@navette-js/panels 1.0.0-beta.4 → 1.0.0-beta.5

package/lib/multi-factor.js

@@ -0,0 +1,928 @@
+// Multi-factor authentication: the provider contract, the login challenge, and two providers:
+// authenticator apps (TOTP, with recovery codes) and security keys (WebAuthn: hardware keys and passkeys).
+import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes, randomInt, timingSafeEqual } from 'node:crypto';
+import { Action } from '@navette-js/actions';
+import { Field, Halt, OneTimeCodeInput, Radio, Step, TextInput } from '@navette-js/forms';
+import { Actions, Flex, Group, Html, Image, Section, Text } from '@navette-js/schemas';
+import { HtmlString, e, js } from '@navette-js/support';
+import { t, tc } from '@navette-js/support/i18n';
+import { button } from '@navette-js/support/ui';
+import { readToken, signToken } from "./auth.js";
+import { Notification } from "./notifications.js";
+import { qrCodeDataUri } from "./qr-code.js";
+import { Throttle } from "./throttle.js";
+import { generateTotpSecret, totpUri, verifyTotp } from "./totp.js";
+import { authenticationOptions, generateChallenge, registrationOptions, verifyAuthentication, verifyRegistration, WebAuthnError } from "./webauthn.js";
+/** In-memory store: fine for a single process. When running several, use a shared store (Redis…) with `cacheStore()`. */
+export class MemoryCacheStore {
+    entries = new Map();
+    max;
+    constructor(max = 50_000) { this.max = max; }
+    get(key) {
+        const entry = this.entries.get(key);
+        if (!entry)
+            return undefined;
+        if (entry.expires <= Date.now()) {
+            this.entries.delete(key);
+            return undefined;
+        }
+        return entry.value;
+    }
+    put(key, value, ttlSeconds) {
+        this.entries.set(key, { value, expires: Date.now() + ttlSeconds * 1000 });
+        if (this.entries.size > this.max) {
+            const now = Date.now();
+            for (const [k, v] of this.entries)
+                if (v.expires <= now)
+                    this.entries.delete(k);
+            // Still full: drop the oldest entries.
+            for (const k of this.entries.keys()) {
+                if (this.entries.size <= this.max)
+                    break;
+                this.entries.delete(k);
+            }
+        }
+    }
+    forget(key) { this.entries.delete(key); }
+}
+let defaultCacheStore = new MemoryCacheStore();
+/** Store used by the providers that do not set their own `cacheStore()`. */
+export const useMultiFactorCacheStore = (store) => { defaultCacheStore = store; };
+/** The store of short-lived values shared by authentication features (multi-factor codes, email change blocks). */
+export const getDefaultCacheStore = () => defaultCacheStore;
+/** Runs `fn` after any other call holding the same key in this process (check-then-write sequences). */
+const queues = new Map();
+async function serialized(key, fn) {
+    const previous = queues.get(key) ?? Promise.resolve();
+    const run = previous.catch(() => { }).then(fn);
+    queues.set(key, run);
+    try {
+        return await run;
+    }
+    finally {
+        if (queues.get(key) === run)
+            queues.delete(key);
+    }
+}
+// ------------------------------------------------------------------ helpers
+const contextOf = (livewire) => livewire?._ctx;
+const userKey = (user) => createHash('sha256').update(String(user.id)).digest('base64url').slice(0, 22);
+/** The signed-in user of the request the action runs in; the action stops if they changed since it was mounted. */
+function currentUser(livewire) {
+    const user = contextOf(livewire)?.user;
+    if (!user)
+        throw new Halt();
+    return user;
+}
+const fail = (livewire, path, message) => { livewire.addError(path, message); throw new Halt(); };
+/** "Current password" field: checked against the auth provider. Not saved. */
+function currentPasswordInput(name, label, attribute) {
+    return TextInput.make(name).label(label).validationAttribute(attribute).password().revealable().autocomplete('current-password').required().dehydrated(false)
+        .rule({
+        name: 'current_password',
+        passes: async (value, ctx) => { const { panel, user } = contextOf(ctx.livewire); return Boolean(user && (await panel.getAuth().attempt(user.email, String(value)))); },
+        message: () => 'The password is incorrect.',
+    });
+}
+/** Link showing the recovery code field: it sets `useRecoveryCode` next to the field, in the browser state. */
+function useRecoveryCodeLink(label, ctx) {
+    const path = [ctx.component.container.getStatePath(), 'useRecoveryCode'].filter(Boolean).join('.');
+    return Text.make(new HtmlString(`<button type="button" class="fi-link fi-size-sm fi-color fi-color-primary fi-text-color-600 dark:fi-text-color-400" x-on:click="${e(`$wire.set(${js(path)}, true)`)}"><span class="fi-link-label">${e(label)}</span></button>`));
+}
+/** A rate limit as a validation rule: each validation counts as an attempt. */
+const throttleRule = (throttle, key, message) => ({
+    name: 'throttle', passes: (_value, ctx) => throttle.hit(key(ctx)) === 0, message: () => message, implicit: true,
+});
+const statusBadge = (enabled, enabledLabel, disabledLabel) => (enabled ? Text.make(enabledLabel).badge().color('success') : Text.make(disabledLabel).badge());
+// ------------------------------------------------------------------ the challenge
+/** The login challenge: enabled providers, the picker, rate limiting. */
+export class MultiFactorChallenge {
+    /** Attempts per user and per minute. */
+    static maxAttempts = 5;
+    static throttle = null;
+    panel;
+    constructor(panel) { this.panel = panel; }
+    static make(panel) { return new this(panel); }
+    getProviders() { return this.panel.getMultiFactorAuthenticationProviders(); }
+    async getEnabledProviders(user) {
+        const enabled = [];
+        for (const provider of this.getProviders())
+            if (await provider.isEnabled(user, this.panel))
+                enabled.push(provider);
+        return enabled;
+    }
+    async hasEnabledProviders(user) {
+        for (const provider of this.getProviders())
+            if (await provider.isEnabled(user, this.panel))
+                return true;
+        return false;
+    }
+    async beforeChallenge(user, provider) {
+        const target = provider ?? (await this.getEnabledProviders(user))[0];
+        await target?.beforeChallenge?.(user, this.panel);
+    }
+    /**
+     * Challenge fields for these enabled providers: a picker when there are several, then each provider's fields under its id
+     * (only the picked provider's are shown and validated).
+     */
+    getFormComponents(user, enabled) {
+        const several = enabled.length > 1;
+        const picker = several ? [Section.make().compact().secondary().schema([
+                Radio.make('provider').label(t('filament-panels::auth/pages/login.multi_factor.form.provider.label'))
+                    .options(Object.fromEntries(enabled.map((provider) => [provider.getId(), provider.getLoginFormLabel()])))
+                    .default(enabled[0].getId()).live().required().markAsRequired(false),
+            ])] : [];
+        return [
+            ...picker,
+            ...enabled.map((provider) => {
+                const group = Group.make(provider.getChallengeFormComponents(user, this.panel)).statePath(provider.getId());
+                return several ? group.visible(({ get }) => (get('provider') ?? enabled[0].getId()) === provider.getId()) : group;
+            }),
+        ];
+    }
+    static limiter() { return (this.throttle ??= new Throttle(this.maxAttempts)); }
+    /** Records an attempt; returns 0 if allowed, otherwise the seconds to wait. */
+    hitRateLimiter(user) { return this.constructor.limiter().hit(`${this.panel.getId()}:${userKey(user)}`); }
+    clearRateLimiter(user) { this.constructor.limiter().clear(`${this.panel.getId()}:${userKey(user)}`); }
+}
+const ENCRYPTED_PREFIX = 'enc:v1:';
+const secretKey = (panel) => Buffer.from(hkdfSync('sha256', panel.getAuthKey(), 'navette', 'app-authentication-secret', 32));
+/** Encrypts a TOTP secret at rest (AES-256-GCM, with a key derived from the panel key). */
+export function encryptSecret(panel, secret) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', secretKey(panel), iv);
+    const data = Buffer.concat([cipher.update(secret, 'utf8'), cipher.final()]);
+    return `${ENCRYPTED_PREFIX}${Buffer.concat([iv, cipher.getAuthTag(), data]).toString('base64url')}`;
+}
+/** Decrypts a stored secret; a value without the prefix is returned as is (secrets stored in clear by your own code). `null` when it cannot be read. */
+export function decryptSecret(panel, stored) {
+    if (!stored.startsWith(ENCRYPTED_PREFIX))
+        return stored;
+    try {
+        const raw = Buffer.from(stored.slice(ENCRYPTED_PREFIX.length), 'base64url');
+        const decipher = createDecipheriv('aes-256-gcm', secretKey(panel), raw.subarray(0, 12));
+        decipher.setAuthTag(raw.subarray(12, 28));
+        return Buffer.concat([decipher.update(raw.subarray(28)), decipher.final()]).toString('utf8');
+    }
+    catch {
+        return null;
+    }
+}
+const hashRecoveryCode = (code) => `sha256:${createHash('sha256').update(code.trim()).digest('hex')}`;
+const RECOVERY_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+const randomString = (length) => Array.from({ length }, () => RECOVERY_ALPHABET[randomInt(RECOVERY_ALPHABET.length)]).join('');
+/**
+ * Authentication with a code from an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password…):
+ * time-based one-time passwords (RFC 6238). `recoverable()` adds single-use recovery codes.
+ */
+export class AppAuthentication {
+    _id = 'app';
+    _recoverable = false;
+    _regenerableRecoveryCodes = true;
+    _recoveryCodeCount = 8;
+    _brandName = null;
+    _codeWindow = 1;
+    _digits = 6;
+    _period = 30;
+    _algorithm = 'sha1';
+    _store = null;
+    _cacheStore = null;
+    _confirmsPassword = true;
+    _generateRecoveryCodes = null;
+    setupThrottle = new Throttle(5);
+    managementThrottle = new Throttle(5);
+    static make() { return new this(); }
+    getId() { return this._id; }
+    /** Changes the id (to register two app providers with different settings). */
+    id(id) { this._id = id; return this; }
+    getLoginFormLabel() { return t('filament-panels::auth/multi-factor/app/provider.login_form.label'); }
+    /** Single-use recovery codes, shown once at setup, to sign in without the app. Needs `get`/`saveAppAuthenticationRecoveryCodes` on the store. */
+    recoverable(condition = true) { this._recoverable = condition; return this; }
+    isRecoverable() { return this._recoverable; }
+    /** `false`: users cannot regenerate their recovery codes. */
+    regenerableRecoveryCodes(condition = true) { this._regenerableRecoveryCodes = condition; return this; }
+    canRegenerateRecoveryCodes() { return this._regenerableRecoveryCodes; }
+    recoveryCodeCount(count) { this._recoveryCodeCount = Math.max(1, Math.min(50, Math.floor(count))); return this; }
+    getRecoveryCodeCount() { return this._recoveryCodeCount; }
+    /** Generates the recovery codes (by default, `xxxxxxxxxx-xxxxxxxxxx` from 62 characters). */
+    generateRecoveryCodesUsing(callback) { this._generateRecoveryCodes = callback; return this; }
+    /** Name shown in the app, next to the account (the panel's brand name by default). */
+    brandName(name) { this._brandName = name; return this; }
+    getBrandName(panel) { return this._brandName ?? panel.getBrandName().replace(/<[^>]*>/g, ''); }
+    /** Codes accepted before and after the current one, to allow for clock drift (1 by default: ±30 seconds). */
+    codeWindow(window) { this._codeWindow = Math.max(0, Math.min(10, Math.floor(window))); return this; }
+    getCodeWindow() { return this._codeWindow; }
+    /** Code settings. Most apps only support the defaults (6 digits, 30 seconds, SHA-1). */
+    codeOptions(options) {
+        if (options.digits)
+            this._digits = options.digits;
+        if (options.period)
+            this._period = options.period;
+        if (options.algorithm)
+            this._algorithm = options.algorithm;
+        return this;
+    }
+    /** Where secrets and recovery codes are stored (the panel's auth provider by default). */
+    store(store) { this._store = store; return this; }
+    /** Where used codes are remembered (replay protection). */
+    cacheStore(store) { this._cacheStore = store; return this; }
+    /** `false`: setting up and turning off do not ask for the current password (accounts without one). */
+    confirmsPassword(condition = true) { this._confirmsPassword = condition; return this; }
+    getStore(panel) {
+        const store = this._store ?? panel.getAuth();
+        if (typeof store.getAppAuthenticationSecret !== 'function' || typeof store.saveAppAuthenticationSecret !== 'function') {
+            throw new Error('App authentication: the auth provider must implement getAppAuthenticationSecret and saveAppAuthenticationSecret (knexAuthProvider does), or pass a store with store().');
+        }
+        return store;
+    }
+    codeOptionsOf() { return { digits: this._digits, period: this._period, algorithm: this._algorithm }; }
+    checkConfiguration(panel) {
+        const store = this.getStore(panel);
+        if (this._recoverable && (typeof store.getAppAuthenticationRecoveryCodes !== 'function' || typeof store.saveAppAuthenticationRecoveryCodes !== 'function')) {
+            throw new Error('App authentication: recoverable() needs getAppAuthenticationRecoveryCodes and saveAppAuthenticationRecoveryCodes on the store (knexAuthProvider has them).');
+        }
+    }
+    async isEnabled(user, panel) {
+        const stored = await this.getStore(panel).getAppAuthenticationSecret(user);
+        return typeof stored === 'string' && stored !== '';
+    }
+    /** The user's secret, decrypted; `null` when none is set or it cannot be decrypted (the panel key changed). */
+    async getSecret(user, panel) {
+        const stored = await this.getStore(panel).getAppAuthenticationSecret(user);
+        return typeof stored === 'string' && stored !== '' ? decryptSecret(panel, stored) : null;
+    }
+    async saveSecret(user, panel, secret) {
+        await this.getStore(panel).saveAppAuthenticationSecret(user, secret === null ? null : encryptSecret(panel, secret));
+    }
+    generateSecret() { return generateTotpSecret(20); }
+    generateRecoveryCodes() { return this._generateRecoveryCodes?.() ?? Array.from({ length: this._recoveryCodeCount }, () => `${randomString(10)}-${randomString(10)}`); }
+    /** Saves recovery codes (hashed): `null` removes them. */
+    async saveRecoveryCodes(user, panel, codes) {
+        const store = this.getStore(panel);
+        if (typeof store.saveAppAuthenticationRecoveryCodes !== 'function')
+            throw new Error('App authentication: recoverable() needs saveAppAuthenticationRecoveryCodes on the store.');
+        await store.saveAppAuthenticationRecoveryCodes(user, codes === null ? null : codes.map(hashRecoveryCode));
+    }
+    /** `otpauth://` URI of a secret, for the QR code. */
+    getUri(user, panel, secret) { return totpUri(secret, user.email, this.getBrandName(panel), this.codeOptionsOf()); }
+    /** QR code of a secret, as a `data:` URI. */
+    generateQrCodeDataUri(user, panel, secret) { return qrCodeDataUri(this.getUri(user, panel, secret), { title: t('filament-panels::auth/multi-factor/app/actions/set-up.modal.content.qr_code.alt') }); }
+    /**
+     * Checks a code. With `preventReuse` (sign-in and sensitive actions), a code is accepted once: the time step of the last
+     * accepted code is remembered, and that code and every earlier one are refused (RFC 6238 §5.2).
+     */
+    async verifyCode(code, secret, options = {}) {
+        const verify = (after) => verifyTotp(secret, code, { ...this.codeOptionsOf(), window: this._codeWindow, after });
+        if (!options.preventReuse)
+            return verify(null) !== null;
+        const key = `navette:mfa:app:last-step:${createHash('sha256').update(secret).digest('base64url')}`;
+        const cache = this._cacheStore ?? defaultCacheStore;
+        return serialized(key, async () => {
+            const last = await cache.get(key);
+            const step = verify(typeof last === 'number' ? last : null);
+            if (step === null)
+                return false;
+            await cache.put(key, step, (this._codeWindow * 2 + 2) * this._period);
+            return true;
+        });
+    }
+    /** Checks a recovery code and removes it: each one works once. */
+    async verifyRecoveryCode(code, user, panel) {
+        if (typeof code !== 'string' || code.trim() === '' || code.length > 200)
+            return false;
+        const store = this.getStore(panel);
+        if (typeof store.getAppAuthenticationRecoveryCodes !== 'function' || typeof store.saveAppAuthenticationRecoveryCodes !== 'function')
+            return false;
+        return serialized(`navette:mfa:app:recovery:${panel.getId()}:${userKey(user)}`, async () => {
+            const hashes = (await store.getAppAuthenticationRecoveryCodes(user)) ?? [];
+            const candidate = Buffer.from(hashRecoveryCode(code));
+            let matched = -1;
+            // Every stored hash is compared, in constant time.
+            hashes.forEach((hash, index) => { const stored = Buffer.from(String(hash)); if (stored.length === candidate.length && timingSafeEqual(stored, candidate) && matched < 0)
+                matched = index; });
+            if (matched < 0)
+                return false;
+            await store.saveAppAuthenticationRecoveryCodes(user, hashes.filter((_, index) => index !== matched));
+            return true;
+        });
+    }
+    getChallengeFormComponents(user, panel) {
+        const recoverable = this._recoverable;
+        const group = 'filament-panels::auth/multi-factor/app/provider.login_form';
+        return [
+            OneTimeCodeInput.make('code').length(this._digits).label(t(`${group}.code.label`)).validationAttribute(t(`${group}.code.validation_attribute`))
+                .submitOnCompletion().autofocus()
+                .belowContent(recoverable ? (ctx) => (ctx.get('useRecoveryCode') ? null : useRecoveryCodeLink(t(`${group}.code.actions.use_recovery_code.label`), ctx)) : null)
+                .required(({ get }) => !recoverable || !get('useRecoveryCode') || !get('recoveryCode'))
+                .rule({ name: 'totp', passes: async (value) => { const secret = await this.getSecret(user, panel); return secret !== null && this.verifyCode(value, secret, { preventReuse: true }); }, message: () => t(`${group}.code.messages.invalid`) })
+                .hidden(({ get }) => recoverable && Boolean(get('useRecoveryCode'))),
+            TextInput.make('recoveryCode').label(t(`${group}.recovery_code.label`)).validationAttribute(t(`${group}.recovery_code.validation_attribute`))
+                .password().revealable().autocomplete('one-time-code').required()
+                .rule({ name: 'recovery_code', passes: (value) => this.verifyRecoveryCode(value, user, panel), message: () => t(`${group}.recovery_code.messages.invalid`) })
+                .visible(({ get }) => recoverable && Boolean(get('useRecoveryCode'))),
+        ];
+    }
+    getManagementSchemaComponents(user, panel) {
+        const group = 'filament-panels::auth/multi-factor/app/provider.management_schema.actions';
+        const enabled = () => this.isEnabled(user, panel);
+        return [
+            Actions.make(this.getActions(user, panel)).key(`${this._id}-actions`)
+                .label(t(`${group}.label`)).belowContent(t(`${group}.below_content`))
+                .afterLabel(async () => statusBadge(await enabled(), t(`${group}.messages.enabled`), t(`${group}.messages.disabled`))),
+        ];
+    }
+    getActions(user, panel) {
+        const enabled = () => this.isEnabled(user, panel);
+        return [
+            this.setUpAction(panel).hidden(enabled),
+            this.regenerateRecoveryCodesAction(panel).visible(async () => this._recoverable && this._regenerableRecoveryCodes && (await enabled())),
+            this.disableAction(panel).visible(enabled),
+            ...(this._recoverable && this._regenerableRecoveryCodes ? [this.showNewRecoveryCodesAction(panel)] : []),
+        ];
+    }
+    /** Setup modal: QR code and secret, a code from the app (and the password), then the recovery codes. */
+    setUpAction(panel) {
+        const group = 'filament-panels::auth/multi-factor/app/actions/set-up';
+        const purpose = `${panel.getId()}.mfa-app-set-up`;
+        // The secret and recovery codes travel with the mounted action, signed: the browser can show them but not change them.
+        const pending = (ctx) => {
+            const payload = readToken(panel.getAuthKey(), purpose, ctx.arguments?.pending);
+            const user = contextOf(ctx.livewire)?.user;
+            return payload && user && payload.user === userKey(user) && typeof payload.secret === 'string' ? { secret: payload.secret, codes: Array.isArray(payload.codes) ? payload.codes.map(String) : [] } : null;
+        };
+        const argumentsOf = (ctx) => ctx.livewire.mountedActions?.find?.((mounted) => mounted.name === 'setUpAppAuthentication')?.arguments ?? {};
+        const pendingFromSchema = (ctx) => pending({ arguments: argumentsOf(ctx), livewire: ctx.livewire });
+        const codeInput = OneTimeCodeInput.make('code').length(this._digits).label(t(`${group}.modal.form.code.label`)).validationAttribute(t(`${group}.modal.form.code.validation_attribute`))
+            .helperText(t(`${group}.modal.form.code.below_content`)).required()
+            .rule({ name: 'totp', passes: async (value, ctx) => { const state = pendingFromSchema(ctx); return state !== null && this.verifyCode(value, state.secret); }, message: () => t(`${group}.modal.form.code.messages.invalid`) });
+        const steps = [
+            Step.make('app')
+                .beforeValidation((ctx) => {
+                const user = currentUser(ctx.livewire);
+                if (this.setupThrottle.hit(`${panel.getId()}:${userKey(user)}`) > 0) {
+                    const codePath = ctx.component.getChildSchemas()[0].getFlatComponents().find((component) => component instanceof OneTimeCodeInput)?.getStatePath();
+                    if (codePath)
+                        fail(ctx.livewire, codePath, t(`${group}.modal.form.code.messages.rate_limited`));
+                    throw new Halt();
+                }
+            })
+                .schema([
+                Group.make([
+                    Text.make(t(`${group}.modal.content.qr_code.instruction`)).color('neutral'),
+                    Image.make((ctx) => { const state = pendingFromSchema(ctx); const user = contextOf(ctx.livewire).user; return state ? this.generateQrCodeDataUri(user, panel, state.secret) : ''; }, t(`${group}.modal.content.qr_code.alt`))
+                        .imageHeight('12rem').alignCenter(),
+                    Flex.make([
+                        Text.make(t(`${group}.modal.content.text_code.instruction`)).color('neutral').grow(false),
+                        Text.make((ctx) => pendingFromSchema(ctx)?.secret ?? '').fontFamily('mono').color('neutral').copyable().copyMessage(t(`${group}.modal.content.text_code.messages.copied`)).grow(false),
+                    ]).from('sm'),
+                ]).dense(),
+                codeInput,
+                ...(this._confirmsPassword ? [currentPasswordInput('password', t(`${group}.modal.form.password.label`), t(`${group}.modal.form.password.validation_attribute`))] : []),
+            ]),
+            ...(this._recoverable ? [Step.make('recovery').schema(this.recoveryCodesContent((ctx) => pendingFromSchema(ctx)?.codes ?? [], t(`${group}.modal.content.recovery_codes.instruction`)))] : []),
+        ];
+        return Action.make('setUpAppAuthentication')
+            .label(t(`${group}.label`)).color('primary').icon('m-lock-closed').link()
+            .mountUsing((ctx) => {
+            const user = currentUser(ctx.livewire);
+            ctx.arguments.pending = signToken(panel.getAuthKey(), purpose, { secret: this.generateSecret(), ...(this._recoverable ? { codes: this.generateRecoveryCodes() } : {}), user: userKey(user) }, 60 * 30);
+        })
+            .modalWidth('lg').closeModalByClickingAway(false).closeModalByEscaping(false)
+            .modalIcon('o-lock-closed').modalIconColor('primary')
+            .modalHeading(t(`${group}.modal.heading`))
+            .modalDescription(() => new HtmlString(t(`${group}.modal.description`)
+            .replace(/<x-filament::link href="([^"]+)" target="_blank">([^<]+)<\/x-filament::link>/g, (_match, href, label) => `<a href="${e(href)}" target="_blank" rel="noopener" class="fi-link fi-size-md fi-color fi-color-primary fi-text-color-600 dark:fi-text-color-400"><span class="fi-link-label">${e(label)}</span></a>`)
+            .trim()))
+            .modalSubmitActionLabel(t(`${group}.modal.actions.submit.label`))
+            .steps(steps)
+            .modifyWizardUsing((wizard) => wizard.hiddenHeader())
+            .action(async (ctx) => {
+            const user = currentUser(ctx.livewire);
+            const state = pending(ctx);
+            // Issued for another user, or expired: nothing is saved.
+            if (!state)
+                return;
+            await this.saveSecret(user, panel, state.secret);
+            if (this._recoverable)
+                await this.saveRecoveryCodes(user, panel, state.codes);
+            Notification.make().success().title(t(`${group}.notifications.enabled.title`)).icon('o-lock-closed').send();
+        });
+    }
+    /** Recovery codes, with "copy" and "download" links. */
+    recoveryCodesContent(codes, instruction) {
+        const content = 'filament-panels::auth/multi-factor/recovery-codes-modal-content';
+        return [
+            Text.make(instruction).weight('bold').color('neutral'),
+            Html.make((ctx) => `<ul class="fi-sc-unordered-list fi-size-xs">${codes(ctx).map((code) => `<li><span class="fi-sc-text fi-font-mono fi-size-xs fi-color-neutral">${e(code)}</span></li>`).join('')}</ul>`),
+            Text.make((ctx) => {
+                const text = codes(ctx).join('\n');
+                const linkClass = 'fi-link fi-size-sm fi-color fi-color-primary fi-text-color-600 dark:fi-text-color-400';
+                return new HtmlString(`<span>${e(t(`${content}.actions.0`))} <button type="button" class="${linkClass}" x-on:click="${e(`window.navigator.clipboard.writeText(${js(text)}); $tooltip(${js(t(`${content}.messages.copied`))}, { theme: $store.theme })`)}"><span class="fi-link-label">${e(t(`${content}.actions.copy.label`))}</span></button> ${e(t(`${content}.actions.1`))} <a href="${e(`data:application/octet-stream,${encodeURIComponent(text)}`)}" download="recovery-codes.txt" class="${linkClass}"><span class="fi-link-label">${e(t(`${content}.actions.download.label`))}</span></a> ${e(t(`${content}.actions.2`))}</span>`);
+            }),
+        ];
+    }
+    /** Fields confirming a sensitive action: a code from the app (or a recovery code) and, optionally, the password. */
+    confirmationFields(panel, group, options) {
+        const throttleKey = (ctx) => `${panel.getId()}:${userKey(contextOf(ctx.livewire).user)}`;
+        const recoverable = options.recoveryCodes && this._recoverable;
+        return [
+            OneTimeCodeInput.make('code').length(this._digits).label(t(`${group}.modal.form.code.label`)).validationAttribute(t(`${group}.modal.form.code.validation_attribute`))
+                .required(({ get }) => !recoverable || !get('recoveryCode'))
+                .belowContent(recoverable ? (ctx) => (ctx.get('useRecoveryCode') ? null : useRecoveryCodeLink(t(`${group}.modal.form.code.actions.use_recovery_code.label`), ctx)) : null)
+                .rule(throttleRule(this.managementThrottle, throttleKey, t(`${group}.modal.form.code.messages.rate_limited`)))
+                .rule({ name: 'totp', passes: async (value, ctx) => { const user = contextOf(ctx.livewire).user; const secret = await this.getSecret(user, panel); return secret !== null && this.verifyCode(value, secret, { preventReuse: true }); }, message: () => t(`${group}.modal.form.code.messages.invalid`) })
+                .hidden(({ get }) => recoverable && Boolean(get('useRecoveryCode'))),
+            ...(recoverable ? [
+                TextInput.make('recoveryCode').label(t(`${group}.modal.form.recovery_code.label`)).validationAttribute(t(`${group}.modal.form.recovery_code.validation_attribute`))
+                    .password().revealable().autocomplete('one-time-code').required()
+                    .rule({ name: 'recovery_code', passes: (value, ctx) => this.verifyRecoveryCode(value, contextOf(ctx.livewire).user, panel), message: () => t(`${group}.modal.form.recovery_code.messages.invalid`) })
+                    .visible(({ get }) => Boolean(get('useRecoveryCode'))),
+            ] : []),
+            ...(this._confirmsPassword ? [currentPasswordInput('password', t(`${group}.modal.form.password.label`), t(`${group}.modal.form.password.validation_attribute`))] : []),
+        ];
+    }
+    /** Turns app authentication off, after a code (or a recovery code) and the password. */
+    disableAction(panel) {
+        const group = 'filament-panels::auth/multi-factor/app/actions/disable';
+        return Action.make('disableAppAuthentication')
+            .label(t(`${group}.label`)).color('danger').icon('m-lock-open').link()
+            .modalWidth('md').modalIcon('o-lock-open').modalIconColor('danger')
+            .modalHeading(t(`${group}.modal.heading`)).modalDescription(t(`${group}.modal.description`))
+            .modalSubmitActionLabel(t(`${group}.modal.actions.submit.label`))
+            .schema(this.confirmationFields(panel, group, { recoveryCodes: true }))
+            .action(async (ctx) => {
+            const user = currentUser(ctx.livewire);
+            await this.saveSecret(user, panel, null);
+            if (this._recoverable)
+                await this.saveRecoveryCodes(user, panel, null);
+            Notification.make().success().title(t(`${group}.notifications.disabled.title`)).icon('o-lock-open').send();
+        });
+    }
+    /** Replaces the recovery codes, after a code from the app and the password; the new codes are shown once. */
+    regenerateRecoveryCodesAction(panel) {
+        const group = 'filament-panels::auth/multi-factor/app/actions/regenerate-recovery-codes';
+        return Action.make('regenerateAppAuthenticationRecoveryCodes')
+            .label(t(`${group}.label`)).color('gray').icon('m-arrow-path').link()
+            .modalWidth('md').modalIcon('o-arrow-path')
+            .modalHeading(t(`${group}.modal.heading`)).modalDescription(t(`${group}.modal.description`))
+            .modalSubmitActionLabel(t(`${group}.modal.actions.submit.label`))
+            .schema(this.confirmationFields(panel, group, { recoveryCodes: false }))
+            .action(async (ctx) => {
+            const user = currentUser(ctx.livewire);
+            const codes = this.generateRecoveryCodes();
+            await this.saveRecoveryCodes(user, panel, codes);
+            Notification.make().success().title(t(`${group}.notifications.regenerated.title`)).icon('o-lock-closed').send();
+            // The new codes, shown once, in a modal opened in place of this one.
+            await ctx.livewire.replaceMountedAction('showNewAppAuthenticationRecoveryCodes', { codes: signToken(panel.getAuthKey(), `${panel.getId()}.mfa-app-recovery-codes`, { codes, user: userKey(user) }, 60 * 10) });
+        });
+    }
+    /** Shows recovery codes just generated; only opened by `regenerateRecoveryCodesAction()`. */
+    showNewRecoveryCodesAction(panel) {
+        const group = 'filament-panels::auth/multi-factor/app/actions/regenerate-recovery-codes.show_new_recovery_codes.modal';
+        const codes = (ctx) => {
+            const mounted = ctx.livewire.mountedActions?.find?.((candidate) => candidate.name === 'showNewAppAuthenticationRecoveryCodes');
+            const payload = readToken(panel.getAuthKey(), `${panel.getId()}.mfa-app-recovery-codes`, mounted?.arguments?.codes);
+            const user = contextOf(ctx.livewire)?.user;
+            return payload && user && payload.user === userKey(user) && Array.isArray(payload.codes) ? payload.codes.map(String) : [];
+        };
+        return Action.make('showNewAppAuthenticationRecoveryCodes').hidden()
+            .modalHeading(t(`${group}.heading`)).modalWidth('md').modalIcon('o-lock-closed').modalIconColor('primary')
+            .closeModalByClickingAway(false).modalSubmitAction(false).modalCancelActionLabel(t(`${group}.actions.submit.label`))
+            .schema(this.recoveryCodesContent(codes, t(`${group}.description`)));
+    }
+}
+/** Field running a WebAuthn ceremony in the browser; its state is the credential (JSON) the browser returns. */
+export class SecurityKeyInput extends Field {
+    _mode = 'authenticate';
+    _optionsUsing = null;
+    _submitOnSuccess = false;
+    _autoStart = false;
+    _buttonLabel = null;
+    static make(name) { return new this(name); }
+    /** `register`: adds a key (`navigator.credentials.create()`); `authenticate`: uses one (`navigator.credentials.get()`). */
+    mode(mode) { this._mode = mode; return this; }
+    /** Options of the ceremony, asked for by the browser when the user clicks the button. */
+    optionsUsing(callback) { this._optionsUsing = callback; return this; }
+    /** Submits the form as soon as the key answered. */
+    submitOnSuccess(condition = true) { this._submitOnSuccess = condition; return this; }
+    /** Starts the ceremony when the field appears (browsers may still require a click). */
+    autoStart(condition = true) { this._autoStart = condition; return this; }
+    buttonLabel(label) { this._buttonLabel = label; return this; }
+    getExposedMethods() { return ['getPublicKeyOptions']; }
+    async getPublicKeyOptions() {
+        if (!(await this.isVisible()) || (await this.isDisabled()))
+            return null;
+        return (await this._optionsUsing?.(this)) ?? null;
+    }
+    hydrateState(value) { return typeof value === 'string' && value.length <= 100_000 ? value : null; }
+    async toHtml() {
+        const group = 'filament-panels::auth/multi-factor/security-keys/field';
+        const messages = {
+            waiting: t(`${group}.messages.waiting`), success: t(`${group}.messages.${this._mode === 'register' ? 'registered' : 'verified'}`),
+            cancelled: t(`${group}.messages.cancelled`), unsupported: t(`${group}.messages.unsupported`), failed: t(`${group}.messages.failed`),
+        };
+        const config = { mode: this._mode, key: this.getKey(), submitOnSuccess: this._submitOnSuccess, autoStart: this._autoStart, messages };
+        const label = this._buttonLabel ?? t(`${group}.actions.${this._mode === 'register' ? 'register' : 'authenticate'}.label`);
+        const control = button({ color: 'gray', icon: 'o-key', attributes: { 'x-on:click': 'start()', 'x-bind:disabled': 'isWaiting', id: this.getId(), 'aria-describedby': `${this.getId()}-status` } }, `<span class="fi-btn-label">${e(label)}</span>`);
+        return this.wrap(`<div x-data="${e(`navetteSecurityKey({ state: $wire.$entangle(${js(this.getStatePath())}, false), ...${js(config)} })`)}" class="nv-security-key">${control}<p id="${e(this.getId())}-status" class="nv-security-key-status" role="status" aria-live="polite" x-show="message" x-text="message" x-bind:class="{ 'nv-security-key-status-error': isError }" x-cloak></p></div>`, { labelAsDiv: true });
+    }
+}
+/**
+ * Authentication with a security key: a hardware key (YubiKey, Titan…) or a passkey stored by the device or a password
+ * manager (WebAuthn). Users can register several keys. Needs a secure context: HTTPS, or `localhost` in development.
+ */
+export class SecurityKeyAuthentication {
+    _id = 'security-keys';
+    _rpId = null;
+    _rpName = null;
+    _origins = null;
+    _userVerification = 'preferred';
+    _authenticatorAttachment = null;
+    _residentKey = 'discouraged';
+    _timeout = 120_000;
+    _maxKeys = 10;
+    _store = null;
+    _cacheStore = null;
+    _confirmsPassword = true;
+    throttle = new Throttle(10);
+    static make() { return new this(); }
+    getId() { return this._id; }
+    id(id) { this._id = id; return this; }
+    getLoginFormLabel() { return t('filament-panels::auth/multi-factor/security-keys/provider.login_form.label'); }
+    /** Relying party id: the domain the keys are bound to (by default, the host of `panel.appUrl()` or of the request). */
+    relyingPartyId(id) { this._rpId = id; return this; }
+    /** Name shown by the browser while registering a key (the panel's brand name by default). */
+    relyingPartyName(name) { this._rpName = name; return this; }
+    /** Origins allowed to use the keys (`https://admin.example.com`); by default, the origin of `panel.appUrl()` or of the request. */
+    origins(origins) { this._origins = origins; return this; }
+    /** `required`: the key must check a PIN or biometrics; `preferred` (default): when it can. */
+    userVerification(requirement) { this._userVerification = requirement; return this; }
+    /** Restricts registration to keys built into the device (`platform`) or to removable ones (`cross-platform`). */
+    authenticatorAttachment(attachment) { this._authenticatorAttachment = attachment; return this; }
+    /** Asks for a discoverable credential (passkey) when registering. */
+    residentKey(requirement) { this._residentKey = requirement; return this; }
+    /** Milliseconds the browser waits for the key (2 minutes by default). */
+    timeout(milliseconds) { this._timeout = Math.max(10_000, Math.min(600_000, Math.floor(milliseconds))); return this; }
+    /** Keys a user may register (10 by default). */
+    maxKeys(count) { this._maxKeys = Math.max(1, Math.floor(count)); return this; }
+    store(store) { this._store = store; return this; }
+    /** Where pending challenges are kept between the two requests of a ceremony. */
+    cacheStore(store) { this._cacheStore = store; return this; }
+    /** `false`: adding and removing keys do not ask for the current password. */
+    confirmsPassword(condition = true) { this._confirmsPassword = condition; return this; }
+    getStore(panel) {
+        const store = this._store ?? panel.getAuth();
+        for (const method of ['getSecurityKeys', 'createSecurityKey', 'updateSecurityKey', 'deleteSecurityKey']) {
+            if (typeof store[method] !== 'function')
+                throw new Error(`Security keys: the auth provider must implement ${method} (knexAuthProvider does), or pass a store with store().`);
+        }
+        return store;
+    }
+    checkConfiguration(panel) { this.getStore(panel); }
+    getKeys(user, panel) { return Promise.resolve(this.getStore(panel).getSecurityKeys(user)).then((keys) => keys ?? []); }
+    async isEnabled(user, panel) { return (await this.getKeys(user, panel)).length > 0; }
+    /** Relying party of a request: its id (domain) and allowed origins. */
+    getRelyingParty(panel, req) {
+        // The host the browser used; the scheme of `appUrl` when it names the same host (behind a TLS proxy the request says http).
+        const appUrl = panel.getAppUrl() ? new URL(panel.getAppUrl()) : null;
+        const host = req?.get?.('host') ?? null;
+        const base = host ? (appUrl && appUrl.host === host ? appUrl : new URL(`${req.protocol ?? 'http'}://${host}`)) : appUrl;
+        const id = this._rpId ?? base?.hostname ?? 'localhost';
+        return { id, name: this._rpName ?? panel.getBrandName().replace(/<[^>]*>/g, ''), origins: this._origins ?? (base ? [base.origin] : []) };
+    }
+    cache() { return this._cacheStore ?? defaultCacheStore; }
+    /** A new challenge, remembered for this user and purpose until it is used or expires. */
+    async issueChallenge(user, panel, purpose) {
+        const challenge = generateChallenge();
+        await this.cache().put(`navette:mfa:webauthn:${challenge}`, { purpose, user: userKey(user), panel: panel.getId() }, Math.ceil(this._timeout / 1000) + 60);
+        return challenge;
+    }
+    /** The challenge a response answers, if it was issued for this user and purpose; it is consumed (single use). */
+    async consumeChallenge(response, user, panel, purpose) {
+        let challenge;
+        try {
+            challenge = JSON.parse(Buffer.from(String(response?.response?.clientDataJSON ?? ''), 'base64url').toString('utf8'))?.challenge;
+        }
+        catch {
+            return null;
+        }
+        if (typeof challenge !== 'string' || !/^[A-Za-z0-9_-]{16,200}$/.test(challenge))
+            return null;
+        const key = `navette:mfa:webauthn:${challenge}`;
+        return serialized(key, async () => {
+            const entry = (await this.cache().get(key));
+            if (!entry || entry.purpose !== purpose || entry.user !== userKey(user) || entry.panel !== panel.getId())
+                return null;
+            await this.cache().forget(key);
+            return challenge;
+        });
+    }
+    requestOf(field) { return contextOf(field.livewire)?.req; }
+    /** Checks an assertion from the browser against the user's keys; updates the key's counter. */
+    async verifyAssertion(value, user, panel, req) {
+        if (typeof value !== 'string')
+            return false;
+        let response;
+        try {
+            response = JSON.parse(value);
+        }
+        catch {
+            return false;
+        }
+        const keys = await this.getKeys(user, panel);
+        const key = keys.find((candidate) => candidate.credentialId === response?.id || candidate.credentialId === response?.rawId);
+        if (!key)
+            return false;
+        const challenge = await this.consumeChallenge(response, user, panel, 'authenticate');
+        if (!challenge)
+            return false;
+        const party = this.getRelyingParty(panel, req);
+        try {
+            const result = verifyAuthentication(response, { challenge, origin: party.origins, rpId: party.id, requireUserVerification: this._userVerification === 'required', credential: key });
+            await this.getStore(panel).updateSecurityKey(user, key.id, { signCount: result.signCount, lastUsedAt: new Date().toISOString() });
+            return true;
+        }
+        catch (error) {
+            if (error instanceof WebAuthnError)
+                return false;
+            throw error;
+        }
+    }
+    getChallengeFormComponents(user, panel) {
+        const group = 'filament-panels::auth/multi-factor/security-keys/provider.login_form';
+        return [
+            SecurityKeyInput.make('credential').mode('authenticate').label(t(`${group}.credential.label`)).validationAttribute(t(`${group}.credential.validation_attribute`))
+                .submitOnSuccess().autoStart().required()
+                .optionsUsing(async (field) => {
+                const party = this.getRelyingParty(panel, this.requestOf(field));
+                return authenticationOptions({ rpId: party.id, challenge: await this.issueChallenge(user, panel, 'authenticate'), allowCredentials: await this.getKeys(user, panel), userVerification: this._userVerification, timeout: this._timeout });
+            })
+                .rule({ name: 'security_key', passes: (value, ctx) => this.verifyAssertion(value, user, panel, contextOf(ctx.livewire)?.req), message: () => t(`${group}.credential.messages.invalid`) }),
+        ];
+    }
+    getManagementSchemaComponents(user, panel) {
+        const group = 'filament-panels::auth/multi-factor/security-keys/provider.management_schema.actions';
+        const keys = () => this.getKeys(user, panel);
+        return [
+            Actions.make([this.registerAction(panel), this.removeAction(panel).visible(async () => (await keys()).length > 0)]).key(`${this._id}-actions`)
+                .label(t(`${group}.label`))
+                .afterLabel(async () => statusBadge((await keys()).length > 0, t(`${group}.messages.enabled`), t(`${group}.messages.disabled`)))
+                .aboveContent(async () => {
+                const list = await keys();
+                if (!list.length)
+                    return t(`${group}.below_content`);
+                return new HtmlString(`<ul class="nv-security-keys">${list.map((key) => `<li><span class="nv-security-key-name">${e(key.name)}</span> <span class="nv-security-key-meta">${e(t(`${group}.messages.${key.lastUsedAt ? 'last_used' : 'added'}`, { date: String(key.lastUsedAt ?? key.createdAt ?? '').slice(0, 10) }))}</span></li>`).join('')}</ul>`);
+            }),
+        ];
+    }
+    /** Adds a key: a name, the ceremony in the browser, and the password. */
+    registerAction(panel) {
+        const group = 'filament-panels::auth/multi-factor/security-keys/actions/register';
+        return Action.make('registerSecurityKey')
+            .label(t(`${group}.label`)).color('primary').icon('m-key').link()
+            .visible(async (ctx) => { const user = contextOf(ctx.livewire)?.user; return Boolean(user) && (await this.getKeys(user, panel)).length < this._maxKeys; })
+            .modalWidth('md').modalIcon('o-key').modalIconColor('primary')
+            .modalHeading(t(`${group}.modal.heading`)).modalDescription(t(`${group}.modal.description`))
+            .modalSubmitActionLabel(t(`${group}.modal.actions.submit.label`))
+            .closeModalByClickingAway(false)
+            .schema([
+            TextInput.make('name').label(t(`${group}.modal.form.name.label`)).placeholder(t(`${group}.modal.form.name.placeholder`)).required().maxLength(60),
+            SecurityKeyInput.make('credential').mode('register').label(t(`${group}.modal.form.credential.label`)).validationAttribute(t(`${group}.modal.form.credential.validation_attribute`)).required()
+                .optionsUsing(async (field) => {
+                const user = contextOf(field.livewire)?.user;
+                if (!user)
+                    return null;
+                const party = this.getRelyingParty(panel, this.requestOf(field));
+                return registrationOptions({
+                    rpId: party.id, rpName: party.name, userId: `${panel.getId()}:${userKey(user)}`, userName: user.email, userDisplayName: user.name,
+                    challenge: await this.issueChallenge(user, panel, 'register'), excludeCredentials: await this.getKeys(user, panel),
+                    userVerification: this._userVerification, residentKey: this._residentKey, authenticatorAttachment: this._authenticatorAttachment, timeout: this._timeout,
+                });
+            }),
+            ...(this._confirmsPassword ? [currentPasswordInput('password', t(`${group}.modal.form.password.label`), t(`${group}.modal.form.password.validation_attribute`))] : []),
+        ])
+            .action(async (ctx) => {
+            const user = currentUser(ctx.livewire);
+            const path = (ctx.schema?.getFlatComponents?.() ?? []).find((component) => component instanceof SecurityKeyInput)?.getStatePath() ?? 'credential';
+            const invalid = () => fail(ctx.livewire, path, t(`${group}.modal.form.credential.messages.invalid`));
+            if (this.throttle.hit(`${panel.getId()}:${userKey(user)}`) > 0)
+                fail(ctx.livewire, path, t(`${group}.modal.form.credential.messages.rate_limited`));
+            if ((await this.getKeys(user, panel)).length >= this._maxKeys)
+                return;
+            let response;
+            try {
+                response = JSON.parse(String(ctx.data.credential));
+            }
+            catch {
+                invalid();
+            }
+            const challenge = await this.consumeChallenge(response, user, panel, 'register');
+            if (!challenge)
+                invalid();
+            const party = this.getRelyingParty(panel, contextOf(ctx.livewire).req);
+            let credential;
+            try {
+                credential = verifyRegistration(response, { challenge: challenge, origin: party.origins, rpId: party.id, requireUserVerification: this._userVerification === 'required' });
+            }
+            catch (error) {
+                if (error instanceof WebAuthnError)
+                    invalid();
+                throw error;
+            }
+            if ((await this.getKeys(user, panel)).some((key) => key.credentialId === credential.credentialId))
+                invalid();
+            await this.getStore(panel).createSecurityKey(user, {
+                name: String(ctx.data.name).trim().slice(0, 60), credentialId: credential.credentialId, publicKey: credential.publicKey, algorithm: credential.algorithm,
+                signCount: credential.signCount, transports: credential.transports,
+            });
+            Notification.make().success().title(t(`${group}.notifications.registered.title`)).icon('o-key').send();
+        });
+    }
+    /** Removes one of the user's keys, after the password. */
+    removeAction(panel) {
+        const group = 'filament-panels::auth/multi-factor/security-keys/actions/remove';
+        return Action.make('removeSecurityKey')
+            .label(t(`${group}.label`)).color('danger').icon('m-trash').link()
+            .modalWidth('md').modalIcon('o-trash').modalIconColor('danger')
+            .modalHeading(t(`${group}.modal.heading`)).modalDescription(t(`${group}.modal.description`))
+            .modalSubmitActionLabel(t(`${group}.modal.actions.submit.label`))
+            // The user's keys are read when the modal opens, then kept with the mounted action.
+            .mountUsing(async (ctx) => {
+            const user = currentUser(ctx.livewire);
+            ctx.arguments.keys = (await this.getKeys(user, panel)).map((key) => [String(key.id), String(key.name)]);
+        })
+            .schema((schema) => {
+            const mounted = schema.livewire.mountedActions?.find?.((candidate) => candidate.name === 'removeSecurityKey');
+            const options = Array.isArray(mounted?.arguments?.keys) ? mounted.arguments.keys.filter((entry) => Array.isArray(entry) && entry.length === 2).map(([id, name]) => [String(id), String(name)]) : [];
+            return schema.components([
+                Radio.make('key').label(t(`${group}.modal.form.key.label`)).required().options(options),
+                ...(this._confirmsPassword ? [currentPasswordInput('password', t(`${group}.modal.form.password.label`), t(`${group}.modal.form.password.validation_attribute`))] : []),
+            ]);
+        })
+            .action(async (ctx) => {
+            const user = currentUser(ctx.livewire);
+            const key = (await this.getKeys(user, panel)).find((candidate) => String(candidate.id) === String(ctx.data.key));
+            if (!key)
+                return;
+            await this.getStore(panel).deleteSecurityKey(user, key.id);
+            Notification.make().success().title(t(`${group}.notifications.removed.title`)).send();
+        });
+    }
+}
+/** One-time code field with a "Send a new code by email" link, which asks the server for another code. */
+export class EmailCodeInput extends OneTimeCodeInput {
+    _resend = null;
+    _resendLabel = '';
+    static make(name) { return new this(name); }
+    /** What the link does (send a new code); without it, there is no link. */
+    resendUsing(callback, label = '') {
+        this._resend = callback;
+        this._resendLabel = label;
+        if (callback)
+            this.belowContent(() => Text.make(new HtmlString(`<button type="button" class="fi-link fi-size-sm fi-color fi-color-primary fi-text-color-600 dark:fi-text-color-400" x-on:click="${e(`$wire.callSchemaComponentMethod(${js(this.getKey())}, 'resendCode', {})`)}"><span class="fi-link-label">${e(this._resendLabel)}</span></button>`)));
+        return this;
+    }
+    getExposedMethods() { return this._resend ? ['resendCode'] : []; }
+    isRenderlessMethod() { return false; }
+    async resendCode() {
+        if (!this._resend || !(await this.isVisible()) || (await this.isDisabled()))
+            return;
+        await this._resend(this);
+    }
+}
+/**
+ * Authentication with a 6-digit code sent to the user's email address, through the panel's `mailer()`.
+ * A code is valid for a few minutes (4 by default) and once; at most two codes are sent per minute.
+ */
+export class EmailAuthentication {
+    _id = 'email_code';
+    _codeExpiryMinutes = 4;
+    _generateCode = null;
+    _store = null;
+    _cacheStore = null;
+    _sendCode = null;
+    sendThrottle = new Throttle(2);
+    managementThrottle = new Throttle(5);
+    static make() { return new this(); }
+    getId() { return this._id; }
+    id(id) { this._id = id; return this; }
+    getLoginFormLabel() { return t('filament-panels::auth/multi-factor/email/provider.login_form.label'); }
+    /** Minutes a code stays valid. */
+    codeExpiryMinutes(minutes) { this._codeExpiryMinutes = Math.max(1, Math.min(60, Math.floor(minutes))); return this; }
+    getCodeExpiryMinutes() { return this._codeExpiryMinutes; }
+    /** Generates the codes (6 random digits by default). */
+    generateCodeUsing(callback) { this._generateCode = callback; return this; }
+    generateCode() { return this._generateCode?.() ?? String(randomInt(1_000_000)).padStart(6, '0'); }
+    /** Sends the code yourself (SMS gateway, your own email template…) instead of the panel's mailer. */
+    sendCodeUsing(callback) { this._sendCode = callback; return this; }
+    store(store) { this._store = store; return this; }
+    /** Where pending codes are kept until they are used or expire. */
+    cacheStore(store) { this._cacheStore = store; return this; }
+    getStore(panel) {
+        const store = this._store ?? panel.getAuth();
+        if (typeof store.hasEmailAuthentication !== 'function' || typeof store.saveEmailAuthentication !== 'function') {
+            throw new Error('Email authentication: the auth provider must implement hasEmailAuthentication and saveEmailAuthentication (knexAuthProvider does), or pass a store with store().');
+        }
+        return store;
+    }
+    checkConfiguration(panel) { this.getStore(panel); }
+    async isEnabled(user, panel) { return Boolean(await this.getStore(panel).hasEmailAuthentication(user)); }
+    async setEnabled(user, panel, enabled) { await this.getStore(panel).saveEmailAuthentication(user, enabled); }
+    cache() { return this._cacheStore ?? defaultCacheStore; }
+    codeKey(user, panel) { return `navette:mfa:email:${panel.getId()}:${this._id}:${userKey(user)}`; }
+    /** Sends a new code (the previous one stops working). Returns `false` when two codes were already sent this minute. */
+    async sendCode(user, panel) {
+        if (this.sendThrottle.hit(`${panel.getId()}:${userKey(user)}`) > 0)
+            return false;
+        const code = this.generateCode();
+        const minutes = this._codeExpiryMinutes;
+        await this.cache().put(this.codeKey(user, panel), { hash: createHash('sha256').update(code).digest('hex'), expires: Date.now() + minutes * 60_000 }, minutes * 60);
+        if (this._sendCode) {
+            await this._sendCode(user, code, minutes, panel);
+            return true;
+        }
+        const group = 'filament-panels::auth/multi-factor/email/notifications/verify-email-authentication';
+        await panel.sendMail({ to: user.email, subject: t(`${group}.subject`), lines: [t(`${group}.lines.0`, { code }), tc(`${group}.lines.1`, minutes, { minutes })] });
+        return true;
+    }
+    /** Checks a code against the last one sent; a valid code is consumed. */
+    async verifyCode(code, user, panel) {
+        if (typeof code !== 'string' || !/^\d{4,12}$/.test(code))
+            return false;
+        const key = this.codeKey(user, panel);
+        return serialized(key, async () => {
+            const pending = (await this.cache().get(key));
+            if (!pending?.hash || !pending.expires || pending.expires < Date.now())
+                return false;
+            const expected = Buffer.from(pending.hash), actual = Buffer.from(createHash('sha256').update(code).digest('hex'));
+            if (expected.length !== actual.length || !timingSafeEqual(expected, actual))
+                return false;
+            await this.cache().forget(key);
+            return true;
+        });
+    }
+    async beforeChallenge(user, panel) { await this.sendCode(user, panel); }
+    /** Sends a new code and tells the user (or that they must wait). */
+    async resend(user, panel, group) {
+        if (await this.sendCode(user, panel))
+            Notification.make().success().title(t(`${group}.resend.notifications.resent.title`)).send();
+        else
+            Notification.make().danger().title(t(`${group}.resend.notifications.throttled.title`)).send();
+    }
+    getChallengeFormComponents(user, panel) {
+        const group = 'filament-panels::auth/multi-factor/email/provider.login_form.code';
+        return [
+            EmailCodeInput.make('code').label(t(`${group}.label`)).validationAttribute(t(`${group}.validation_attribute`))
+                .submitOnCompletion().autofocus().required()
+                .resendUsing(() => this.resend(user, panel, `${group}.actions`), t(`${group}.actions.resend.label`))
+                .rule({ name: 'email_code', passes: (value) => this.verifyCode(value, user, panel), message: () => t(`${group}.messages.invalid`) }),
+        ];
+    }
+    /** Code field of the setup and disable modals: the signed-in user's code, rate limited. */
+    modalCodeInput(panel, group) {
+        const throttleKey = (ctx) => `${panel.getId()}:${userKey(contextOf(ctx.livewire).user)}`;
+        return EmailCodeInput.make('code').label(t(`${group}.modal.form.code.label`)).validationAttribute(t(`${group}.modal.form.code.validation_attribute`)).required()
+            .resendUsing((field) => this.resend(currentUser(field.livewire), panel, `${group}.modal.form.code.actions`), t(`${group}.modal.form.code.actions.resend.label`))
+            .rule(throttleRule(this.managementThrottle, throttleKey, t(`${group}.modal.form.code.messages.rate_limited`)))
+            .rule({ name: 'email_code', passes: (value, ctx) => this.verifyCode(value, contextOf(ctx.livewire).user, panel), message: () => t(`${group}.modal.form.code.messages.invalid`) });
+    }
+    getManagementSchemaComponents(user, panel) {
+        const group = 'filament-panels::auth/multi-factor/email/provider.management_schema.actions';
+        const enabled = () => this.isEnabled(user, panel);
+        return [
+            Actions.make([this.setUpAction(panel).hidden(enabled), this.disableAction(panel).visible(enabled)]).key(`${this._id}-actions`)
+                .label(t(`${group}.label`)).belowContent(t(`${group}.below_content`))
+                .afterLabel(async () => statusBadge(await enabled(), t(`${group}.messages.enabled`), t(`${group}.messages.disabled`))),
+        ];
+    }
+    /** Sends a code when the modal opens; entering it turns email codes on. */
+    setUpAction(panel) {
+        const group = 'filament-panels::auth/multi-factor/email/actions/set-up';
+        return Action.make('setUpEmailAuthentication')
+            .label(t(`${group}.label`)).color('primary').icon('m-lock-closed').link()
+            .mountUsing(async (ctx) => { await this.sendCode(currentUser(ctx.livewire), panel); })
+            .modalWidth('md').modalIcon('o-lock-closed').modalIconColor('primary').closeModalByClickingAway(false)
+            .modalHeading(t(`${group}.modal.heading`)).modalDescription(t(`${group}.modal.description`))
+            .modalSubmitActionLabel(t(`${group}.modal.actions.submit.label`))
+            .schema([this.modalCodeInput(panel, group)])
+            .action(async (ctx) => {
+            await this.setEnabled(currentUser(ctx.livewire), panel, true);
+            Notification.make().success().title(t(`${group}.notifications.enabled.title`)).icon('o-lock-closed').send();
+        });
+    }
+    /** Sends a code when the modal opens; entering it turns email codes off. */
+    disableAction(panel) {
+        const group = 'filament-panels::auth/multi-factor/email/actions/disable';
+        return Action.make('disableEmailAuthentication')
+            .label(t(`${group}.label`)).color('danger').icon('m-lock-open').link()
+            .mountUsing(async (ctx) => { await this.sendCode(currentUser(ctx.livewire), panel); })
+            .modalWidth('md').modalIcon('o-lock-open').modalIconColor('danger')
+            .modalHeading(t(`${group}.modal.heading`)).modalDescription(t(`${group}.modal.description`))
+            .modalSubmitActionLabel(t(`${group}.modal.actions.submit.label`))
+            .schema([this.modalCodeInput(panel, group)])
+            .action(async (ctx) => {
+            await this.setEnabled(currentUser(ctx.livewire), panel, false);
+            Notification.make().success().title(t(`${group}.notifications.disabled.title`)).icon('o-lock-open').send();
+        });
+    }
+}