@madauth/server 0.3.0-beta.1 → 0.4.0-beta.1

package/dist/entry/node.d.ts

@@ -1,7 +1,7 @@
-import { E as EntryOptions } from '../config-DEBYi8hb.js';
+import { E as EntryOptions } from '../config-DkE_2D3-.js';
 import 'jose';
-import '../schema-3yhCc2jH.js';
-import '../webhook-DCDP6SaE.js';
+import '../schema-DTeiSuQB.js';
+import '../webhook-B6P50ocX.js';
 
 type StartOptions = EntryOptions;
 /**

package/dist/entry/node.js

@@ -1,13 +1,13 @@
 import {
   createApp
-} from "../chunk-ZSBKNV5W.js";
-import "../chunk-DCDTO5LG.js";
+} from "../chunk-3PACOYTG.js";
+import "../chunk-A7UYZRBL.js";
 import {
   loadConfig,
   resolveEnv
-} from "../chunk-ODITZLMM.js";
+} from "../chunk-ISJGOCF3.js";
 import "../chunk-JDQLSL36.js";
-import "../chunk-NPNM26J3.js";
+import "../chunk-Y7ZSUROX.js";
 
 // src/entry/node.ts
 import { serve } from "@hono/node-server";

package/dist/index.d.ts

@@ -1,21 +1,36 @@
 import { Hono } from 'hono';
-import { M as MadauthConfig } from './config-DEBYi8hb.js';
-export { C as ConfigError, a as ConfigOverrides, E as EntryOptions, e as envVars, l as loadConfig } from './config-DEBYi8hb.js';
+import { M as MadauthConfig } from './config-DkE_2D3-.js';
+export { C as ConfigError, a as ConfigOverrides, E as EntryOptions, e as envVars, l as loadConfig } from './config-DkE_2D3-.js';
 import { JWK } from 'jose';
-import { a as Schema } from './schema-3yhCc2jH.js';
-export { F as FieldDef, b as FieldType, R as Row, S as StoreAdapter, V as Value, W as Where, m as madauthSchema } from './schema-3yhCc2jH.js';
-export { M as MadauthUser } from './user-BMWEWREH.js';
-import './webhook-DCDP6SaE.js';
+import { a as Schema } from './schema-DTeiSuQB.js';
+export { F as FieldDef, b as FieldType, R as Row, S as StoreAdapter, V as Value, W as Where, m as madauthSchema } from './schema-DTeiSuQB.js';
+export { M as MadauthUser } from './user-BZs84sui.js';
+import './webhook-B6P50ocX.js';
+
+/**
+ * The primary sign-in methods madAuth has: Google, e-mail & password, and the authenticator app on its own
+ * (the e-mail address and a code from the app).
+ */
+declare const SIGN_IN_METHODS: readonly ["google", "password", "totp"];
+type SignInMethod = (typeof SIGN_IN_METHODS)[number];
+/** The methods that can ask for a code from the authenticator app after they succeeded. */
+declare const METHODS_WITH_SECOND_FACTOR: readonly ["google", "password"];
+/**
+ * Whether a method asks for the authenticator app as a second factor: never, when the user has set one up
+ * (`optional`), or always, so that a user without one sets it up at the next sign-in (`required`).
+ */
+declare const SECOND_FACTOR_POLICIES: readonly ["none", "optional", "required"];
+type SecondFactorPolicy = (typeof SECOND_FACTOR_POLICIES)[number];
+/** The settings of a method that is on. `secondFactor` is for Google and password; it defaults to `none`. */
+interface MethodSetting {
+    secondFactor?: SecondFactorPolicy;
+}
+/** The sign-in methods that are on, each with its settings. A method that is not listed is off. */
+type MethodSettings = Partial<Record<SignInMethod, MethodSetting>>;
 
 /** Creates a new private ES256 JWK for MADAUTH_SIGNING_KEY. */
 declare function generateSigningKey(): Promise<JWK>;
 
-/** The sign-in methods madAuth has. */
-declare const SIGN_IN_METHODS: readonly ["google", "password"];
-type SignInMethod = (typeof SIGN_IN_METHODS)[number];
-/** Which sign-in methods are on. A method that is not mentioned is on. */
-type MethodSettings = Partial<Record<SignInMethod, boolean>>;
-
 /** Hash parameter that carries a sign-in error back to the app after the code flow. */
 declare const REDIRECT_ERROR_PARAM = "madauth_error";
 
@@ -25,7 +40,7 @@ declare const REDIRECT_ERROR_PARAM = "madauth_error";
  */
 declare function createApp(config: MadauthConfig): Hono;
 
-/** The SQL table that holds a model, e.g. `madauth_user`. */
+/** The SQL table that holds a model, e.g. `madauth_user`, or `madauth_recovery_code` for `recoveryCode`. */
 declare function tableName(model: string): string;
 /** The SQL column that holds a field, e.g. `email_normalized` for `emailNormalized`. */
 declare function columnName(field: string): string;
@@ -55,4 +70,4 @@ declare function parseRoles(input: unknown): string[] | null;
  */
 declare function parseClaims(input: unknown): Claims | null;
 
-export { ADMIN_ROLE, type Claims, MadauthConfig, type MethodSettings, REDIRECT_ERROR_PARAM, SIGN_IN_METHODS, Schema, type SignInMethod, type SqlDialect, columnName, createApp, createTablesSql, generateSigningKey, parseClaims, parseRoles, tableName, upgradeTablesSql };
+export { ADMIN_ROLE, type Claims, METHODS_WITH_SECOND_FACTOR, MadauthConfig, type MethodSetting, type MethodSettings, REDIRECT_ERROR_PARAM, SECOND_FACTOR_POLICIES, SIGN_IN_METHODS, Schema, type SecondFactorPolicy, type SignInMethod, type SqlDialect, columnName, createApp, createTablesSql, generateSigningKey, parseClaims, parseRoles, tableName, upgradeTablesSql };

package/dist/index.js

@@ -3,32 +3,36 @@ import {
   createTablesSql,
   tableName,
   upgradeTablesSql
-} from "./chunk-56MOVFO4.js";
+} from "./chunk-OMIX3ERC.js";
 import {
   madauthSchema
-} from "./chunk-CD7Y4T66.js";
+} from "./chunk-GA4TF7EI.js";
 import {
   REDIRECT_ERROR_PARAM,
   createApp
-} from "./chunk-ZSBKNV5W.js";
-import "./chunk-DCDTO5LG.js";
+} from "./chunk-3PACOYTG.js";
+import "./chunk-A7UYZRBL.js";
 import {
   ADMIN_ROLE,
   ConfigError,
+  METHODS_WITH_SECOND_FACTOR,
+  SECOND_FACTOR_POLICIES,
   SIGN_IN_METHODS,
   envVars,
   loadConfig,
   parseClaims,
   parseRoles
-} from "./chunk-ODITZLMM.js";
+} from "./chunk-ISJGOCF3.js";
 import {
   generateSigningKey
 } from "./chunk-JDQLSL36.js";
-import "./chunk-NPNM26J3.js";
+import "./chunk-Y7ZSUROX.js";
 export {
   ADMIN_ROLE,
   ConfigError,
+  METHODS_WITH_SECOND_FACTOR,
   REDIRECT_ERROR_PARAM,
+  SECOND_FACTOR_POLICIES,
   SIGN_IN_METHODS,
   columnName,
   createApp,

package/dist/{schema-3yhCc2jH.d.ts → schema-DTeiSuQB.d.ts}

@@ -43,7 +43,7 @@ interface Schema {
 }
 /** The records madAuth stores. Timestamps are milliseconds since 1970. */
 declare const madauthSchema: {
-    readonly version: 4;
+    readonly version: 5;
     readonly models: {
         /** Someone who signed in, whichever way: the e-mail address is the identity shared by the sign-in methods. */
         readonly user: {
@@ -86,7 +86,10 @@ declare const madauthSchema: {
                 };
             };
         };
-        /** How a user signs in. `key` is `password:<userId>` or `google:<sub>`; later e.g. `totp:<userId>`. */
+        /**
+         * How a user signs in. `key` is `password:<userId>`, `google:<sub>` or `totp:<userId>` (the authenticator
+         * app, whose `secret` is encrypted).
+         */
         readonly account: {
             readonly fields: {
                 readonly id: {
@@ -116,6 +119,40 @@ declare const madauthSchema: {
                     readonly type: "string";
                     readonly nullable: true;
                 };
+                /** The time step of the last authenticator code that was accepted, so a code works once; 0 before (since version 5). */
+                readonly lastUsedStep: {
+                    readonly type: "number";
+                };
+                /**
+                 * The setup an authenticator secret came from; its recovery codes carry the same id, so the app and
+                 * its codes always belong together. Empty for other accounts (since version 5).
+                 */
+                readonly setupId: {
+                    readonly type: "string";
+                    readonly nullable: true;
+                };
+                readonly createdAt: {
+                    readonly type: "number";
+                };
+            };
+        };
+        /**
+         * A recovery code of a user's authenticator app (since version 5). `id` is the code's keyed hash; the
+         * record goes when the code is used. It works only while the account's `setupId` is its own.
+         */
+        readonly recoveryCode: {
+            readonly fields: {
+                readonly id: {
+                    readonly type: "string";
+                    readonly primaryKey: true;
+                };
+                readonly userId: {
+                    readonly type: "string";
+                    readonly index: true;
+                };
+                readonly setupId: {
+                    readonly type: "string";
+                };
                 readonly createdAt: {
                     readonly type: "number";
                 };

package/dist/sqlite.js

@@ -3,10 +3,10 @@ import {
   createTablesSql,
   tableName,
   upgradeTablesSql
-} from "./chunk-56MOVFO4.js";
+} from "./chunk-OMIX3ERC.js";
 import {
   madauthSchema
-} from "./chunk-CD7Y4T66.js";
+} from "./chunk-GA4TF7EI.js";
 
 // src/store/sqlite.ts
 function createSqliteAdapter(path) {