => formatKey4("-emailcode", `${purpose}:${normalizeIdentity(identity)}`);
+var attemptsKey = (purpose, identity) => formatKey4("-emailcode-attempts", `${purpose}:${normalizeIdentity(identity)}`);
+var hashCode = (code) => crypto.createHash("sha256").update(code).digest("hex");
+var generateNumericCode = (digits) => String(crypto.randomInt(0, 10 ** digits)).padStart(digits, "0");
+var issueEmailCode = async ({ purpose, identity, ttlSeconds, digits }) => {
+  const code = generateNumericCode(digits);
+  await redis3.set(codeKey(purpose, identity), hashCode(code), "EX", ttlSeconds);
+  await redis3.del(attemptsKey(purpose, identity));
+  return code;
+};
+var verifyEmailCode = async ({ purpose, identity, code, maxAttempts }) => {
+  const key = codeKey(purpose, identity);
+  const storedHash = await redis3.get(key);
+  if (!storedHash) return "expired";
+  const counter = attemptsKey(purpose, identity);
+  const attempts = await redis3.incr(counter);
+  const remaining = await redis3.ttl(key);
+  await redis3.expire(counter, remaining > 0 ? remaining : 600);
+  if (attempts > maxAttempts) {
+    await redis3.del(key);
+    await redis3.del(counter);
+    return "locked";
+  }
+  const submitted = Buffer.from(hashCode(code.trim()));
+  const expected = Buffer.from(storedHash);
+  const matches = submitted.length === expected.length && crypto.timingSafeEqual(submitted, expected);
+  if (!matches) return "invalid";
+  const deleted = await redis3.del(key);
+  await redis3.del(counter);
+  return deleted > 0 ? "valid" : "expired";
+};
+var clearEmailCode = async (purpose, identity) => {
+  await redis3.del(codeKey(purpose, identity));
+  await redis3.del(attemptsKey(purpose, identity));
+};
+
+// src/totp.ts
+import crypto2 from "crypto";
+var BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+var base32Encode = (input) => {
+  let bits = 0;
+  let value = 0;
+  let output = "";
+  for (const byte of input) {
+    value = value << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      output += BASE32_ALPHABET[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) output += BASE32_ALPHABET[value << 5 - bits & 31];
+  return output;
+};
+var base32Decode = (input) => {
+  const normalized = input.toUpperCase().replaceAll(/[\s=]/g, "");
+  if (normalized.length === 0) return null;
+  let bits = 0;
+  let value = 0;
+  const bytes = [];
+  for (const char of normalized) {
+    const index = BASE32_ALPHABET.indexOf(char);
+    if (index === -1) return null;
+    value = value << 5 | index;
+    bits += 5;
+    if (bits >= 8) {
+      bytes.push(value >>> bits - 8 & 255);
+      bits -= 8;
+    }
+  }
+  return Buffer.from(bytes);
+};
+var hotp = (key, counter, digits = 6) => {
+  const counterBuffer = Buffer.alloc(8);
+  counterBuffer.writeBigUInt64BE(BigInt(counter));
+  const digest = crypto2.createHmac("sha1", key).update(counterBuffer).digest();
+  const offset = digest.readUInt8(digest.length - 1) & 15;
+  const binary = digest.readUInt32BE(offset) & 2147483647;
+  return String(binary % 10 ** digits).padStart(digits, "0");
+};
+var TOTP_STEP_SECONDS = 30;
+var verifyTotp = ({ secret, code, window = 1, timestampMs }) => {
+  const key = base32Decode(secret);
+  const normalizedCode = code.trim();
+  if (!key || key.length === 0 || !/^\d{6,8}$/.test(normalizedCode)) return { valid: false, timestep: null };
+  const now = timestampMs ?? Date.now();
+  const currentStep = Math.floor(now / 1e3 / TOTP_STEP_SECONDS);
+  const drift = Math.max(0, Math.min(window, 4));
+  let matched = null;
+  for (let step = currentStep - drift; step <= currentStep + drift; step++) {
+    const expected = hotp(key, step, normalizedCode.length);
+    const expectedBuffer = Buffer.from(expected);
+    const actualBuffer = Buffer.from(normalizedCode);
+    if (expectedBuffer.length === actualBuffer.length && crypto2.timingSafeEqual(expectedBuffer, actualBuffer)) {
+      matched ??= step;
+    }
+  }
+  return matched === null ? { valid: false, timestep: null } : { valid: true, timestep: matched };
+};
+var generateTotpSecret = () => base32Encode(crypto2.randomBytes(20));
+var buildOtpauthUri = ({ secret, accountName, issuer }) => {
+  const label = `${encodeURIComponent(issuer)}:${encodeURIComponent(accountName)}`;
+  const query = new URLSearchParams({
+    secret,
+    issuer,
+    algorithm: "SHA1",
+    digits: "6",
+    period: String(TOTP_STEP_SECONDS)
+  });
+  return `otpauth://totp/${label}?${query.toString()}`;
+};
+
+// src/twoFactor.ts
+var sha256 = (value) => crypto3.createHash("sha256").update(value).digest("hex");
+var ENCRYPTED_PREFIX = "gcm:";
+var warnedPlaintextSecret = false;
+var encryptionKey = () => {
+  const raw = process.env.TOTP_ENCRYPTION_KEY;
+  if (!raw) return null;
+  return crypto3.createHash("sha256").update(raw).digest();
+};
+var encryptTotpSecret = (secret) => {
+  const key = encryptionKey();
+  if (!key) {
+    if (!warnedPlaintextSecret) {
+      warnedPlaintextSecret = true;
+      getLogger5().warn("[2fa] TOTP_ENCRYPTION_KEY is not set \u2014 TOTP secrets are stored unencrypted. Set it in .env.local to encrypt new enrollments at rest.");
+    }
+    return secret;
+  }
+  const iv = crypto3.randomBytes(12);
+  const cipher = crypto3.createCipheriv("aes-256-gcm", key, iv);
+  const ciphertext = Buffer.concat([cipher.update(secret, "utf8"), cipher.final()]);
+  return `${ENCRYPTED_PREFIX}${iv.toString("base64")}:${cipher.getAuthTag().toString("base64")}:${ciphertext.toString("base64")}`;
+};
+var decryptTotpSecret = (stored) => {
+  if (!stored.startsWith(ENCRYPTED_PREFIX)) return stored;
+  const key = encryptionKey();
+  if (!key) {
+    getLogger5().error("[2fa] found an encrypted TOTP secret but TOTP_ENCRYPTION_KEY is not set \u2014 cannot verify TOTP codes.");
+    return null;
+  }
+  const [ivPart, tagPart, dataPart] = stored.slice(ENCRYPTED_PREFIX.length).split(":");
+  if (!ivPart || !tagPart || !dataPart) return null;
+  try {
+    const decipher = crypto3.createDecipheriv("aes-256-gcm", key, Buffer.from(ivPart, "base64"));
+    decipher.setAuthTag(Buffer.from(tagPart, "base64"));
+    return Buffer.concat([decipher.update(Buffer.from(dataPart, "base64")), decipher.final()]).toString("utf8");
+  } catch {
+    getLogger5().error("[2fa] TOTP secret decryption failed (wrong TOTP_ENCRYPTION_KEY?).");
+    return null;
+  }
+};
+var challengeKey = (token) => formatKey5("-2fa-challenge", sha256(token));
+var challengeAttemptsKey = (token) => formatKey5("-2fa-challenge-attempts", sha256(token));
+var usedTimestepKey = (userId, timestep) => formatKey5("-2fa-usedstep", `${userId}:${String(timestep)}`);
+var accountFailureKey = (userId) => formatKey5("-2fa-accountfail", userId);
+var RECOVERY_LEASE_MS = 5e3;
+var recoveryLeaseName = (userId) => `2fa-recovery:${userId}`;
+var pendingSecretKey = (userId) => formatKey5("-2fa-pending", userId);
+var ACCOUNT_FAIL_LIMIT = 10;
+var ACCOUNT_FAIL_WINDOW_SECONDS = 15 * 60;
+var isTwoFactorAccountLocked = async (userId) => {
+  const count = Number(await redis4.get(accountFailureKey(userId)) ?? "0");
+  return count >= ACCOUNT_FAIL_LIMIT;
+};
+var recordTwoFactorAccountFailure = async (userId) => {
+  const key = accountFailureKey(userId);
+  const count = await redis4.incr(key);
+  if (count === 1) await redis4.expire(key, ACCOUNT_FAIL_WINDOW_SECONDS);
+};
+var clearTwoFactorAccountFailures = async (userId) => {
+  await redis4.del(accountFailureKey(userId));
+};
+var twoFactorConfig = () => getProjectConfig9().auth;
+var availableTwoFactorMethods = (user) => {
+  const methods = [];
+  if (user.totpSecret) methods.push("totp");
+  if (twoFactorConfig().twoFactorEmailFallback && user.email) methods.push("email-code");
+  if ((user.recoveryCodes ?? []).length > 0) methods.push("recovery-code");
+  return methods;
+};
+var createTwoFactorChallengeIfRequired = async (user, _context) => {
+  if (twoFactorConfig().twoFactor === "disabled") return null;
+  if (!user.twoFactorEnabled || !user.totpSecret) return null;
+  const methods = availableTwoFactorMethods(user);
+  const token = crypto3.randomBytes(32).toString("hex");
+  const record = { userId: user.id, email: user.email ?? void 0 };
+  await redis4.set(challengeKey(token), JSON.stringify(record), "EX", twoFactorConfig().twoFactorChallengeTtlSeconds);
+  return {
+    status: true,
+    reason: "login.twoFactorRequired",
+    requiresTwoFactor: true,
+    challengeToken: token,
+    twoFactorMethods: methods
+  };
+};
+var readChallenge = async (token) => {
+  if (!/^[a-f0-9]{64}$/.test(token)) return null;
+  const raw = await redis4.get(challengeKey(token));
+  if (!raw) return null;
+  const [parseError, parsed] = await tryCatch3(() => Promise.resolve(JSON.parse(raw)));
+  if (parseError || typeof parsed?.userId !== "string") return null;
+  return parsed;
+};
+var burnChallenge = async (token) => {
+  await redis4.del(challengeKey(token));
+  await redis4.del(challengeAttemptsKey(token));
+};
+var verifyTotpForUser = async (user, code, enforceSingleUse) => {
+  if (!user.totpSecret) return false;
+  if (!/^\d{6}$/.test(code.trim())) return false;
+  const secret = decryptTotpSecret(user.totpSecret);
+  if (!secret) return false;
+  const result = verifyTotp({ secret, code });
+  if (!result.valid || result.timestep === null) return false;
+  if (!enforceSingleUse) return true;
+  const claimed = await redis4.set(usedTimestepKey(user.id, result.timestep), "1", "EX", 60 * 2, "NX");
+  return claimed !== null;
+};
+var matchRecoveryHash = (hashes, code) => {
+  const submitted = Buffer.from(sha256(code.trim().toLowerCase()));
+  return hashes.findIndex((hash2) => {
+    const stored = Buffer.from(hash2);
+    return stored.length === submitted.length && crypto3.timingSafeEqual(stored, submitted);
+  });
+};
+var consumeRecoveryCode = async (user, code) => {
+  if ((user.recoveryCodes ?? []).length === 0) return false;
+  const leaseToken = await acquireLease(recoveryLeaseName(user.id), RECOVERY_LEASE_MS);
+  if (!leaseToken) {
+    getLogger5().warn("[2fa] recovery-code burn is contended (lease busy) \u2014 refusing this attempt, retry");
+    return false;
+  }
+  try {
+    const fresh = await getUserAdapter().findById(user.id);
+    const hashes = fresh?.recoveryCodes ?? [];
+    const index = matchRecoveryHash(hashes, code);
+    if (index === -1) return false;
+    const remaining = hashes.filter((_, position) => position !== index);
+    const [updateError] = await tryCatch3(() => getUserAdapter().update(user.id, { recoveryCodes: remaining }));
+    if (updateError) {
+      getLogger5().error("[2fa] could not persist recovery-code consumption \u2014 refusing the code", updateError);
+      return false;
+    }
+    return true;
+  } finally {
+    await releaseLease(recoveryLeaseName(user.id), leaseToken);
+  }
+};
+var verifyTwoFactorChallenge = async (input) => {
+  const challenge = await readChallenge(input.challengeToken);
+  if (!challenge) return { status: false, reason: "login.twoFactorChallengeExpired" };
+  if (await isTwoFactorAccountLocked(challenge.userId)) {
+    return { status: false, reason: "login.twoFactorLocked" };
+  }
+  const counter = challengeAttemptsKey(input.challengeToken);
+  const attempts = await redis4.incr(counter);
+  const remaining = await redis4.ttl(challengeKey(input.challengeToken));
+  if (remaining > 0) await redis4.expire(counter, remaining);
+  if (attempts > twoFactorConfig().twoFactorMaxAttempts) {
+    await burnChallenge(input.challengeToken);
+    return { status: false, reason: "login.twoFactorLocked" };
+  }
+  const user = await getUserAdapter().findById(challenge.userId);
+  if (!user) {
+    await burnChallenge(input.challengeToken);
+    return { status: false, reason: "login.twoFactorChallengeExpired" };
+  }
+  const method = input.method ?? "totp";
+  let verified = false;
+  if (method === "totp") {
+    verified = await verifyTotpForUser(user, input.code, true);
+  } else if (method === "email-code") {
+    if (!twoFactorConfig().twoFactorEmailFallback) return { status: false, reason: "login.twoFactorMethodUnavailable" };
+    verified = await verifyEmailCode({
+      purpose: "2fa",
+      identity: user.id,
+      code: input.code,
+      maxAttempts: twoFactorConfig().emailCodeMaxAttempts
+    }) === "valid";
+  } else {
+    verified = await consumeRecoveryCode(user, input.code);
+  }
+  if (!verified) {
+    await recordTwoFactorAccountFailure(user.id);
+    void dispatchHook3("loginFailed", { email: user.email ?? void 0, userId: user.id, provider: "credentials", reason: "login.twoFactorInvalidCode", stage: "login", requesterIp: input.requesterIp });
+    return { status: false, reason: "login.twoFactorInvalidCode" };
+  }
+  await burnChallenge(input.challengeToken);
+  await clearEmailCode("2fa", user.id);
+  await clearTwoFactorAccountFailures(user.id);
+  return finalizeLogin(user, {
+    provider: "credentials",
+    email: user.email ?? void 0,
+    supersedeToken: input.supersedeToken,
+    requesterIp: input.requesterIp
+  });
+};
+var requestTwoFactorEmailCode = async (challengeToken) => {
+  if (!twoFactorConfig().twoFactorEmailFallback) return { ok: false, reason: "login.twoFactorMethodUnavailable" };
+  const challenge = await readChallenge(challengeToken);
+  if (!challenge) return { ok: false, reason: "login.twoFactorChallengeExpired" };
+  const user = await getUserAdapter().findById(challenge.userId);
+  if (!user?.email) return { ok: false, reason: "login.twoFactorChallengeExpired" };
+  const config = twoFactorConfig();
+  const code = await issueEmailCode({
+    purpose: "2fa",
+    identity: user.id,
+    ttlSeconds: config.emailCodeTtlSeconds,
+    digits: config.emailCodeLength
+  });
+  const sent = await sendCodeEmail(user.email, code, "Your verification code", `Use this code to finish signing in to ${getProjectName()}.`);
+  return sent ? { ok: true } : { ok: false, reason: "login.emailCodeSendFailed" };
+};
+var sendCodeEmail = async (to, code, subject, intro) => {
+  const [loadError, email] = await tryCatch3(() => loadEmailModule());
+  if (loadError || !email) {
+    getLogger5().error("[2fa/email-code] @luckystack/email is not installed \u2014 cannot send the code email.");
+    return false;
+  }
+  const spaced = code.match(/\d/g)?.join(" ") ?? code;
+  const [sendError, result] = await tryCatch3(() => email.sendEmail({
+    to,
+    subject,
+    html: `<p>${intro}</p><p style="font-size:28px;font-weight:700;letter-spacing:6px;font-family:monospace">${spaced}</p><p>The code expires in ${String(Math.round(twoFactorConfig().emailCodeTtlSeconds / 60))} minutes. If you didn't request it, you can ignore this email.</p>`,
+    text: `${intro}
+
+Code: ${code}
+
+The code expires in ${String(Math.round(twoFactorConfig().emailCodeTtlSeconds / 60))} minutes. If you didn't request it, you can ignore this email.`,
+    adapterHint: "transactional"
+  }));
+  if (sendError || !result?.ok) {
+    getLogger5().error("[2fa/email-code] sending the code email failed", sendError ?? new Error(result?.reason ?? "unknown"));
+    return false;
+  }
+  return true;
+};
+var enrollmentBlockedReason = (user) => {
+  if (twoFactorConfig().twoFactor === "disabled") return "login.twoFactorDisabledByServer";
+  if (user.twoFactorEnabled) return "login.twoFactorAlreadyEnabled";
+  return null;
+};
+var beginTotpEnrollment = async (user) => {
+  const blocked = enrollmentBlockedReason(user);
+  if (blocked) return { ok: false, reason: blocked };
+  const secret = generateTotpSecret();
+  await redis4.set(pendingSecretKey(user.id), encryptTotpSecret(secret), "EX", 60 * 10);
+  return {
+    ok: true,
+    secret,
+    otpauthUri: buildOtpauthUri({ secret, accountName: user.email ?? user.id, issuer: getProjectName() })
+  };
+};
+var generateRecoveryCodes = () => {
+  const raw = Array.from({ length: 10 }, () => {
+    const hex = crypto3.randomBytes(10).toString("hex");
+    return `${hex.slice(0, 5)}-${hex.slice(5, 10)}-${hex.slice(10, 15)}-${hex.slice(15, 20)}`;
+  });
+  return { raw, hashes: raw.map((code) => sha256(code.toLowerCase())) };
+};
+var confirmTotpEnrollment = async (user, code) => {
+  const blocked = enrollmentBlockedReason(user);
+  if (blocked) return { ok: false, reason: blocked };
+  const pendingStored = await redis4.get(pendingSecretKey(user.id));
+  if (!pendingStored) return { ok: false, reason: "login.twoFactorEnrollmentExpired" };
+  const secret = decryptTotpSecret(pendingStored);
+  if (!secret) return { ok: false, reason: "login.twoFactorEnrollmentExpired" };
+  const result = verifyTotp({ secret, code });
+  if (!result.valid) return { ok: false, reason: "login.twoFactorInvalidCode" };
+  const { raw, hashes } = generateRecoveryCodes();
+  const [updateError] = await tryCatch3(() => getUserAdapter().update(user.id, {
+    totpSecret: encryptTotpSecret(secret),
+    twoFactorEnabled: true,
+    recoveryCodes: hashes
+  }));
+  if (updateError) {
+    getLogger5().error("[2fa] enrollment persist failed \u2014 is your UserAdapter/schema missing the 2FA fields? (twoFactorEnabled, totpSecret, recoveryCodes)", updateError);
+    return { ok: false, reason: "login.twoFactorPersistFailed" };
+  }
+  await redis4.del(pendingSecretKey(user.id));
+  return { ok: true, recoveryCodes: raw };
+};
+var disableTwoFactor = async (user, code) => {
+  const viaTotp = await verifyTotpForUser(user, code, false);
+  const viaRecovery = viaTotp ? false : await consumeRecoveryCode(user, code);
+  if (!viaTotp && !viaRecovery) return { ok: false, reason: "login.twoFactorInvalidCode" };
+  const [updateError] = await tryCatch3(() => getUserAdapter().update(user.id, {
+    totpSecret: null,
+    twoFactorEnabled: false,
+    recoveryCodes: []
+  }));
+  if (updateError) {
+    getLogger5().error("[2fa] disable persist failed", updateError);
+    return { ok: false, reason: "login.twoFactorPersistFailed" };
+  }
+  await clearTwoFactorAccountFailures(user.id);
+  return { ok: true };
+};
+var regenerateRecoveryCodes = async (user, code) => {
+  if (!await verifyTotpForUser(user, code, false)) return { ok: false, reason: "login.twoFactorInvalidCode" };
+  const { raw, hashes } = generateRecoveryCodes();
+  const [updateError] = await tryCatch3(() => getUserAdapter().update(user.id, { recoveryCodes: hashes }));
+  if (updateError) {
+    getLogger5().error("[2fa] recovery-code regenerate persist failed", updateError);
+    return { ok: false, reason: "login.twoFactorPersistFailed" };
+  }
+  return { ok: true, recoveryCodes: raw };
+};
+registerTwoFactorGate(createTwoFactorChallengeIfRequired);
+
+// src/emailCodeLogin.ts
+import { checkRateLimit as checkRateLimit2, getLogger as getLogger6, getProjectConfig as getProjectConfig10, getProjectName as getProjectName2, tryCatch as tryCatch4 } from "@luckystack/core";
+var emailCodeConfig = () => getProjectConfig10().auth;
+var normalizeEmail = (email) => email.trim().toLowerCase();
+var REQUEST_WINDOW_MS = 15 * 60 * 1e3;
+var REQUESTS_PER_EMAIL = 3;
+var REQUESTS_PER_IP = 10;
+var requestEmailLoginCode = async ({ email, requesterIp }) => {
+  const config = emailCodeConfig();
+  if (!config.emailCodeLogin) return { ok: false, reason: "login.emailCodeDisabled" };
+  const normalized = normalizeEmail(email);
+  if (!normalized || normalized.length > config.emailMaxLength) return { ok: false, reason: "login.invalidEmailFormat" };
+  const perEmail = await checkRateLimit2({ key: `email-code:req:${normalized}`, limit: REQUESTS_PER_EMAIL, windowMs: REQUEST_WINDOW_MS });
+  const perIp = requesterIp ? await checkRateLimit2({ key: `email-code:req-ip:${requesterIp}`, limit: REQUESTS_PER_IP, windowMs: REQUEST_WINDOW_MS }) : { allowed: true };
+  if (!perEmail.allowed || !perIp.allowed) return { ok: false, reason: "api.rateLimitExceeded" };
+  const [findError, user] = await tryCatch4(
+    () => resolveUserByEmail(getUserAdapter(), { email: normalized, provider: "credentials" })
+  );
+  if (findError) {
+    getLogger6().error("email-code login: user lookup failed", findError);
+    return { ok: true };
+  }
+  if (!user) {
+    getLogger6().info("[email-code] request for unknown address (not sent)");
+    return { ok: true };
+  }
+  const code = await issueEmailCode({
+    purpose: "login",
+    identity: normalized,
+    ttlSeconds: config.emailCodeTtlSeconds,
+    digits: config.emailCodeLength
+  });
+  void sendCodeEmail(
+    normalized,
+    code,
+    "Your sign-in code",
+    `Use this code to sign in to ${getProjectName2()}.`
+  ).then((sent) => {
+    if (!sent) getLogger6().error("[email-code] login code send failed (account exists) \u2014 check the email adapter");
+  });
+  return { ok: true };
+};
+var verifyEmailLoginCode = async (input) => {
+  const config = emailCodeConfig();
+  if (!config.emailCodeLogin) return { status: false, reason: "login.emailCodeDisabled" };
+  const normalized = normalizeEmail(input.email);
+  const verdict = await verifyEmailCode({
+    purpose: "login",
+    identity: normalized,
+    code: input.code,
+    maxAttempts: config.emailCodeMaxAttempts
+  });
+  if (verdict !== "valid") {
+    const reason = verdict === "invalid" ? "login.emailCodeInvalid" : verdict === "locked" ? "login.emailCodeLocked" : "login.emailCodeExpired";
+    return { status: false, reason };
+  }
+  const [findError, user] = await tryCatch4(
+    () => resolveUserByEmail(getUserAdapter(), { email: normalized, provider: "credentials" })
+  );
+  if (findError || !user) {
+    getLogger6().error("email-code login: user vanished between issue and verify", findError ?? void 0);
+    return { status: false, reason: "login.emailCodeExpired" };
+  }
+  await clearEmailCode("login", normalized);
+  const challenge = await createTwoFactorChallengeIfRequired(user, { requesterIp: input.requesterIp });
+  if (challenge) return challenge;
+  return finalizeLogin(user, {
+    provider: "credentials",
+    email: normalized,
+    supersedeToken: input.supersedeToken,
+    requesterIp: input.requesterIp
+  });
+};
+
 // src/index.ts
 registerSessionProvider({
   getSession,
@@ -1251,17 +1762,29 @@ export {
   PasswordPolicyError,
   activeUsersKeyFor,
   asOAuthUserData,
+  availableTwoFactorMethods,
+  base32Decode,
+  base32Encode,
+  beginTotpEnrollment,
+  buildOtpauthUri,
   clearAuthFailures,
+  clearEmailCode,
+  confirmTotpEnrollment,
   consumeEmailChangeToken,
   consumePasswordResetToken,
   createEmailChangeToken,
   createOAuthState,
   createPasswordResetToken,
+  createTwoFactorChallengeIfRequired,
   credentialsProvider,
   defaultPrismaUserAdapter,
   deleteSession,
+  disableTwoFactor,
   discordProvider,
   facebookProvider,
+  finalizeLogin,
+  generateNumericCode,
+  generateTotpSecret,
   getAllSessions,
   getOAuthProviders,
   getPostLoginRedirect,
@@ -1271,9 +1794,11 @@ export {
   getUserAdapter,
   githubProvider,
   googleProvider,
+  hotp,
   isAccountLocked,
   isFullOAuthProvider,
   isUserAdapterRegistered,
+  issueEmailCode,
   loginCallback,
   loginWithCredentials,
   loginWithCredentialsCore,
@@ -1281,13 +1806,17 @@ export {
   microsoftProvider,
   recordAuthFailure,
   redisSessionAdapter,
+  regenerateRecoveryCodes,
   registerOAuthProviderFactory,
   registerOAuthProviders,
   registerPostLoginRedirect,
   registerSessionAdapter,
   registerSessionSanitizer,
+  registerTwoFactorGate,
   registerUserAdapter,
   registerWithCredentials,
+  requestEmailLoginCode,
+  requestTwoFactorEmailCode,
   revokeUserSessions,
   saveSession,
   sendEmailChangeConfirmation,
@@ -1295,6 +1824,10 @@ export {
   sessionKeyFor,
   updatePasswordHash,
   validatePassword,
-  verifyPassword
+  verifyEmailCode,
+  verifyEmailLoginCode,
+  verifyPassword,
+  verifyTotp,
+  verifyTwoFactorChallenge
 };
 //# sourceMappingURL=index.js.map