@nest-my-admin/auth 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 nest-my-admin contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,11 @@
-# Temporary Holding Version
+# @nest-my-admin/auth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The built-in sign-in for [nest-my-admin](https://github.com/phantomboy0/nest-my-admin): admin users, hashed passwords, revocable sessions, lockout and two-factor sign-in.
+
+```ts
+import { builtinAuth, ADMIN_AUTH_ENTITIES } from '@nest-my-admin/auth';
+
+AdminModule.forRoot({ auth: builtinAuth({ bootstrapSuperuser: { username: 'admin', password: process.env.ADMIN_PASSWORD! } }) });
+```
+
+Add `ADMIN_AUTH_ENTITIES` to your TypeORM entities. Documentation: https://github.com/phantomboy0/nest-my-admin#readme

package/dist/builtin-auth.d.ts

@@ -0,0 +1,120 @@
+import type { IncomingMessage } from 'node:http';
+import { type DataSource } from 'typeorm';
+import { type AdminAuthAdapter, type AdminAuthConfig, type AdminPrincipal, type AdminSessionInfo, type AdminUser, type AdminUserChanges, type AdminUserRecord, type NewAdminUser, type AuthIO, type LoginInput, type TwoFactorStatus } from '@nest-my-admin/core';
+import { NmaUser } from './entities.js';
+import { SCRYPT, type PasswordPolicy } from './password.js';
+export interface BuiltinAuthOptions {
+    /** The TypeORM DataSource holding `ADMIN_AUTH_ENTITIES` (its name; default the default DataSource). */
+    dataSource?: string;
+    /** Default `nma_session`. */
+    cookieName?: string;
+    /** `auto` (default): Secure on https requests (Express's `trust proxy` decides for proxied ones). */
+    secureCookie?: boolean | 'auto';
+    /** A session ends after this many seconds without a request. Default 12 hours. */
+    idleTimeout?: number;
+    /** …and at the latest this many seconds after sign-in. Default 30 days. */
+    absoluteTimeout?: number;
+    /** Failed passwords before the account locks, and for how long. Default 5 attempts, 15 minutes. */
+    lockout?: {
+        attempts?: number;
+        minutes?: number;
+    };
+    /** Sign-in attempts per IP address per minute. Default 20. */
+    loginAttemptsPerMinute?: number;
+    password?: PasswordPolicy;
+    /** Creates this superuser at boot when there are no admin users yet. */
+    bootstrapSuperuser?: {
+        username: string;
+        password: string;
+        displayName?: string;
+        email?: string;
+    };
+    /** Encrypts two-factor keys at rest (AES-256-GCM): 32 bytes, base64 (`openssl rand -base64 32`). Keep it out of the repository. */
+    secretKey?: string;
+    /** The name authenticator apps show next to the code. Default `nest-my-admin`. */
+    issuer?: string;
+    /** @internal Tests: the clock and a cheaper hash. */
+    now?: () => Date;
+    /** @internal */
+    scrypt?: typeof SCRYPT;
+}
+/** The built-in adapter (spec §7): `nma_user` and `nma_session` on the host's DataSource. */
+export declare class BuiltinAuthAdapter implements AdminAuthAdapter {
+    private readonly dataSource;
+    private readonly users;
+    private readonly sessions;
+    private readonly options;
+    private readonly limiter;
+    private readonly box;
+    private readonly logger;
+    /** Checked for unknown usernames, so they cost as much time as a wrong password. */
+    private dummyHash?;
+    constructor(dataSource: DataSource, options?: BuiltinAuthOptions);
+    /** Creates the bootstrap superuser when the table is empty. */
+    init(bootstrap?: BuiltinAuthOptions['bootstrapSuperuser']): Promise<void>;
+    authenticate(req: IncomingMessage): Promise<AdminPrincipal | null>;
+    login(input: LoginInput, io: AuthIO): Promise<AdminPrincipal>;
+    private failed;
+    /**
+     * Records `step` as used, only if no sign-in used it (or a later one) meanwhile: the same code sent twice at once
+     * signs in once. Drivers that do not report affected rows fall back to the check before.
+     */
+    private claimStep;
+    private secretOf;
+    /** The stored hashes without the one `code` matches, or undefined when it matches none. */
+    private useRecoveryCode;
+    logout(principal: AdminPrincipal, io: AuthIO): Promise<void>;
+    listSessions(principal: AdminPrincipal): Promise<AdminSessionInfo[]>;
+    revokeSession(principal: AdminPrincipal, sessionId: string): Promise<void>;
+    revokeOtherSessions(principal: AdminPrincipal): Promise<void>;
+    changePassword(principal: AdminPrincipal, input: {
+        current: string;
+        next: string;
+    }): Promise<void>;
+    private userOf;
+    private checkPassword;
+    twoFactorStatus(principal: AdminPrincipal): Promise<TwoFactorStatus>;
+    beginTwoFactor(principal: AdminPrincipal): Promise<{
+        secret: string;
+        otpauthUrl: string;
+    }>;
+    confirmTwoFactor(principal: AdminPrincipal, code: string): Promise<{
+        recoveryCodes: string[];
+    }>;
+    disableTwoFactor(principal: AdminPrincipal, password: string): Promise<void>;
+    newRecoveryCodes(principal: AdminPrincipal, password: string): Promise<{
+        recoveryCodes: string[];
+    }>;
+    /** Turns off a user's second factor (the Users page) and ends their sessions. */
+    resetTwoFactor(id: string): Promise<void>;
+    private readonly warned;
+    private warnOnce;
+    listUsers(query: {
+        search?: string;
+        page: number;
+        pageSize: number;
+    }): Promise<{
+        items: AdminUserRecord[];
+        total: number;
+    }>;
+    getUser(id: string): Promise<AdminUserRecord | null>;
+    createUser(input: NewAdminUser): Promise<AdminUserRecord>;
+    updateUser(id: string, changes: AdminUserChanges): Promise<AdminUserRecord>;
+    /** Sets a new password (the policy applies) and ends every session of that user. */
+    setPassword(id: string, password: string): Promise<void>;
+    private setCookie;
+}
+export declare function toAdminUser(user: NmaUser): AdminUser;
+/** Creates an admin user (a seed script, a CLI of your own). The password must meet the policy. */
+export declare function createAdminUser(dataSource: DataSource, input: {
+    username: string;
+    password: string;
+    displayName?: string;
+    email?: string;
+    isSuperuser?: boolean;
+}, options?: {
+    password?: PasswordPolicy;
+    scrypt?: typeof SCRYPT;
+}): Promise<NmaUser>;
+/** `AdminModule.forRoot({ auth: builtinAuth({ … }) })`. */
+export declare function builtinAuth(options?: BuiltinAuthOptions): AdminAuthConfig;

package/dist/builtin-auth.js

@@ -0,0 +1,434 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { Logger } from '@nestjs/common';
+import { getDataSourceToken } from '@nestjs/typeorm';
+import { LessThan, Not } from 'typeorm';
+import { AdminAuth, AdminRateLimitError, AdminTwoFactorRequiredError, AdminUnauthenticatedError, AdminValidationError, appendSetCookie, isSecureRequest, parseCookies, serializeCookie, } from '@nest-my-admin/core';
+import { NmaSession, NmaUser } from './entities.js';
+import { SCRYPT, hashPassword, passwordProblems, verifyPassword } from './password.js';
+import { RateLimiter } from './rate-limit.js';
+import { SecretBox } from './secret-box.js';
+import { base32Decode, base32Encode, newTotpSecret, otpauthUrl, verifyTotp } from './totp.js';
+const WRONG = 'Wrong username or password';
+const WRONG_CODE = 'The code is wrong or was already used';
+const RECOVERY_CODES = 10;
+const sha256 = (value) => createHash('sha256').update(value).digest('hex');
+/** The admin's mount path, from the request (Express sets `baseUrl` for the handler mounted at `path`). */
+function cookiePath(req) {
+    const base = req.baseUrl;
+    return base && base.startsWith('/') ? base : '/';
+}
+function clientIp(req) {
+    return req.ip ?? req.socket?.remoteAddress ?? 'unknown';
+}
+/** The built-in adapter (spec §7): `nma_user` and `nma_session` on the host's DataSource. */
+export class BuiltinAuthAdapter {
+    dataSource;
+    users;
+    sessions;
+    options;
+    limiter;
+    box;
+    logger = new Logger('NestMyAdmin');
+    /** Checked for unknown usernames, so they cost as much time as a wrong password. */
+    dummyHash;
+    constructor(dataSource, options = {}) {
+        this.dataSource = dataSource;
+        for (const entity of [NmaUser, NmaSession]) {
+            if (!dataSource.hasMetadata(entity)) {
+                throw new Error(`@nest-my-admin/auth: add ADMIN_AUTH_ENTITIES to the entities of the DataSource "${options.dataSource ?? 'default'}" (${entity.name} is missing)`);
+            }
+        }
+        this.users = dataSource.getRepository(NmaUser);
+        this.sessions = dataSource.getRepository(NmaSession);
+        this.options = {
+            cookieName: options.cookieName ?? 'nma_session',
+            secureCookie: options.secureCookie ?? 'auto',
+            idleTimeout: options.idleTimeout ?? 12 * 3600,
+            absoluteTimeout: options.absoluteTimeout ?? 30 * 24 * 3600,
+            lockoutAttempts: options.lockout?.attempts ?? 5,
+            lockoutMs: (options.lockout?.minutes ?? 15) * 60_000,
+            loginAttemptsPerMinute: options.loginAttemptsPerMinute ?? 20,
+            password: options.password ?? {},
+            now: options.now ?? (() => new Date()),
+            scrypt: options.scrypt ?? SCRYPT,
+            issuer: options.issuer ?? 'nest-my-admin',
+        };
+        this.box = new SecretBox(options.secretKey);
+        this.limiter = new RateLimiter(this.options.loginAttemptsPerMinute, 60_000);
+    }
+    /** Creates the bootstrap superuser when the table is empty. */
+    async init(bootstrap) {
+        if (bootstrap && (await this.users.count()) === 0) {
+            await createAdminUser(this.dataSource, { ...bootstrap, isSuperuser: true }, { password: this.options.password, scrypt: this.options.scrypt });
+        }
+    }
+    async authenticate(req) {
+        const token = parseCookies(req.headers.cookie)[this.options.cookieName];
+        if (!token || token.length > 200)
+            return null;
+        const session = await this.sessions.findOne({ where: { tokenHash: sha256(token) }, relations: { user: true } });
+        if (!session)
+            return null;
+        const now = this.options.now();
+        const idleLimit = session.lastSeenAt.getTime() + this.options.idleTimeout * 1000;
+        if (now.getTime() >= session.expiresAt.getTime() || now.getTime() >= idleLimit || !session.user?.isActive) {
+            await this.sessions.delete({ id: session.id });
+            return null;
+        }
+        // Sliding expiry, written at most once a minute.
+        if (now.getTime() - session.lastSeenAt.getTime() > 60_000)
+            await this.sessions.update({ id: session.id }, { lastSeenAt: now });
+        return { user: toAdminUser(session.user), csrfToken: session.csrfToken, sessionId: session.id };
+    }
+    async login(input, io) {
+        const now = this.options.now();
+        const limit = this.limiter.hit(clientIp(io.req), now.getTime());
+        if (!limit.allowed)
+            throw new AdminRateLimitError('Too many sign-in attempts; wait a minute and try again', limit.retryAfter);
+        const username = input.username.trim().toLowerCase();
+        const user = await this.users.findOne({ where: { username } });
+        // Unknown users are checked against a dummy hash: the same work, the same answer.
+        this.dummyHash ??= hashPassword(randomBytes(16).toString('hex'), this.options.scrypt);
+        const matches = await verifyPassword(input.password, user?.passwordHash ?? (await this.dummyHash));
+        const locked = user?.lockedUntil !== null && user?.lockedUntil !== undefined && user.lockedUntil.getTime() > now.getTime();
+        if (!user || !user.isActive || locked || !matches) {
+            if (user && !locked && !matches)
+                await this.failed(user, now);
+            throw new AdminUnauthenticatedError(WRONG);
+        }
+        // The second factor: no session without it. A wrong code counts toward the lockout like a wrong password.
+        const second = {};
+        if (user.totpSecret) {
+            if (input.otp === undefined)
+                throw new AdminTwoFactorRequiredError();
+            const step = verifyTotp(this.secretOf(user.totpSecret), input.otp, now.getTime(), { after: user.totpLastStep });
+            if (step === null || !(await this.claimStep(user, step))) {
+                const remaining = this.useRecoveryCode(user, input.otp);
+                if (!remaining) {
+                    await this.failed(user, now);
+                    throw new AdminTwoFactorRequiredError(WRONG_CODE);
+                }
+                second.recoveryCodes = remaining;
+            }
+        }
+        await this.users.update({ id: user.id }, { failedLogins: 0, lockedUntil: null, lastLoginAt: now, ...second });
+        // A sign-in clears the user's expired sessions.
+        await this.sessions.delete({ userId: user.id, expiresAt: LessThan(now) });
+        const token = randomBytes(32).toString('base64url');
+        const session = this.sessions.create({
+            id: randomBytes(16).toString('hex'),
+            tokenHash: sha256(token),
+            userId: user.id,
+            csrfToken: randomBytes(24).toString('base64url'),
+            createdAt: now,
+            lastSeenAt: now,
+            expiresAt: new Date(now.getTime() + this.options.absoluteTimeout * 1000),
+            userAgent: String(io.req.headers['user-agent'] ?? '').slice(0, 300) || null,
+            ip: clientIp(io.req).slice(0, 64),
+        });
+        await this.sessions.insert(session);
+        this.setCookie(io, token, this.options.absoluteTimeout);
+        return { user: toAdminUser(user), csrfToken: session.csrfToken, sessionId: session.id };
+    }
+    async failed(user, now) {
+        user.failedLogins += 1;
+        if (user.failedLogins >= this.options.lockoutAttempts) {
+            user.failedLogins = 0;
+            user.lockedUntil = new Date(now.getTime() + this.options.lockoutMs);
+        }
+        await this.users.update({ id: user.id }, { failedLogins: user.failedLogins, lockedUntil: user.lockedUntil });
+    }
+    /**
+     * Records `step` as used, only if no sign-in used it (or a later one) meanwhile: the same code sent twice at once
+     * signs in once. Drivers that do not report affected rows fall back to the check before.
+     */
+    async claimStep(user, step) {
+        const column = this.dataSource.driver.escape('totpLastStep');
+        const result = await this.users
+            .createQueryBuilder()
+            .update()
+            .set({ totpLastStep: step })
+            .where('id = :id', { id: user.id })
+            .andWhere(`(${column} IS NULL OR ${column} < :step)`, { step })
+            .execute();
+        return result.affected === undefined || result.affected > 0;
+    }
+    secretOf(stored) {
+        return base32Decode(this.box.open(stored));
+    }
+    /** The stored hashes without the one `code` matches, or undefined when it matches none. */
+    useRecoveryCode(user, code) {
+        const hashes = parseHashes(user.recoveryCodes);
+        const hash = sha256(normalizeRecoveryCode(code));
+        if (!hashes.includes(hash))
+            return undefined;
+        return JSON.stringify(hashes.filter((candidate) => candidate !== hash));
+    }
+    async logout(principal, io) {
+        if (principal.sessionId)
+            await this.sessions.delete({ id: principal.sessionId });
+        this.setCookie(io, '', 0);
+    }
+    async listSessions(principal) {
+        const now = this.options.now().getTime();
+        const rows = await this.sessions.find({ where: { userId: Number(principal.user.id) }, order: { lastSeenAt: 'DESC' } });
+        return rows
+            .filter((row) => row.expiresAt.getTime() > now && row.lastSeenAt.getTime() + this.options.idleTimeout * 1000 > now)
+            .map((row) => ({
+            id: row.id,
+            createdAt: row.createdAt,
+            lastSeenAt: row.lastSeenAt,
+            expiresAt: new Date(Math.min(row.expiresAt.getTime(), row.lastSeenAt.getTime() + this.options.idleTimeout * 1000)),
+            ...(row.userAgent ? { userAgent: row.userAgent } : {}),
+            ...(row.ip ? { ip: row.ip } : {}),
+        }));
+    }
+    async revokeSession(principal, sessionId) {
+        await this.sessions.delete({ id: sessionId, userId: Number(principal.user.id) });
+    }
+    async revokeOtherSessions(principal) {
+        const userId = Number(principal.user.id);
+        if (principal.sessionId)
+            await this.sessions.delete({ userId, id: Not(principal.sessionId) });
+        else
+            await this.sessions.delete({ userId });
+    }
+    async changePassword(principal, input) {
+        const user = await this.users.findOne({ where: { id: Number(principal.user.id) } });
+        if (!user)
+            throw new AdminUnauthenticatedError();
+        if (!(await verifyPassword(input.current, user.passwordHash)))
+            throw new AdminValidationError({ current: ['is wrong'] }, 'The current password is wrong');
+        const problems = passwordProblems(input.next, { username: user.username }, this.options.password);
+        if (problems.length > 0)
+            throw new AdminValidationError({ next: problems }, 'Choose another password');
+        await this.users.update({ id: user.id }, { passwordHash: await hashPassword(input.next, this.options.scrypt) });
+        // Someone who knew the old password is signed out everywhere else.
+        await this.revokeOtherSessions(principal);
+    }
+    // ---- two-factor sign-in (spec §7) ------------------------------------------------------------------------------
+    async userOf(principal) {
+        const user = await this.users.findOne({ where: { id: Number(principal.user.id) } });
+        if (!user)
+            throw new AdminUnauthenticatedError();
+        return user;
+    }
+    async checkPassword(user, password) {
+        if (!(await verifyPassword(password, user.passwordHash)))
+            throw new AdminValidationError({ password: ['is wrong'] }, 'The password is wrong');
+    }
+    async twoFactorStatus(principal) {
+        const user = await this.userOf(principal);
+        return { enabled: user.totpSecret !== null, recoveryCodesLeft: user.totpSecret ? parseHashes(user.recoveryCodes).length : 0 };
+    }
+    async beginTwoFactor(principal) {
+        const user = await this.userOf(principal);
+        if (user.totpSecret)
+            throw new AdminValidationError({ code: ['two-factor sign-in is already on'] }, 'Two-factor sign-in is already on');
+        if (!this.box.encrypts)
+            this.warnOnce('two-factor keys are stored unencrypted; set builtinAuth({ secretKey }) to encrypt them');
+        const secret = newTotpSecret();
+        await this.users.update({ id: user.id }, { totpPending: this.box.seal(base32Encode(secret)) });
+        return { secret: base32Encode(secret), otpauthUrl: otpauthUrl(this.options.issuer, user.username, secret) };
+    }
+    async confirmTwoFactor(principal, code) {
+        const user = await this.userOf(principal);
+        if (user.totpSecret)
+            throw new AdminValidationError({ code: ['two-factor sign-in is already on'] }, 'Two-factor sign-in is already on');
+        if (!user.totpPending)
+            throw new AdminValidationError({ code: ['start the setup first'] }, 'Start the setup first');
+        const step = verifyTotp(this.secretOf(user.totpPending), code, this.options.now().getTime());
+        if (step === null)
+            throw new AdminValidationError({ code: ['is wrong'] }, 'The code is wrong');
+        const codes = newRecoveryCodes();
+        await this.users.update({ id: user.id }, { totpSecret: user.totpPending, totpPending: null, totpLastStep: step, recoveryCodes: JSON.stringify(codes.map((item) => sha256(normalizeRecoveryCode(item)))) });
+        // Whoever is signed in elsewhere signed in without the second factor.
+        await this.revokeOtherSessions(principal);
+        return { recoveryCodes: codes };
+    }
+    async disableTwoFactor(principal, password) {
+        const user = await this.userOf(principal);
+        await this.checkPassword(user, password);
+        await this.users.update({ id: user.id }, TWO_FACTOR_OFF);
+    }
+    async newRecoveryCodes(principal, password) {
+        const user = await this.userOf(principal);
+        await this.checkPassword(user, password);
+        if (!user.totpSecret)
+            throw new AdminValidationError({ password: ['two-factor sign-in is off'] }, 'Two-factor sign-in is off');
+        const codes = newRecoveryCodes();
+        await this.users.update({ id: user.id }, { recoveryCodes: JSON.stringify(codes.map((item) => sha256(normalizeRecoveryCode(item)))) });
+        return { recoveryCodes: codes };
+    }
+    /** Turns off a user's second factor (the Users page) and ends their sessions. */
+    async resetTwoFactor(id) {
+        const numeric = Number(id);
+        if (!Number.isSafeInteger(numeric))
+            return;
+        await this.users.update({ id: numeric }, TWO_FACTOR_OFF);
+        await this.sessions.delete({ userId: numeric });
+    }
+    warned = new Set();
+    warnOnce(message) {
+        if (this.warned.has(message))
+            return;
+        this.warned.add(message);
+        this.logger.warn(`@nest-my-admin/auth: ${message}`);
+    }
+    // ---- the Users page (spec §6.7) ------------------------------------------------------------------------------
+    async listUsers(query) {
+        const qb = this.users.createQueryBuilder('u');
+        if (query.search) {
+            const pattern = `%${query.search.toLowerCase().replace(/[!%_]/g, (char) => `!${char}`)}%`;
+            qb.where("(LOWER(u.username) LIKE :q ESCAPE '!' OR LOWER(u.displayName) LIKE :q ESCAPE '!' OR LOWER(u.email) LIKE :q ESCAPE '!')", { q: pattern });
+        }
+        const [rows, total] = await qb.orderBy('u.username', 'ASC').skip((query.page - 1) * query.pageSize).take(query.pageSize).getManyAndCount();
+        return { items: rows.map(toUserRecord), total };
+    }
+    async getUser(id) {
+        const numeric = Number(id);
+        if (!Number.isSafeInteger(numeric))
+            return null;
+        const user = await this.users.findOne({ where: { id: numeric } });
+        return user ? toUserRecord(user) : null;
+    }
+    async createUser(input) {
+        const username = input.username.trim().toLowerCase();
+        const errors = {};
+        if (!USERNAME.test(username))
+            errors.username = ['must be letters, digits or . _ @ + - (at most 150)'];
+        else if (await this.users.existsBy({ username }))
+            errors.username = ['is taken'];
+        const displayName = input.displayName.trim();
+        if (displayName === '' || displayName.length > 150)
+            errors.displayName = ['must be 1–150 characters'];
+        const problems = passwordProblems(input.password, { username }, this.options.password);
+        if (problems.length > 0)
+            errors.password = problems;
+        if (input.email && input.email.length > 254)
+            errors.email = ['must be at most 254 characters'];
+        if (Object.keys(errors).length > 0)
+            throw new AdminValidationError(errors);
+        const user = await this.users.save(this.users.create({ username, displayName, email: input.email || null, passwordHash: await hashPassword(input.password, this.options.scrypt), isSuperuser: input.isSuperuser === true }));
+        return toUserRecord(user);
+    }
+    async updateUser(id, changes) {
+        const user = await this.getUser(id);
+        if (!user)
+            throw new AdminValidationError({ id: ['does not exist'] });
+        const update = {};
+        const errors = {};
+        if (changes.displayName !== undefined) {
+            if (typeof changes.displayName !== 'string' || changes.displayName.trim() === '' || changes.displayName.length > 150)
+                errors.displayName = ['must be 1–150 characters'];
+            else
+                update.displayName = changes.displayName.trim();
+        }
+        if (changes.email !== undefined) {
+            if (changes.email !== null && (typeof changes.email !== 'string' || changes.email.length > 254))
+                errors.email = ['must be at most 254 characters'];
+            else
+                update.email = changes.email || null;
+        }
+        for (const key of ['isActive', 'isSuperuser']) {
+            if (changes[key] === undefined)
+                continue;
+            if (typeof changes[key] !== 'boolean')
+                errors[key] = ['must be true or false'];
+            else
+                update[key] = changes[key];
+        }
+        if (Object.keys(errors).length > 0)
+            throw new AdminValidationError(errors);
+        if (Object.keys(update).length > 0)
+            await this.users.update({ id: Number(id) }, update);
+        // A deactivated user is signed out everywhere.
+        if (update.isActive === false)
+            await this.sessions.delete({ userId: Number(id) });
+        return (await this.getUser(id));
+    }
+    /** Sets a new password (the policy applies) and ends every session of that user. */
+    async setPassword(id, password) {
+        const user = await this.users.findOne({ where: { id: Number(id) } });
+        if (!user)
+            throw new AdminValidationError({ id: ['does not exist'] });
+        const problems = passwordProblems(password, { username: user.username }, this.options.password);
+        if (problems.length > 0)
+            throw new AdminValidationError({ password: problems });
+        await this.users.update({ id: user.id }, { passwordHash: await hashPassword(password, this.options.scrypt), failedLogins: 0, lockedUntil: null });
+        await this.sessions.delete({ userId: user.id });
+    }
+    setCookie(io, value, maxAge) {
+        const secure = this.options.secureCookie === 'auto' ? isSecureRequest(io.req) : this.options.secureCookie;
+        appendSetCookie(io.res, serializeCookie(this.options.cookieName, value, { path: cookiePath(io.req), httpOnly: true, secure, sameSite: 'Lax', maxAge }));
+    }
+}
+const USERNAME = /^[\p{L}\p{N}._@+-]{1,150}$/u;
+function toUserRecord(user) {
+    return { ...toAdminUser(user), isActive: user.isActive, lastLoginAt: user.lastLoginAt, createdAt: user.createdAt, twoFactor: user.totpSecret !== null };
+}
+const TWO_FACTOR_OFF = { totpSecret: null, totpPending: null, totpLastStep: null, recoveryCodes: null };
+function parseHashes(stored) {
+    if (!stored)
+        return [];
+    try {
+        const parsed = JSON.parse(stored);
+        return Array.isArray(parsed) ? parsed.filter((item) => typeof item === 'string') : [];
+    }
+    catch {
+        return [];
+    }
+}
+/** Recovery codes are compared without case, spaces and dashes. */
+function normalizeRecoveryCode(code) {
+    return code.toLowerCase().replace(/[\s-]/g, '');
+}
+/** Ten codes like `k7f3q-m2x9d` (50 random bits each). */
+function newRecoveryCodes() {
+    return Array.from({ length: RECOVERY_CODES }, () => {
+        const text = base32Encode(randomBytes(7)).slice(0, 10).toLowerCase();
+        return `${text.slice(0, 5)}-${text.slice(5)}`;
+    });
+}
+export function toAdminUser(user) {
+    return {
+        id: user.id,
+        displayName: user.displayName,
+        username: user.username,
+        ...(user.email ? { email: user.email } : {}),
+        isSuperuser: user.isSuperuser,
+    };
+}
+/** Creates an admin user (a seed script, a CLI of your own). The password must meet the policy. */
+export async function createAdminUser(dataSource, input, options = {}) {
+    const username = input.username.trim().toLowerCase();
+    if (!USERNAME.test(username))
+        throw new Error(`@nest-my-admin/auth: "${input.username}" is not a valid username`);
+    const problems = passwordProblems(input.password, { username }, options.password);
+    if (problems.length > 0)
+        throw new Error(`@nest-my-admin/auth: the password for "${username}" ${problems.join(', ')}`);
+    const users = dataSource.getRepository(NmaUser);
+    return users.save(users.create({
+        username,
+        displayName: input.displayName ?? input.username.trim(),
+        email: input.email ?? null,
+        passwordHash: await hashPassword(input.password, options.scrypt),
+        isSuperuser: input.isSuperuser ?? false,
+    }));
+}
+/** `AdminModule.forRoot({ auth: builtinAuth({ … }) })`. */
+export function builtinAuth(options = {}) {
+    return AdminAuth.factory(async (moduleRef) => {
+        let dataSource;
+        try {
+            dataSource = moduleRef.get(getDataSourceToken(options.dataSource), { strict: false });
+        }
+        catch {
+            throw new Error(`@nest-my-admin/auth: no TypeORM DataSource "${options.dataSource ?? 'default'}"; import TypeOrmModule.forRoot() in the app`);
+        }
+        const adapter = new BuiltinAuthAdapter(dataSource, options);
+        await adapter.init(options.bootstrapSuperuser);
+        return adapter;
+    });
+}
+//# sourceMappingURL=builtin-auth.js.map

package/dist/builtin-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtin-auth.js","sourceRoot":"","sources":["../src/builtin-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAGxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAoC,MAAM,SAAS,CAAC;AAC1E,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,2BAA2B,EAC3B,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,eAAe,GAYhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAuB,MAAM,eAAe,CAAC;AAC5G,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAsC9F,MAAM,KAAK,GAAG,4BAA4B,CAAC;AAC3C,MAAM,UAAU,GAAG,uCAAuC,CAAC;AAC3D,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEnF,2GAA2G;AAC3G,SAAS,UAAU,CAAC,GAAoB;IACtC,MAAM,IAAI,GAAI,GAA8C,CAAC,OAAO,CAAC;IACrE,OAAO,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AACnD,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAQ,GAAyC,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,SAAS,CAAC;AACjG,CAAC;AAED,6FAA6F;AAC7F,MAAM,OAAO,kBAAkB;IAWV,UAAU;IAVZ,KAAK,CAAsB;IAC3B,QAAQ,CAAyB;IACjC,OAAO,CAAW;IAClB,OAAO,CAAc;IACrB,GAAG,CAAY;IACf,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC;IACpD,oFAAoF;IAC5E,SAAS,CAAmB;IAEpC,YACmB,UAAsB,EACvC,OAAO,GAAuB,EAAE;0BADf,UAAU;QAG3B,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,mFAAmF,OAAO,CAAC,UAAU,IAAI,SAAS,MAAM,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC;YACrK,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,GAAG;YACb,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,aAAa;YAC/C,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,MAAM;YAC5C,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE,GAAG,IAAI;YAC7C,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI;YAC1D,eAAe,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,IAAI,CAAC;YAC/C,SAAS,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,GAAG,MAAM;YACpD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB,IAAI,EAAE;YAC5D,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;YAChC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;YACtC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,MAAM;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,eAAe;SAC1C,CAAC;QACF,IAAI,CAAC,GAAG,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,IAAI,CAAC,SAAoD;QAC7D,IAAI,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAChJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAoB;QACrC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAChH,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;QACjF,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC1G,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,iDAAiD;QACjD,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,MAAM;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/H,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;IAClG,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAiB,EAAE,EAAU;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,wDAAwD,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAE9H,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC/D,kFAAkF;QAClF,IAAI,CAAC,SAAS,KAAK,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,IAAI,EAAE,WAAW,KAAK,IAAI,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAE3H,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAClD,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC9D,MAAM,IAAI,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QAED,0GAA0G;QAC1G,MAAM,MAAM,GAAqB,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;gBAAE,MAAM,IAAI,2BAA2B,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;YAChH,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBACzD,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;gBACxD,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBAC7B,MAAM,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;gBACpD,CAAC;gBACD,MAAM,CAAC,aAAa,GAAG,SAAS,CAAC;YACnC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC9G,gDAAgD;QAChD,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACnC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACnC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC;YACxB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAChD,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;YACxE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI;YAC3E,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SAClC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACxD,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;IAC1F,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,IAAa,EAAE,GAAS;QAC3C,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;QACvB,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YACtD,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/G,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,SAAS,CAAC,IAAa,EAAE,IAAY;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK;aAC5B,kBAAkB,EAAE;aACpB,MAAM,EAAE;aACR,GAAG,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;aAC3B,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aAClC,QAAQ,CAAC,IAAI,MAAM,eAAe,MAAM,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC;aAC9D,OAAO,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC9D,CAAC;IAEO,QAAQ,CAAC,MAAc;QAC7B,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,2FAA2F;IACnF,eAAe,CAAC,IAAa,EAAE,IAAY;QACjD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAyB,EAAE,EAAU;QAChD,IAAI,SAAS,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAyB;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACvH,OAAO,IAAI;aACR,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,GAAG,IAAI,GAAG,GAAG,CAAC;aAClH,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACb,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;YAClH,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClC,CAAC,CAAC,CAAC;IACR,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAyB,EAAE,SAAiB;QAC9D,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,SAAyB;QACjD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,SAAS,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;;YACzF,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAyB,EAAE,KAAwC;QACtF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACjD,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAAE,MAAM,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAC1J,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,yBAAyB,CAAC,CAAC;QACvG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChH,mEAAmE;QACnE,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,mHAAmH;IAE3G,KAAK,CAAC,MAAM,CAAC,SAAyB;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,IAAa,EAAE,QAAgB;QACzD,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAAE,MAAM,IAAI,oBAAoB,CAAC,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,uBAAuB,CAAC,CAAC;IAChJ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAyB;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChI,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAyB;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC,kCAAkC,CAAC,EAAE,EAAE,kCAAkC,CAAC,CAAC;QACxI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,CAAC,wFAAwF,CAAC,CAAC;QAChI,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/F,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;IAC9G,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAAyB,EAAE,IAAY;QAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC,kCAAkC,CAAC,EAAE,EAAE,kCAAkC,CAAC,CAAC;QACxI,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC,uBAAuB,CAAC,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACpH,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7F,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC/F,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3M,sEAAsE;QACtE,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAAyB,EAAE,QAAgB;QAChE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAAyB,EAAE,QAAgB;QAChE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,oBAAoB,CAAC,EAAE,QAAQ,EAAE,CAAC,2BAA2B,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAC;QAC/H,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtI,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;YAAE,OAAO;QAC3C,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAClD,CAAC;IAEgB,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,QAAQ,CAAC,OAAe;QAC9B,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO;QACrC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,iHAAiH;IAEjH,KAAK,CAAC,SAAS,CAAC,KAA0D;QACxE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,CAAC;YAC1F,EAAE,CAAC,KAAK,CAAC,wHAAwH,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACrJ,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE,CAAC;QAC3I,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAmB;QAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,MAAM,GAA6B,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,oDAAoD,CAAC,CAAC;aAClG,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;YAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,UAAU,CAAC,CAAC;QACjF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,WAAW,KAAK,EAAE,IAAI,WAAW,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,CAAC,WAAW,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACtG,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACpD,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,CAAC,KAAK,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAC/F,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAChC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC,CACzL,CAAC;QACF,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,OAAyB;QACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,oBAAoB,CAAC,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACtE,MAAM,MAAM,GAAqB,EAAE,CAAC;QACpC,MAAM,MAAM,GAA6B,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAM,CAAC,WAAW,GAAG,CAAC,0BAA0B,CAAC,CAAC;;gBACnK,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACvD,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;gBAAE,MAAM,CAAC,KAAK,GAAG,CAAC,gCAAgC,CAAC,CAAC;;gBAC9I,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC;QAC5C,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAU,EAAE,CAAC;YACvD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,SAAS;YACzC,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;;gBAC1E,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACxF,+CAA+C;QAC/C,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClF,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAE,CAAC;IACnC,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,WAAW,CAAC,EAAU,EAAE,QAAgB;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,oBAAoB,CAAC,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,oBAAoB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChF,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAClJ,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAClD,CAAC;IAEO,SAAS,CAAC,EAAiD,EAAE,KAAa,EAAE,MAAc;QAChG,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,GAA4C,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QACnJ,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1J,CAAC;CACF;AAED,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAE/C,SAAS,YAAY,CAAC,IAAa;IACjC,OAAO,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;AAC1J,CAAC;AAED,MAAM,cAAc,GAAqB,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AAE1H,SAAS,WAAW,CAAC,MAAqB;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,0DAA0D;AAC1D,SAAS,gBAAgB;IACvB,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE;QACjD,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAsB,EACtB,KAA0G,EAC1G,OAAO,GAA0D,EAAE;IAEnE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,CAAC,QAAQ,2BAA2B,CAAC,CAAC;IAClH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvH,MAAM,KAAK,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CACf,KAAK,CAAC,MAAM,CAAC;QACX,QAAQ;QACR,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE;QACvD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;QAC1B,YAAY,EAAE,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC;QAChE,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK;KACxC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,WAAW,CAAC,OAAO,GAAuB,EAAE;IAC1D,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,SAAoB,EAAE,EAAE;QACtD,IAAI,UAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,UAAU,GAAG,SAAS,CAAC,GAAG,CAAa,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAW,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9G,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,+CAA+C,OAAO,CAAC,UAAU,IAAI,SAAS,8CAA8C,CAAC,CAAC;QAChJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/entities.d.ts

@@ -0,0 +1,41 @@
+/** An admin user (spec §7). Usernames are stored lower-case. */
+export declare class NmaUser {
+    id: number;
+    username: string;
+    email: string | null;
+    displayName: string;
+    /** `scrypt$N$r$p$salt$hash`; never sent anywhere. */
+    passwordHash: string;
+    isSuperuser: boolean;
+    /** Inactive users cannot sign in, and their sessions stop working. */
+    isActive: boolean;
+    failedLogins: number;
+    lockedUntil: Date | null;
+    lastLoginAt: Date | null;
+    /** The TOTP key while two-factor sign-in is on (sealed with `secretKey` when one is set). */
+    totpSecret: string | null;
+    /** A key being set up, until it is confirmed with a code. */
+    totpPending: string | null;
+    /** The last 30-second step a code was accepted for: codes are never accepted twice. */
+    totpLastStep: number | null;
+    /** SHA-256 hashes of the unused recovery codes (JSON array). */
+    recoveryCodes: string | null;
+    createdAt: Date;
+}
+/** A signed-in browser. Only the SHA-256 of the session token is stored. */
+export declare class NmaSession {
+    /** Public id (the account page shows and revokes sessions by it); unrelated to the token. */
+    id: string;
+    tokenHash: string;
+    userId: number;
+    user: NmaUser;
+    csrfToken: string;
+    createdAt: Date;
+    lastSeenAt: Date;
+    /** The absolute limit; the idle limit is `lastSeenAt` + the idle timeout. */
+    expiresAt: Date;
+    userAgent: string | null;
+    ip: string | null;
+}
+/** Add these to the TypeORM entities of the DataSource the built-in auth uses. */
+export declare const ADMIN_AUTH_ENTITIES: (typeof NmaUser | typeof NmaSession)[];

package/dist/entities.js

@@ -0,0 +1,162 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Column, CreateDateColumn, Entity, Index, JoinColumn, ManyToOne, PrimaryColumn, PrimaryGeneratedColumn } from 'typeorm';
+/** An admin user (spec §7). Usernames are stored lower-case. */
+let NmaUser = class NmaUser {
+    id;
+    username;
+    email;
+    displayName;
+    /** `scrypt$N$r$p$salt$hash`; never sent anywhere. */
+    passwordHash;
+    isSuperuser;
+    /** Inactive users cannot sign in, and their sessions stop working. */
+    isActive;
+    failedLogins;
+    lockedUntil;
+    lastLoginAt;
+    /** The TOTP key while two-factor sign-in is on (sealed with `secretKey` when one is set). */
+    totpSecret;
+    /** A key being set up, until it is confirmed with a code. */
+    totpPending;
+    /** The last 30-second step a code was accepted for: codes are never accepted twice. */
+    totpLastStep;
+    /** SHA-256 hashes of the unused recovery codes (JSON array). */
+    recoveryCodes;
+    createdAt;
+};
+__decorate([
+    PrimaryGeneratedColumn(),
+    __metadata("design:type", Number)
+], NmaUser.prototype, "id", void 0);
+__decorate([
+    Column({ length: 150, unique: true }),
+    __metadata("design:type", String)
+], NmaUser.prototype, "username", void 0);
+__decorate([
+    Column({ type: 'varchar', length: 254, nullable: true }),
+    __metadata("design:type", Object)
+], NmaUser.prototype, "email", void 0);
+__decorate([
+    Column({ length: 150 }),
+    __metadata("design:type", String)
+], NmaUser.prototype, "displayName", void 0);
+__decorate([
+    Column({ length: 255 }),
+    __metadata("design:type", String)
+], NmaUser.prototype, "passwordHash", void 0);
+__decorate([
+    Column({ default: false }),
+    __metadata("design:type", Boolean)
+], NmaUser.prototype, "isSuperuser", void 0);
+__decorate([
+    Column({ default: true }),
+    __metadata("design:type", Boolean)
+], NmaUser.prototype, "isActive", void 0);
+__decorate([
+    Column({ type: 'int', default: 0 }),
+    __metadata("design:type", Number)
+], NmaUser.prototype, "failedLogins", void 0);
+__decorate([
+    Column({ type: Date, nullable: true }),
+    __metadata("design:type", Object)
+], NmaUser.prototype, "lockedUntil", void 0);
+__decorate([
+    Column({ type: Date, nullable: true }),
+    __metadata("design:type", Object)
+], NmaUser.prototype, "lastLoginAt", void 0);
+__decorate([
+    Column({ type: 'varchar', length: 255, nullable: true }),
+    __metadata("design:type", Object)
+], NmaUser.prototype, "totpSecret", void 0);
+__decorate([
+    Column({ type: 'varchar', length: 255, nullable: true }),
+    __metadata("design:type", Object)
+], NmaUser.prototype, "totpPending", void 0);
+__decorate([
+    Column({ type: 'int', nullable: true }),
+    __metadata("design:type", Object)
+], NmaUser.prototype, "totpLastStep", void 0);
+__decorate([
+    Column({ type: 'text', nullable: true }),
+    __metadata("design:type", Object)
+], NmaUser.prototype, "recoveryCodes", void 0);
+__decorate([
+    CreateDateColumn(),
+    __metadata("design:type", Date)
+], NmaUser.prototype, "createdAt", void 0);
+NmaUser = __decorate([
+    Entity('nma_user')
+], NmaUser);
+export { NmaUser };
+/** A signed-in browser. Only the SHA-256 of the session token is stored. */
+let NmaSession = class NmaSession {
+    /** Public id (the account page shows and revokes sessions by it); unrelated to the token. */
+    id;
+    tokenHash;
+    userId;
+    user;
+    csrfToken;
+    createdAt;
+    lastSeenAt;
+    /** The absolute limit; the idle limit is `lastSeenAt` + the idle timeout. */
+    expiresAt;
+    userAgent;
+    ip;
+};
+__decorate([
+    PrimaryColumn({ type: 'varchar', length: 32 }),
+    __metadata("design:type", String)
+], NmaSession.prototype, "id", void 0);
+__decorate([
+    Column({ type: 'varchar', length: 64, unique: true }),
+    __metadata("design:type", String)
+], NmaSession.prototype, "tokenHash", void 0);
+__decorate([
+    Column({ type: 'int' }),
+    __metadata("design:type", Number)
+], NmaSession.prototype, "userId", void 0);
+__decorate([
+    ManyToOne(() => NmaUser, { onDelete: 'CASCADE' }),
+    JoinColumn({ name: 'userId' }),
+    __metadata("design:type", NmaUser)
+], NmaSession.prototype, "user", void 0);
+__decorate([
+    Column({ type: 'varchar', length: 64 }),
+    __metadata("design:type", String)
+], NmaSession.prototype, "csrfToken", void 0);
+__decorate([
+    Column({ type: Date }),
+    __metadata("design:type", Date)
+], NmaSession.prototype, "createdAt", void 0);
+__decorate([
+    Column({ type: Date }),
+    __metadata("design:type", Date)
+], NmaSession.prototype, "lastSeenAt", void 0);
+__decorate([
+    Column({ type: Date }),
+    __metadata("design:type", Date)
+], NmaSession.prototype, "expiresAt", void 0);
+__decorate([
+    Column({ type: 'varchar', length: 300, nullable: true }),
+    __metadata("design:type", Object)
+], NmaSession.prototype, "userAgent", void 0);
+__decorate([
+    Column({ type: 'varchar', length: 64, nullable: true }),
+    __metadata("design:type", Object)
+], NmaSession.prototype, "ip", void 0);
+NmaSession = __decorate([
+    Entity('nma_session'),
+    Index(['userId'])
+], NmaSession);
+export { NmaSession };
+/** Add these to the TypeORM entities of the DataSource the built-in auth uses. */
+export const ADMIN_AUTH_ENTITIES = [NmaUser, NmaSession];
+//# sourceMappingURL=entities.js.map

package/dist/entities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entities.js","sourceRoot":"","sources":["../src/entities.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAEhI,gEAAgE;AAEzD,IAAM,OAAO,GAAb,MAAM,OAAO;IACQ,EAAE,CAAS;IACE,QAAQ,CAAS;IACE,KAAK,CAAgB;IACtD,WAAW,CAAS;IAC7C,qDAAqD;IAC5B,YAAY,CAAS;IAClB,WAAW,CAAU;IACjD,sEAAsE;IAC3C,QAAQ,CAAU;IACR,YAAY,CAAS;IAClB,WAAW,CAAc;IACzB,WAAW,CAAc;IACjE,6FAA6F;IACnC,UAAU,CAAgB;IACpF,6DAA6D;IACH,WAAW,CAAgB;IACrF,uFAAuF;IAC9C,YAAY,CAAgB;IACrE,gEAAgE;IACtB,aAAa,CAAgB;IACnD,SAAS,CAAO;CACrC,CAAA;AArB2B;IAAzB,sBAAsB,EAAE;;mCAAY;AACE;IAAtC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;;yCAAkB;AACE;IAAzD,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sCAAsB;AACtD;IAAxB,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;4CAAqB;AAEpB;IAAxB,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;6CAAsB;AAClB;IAA3B,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;;4CAAsB;AAEtB;IAA1B,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;;yCAAmB;AACR;IAApC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;;6CAAsB;AAClB;IAAvC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;4CAA0B;AACzB;IAAvC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;4CAA0B;AAEP;IAAzD,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;2CAA2B;AAE1B;IAAzD,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;4CAA4B;AAE5C;IAAxC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;6CAA6B;AAE3B;IAAzC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;8CAA8B;AACnD;IAAnB,gBAAgB,EAAE;8BAAY,IAAI;0CAAC;AArBzB,OAAO;IADnB,MAAM,CAAC,UAAU,CAAC;GACN,OAAO,CAsBnB;;AAED,4EAA4E;AAGrE,IAAM,UAAU,GAAhB,MAAM,UAAU;IACrB,6FAA6F;IAC7C,EAAE,CAAS;IACJ,SAAS,CAAS;IAChD,MAAM,CAAS;IAC2C,IAAI,CAAU;IACxD,SAAS,CAAS;IACnC,SAAS,CAAO;IAChB,UAAU,CAAO;IACzC,6EAA6E;IACrD,SAAS,CAAO;IACkB,SAAS,CAAgB;IAC1B,EAAE,CAAgB;CAC5E,CAAA;AAXiD;IAA/C,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;;sCAAY;AACJ;IAAtD,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;;6CAAmB;AAChD;IAAxB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;;0CAAgB;AAC2C;IAAlF,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAAE,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;8BAAO,OAAO;wCAAC;AACxD;IAAxC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;;6CAAmB;AACnC;IAAvB,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;8BAAY,IAAI;6CAAC;AAChB;IAAvB,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;8BAAa,IAAI;8CAAC;AAEjB;IAAvB,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;8BAAY,IAAI;6CAAC;AACkB;IAAzD,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;6CAA0B;AAC1B;IAAxD,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sCAAmB;AAZhE,UAAU;IAFtB,MAAM,CAAC,aAAa,CAAC;IACrB,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;GACL,UAAU,CAatB;;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { ADMIN_AUTH_ENTITIES, NmaSession, NmaUser } from './entities.js';
+export { BuiltinAuthAdapter, builtinAuth, createAdminUser, toAdminUser, type BuiltinAuthOptions } from './builtin-auth.js';
+export { hashPassword, passwordProblems, verifyPassword, type PasswordPolicy } from './password.js';
+export { totpCode } from './totp.js';

package/dist/index.js

@@ -0,0 +1,5 @@
+export { ADMIN_AUTH_ENTITIES, NmaSession, NmaUser } from './entities.js';
+export { BuiltinAuthAdapter, builtinAuth, createAdminUser, toAdminUser } from './builtin-auth.js';
+export { hashPassword, passwordProblems, verifyPassword } from './password.js';
+export { totpCode } from './totp.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAA2B,MAAM,mBAAmB,CAAC;AAC3H,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAuB,MAAM,eAAe,CAAC;AACpG,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC"}

package/dist/password.d.ts

@@ -0,0 +1,24 @@
+/** scrypt cost: N = 2^15, r = 8, p = 1 (about 32 MB and tens of milliseconds per hash). */
+export declare const SCRYPT: {
+    N: number;
+    r: number;
+    p: number;
+    keylen: number;
+};
+/** `scrypt$N$r$p$salt$hash` (base64): self-describing, so the cost can grow without breaking stored hashes. */
+export declare function hashPassword(password: string, cost?: {
+    N: number;
+    r: number;
+    p: number;
+    keylen: number;
+}): Promise<string>;
+/** Constant-time check; a malformed or foreign hash is simply `false`. */
+export declare function verifyPassword(password: string, stored: string): Promise<boolean>;
+export interface PasswordPolicy {
+    /** Default 10. */
+    minLength?: number;
+}
+/** Problems with a new password (empty when it is acceptable). */
+export declare function passwordProblems(password: string, context: {
+    username?: string;
+}, policy?: PasswordPolicy): string[];

package/dist/password.js

@@ -0,0 +1,41 @@
+import { randomBytes, scrypt as scryptCallback, timingSafeEqual } from 'node:crypto';
+const scrypt = (password, salt, keylen, options) => new Promise((resolve, reject) => scryptCallback(password, salt, keylen, options, (error, key) => (error ? reject(error) : resolve(key))));
+/** scrypt cost: N = 2^15, r = 8, p = 1 (about 32 MB and tens of milliseconds per hash). */
+export const SCRYPT = { N: 32_768, r: 8, p: 1, keylen: 64 };
+function maxmem(N, r, p) {
+    return 128 * N * r * p + 16 * 1024 * 1024;
+}
+/** `scrypt$N$r$p$salt$hash` (base64): self-describing, so the cost can grow without breaking stored hashes. */
+export async function hashPassword(password, cost = SCRYPT) {
+    const salt = randomBytes(16);
+    const key = await scrypt(password.normalize('NFKC'), salt, cost.keylen, { N: cost.N, r: cost.r, p: cost.p, maxmem: maxmem(cost.N, cost.r, cost.p) });
+    return `scrypt$${cost.N}$${cost.r}$${cost.p}$${salt.toString('base64')}$${key.toString('base64')}`;
+}
+/** Constant-time check; a malformed or foreign hash is simply `false`. */
+export async function verifyPassword(password, stored) {
+    const parts = stored.split('$');
+    if (parts.length !== 6 || parts[0] !== 'scrypt')
+        return false;
+    const [N, r, p] = parts.slice(1, 4).map(Number);
+    if (![N, r, p].every((value) => Number.isInteger(value) && value > 0) || N > 2 ** 20 || r > 32 || p > 16)
+        return false;
+    const salt = Buffer.from(parts[4], 'base64');
+    const expected = Buffer.from(parts[5], 'base64');
+    if (salt.length < 8 || expected.length < 16)
+        return false;
+    const key = await scrypt(password.normalize('NFKC'), salt, expected.length, { N, r, p, maxmem: maxmem(N, r, p) });
+    return timingSafeEqual(key, expected);
+}
+/** Problems with a new password (empty when it is acceptable). */
+export function passwordProblems(password, context, policy = {}) {
+    const minLength = policy.minLength ?? 10;
+    const problems = [];
+    if ([...password].length < minLength)
+        problems.push(`must be at least ${minLength} characters`);
+    if ([...password].length > 256)
+        problems.push('must be at most 256 characters');
+    if (context.username && password.trim().toLowerCase() === context.username.trim().toLowerCase())
+        problems.push('must not be the username');
+    return problems;
+}
+//# sourceMappingURL=password.js.map

package/dist/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../src/password.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,IAAI,cAAc,EAAE,eAAe,EAAsB,MAAM,aAAa,CAAC;AAEzG,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAE,MAAc,EAAE,OAAsB,EAAE,EAAE,CACxF,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpJ,2FAA2F;AAC3F,MAAM,CAAC,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAE5D,SAAS,MAAM,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS;IAC7C,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5C,CAAC;AAED,+GAA+G;AAC/G,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,IAAI,GAAG,MAAM;IAChE,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrJ,OAAO,UAAU,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AACrG,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAA6B,CAAC;IAC5E,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACvH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAClH,OAAO,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAOD,kEAAkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,OAA8B,EAAE,MAAM,GAAmB,EAAE;IAC5G,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,GAAG,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,oBAAoB,SAAS,aAAa,CAAC,CAAC;IAChG,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,GAAG,GAAG;QAAE,QAAQ,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC3I,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/rate-limit.d.ts

@@ -0,0 +1,12 @@
+/** Fixed-window counter per key (in memory, per process): `limit` hits per `windowMs`. */
+export declare class RateLimiter {
+    private readonly limit;
+    private readonly windowMs;
+    private readonly hits;
+    constructor(limit: number, windowMs: number);
+    /** Counts one hit; `retryAfter` (seconds) is set when the key is over its limit. */
+    hit(key: string, now?: number): {
+        allowed: boolean;
+        retryAfter: number;
+    };
+}

package/dist/rate-limit.js

@@ -0,0 +1,25 @@
+/** Fixed-window counter per key (in memory, per process): `limit` hits per `windowMs`. */
+export class RateLimiter {
+    limit;
+    windowMs;
+    hits = new Map();
+    constructor(limit, windowMs) {
+        this.limit = limit;
+        this.windowMs = windowMs;
+    }
+    /** Counts one hit; `retryAfter` (seconds) is set when the key is over its limit. */
+    hit(key, now = Date.now()) {
+        if (this.hits.size > 10_000)
+            for (const [name, entry] of this.hits)
+                if (entry.resetAt <= now)
+                    this.hits.delete(name);
+        let entry = this.hits.get(key);
+        if (!entry || entry.resetAt <= now) {
+            entry = { count: 0, resetAt: now + this.windowMs };
+            this.hits.set(key, entry);
+        }
+        entry.count += 1;
+        return entry.count > this.limit ? { allowed: false, retryAfter: Math.ceil((entry.resetAt - now) / 1000) } : { allowed: true, retryAfter: 0 };
+    }
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,MAAM,OAAO,WAAW;IAIH,KAAK;IACL,QAAQ;IAJV,IAAI,GAAG,IAAI,GAAG,EAA8C,CAAC;IAE9E,YACmB,KAAa,EACb,QAAgB;qBADhB,KAAK;wBACL,QAAQ;IACxB,CAAC;IAEJ,oFAAoF;IACpF,GAAG,CAAC,GAAW,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAC/B,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM;YAAE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI;gBAAE,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG;oBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrH,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YACnC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QACjB,OAAO,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IAC/I,CAAC;CACF"}

package/dist/secret-box.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Seals small secrets (TOTP keys) at rest with AES-256-GCM. Without a key, values are stored as they are; values
+ * stored before a key was set are still read, and sealed on their next write.
+ */
+export declare class SecretBox {
+    private readonly key?;
+    /** `key`: 32 bytes, base64 (`openssl rand -base64 32`). */
+    constructor(key?: string);
+    get encrypts(): boolean;
+    seal(plain: string): string;
+    open(stored: string): string;
+}

package/dist/secret-box.js

@@ -0,0 +1,40 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+const PREFIX = 'v1:';
+/**
+ * Seals small secrets (TOTP keys) at rest with AES-256-GCM. Without a key, values are stored as they are; values
+ * stored before a key was set are still read, and sealed on their next write.
+ */
+export class SecretBox {
+    key;
+    /** `key`: 32 bytes, base64 (`openssl rand -base64 32`). */
+    constructor(key) {
+        if (key === undefined)
+            return;
+        const bytes = Buffer.from(key, 'base64');
+        if (bytes.length !== 32)
+            throw new Error('@nest-my-admin/auth: secretKey must be 32 bytes, base64 encoded (openssl rand -base64 32)');
+        this.key = bytes;
+    }
+    get encrypts() {
+        return this.key !== undefined;
+    }
+    seal(plain) {
+        if (!this.key)
+            return plain;
+        const iv = randomBytes(12);
+        const cipher = createCipheriv('aes-256-gcm', this.key, iv);
+        const body = Buffer.concat([cipher.update(plain, 'utf8'), cipher.final()]);
+        return PREFIX + Buffer.concat([iv, cipher.getAuthTag(), body]).toString('base64url');
+    }
+    open(stored) {
+        if (!stored.startsWith(PREFIX))
+            return stored;
+        if (!this.key)
+            throw new Error('@nest-my-admin/auth: a two-factor secret is encrypted, but no secretKey is configured');
+        const raw = Buffer.from(stored.slice(PREFIX.length), 'base64url');
+        const decipher = createDecipheriv('aes-256-gcm', this.key, raw.subarray(0, 12));
+        decipher.setAuthTag(raw.subarray(12, 28));
+        return Buffer.concat([decipher.update(raw.subarray(28)), decipher.final()]).toString('utf8');
+    }
+}
+//# sourceMappingURL=secret-box.js.map

package/dist/secret-box.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-box.js","sourceRoot":"","sources":["../src/secret-box.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,MAAM,MAAM,GAAG,KAAK,CAAC;AAErB;;;GAGG;AACH,MAAM,OAAO,SAAS;IACH,GAAG,CAAU;IAE9B,2DAA2D;IAC3D,YAAY,GAAY;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;QACtI,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,KAAa;QAChB,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QAC5B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3E,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,CAAC,MAAc;QACjB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;QACxH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAChF,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/F,CAAC;CACF"}

package/dist/totp.d.ts

@@ -0,0 +1,25 @@
+/** RFC 4648 base32, without padding (what authenticator apps expect). */
+export declare function base32Encode(bytes: Uint8Array): string;
+/** Accepts lower case, spaces and padding; throws on other characters. */
+export declare function base32Decode(text: string): Buffer;
+/** RFC 4226 HOTP (HMAC-SHA1). */
+export declare function hotp(secret: Uint8Array, counter: number, digits?: number): string;
+export declare const TOTP_PERIOD = 30;
+/** The 30-second step of a moment. */
+export declare function totpStep(now: number): number;
+/** RFC 6238 TOTP for a moment (ms). */
+export declare function totp(secret: Uint8Array, now: number, digits?: number): string;
+/**
+ * The step a code matches within ±`window` steps of `now`, newer than `after` (a code is never accepted twice), or
+ * null. Codes are compared in constant time.
+ */
+export declare function verifyTotp(secret: Uint8Array, code: string, now: number, options?: {
+    after?: number | null;
+    window?: number;
+}): number | null;
+/** 20 random bytes, the size RFC 4226 recommends for SHA-1. */
+export declare function newTotpSecret(): Buffer;
+/** The `otpauth://` URL authenticator apps scan. */
+export declare function otpauthUrl(issuer: string, account: string, secret: Uint8Array): string;
+/** The current code for a base32 key (what the authenticator app shows): for tests and scripts of your own. */
+export declare function totpCode(secret: string, at?: Date): string;

package/dist/totp.js

@@ -0,0 +1,89 @@
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+const ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+/** RFC 4648 base32, without padding (what authenticator apps expect). */
+export function base32Encode(bytes) {
+    let bits = 0;
+    let value = 0;
+    let out = '';
+    for (const byte of bytes) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            out += ALPHABET[(value >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0)
+        out += ALPHABET[(value << (5 - bits)) & 31];
+    return out;
+}
+/** Accepts lower case, spaces and padding; throws on other characters. */
+export function base32Decode(text) {
+    const clean = text.replace(/[\s=]/g, '').toUpperCase();
+    let bits = 0;
+    let value = 0;
+    const out = [];
+    for (const char of clean) {
+        const index = ALPHABET.indexOf(char);
+        if (index < 0)
+            throw new Error(`"${char}" is not base32`);
+        value = (value << 5) | index;
+        bits += 5;
+        if (bits >= 8) {
+            out.push((value >>> (bits - 8)) & 255);
+            bits -= 8;
+        }
+    }
+    return Buffer.from(out);
+}
+/** RFC 4226 HOTP (HMAC-SHA1). */
+export function hotp(secret, counter, digits = 6) {
+    const message = Buffer.alloc(8);
+    message.writeBigUInt64BE(BigInt(counter));
+    const hash = createHmac('sha1', secret).update(message).digest();
+    const offset = hash[hash.length - 1] & 15;
+    const code = (hash.readUInt32BE(offset) & 0x7fffffff) % 10 ** digits;
+    return String(code).padStart(digits, '0');
+}
+export const TOTP_PERIOD = 30;
+/** The 30-second step of a moment. */
+export function totpStep(now) {
+    return Math.floor(now / 1000 / TOTP_PERIOD);
+}
+/** RFC 6238 TOTP for a moment (ms). */
+export function totp(secret, now, digits = 6) {
+    return hotp(secret, totpStep(now), digits);
+}
+/**
+ * The step a code matches within ±`window` steps of `now`, newer than `after` (a code is never accepted twice), or
+ * null. Codes are compared in constant time.
+ */
+export function verifyTotp(secret, code, now, options = {}) {
+    const clean = code.replace(/\s/g, '');
+    if (!/^\d{6}$/.test(clean))
+        return null;
+    const current = totpStep(now);
+    const window = options.window ?? 1;
+    let matched = null;
+    for (let step = current - window; step <= current + window; step++) {
+        const expected = Buffer.from(hotp(secret, step));
+        if (timingSafeEqual(expected, Buffer.from(clean)) && (options.after === undefined || options.after === null || step > options.after))
+            matched = step;
+    }
+    return matched;
+}
+/** 20 random bytes, the size RFC 4226 recommends for SHA-1. */
+export function newTotpSecret() {
+    return randomBytes(20);
+}
+/** The `otpauth://` URL authenticator apps scan. */
+export function otpauthUrl(issuer, account, secret) {
+    const label = `${encodeURIComponent(issuer)}:${encodeURIComponent(account)}`;
+    const params = new URLSearchParams({ secret: base32Encode(secret), issuer, algorithm: 'SHA1', digits: '6', period: String(TOTP_PERIOD) });
+    return `otpauth://totp/${label}?${params.toString()}`;
+}
+/** The current code for a base32 key (what the authenticator app shows): for tests and scripts of your own. */
+export function totpCode(secret, at = new Date()) {
+    return totp(base32Decode(secret), at.getTime());
+}
+//# sourceMappingURL=totp.js.map

package/dist/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../src/totp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAEpD,yEAAyE;AACzE,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,GAAG,IAAI,QAAQ,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC;QAAE,GAAG,IAAI,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,iBAAiB,CAAC,CAAC;QAC1D,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;QAC7B,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;YACvC,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,IAAI,CAAC,MAAkB,EAAE,OAAe,EAAE,MAAM,GAAG,CAAC;IAClE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC;IACrE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAE9B,sCAAsC;AACtC,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,GAAG,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,IAAI,CAAC,MAAkB,EAAE,GAAW,EAAE,MAAM,GAAG,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAAkB,EAAE,IAAY,EAAE,GAAW,EAAE,OAAO,GAA+C,EAAE;IAChI,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IACnC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,KAAK,IAAI,IAAI,GAAG,OAAO,GAAG,MAAM,EAAE,IAAI,IAAI,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACjD,IAAI,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC;IACvJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,MAAkB;IAC5E,MAAM,KAAK,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC1I,OAAO,kBAAkB,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACxD,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,EAAE,GAAS,IAAI,IAAI,EAAE;IAC5D,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;AAClD,CAAC"}

package/package.json

@@ -1,6 +1,57 @@
 {
   "name": "@nest-my-admin/auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "Built-in sign-in for nest-my-admin: admin users, hashed passwords, revocable sessions",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/phantomboy0/nest-my-admin.git",
+    "directory": "packages/auth"
+  },
+  "homepage": "https://github.com/phantomboy0/nest-my-admin#readme",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": ["dist"],
+  "engines": {
+    "node": ">=20.19.0"
+  },
+  "scripts": {
+    "prepack": "cp ../../LICENSE .",
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "peerDependencies": {
+    "@nest-my-admin/core": "0.2.0",
+    "@nestjs/common": "^11.0.0 || ^12.0.0",
+    "@nestjs/core": "^11.0.0 || ^12.0.0",
+    "@nestjs/typeorm": "^11.0.0 || ^12.0.0",
+    "typeorm": "^0.3.20 || ^1.0.0"
+  },
+  "devDependencies": {
+    "@nest-my-admin/core": "0.2.0",
+    "@nestjs/common": "12.1.1",
+    "@nestjs/core": "12.1.1",
+    "@nestjs/platform-express": "12.1.1",
+    "@nestjs/testing": "12.1.1",
+    "@nestjs/typeorm": "12.0.2",
+    "@types/supertest": "7.2.1",
+    "class-transformer": "0.5.1",
+    "class-validator": "0.15.1",
+    "mysql2": "3.24.5",
+    "pg": "8.23.0",
+    "reflect-metadata": "0.2.2",
+    "rxjs": "7.8.2",
+    "sql.js": "1.14.2",
+    "supertest": "7.3.0",
+    "typeorm": "1.1.1"
+  }
+}