@nauth-toolkit/mfa-totp 0.1.13 → 0.1.17
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/nestjs/index.d.ts +5 -0
- package/dist/nestjs/index.d.ts.map +1 -1
- package/dist/nestjs/index.js +6 -0
- package/dist/nestjs/index.js.map +1 -1
- package/dist/nestjs/totp-mfa.module.d.ts +20 -0
- package/dist/nestjs/totp-mfa.module.d.ts.map +1 -1
- package/dist/nestjs/totp-mfa.module.js +27 -1
- package/dist/nestjs/totp-mfa.module.js.map +1 -1
- package/dist/src/dto/mfa.dto.d.ts +476 -0
- package/dist/src/dto/mfa.dto.d.ts.map +1 -1
- package/dist/src/dto/mfa.dto.js +9 -0
- package/dist/src/dto/mfa.dto.js.map +1 -1
- package/dist/src/index.d.ts +6 -0
- package/dist/src/index.d.ts.map +1 -1
- package/dist/src/index.js +6 -0
- package/dist/src/index.js.map +1 -1
- package/dist/src/totp-mfa-provider.service.d.ts +81 -1
- package/dist/src/totp-mfa-provider.service.d.ts.map +1 -1
- package/dist/src/totp-mfa-provider.service.js +101 -3
- package/dist/src/totp-mfa-provider.service.js.map +1 -1
- package/dist/src/totp.service.d.ts +158 -0
- package/dist/src/totp.service.d.ts.map +1 -1
- package/dist/src/totp.service.js +184 -1
- package/dist/src/totp.service.js.map +1 -1
- package/dist/tsconfig.tsbuildinfo +1 -1
- package/package.json +2 -2
|
@@ -1,21 +1,141 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* MFA (Multi-Factor Authentication) DTOs
|
|
3
|
+
*
|
|
4
|
+
* Request and response types for MFA operations including:
|
|
5
|
+
* - TOTP (Time-based One-Time Password) setup and verification
|
|
6
|
+
* - SMS MFA setup and verification
|
|
7
|
+
* - Passkey (WebAuthn) registration and authentication
|
|
8
|
+
* - Backup codes generation and usage
|
|
9
|
+
*/
|
|
10
|
+
/**
|
|
11
|
+
* MFA Challenge Response DTO
|
|
12
|
+
*
|
|
13
|
+
* Returned when login requires MFA verification.
|
|
14
|
+
* Client must complete MFA challenge to receive access tokens.
|
|
15
|
+
*
|
|
16
|
+
* @example
|
|
17
|
+
* ```typescript
|
|
18
|
+
* // Login response with MFA required
|
|
19
|
+
* {
|
|
20
|
+
* challengeName: 'MFA_REQUIRED',
|
|
21
|
+
* session: 'challenge-session-token-here',
|
|
22
|
+
* challengeParameters: {
|
|
23
|
+
* availableMethods: ['totp', 'sms'],
|
|
24
|
+
* preferredMethod: 'totp'
|
|
25
|
+
* }
|
|
26
|
+
* }
|
|
27
|
+
* ```
|
|
28
|
+
*/
|
|
1
29
|
export interface MFAChallengeResponseDTO {
|
|
30
|
+
/**
|
|
31
|
+
* Challenge type (always 'MFA_REQUIRED')
|
|
32
|
+
*/
|
|
2
33
|
challengeName: 'MFA_REQUIRED';
|
|
34
|
+
/**
|
|
35
|
+
* Temporary challenge session token
|
|
36
|
+
* Must be submitted with MFA verification
|
|
37
|
+
*/
|
|
3
38
|
session: string;
|
|
39
|
+
/**
|
|
40
|
+
* Challenge parameters with available MFA methods
|
|
41
|
+
*/
|
|
4
42
|
challengeParameters: {
|
|
43
|
+
/**
|
|
44
|
+
* MFA methods available for this user
|
|
45
|
+
*/
|
|
5
46
|
availableMethods: Array<'totp' | 'sms' | 'passkey' | 'backup'>;
|
|
47
|
+
/**
|
|
48
|
+
* User's preferred MFA method
|
|
49
|
+
*/
|
|
6
50
|
preferredMethod?: 'totp' | 'sms' | 'passkey';
|
|
51
|
+
/**
|
|
52
|
+
* Masked phone number for SMS (if available)
|
|
53
|
+
* @example '***-***-1234'
|
|
54
|
+
*/
|
|
7
55
|
maskedPhone?: string;
|
|
8
56
|
};
|
|
9
57
|
}
|
|
58
|
+
/**
|
|
59
|
+
* Verify MFA Code DTO
|
|
60
|
+
*
|
|
61
|
+
* Submit MFA code to complete authentication challenge.
|
|
62
|
+
*
|
|
63
|
+
* @example
|
|
64
|
+
* ```typescript
|
|
65
|
+
* // Verify TOTP code
|
|
66
|
+
* {
|
|
67
|
+
* session: 'challenge-session-token',
|
|
68
|
+
* method: 'totp',
|
|
69
|
+
* code: '123456'
|
|
70
|
+
* }
|
|
71
|
+
*
|
|
72
|
+
* // Verify SMS code with device trust
|
|
73
|
+
* {
|
|
74
|
+
* session: 'challenge-session-token',
|
|
75
|
+
* method: 'sms',
|
|
76
|
+
* code: '987654',
|
|
77
|
+
* trustDevice: true
|
|
78
|
+
* }
|
|
79
|
+
* ```
|
|
80
|
+
*/
|
|
10
81
|
export interface VerifyMFACodeDTO {
|
|
82
|
+
/**
|
|
83
|
+
* Challenge session token from MFA challenge
|
|
84
|
+
*/
|
|
11
85
|
session: string;
|
|
86
|
+
/**
|
|
87
|
+
* MFA method being used
|
|
88
|
+
*/
|
|
12
89
|
method: 'totp' | 'sms' | 'backup';
|
|
90
|
+
/**
|
|
91
|
+
* MFA code to verify
|
|
92
|
+
*/
|
|
13
93
|
code: string;
|
|
94
|
+
/**
|
|
95
|
+
* Trust this device (skip MFA for configured period)
|
|
96
|
+
* Only applicable if rememberDevice is enabled in config
|
|
97
|
+
*
|
|
98
|
+
* @default false
|
|
99
|
+
*/
|
|
14
100
|
trustDevice?: boolean;
|
|
101
|
+
/**
|
|
102
|
+
* Device identifier for trusted device tracking
|
|
103
|
+
* Should be persistent per device (e.g., UUID stored in localStorage)
|
|
104
|
+
*/
|
|
15
105
|
deviceId?: string;
|
|
16
106
|
}
|
|
107
|
+
/**
|
|
108
|
+
* Verify Passkey DTO
|
|
109
|
+
*
|
|
110
|
+
* Submit WebAuthn assertion to complete authentication challenge.
|
|
111
|
+
*
|
|
112
|
+
* @example
|
|
113
|
+
* ```typescript
|
|
114
|
+
* {
|
|
115
|
+
* session: 'challenge-session-token',
|
|
116
|
+
* credential: {
|
|
117
|
+
* id: 'credential-id-here',
|
|
118
|
+
* rawId: 'base64-raw-id',
|
|
119
|
+
* response: {
|
|
120
|
+
* clientDataJSON: 'base64-client-data',
|
|
121
|
+
* authenticatorData: 'base64-authenticator-data',
|
|
122
|
+
* signature: 'base64-signature',
|
|
123
|
+
* userHandle: 'base64-user-handle'
|
|
124
|
+
* },
|
|
125
|
+
* type: 'public-key'
|
|
126
|
+
* },
|
|
127
|
+
* trustDevice: true
|
|
128
|
+
* }
|
|
129
|
+
* ```
|
|
130
|
+
*/
|
|
17
131
|
export interface VerifyPasskeyDTO {
|
|
132
|
+
/**
|
|
133
|
+
* Challenge session token from MFA challenge
|
|
134
|
+
*/
|
|
18
135
|
session: string;
|
|
136
|
+
/**
|
|
137
|
+
* WebAuthn credential (PublicKeyCredential from navigator.credentials.get())
|
|
138
|
+
*/
|
|
19
139
|
credential: {
|
|
20
140
|
id: string;
|
|
21
141
|
rawId: string;
|
|
@@ -27,32 +147,179 @@ export interface VerifyPasskeyDTO {
|
|
|
27
147
|
};
|
|
28
148
|
type: 'public-key';
|
|
29
149
|
};
|
|
150
|
+
/**
|
|
151
|
+
* Trust this device (skip MFA for configured period)
|
|
152
|
+
* @default false
|
|
153
|
+
*/
|
|
30
154
|
trustDevice?: boolean;
|
|
31
155
|
}
|
|
156
|
+
/**
|
|
157
|
+
* Setup TOTP Response DTO
|
|
158
|
+
*
|
|
159
|
+
* Returns QR code and secret for TOTP setup.
|
|
160
|
+
* User must scan QR code with authenticator app and verify with a code.
|
|
161
|
+
*
|
|
162
|
+
* @example
|
|
163
|
+
* ```typescript
|
|
164
|
+
* {
|
|
165
|
+
* secret: 'base32-encoded-secret',
|
|
166
|
+
* qrCode: 'data:image/png;base64,...',
|
|
167
|
+
* manualEntryKey: 'ABCD EFGH IJKL MNOP',
|
|
168
|
+
* issuer: 'MyApp',
|
|
169
|
+
* accountName: 'user@example.com'
|
|
170
|
+
* }
|
|
171
|
+
* ```
|
|
172
|
+
*/
|
|
32
173
|
export interface SetupTOTPResponseDTO {
|
|
174
|
+
/**
|
|
175
|
+
* Base32-encoded TOTP secret
|
|
176
|
+
* Used to generate QR code and for manual entry
|
|
177
|
+
*/
|
|
33
178
|
secret: string;
|
|
179
|
+
/**
|
|
180
|
+
* QR code as data URL
|
|
181
|
+
* User scans this with authenticator app
|
|
182
|
+
*/
|
|
34
183
|
qrCode: string;
|
|
184
|
+
/**
|
|
185
|
+
* Formatted secret for manual entry
|
|
186
|
+
* Displayed if QR scan fails
|
|
187
|
+
* @example 'ABCD EFGH IJKL MNOP'
|
|
188
|
+
*/
|
|
35
189
|
manualEntryKey: string;
|
|
190
|
+
/**
|
|
191
|
+
* Issuer name (from config)
|
|
192
|
+
*/
|
|
36
193
|
issuer: string;
|
|
194
|
+
/**
|
|
195
|
+
* Account name (typically user's email)
|
|
196
|
+
*/
|
|
37
197
|
accountName: string;
|
|
38
198
|
}
|
|
199
|
+
/**
|
|
200
|
+
* Verify TOTP Setup DTO
|
|
201
|
+
*
|
|
202
|
+
* Submit code to complete TOTP setup.
|
|
203
|
+
* Verifies the user can generate valid codes.
|
|
204
|
+
*
|
|
205
|
+
* @example
|
|
206
|
+
* ```typescript
|
|
207
|
+
* {
|
|
208
|
+
* secret: 'base32-secret-from-setup',
|
|
209
|
+
* code: '123456',
|
|
210
|
+
* deviceName: 'Google Authenticator'
|
|
211
|
+
* }
|
|
212
|
+
* ```
|
|
213
|
+
*/
|
|
39
214
|
export interface VerifyTOTPSetupDTO {
|
|
215
|
+
/**
|
|
216
|
+
* TOTP secret from setup response
|
|
217
|
+
*/
|
|
40
218
|
secret: string;
|
|
219
|
+
/**
|
|
220
|
+
* TOTP code from authenticator app
|
|
221
|
+
*/
|
|
41
222
|
code: string;
|
|
223
|
+
/**
|
|
224
|
+
* User-friendly device name
|
|
225
|
+
* @example 'Google Authenticator', 'Authy', '1Password'
|
|
226
|
+
*/
|
|
42
227
|
deviceName?: string;
|
|
43
228
|
}
|
|
229
|
+
/**
|
|
230
|
+
* Setup SMS MFA DTO
|
|
231
|
+
*
|
|
232
|
+
* Configure SMS as MFA method.
|
|
233
|
+
* Sends verification code to phone number.
|
|
234
|
+
*
|
|
235
|
+
* @example
|
|
236
|
+
* ```typescript
|
|
237
|
+
* {
|
|
238
|
+
* phoneNumber: '+1234567890',
|
|
239
|
+
* deviceName: 'My Phone'
|
|
240
|
+
* }
|
|
241
|
+
* ```
|
|
242
|
+
*/
|
|
44
243
|
export interface SetupSMSMFADTO {
|
|
244
|
+
/**
|
|
245
|
+
* Phone number in E.164 format
|
|
246
|
+
* @example '+1234567890'
|
|
247
|
+
*/
|
|
45
248
|
phoneNumber: string;
|
|
249
|
+
/**
|
|
250
|
+
* User-friendly device name
|
|
251
|
+
* @example 'My iPhone', 'Work Phone'
|
|
252
|
+
*/
|
|
46
253
|
deviceName?: string;
|
|
47
254
|
}
|
|
255
|
+
/**
|
|
256
|
+
* Verify SMS MFA Setup DTO
|
|
257
|
+
*
|
|
258
|
+
* Submit code to complete SMS MFA setup.
|
|
259
|
+
*
|
|
260
|
+
* @example
|
|
261
|
+
* ```typescript
|
|
262
|
+
* {
|
|
263
|
+
* phoneNumber: '+1234567890',
|
|
264
|
+
* code: '123456'
|
|
265
|
+
* }
|
|
266
|
+
* ```
|
|
267
|
+
*/
|
|
48
268
|
export interface VerifySMSMFASetupDTO {
|
|
269
|
+
/**
|
|
270
|
+
* Phone number receiving the code
|
|
271
|
+
*/
|
|
49
272
|
phoneNumber: string;
|
|
273
|
+
/**
|
|
274
|
+
* SMS verification code
|
|
275
|
+
*/
|
|
50
276
|
code: string;
|
|
51
277
|
}
|
|
278
|
+
/**
|
|
279
|
+
* Send SMS MFA Code DTO
|
|
280
|
+
*
|
|
281
|
+
* Request SMS code during MFA challenge.
|
|
282
|
+
*
|
|
283
|
+
* @example
|
|
284
|
+
* ```typescript
|
|
285
|
+
* {
|
|
286
|
+
* session: 'challenge-session-token'
|
|
287
|
+
* }
|
|
288
|
+
* ```
|
|
289
|
+
*/
|
|
52
290
|
export interface SendSMSMFACodeDTO {
|
|
291
|
+
/**
|
|
292
|
+
* Challenge session token
|
|
293
|
+
*/
|
|
53
294
|
session: string;
|
|
54
295
|
}
|
|
296
|
+
/**
|
|
297
|
+
* Setup Passkey Response DTO
|
|
298
|
+
*
|
|
299
|
+
* Returns WebAuthn registration options.
|
|
300
|
+
* Client passes these to navigator.credentials.create().
|
|
301
|
+
*
|
|
302
|
+
* @example
|
|
303
|
+
* ```typescript
|
|
304
|
+
* {
|
|
305
|
+
* challenge: 'base64-challenge',
|
|
306
|
+
* rp: { name: 'MyApp', id: 'myapp.com' },
|
|
307
|
+
* user: {
|
|
308
|
+
* id: 'base64-user-id',
|
|
309
|
+
* name: 'user@example.com',
|
|
310
|
+
* displayName: 'John Doe'
|
|
311
|
+
* },
|
|
312
|
+
* pubKeyCredParams: [{ type: 'public-key', alg: -7 }],
|
|
313
|
+
* timeout: 60000,
|
|
314
|
+
* attestation: 'none'
|
|
315
|
+
* }
|
|
316
|
+
* ```
|
|
317
|
+
*/
|
|
55
318
|
export interface SetupPasskeyResponseDTO {
|
|
319
|
+
/**
|
|
320
|
+
* WebAuthn registration options
|
|
321
|
+
* Pass to navigator.credentials.create({ publicKey: options })
|
|
322
|
+
*/
|
|
56
323
|
options: {
|
|
57
324
|
challenge: string;
|
|
58
325
|
rp: {
|
|
@@ -82,7 +349,31 @@ export interface SetupPasskeyResponseDTO {
|
|
|
82
349
|
}>;
|
|
83
350
|
};
|
|
84
351
|
}
|
|
352
|
+
/**
|
|
353
|
+
* Verify Passkey Setup DTO
|
|
354
|
+
*
|
|
355
|
+
* Submit WebAuthn credential to complete passkey setup.
|
|
356
|
+
*
|
|
357
|
+
* @example
|
|
358
|
+
* ```typescript
|
|
359
|
+
* {
|
|
360
|
+
* credential: {
|
|
361
|
+
* id: 'credential-id',
|
|
362
|
+
* rawId: 'base64-raw-id',
|
|
363
|
+
* response: {
|
|
364
|
+
* clientDataJSON: 'base64-client-data',
|
|
365
|
+
* attestationObject: 'base64-attestation'
|
|
366
|
+
* },
|
|
367
|
+
* type: 'public-key'
|
|
368
|
+
* },
|
|
369
|
+
* deviceName: 'iPhone 15 Pro'
|
|
370
|
+
* }
|
|
371
|
+
* ```
|
|
372
|
+
*/
|
|
85
373
|
export interface VerifyPasskeySetupDTO {
|
|
374
|
+
/**
|
|
375
|
+
* WebAuthn credential from navigator.credentials.create()
|
|
376
|
+
*/
|
|
86
377
|
credential: {
|
|
87
378
|
id: string;
|
|
88
379
|
rawId: string;
|
|
@@ -92,9 +383,35 @@ export interface VerifyPasskeySetupDTO {
|
|
|
92
383
|
};
|
|
93
384
|
type: 'public-key';
|
|
94
385
|
};
|
|
386
|
+
/**
|
|
387
|
+
* User-friendly device name
|
|
388
|
+
* @example 'iPhone 17 Pro', 'YubiKey 5C'
|
|
389
|
+
*/
|
|
95
390
|
deviceName?: string;
|
|
96
391
|
}
|
|
392
|
+
/**
|
|
393
|
+
* Get Passkey Challenge Response DTO
|
|
394
|
+
*
|
|
395
|
+
* Returns WebAuthn authentication options for MFA challenge.
|
|
396
|
+
*
|
|
397
|
+
* @example
|
|
398
|
+
* ```typescript
|
|
399
|
+
* {
|
|
400
|
+
* challenge: 'base64-challenge',
|
|
401
|
+
* timeout: 60000,
|
|
402
|
+
* rpId: 'myapp.com',
|
|
403
|
+
* allowCredentials: [
|
|
404
|
+
* { id: 'credential-id-1', type: 'public-key', transports: ['usb', 'nfc'] }
|
|
405
|
+
* ],
|
|
406
|
+
* userVerification: 'preferred'
|
|
407
|
+
* }
|
|
408
|
+
* ```
|
|
409
|
+
*/
|
|
97
410
|
export interface GetPasskeyChallengeResponseDTO {
|
|
411
|
+
/**
|
|
412
|
+
* WebAuthn authentication options
|
|
413
|
+
* Pass to navigator.credentials.get({ publicKey: options })
|
|
414
|
+
*/
|
|
98
415
|
options: {
|
|
99
416
|
challenge: string;
|
|
100
417
|
timeout: number;
|
|
@@ -107,37 +424,196 @@ export interface GetPasskeyChallengeResponseDTO {
|
|
|
107
424
|
userVerification: 'required' | 'preferred' | 'discouraged';
|
|
108
425
|
};
|
|
109
426
|
}
|
|
427
|
+
/**
|
|
428
|
+
* Generate Backup Codes Response DTO
|
|
429
|
+
*
|
|
430
|
+
* Returns newly generated backup codes.
|
|
431
|
+
* Codes are only shown once - user must save them securely.
|
|
432
|
+
*
|
|
433
|
+
* @example
|
|
434
|
+
* ```typescript
|
|
435
|
+
* {
|
|
436
|
+
* codes: [
|
|
437
|
+
* 'ABCD1234',
|
|
438
|
+
* 'EFGH5678',
|
|
439
|
+
* // ... 8 more codes
|
|
440
|
+
* ],
|
|
441
|
+
* generated: '2024-01-15T10:30:00Z'
|
|
442
|
+
* }
|
|
443
|
+
* ```
|
|
444
|
+
*/
|
|
110
445
|
export interface GenerateBackupCodesResponseDTO {
|
|
446
|
+
/**
|
|
447
|
+
* Array of backup codes
|
|
448
|
+
* Each code can only be used once
|
|
449
|
+
*/
|
|
111
450
|
codes: string[];
|
|
451
|
+
/**
|
|
452
|
+
* Generation timestamp
|
|
453
|
+
*/
|
|
112
454
|
generated: string;
|
|
113
455
|
}
|
|
456
|
+
/**
|
|
457
|
+
* MFA Device DTO
|
|
458
|
+
*
|
|
459
|
+
* Information about a registered MFA device.
|
|
460
|
+
*
|
|
461
|
+
* @example
|
|
462
|
+
* ```typescript
|
|
463
|
+
* {
|
|
464
|
+
* id: 123,
|
|
465
|
+
* type: 'totp',
|
|
466
|
+
* name: 'Google Authenticator',
|
|
467
|
+
* isActive: true,
|
|
468
|
+
* isPrimary: true,
|
|
469
|
+
* lastUsedAt: '2024-01-15T10:30:00Z',
|
|
470
|
+
* createdAt: '2024-01-01T00:00:00Z'
|
|
471
|
+
* }
|
|
472
|
+
* ```
|
|
473
|
+
*/
|
|
114
474
|
export interface MFADeviceDTO {
|
|
475
|
+
/**
|
|
476
|
+
* Device ID
|
|
477
|
+
*/
|
|
115
478
|
id: number;
|
|
479
|
+
/**
|
|
480
|
+
* MFA method type
|
|
481
|
+
*/
|
|
116
482
|
type: 'totp' | 'sms' | 'passkey';
|
|
483
|
+
/**
|
|
484
|
+
* User-friendly device name
|
|
485
|
+
*/
|
|
117
486
|
name: string;
|
|
487
|
+
/**
|
|
488
|
+
* Whether device is active
|
|
489
|
+
*/
|
|
118
490
|
isActive: boolean;
|
|
491
|
+
/**
|
|
492
|
+
* Whether this is the primary/preferred device
|
|
493
|
+
*/
|
|
119
494
|
isPrimary: boolean;
|
|
495
|
+
/**
|
|
496
|
+
* Last usage timestamp
|
|
497
|
+
*/
|
|
120
498
|
lastUsedAt?: string;
|
|
499
|
+
/**
|
|
500
|
+
* Registration timestamp
|
|
501
|
+
*/
|
|
121
502
|
createdAt: string;
|
|
503
|
+
/**
|
|
504
|
+
* Masked phone number (SMS only)
|
|
505
|
+
*/
|
|
122
506
|
maskedPhone?: string;
|
|
123
507
|
}
|
|
508
|
+
/**
|
|
509
|
+
* List MFA Devices Response DTO
|
|
510
|
+
*
|
|
511
|
+
* Returns all MFA devices for a user.
|
|
512
|
+
*
|
|
513
|
+
* @example
|
|
514
|
+
* ```typescript
|
|
515
|
+
* {
|
|
516
|
+
* devices: [
|
|
517
|
+
* { id: 1, type: 'totp', name: 'Google Authenticator', ... },
|
|
518
|
+
* { id: 2, type: 'sms', name: 'My Phone', ... }
|
|
519
|
+
* ],
|
|
520
|
+
* hasBackupCodes: true
|
|
521
|
+
* }
|
|
522
|
+
* ```
|
|
523
|
+
*/
|
|
124
524
|
export interface ListMFADevicesResponseDTO {
|
|
525
|
+
/**
|
|
526
|
+
* Array of MFA devices
|
|
527
|
+
*/
|
|
125
528
|
devices: MFADeviceDTO[];
|
|
529
|
+
/**
|
|
530
|
+
* Whether user has backup codes generated
|
|
531
|
+
*/
|
|
126
532
|
hasBackupCodes: boolean;
|
|
127
533
|
}
|
|
534
|
+
/**
|
|
535
|
+
* Update MFA Device DTO
|
|
536
|
+
*
|
|
537
|
+
* Update device name or primary status.
|
|
538
|
+
*
|
|
539
|
+
* @example
|
|
540
|
+
* ```typescript
|
|
541
|
+
* {
|
|
542
|
+
* name: 'My New Authenticator',
|
|
543
|
+
* isPrimary: true
|
|
544
|
+
* }
|
|
545
|
+
* ```
|
|
546
|
+
*/
|
|
128
547
|
export interface UpdateMFADeviceDTO {
|
|
548
|
+
/**
|
|
549
|
+
* New device name
|
|
550
|
+
*/
|
|
129
551
|
name?: string;
|
|
552
|
+
/**
|
|
553
|
+
* Set as primary device
|
|
554
|
+
*/
|
|
130
555
|
isPrimary?: boolean;
|
|
131
556
|
}
|
|
557
|
+
/**
|
|
558
|
+
* Disable MFA Device DTO
|
|
559
|
+
*
|
|
560
|
+
* Disable an MFA device (requires password confirmation).
|
|
561
|
+
*
|
|
562
|
+
* @example
|
|
563
|
+
* ```typescript
|
|
564
|
+
* {
|
|
565
|
+
* password: 'user-password-here'
|
|
566
|
+
* }
|
|
567
|
+
* ```
|
|
568
|
+
*/
|
|
132
569
|
export interface DisableMFADeviceDTO {
|
|
570
|
+
/**
|
|
571
|
+
* User's password (for security confirmation)
|
|
572
|
+
*/
|
|
133
573
|
password: string;
|
|
134
574
|
}
|
|
575
|
+
/**
|
|
576
|
+
* MFA Status Response DTO
|
|
577
|
+
*
|
|
578
|
+
* Returns MFA configuration status for a user.
|
|
579
|
+
*
|
|
580
|
+
* @example
|
|
581
|
+
* ```typescript
|
|
582
|
+
* {
|
|
583
|
+
* enabled: true,
|
|
584
|
+
* required: false,
|
|
585
|
+
* gracePeriodEnds: '2024-01-22T00:00:00Z',
|
|
586
|
+
* configuredMethods: ['totp', 'sms'],
|
|
587
|
+
* preferredMethod: 'totp',
|
|
588
|
+
* hasBackupCodes: true
|
|
589
|
+
* }
|
|
590
|
+
* ```
|
|
591
|
+
*/
|
|
135
592
|
export interface MFAStatusResponseDTO {
|
|
593
|
+
/**
|
|
594
|
+
* Whether MFA is enabled for this user
|
|
595
|
+
*/
|
|
136
596
|
enabled: boolean;
|
|
597
|
+
/**
|
|
598
|
+
* Whether MFA is required (based on enforcement policy)
|
|
599
|
+
*/
|
|
137
600
|
required: boolean;
|
|
601
|
+
/**
|
|
602
|
+
* Grace period expiration (if MFA is required)
|
|
603
|
+
* After this date, user must enable MFA to login
|
|
604
|
+
*/
|
|
138
605
|
gracePeriodEnds?: string;
|
|
606
|
+
/**
|
|
607
|
+
* MFA methods configured by user
|
|
608
|
+
*/
|
|
139
609
|
configuredMethods: Array<'totp' | 'sms' | 'passkey'>;
|
|
610
|
+
/**
|
|
611
|
+
* User's preferred MFA method
|
|
612
|
+
*/
|
|
140
613
|
preferredMethod?: 'totp' | 'sms' | 'passkey';
|
|
614
|
+
/**
|
|
615
|
+
* Whether user has generated backup codes
|
|
616
|
+
*/
|
|
141
617
|
hasBackupCodes: boolean;
|
|
142
618
|
}
|
|
143
619
|
//# sourceMappingURL=mfa.dto.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mfa.dto.d.ts","sourceRoot":"","sources":["../../../src/dto/mfa.dto.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"mfa.dto.d.ts","sourceRoot":"","sources":["../../../src/dto/mfa.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,aAAa,EAAE,cAAc,CAAC;IAE9B;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,mBAAmB,EAAE;QACnB;;WAEG;QACH,gBAAgB,EAAE,KAAK,CAAC,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,QAAQ,CAAC,CAAC;QAE/D;;WAEG;QACH,eAAe,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;QAE7C;;;WAGG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAMD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAElC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,UAAU,EAAE;QACV,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE;YACR,cAAc,EAAE,MAAM,CAAC;YACvB,iBAAiB,EAAE,MAAM,CAAC;YAC1B,SAAS,EAAE,MAAM,CAAC;YAClB,UAAU,CAAC,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,IAAI,EAAE,YAAY,CAAC;KACpB,CAAC;IAEF;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,EAAE,EAAE;YACF,IAAI,EAAE,MAAM,CAAC;YACb,EAAE,EAAE,MAAM,CAAC;SACZ,CAAC;QACF,IAAI,EAAE;YACJ,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,gBAAgB,EAAE,KAAK,CAAC;YACtB,IAAI,EAAE,YAAY,CAAC;YACnB,GAAG,EAAE,MAAM,CAAC;SACb,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,QAAQ,CAAC;QAC5C,sBAAsB,CAAC,EAAE;YACvB,uBAAuB,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAC;YACxD,kBAAkB,CAAC,EAAE,OAAO,CAAC;YAC7B,gBAAgB,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;SAC7D,CAAC;QACF,kBAAkB,CAAC,EAAE,KAAK,CAAC;YACzB,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,YAAY,CAAC;YACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;SACvB,CAAC,CAAC;KACJ,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,UAAU,EAAE;QACV,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE;YACR,cAAc,EAAE,MAAM,CAAC;YACvB,iBAAiB,EAAE,MAAM,CAAC;SAC3B,CAAC;QACF,IAAI,EAAE,YAAY,CAAC;KACpB,CAAC;IAEF;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;;OAGG;IACH,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,gBAAgB,EAAE,KAAK,CAAC;YACtB,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,YAAY,CAAC;YACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;SACvB,CAAC,CAAC;QACH,gBAAgB,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;KAC5D,CAAC;CACH;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;;OAGG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IAEX;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;IAEjC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAC;IAElB;;OAEG;IACH,SAAS,EAAE,OAAO,CAAC;IAEnB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,OAAO,EAAE,YAAY,EAAE,CAAC;IAExB;;OAEG;IACH,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAC;IAElB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,iBAAiB,EAAE,KAAK,CAAC,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC,CAAC;IAErD;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;IAE7C;;OAEG;IACH,cAAc,EAAE,OAAO,CAAC;CACzB"}
|
package/dist/src/dto/mfa.dto.js
CHANGED
|
@@ -1,3 +1,12 @@
|
|
|
1
1
|
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* MFA (Multi-Factor Authentication) DTOs
|
|
4
|
+
*
|
|
5
|
+
* Request and response types for MFA operations including:
|
|
6
|
+
* - TOTP (Time-based One-Time Password) setup and verification
|
|
7
|
+
* - SMS MFA setup and verification
|
|
8
|
+
* - Passkey (WebAuthn) registration and authentication
|
|
9
|
+
* - Backup codes generation and usage
|
|
10
|
+
*/
|
|
2
11
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
12
|
//# sourceMappingURL=mfa.dto.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mfa.dto.js","sourceRoot":"","sources":["../../../src/dto/mfa.dto.ts"],"names":[],"mappings":""}
|
|
1
|
+
{"version":3,"file":"mfa.dto.js","sourceRoot":"","sources":["../../../src/dto/mfa.dto.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG"}
|
package/dist/src/index.d.ts
CHANGED
|
@@ -1,3 +1,9 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* @nauth-toolkit/mfa-totp
|
|
3
|
+
*
|
|
4
|
+
* Platform-agnostic TOTP/Authenticator MFA provider for nauth-toolkit.
|
|
5
|
+
* For NestJS integration, use '@nauth-toolkit/mfa-totp/nestjs'
|
|
6
|
+
*/
|
|
1
7
|
export { TOTPService } from './totp.service';
|
|
2
8
|
export { TOTPMFAProviderService } from './totp-mfa-provider.service';
|
|
3
9
|
export * from './dto/mfa.dto';
|
package/dist/src/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,cAAc,eAAe,CAAC"}
|
package/dist/src/index.js
CHANGED
|
@@ -1,4 +1,10 @@
|
|
|
1
1
|
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* @nauth-toolkit/mfa-totp
|
|
4
|
+
*
|
|
5
|
+
* Platform-agnostic TOTP/Authenticator MFA provider for nauth-toolkit.
|
|
6
|
+
* For NestJS integration, use '@nauth-toolkit/mfa-totp/nestjs'
|
|
7
|
+
*/
|
|
2
8
|
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
3
9
|
if (k2 === undefined) k2 = k;
|
|
4
10
|
var desc = Object.getOwnPropertyDescriptor(m, k);
|
package/dist/src/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;AAEH,+CAA6C;AAApC,2GAAA,WAAW,OAAA;AACpB,yEAAqE;AAA5D,mIAAA,sBAAsB,OAAA;AAC/B,gDAA8B"}
|