@omni2fa/core 0.7.3 → 0.8.1

package/dist/index.js

@@ -52,15 +52,33 @@ const a = {
 function T(t) {
   return S[t] ?? S[a.Unknown];
 }
-const F = "omni2fa:preauth", L = "omni2fa:session", b = "http://omni2fa.local";
-class K {
+const W = "X-Omni2FA-StepUp", F = "omni2fa:preauth", K = "omni2fa:session";
+function b(t) {
+  let e = t;
+  const r = /^[a-zA-Z][a-zA-Z\d+\-.]*:\/\//.exec(e);
+  if (r) {
+    e = e.slice(r[0].length);
+    const l = e.indexOf("/");
+    e = l === -1 ? "/" : e.slice(l);
+  } else if (e.startsWith("//")) {
+    e = e.slice(2);
+    const l = e.indexOf("/");
+    e = l === -1 ? "/" : e.slice(l);
+  }
+  const n = e.indexOf("#");
+  n !== -1 && (e = e.slice(0, n));
+  const o = e.indexOf("?");
+  return o !== -1 && (e = e.slice(0, o)), e.startsWith("/") ? e : `/${e}`;
+}
+class $ {
   storage;
   preAuthKey;
   sessionKey;
   basePath;
   inner;
+  stepUpHandler = null;
   constructor(e) {
-    this.storage = e.storage ?? new _(), this.preAuthKey = e.preAuthStorageKey ?? F, this.sessionKey = e.sessionStorageKey ?? L, this.basePath = new URL(e.baseUrl, b).pathname.replace(/\/$/, ""), this.inner = J({
+    this.storage = e.storage ?? new _(), this.preAuthKey = e.preAuthStorageKey ?? F, this.sessionKey = e.sessionStorageKey ?? K, this.basePath = b(e.baseUrl).replace(/\/$/, ""), this.inner = J({
       baseUrl: e.baseUrl,
       fetch: e.fetch ?? globalThis.fetch.bind(globalThis),
       ...e.credentials ? { credentials: e.credentials } : {}
@@ -75,7 +93,7 @@ class K {
   }
   /** Pre-auth endpoints are exactly the ones mounted under <c>{basePath}/challenge/</c>. */
   isPreAuthEndpoint(e) {
-    const r = new URL(e, b).pathname;
+    const r = b(e);
     return (r.startsWith(this.basePath) ? r.slice(this.basePath.length) : r).startsWith("/challenge/");
   }
   setPreAuthToken(e) {
@@ -90,6 +108,23 @@ class K {
   getSessionToken() {
     return this.storage.get(this.sessionKey);
   }
+  setStepUpHandler(e) {
+    this.stepUpHandler = e;
+  }
+  /**
+   * Run a request and, if it comes back 403 STEP_UP_REQUIRED with a handler registered, confirm 2FA
+   * and retry once with the step-up header. Used by the library's own sensitive endpoints; other calls
+   * invoke openapi-fetch directly.
+   */
+  async sendWithStepUp(e) {
+    const r = await e({});
+    if (r.error !== void 0 && r.response.status === 403 && r.error.code === a.StepUpRequired && this.stepUpHandler !== null) {
+      const n = r.error.details?.availableMethods ?? [], o = await this.stepUpHandler(n);
+      if (o)
+        return e({ [W]: o });
+    }
+    return r;
+  }
   setToken(e, r) {
     r === null || r.length === 0 ? this.storage.remove(e) : this.storage.set(e, r);
   }
@@ -98,11 +133,13 @@ class K {
     return this.toCall(e, r, n);
   }
   async removeMethod(e) {
-    const { error: r, response: n } = await this.inner.DELETE("/methods/{methodId}", { params: { path: { methodId: e } } });
+    const { error: r, response: n } = await this.sendWithStepUp(
+      (o) => this.inner.DELETE("/methods/{methodId}", { params: { path: { methodId: e } }, headers: o })
+    );
     return r ? this.errorCall(r, n) : { ok: !0, value: void 0 };
   }
   async startTotpEnrollment() {
-    const { data: e, error: r, response: n } = await this.inner.POST("/enroll/totp/start");
+    const { data: e, error: r, response: n } = await this.sendWithStepUp((o) => this.inner.POST("/enroll/totp/start", { headers: o }));
     return this.toCall(e, r, n);
   }
   async confirmTotpEnrollment(e) {
@@ -110,7 +147,7 @@ class K {
     return this.toCall(r, n, o);
   }
   async startEmailEnrollment(e) {
-    const { data: r, error: n, response: o } = await this.inner.POST("/enroll/email/start", { body: e });
+    const { data: r, error: n, response: o } = await this.sendWithStepUp((l) => this.inner.POST("/enroll/email/start", { body: e, headers: l }));
     return this.toCall(r, n, o);
   }
   async confirmEmailEnrollment(e) {
@@ -122,7 +159,7 @@ class K {
     return this.toCall(r, n, o);
   }
   async startWebAuthnEnrollment() {
-    const { data: e, error: r, response: n } = await this.inner.POST("/enroll/webauthn/start");
+    const { data: e, error: r, response: n } = await this.sendWithStepUp((o) => this.inner.POST("/enroll/webauthn/start", { headers: o }));
     return this.toCall(e, r, n);
   }
   async confirmWebAuthnEnrollment(e) {
@@ -158,7 +195,7 @@ class K {
     return this.toCall(r, n, o);
   }
   async regenerateRecoveryCodes() {
-    const { data: e, error: r, response: n } = await this.inner.POST("/recovery-codes/regenerate");
+    const { data: e, error: r, response: n } = await this.sendWithStepUp((o) => this.inner.POST("/recovery-codes/regenerate", { headers: o }));
     return this.toCall(e, r, n);
   }
   toCall(e, r, n) {
@@ -180,7 +217,7 @@ class K {
     };
   }
 }
-class te {
+class ne {
   get(e) {
     return globalThis.sessionStorage?.getItem(e) ?? null;
   }
@@ -191,7 +228,7 @@ class te {
     globalThis.sessionStorage?.removeItem(e);
   }
 }
-class ne {
+class oe {
   get(e) {
     return globalThis.localStorage?.getItem(e) ?? null;
   }
@@ -210,7 +247,7 @@ class s extends Error {
     super(r), this.name = "Omni2FaApiError", this.code = e, this.httpStatus = n, this.details = o;
   }
 }
-const W = {
+const L = {
   enrollmentId: null,
   otpAuthUri: null,
   secret: null,
@@ -219,7 +256,7 @@ const W = {
   errorCode: null,
   errorMessage: null
 };
-function $(t) {
+function H(t) {
   return h({
     types: {
       context: {},
@@ -246,7 +283,7 @@ function $(t) {
   }).createMachine({
     id: "totpEnrollment",
     initial: "idle",
-    context: W,
+    context: L,
     states: {
       idle: {
         on: {
@@ -314,7 +351,7 @@ function y({ context: t }) {
 function k(t, e) {
   e instanceof s ? (t.errorCode = e.code, t.errorMessage = e.message) : (t.errorCode = "UNKNOWN", t.errorMessage = e instanceof Error ? e.message : null);
 }
-const H = {
+const V = {
   enrollmentId: null,
   email: null,
   expiresAt: null,
@@ -324,7 +361,7 @@ const H = {
   errorCode: null,
   errorMessage: null
 };
-function V(t) {
+function Y(t) {
   return h({
     types: {
       context: {},
@@ -357,7 +394,7 @@ function V(t) {
   }).createMachine({
     id: "emailEnrollment",
     initial: "idle",
-    context: H,
+    context: V,
     states: {
       idle: {
         on: {
@@ -463,15 +500,15 @@ function d(t) {
     r += String.fromCharCode(n);
   return btoa(r).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-function D(t) {
+function R(t) {
   return (t ?? []).map((e) => ({ ...e, id: m(e.id) }));
 }
-async function Y(t) {
+async function q(t) {
   const e = JSON.parse(t), r = {
     ...e,
     challenge: m(e.challenge),
     user: { ...e.user, id: m(e.user.id) },
-    excludeCredentials: D(e.excludeCredentials)
+    excludeCredentials: R(e.excludeCredentials)
     // Cast through unknown: the spread carries Fido2's index-signature fields the DOM type omits.
   }, n = await navigator.credentials.create({ publicKey: r });
   if (n === null)
@@ -492,7 +529,7 @@ async function P(t) {
   const e = JSON.parse(t), r = {
     ...e,
     challenge: m(e.challenge),
-    allowCredentials: D(e.allowCredentials)
+    allowCredentials: R(e.allowCredentials)
   }, n = await navigator.credentials.get({ publicKey: r });
   if (n === null)
     throw new Error("WebAuthn authentication produced no credential.");
@@ -510,7 +547,7 @@ async function P(t) {
     }
   });
 }
-const q = {
+const z = {
   enrollmentId: null,
   optionsJson: null,
   name: null,
@@ -533,7 +570,7 @@ function B(t) {
         return e.value;
       }),
       registerAndConfirm: i(async ({ input: e }) => {
-        const r = await Y(e.optionsJson), n = await t.confirmWebAuthnEnrollment({
+        const r = await q(e.optionsJson), n = await t.confirmWebAuthnEnrollment({
           enrollmentId: e.enrollmentId,
           attestationResponseJson: r,
           name: e.name
@@ -546,7 +583,7 @@ function B(t) {
   }).createMachine({
     id: "webauthnEnrollment",
     initial: "idle",
-    context: q,
+    context: z,
     states: {
       idle: {
         on: {
@@ -567,7 +604,7 @@ function B(t) {
           },
           onError: {
             target: "failed",
-            actions: ({ context: e, event: r }) => U(e, r.error)
+            actions: ({ context: e, event: r }) => O(e, r.error)
           }
         }
       },
@@ -586,28 +623,28 @@ function B(t) {
           },
           onError: {
             target: "failed",
-            actions: ({ context: e, event: r }) => U(e, r.error)
+            actions: ({ context: e, event: r }) => O(e, r.error)
           }
         }
       },
       enrolled: {
         on: {
-          reset: { target: "idle", actions: O }
+          reset: { target: "idle", actions: U }
         }
       },
       failed: {
         on: {
           retry: { target: "starting" },
-          reset: { target: "idle", actions: O }
+          reset: { target: "idle", actions: U }
         }
       }
     }
   });
 }
-function O({ context: t }) {
+function U({ context: t }) {
   t.enrollmentId = null, t.optionsJson = null, t.name = null, t.methodId = null, t.recoveryCodes = null, t.errorCode = null, t.errorMessage = null;
 }
-function U(t, e) {
+function O(t, e) {
   e instanceof s ? (t.errorCode = e.code, t.errorMessage = e.message) : (t.errorCode = "UNKNOWN", t.errorMessage = e instanceof Error ? e.message : null);
 }
 const G = {
@@ -809,7 +846,7 @@ const j = {
   errorCode: null,
   errorMessage: null
 };
-function z(t) {
+function Z(t) {
   return h({
     types: {
       context: {},
@@ -895,7 +932,7 @@ function Q({ context: t }) {
 function N(t, e) {
   e instanceof s ? (t.errorCode = e.code, t.errorMessage = e.message) : (t.errorCode = "UNKNOWN", t.errorMessage = e instanceof Error ? e.message : null);
 }
-const Z = {
+const x = {
   methodId: null,
   methodType: null,
   stepUpToken: null,
@@ -905,7 +942,7 @@ const Z = {
   errorCode: null,
   errorMessage: null
 };
-function x(t) {
+function ee(t) {
   return h({
     types: {
       context: {},
@@ -940,7 +977,7 @@ function x(t) {
   }).createMachine({
     id: "stepup",
     initial: "idle",
-    context: Z,
+    context: x,
     states: {
       idle: {
         on: {
@@ -983,7 +1020,7 @@ function x(t) {
           },
           onDone: {
             target: "verified",
-            actions: ({ context: e, event: r }) => R(e, r.output.stepUpToken)
+            actions: ({ context: e, event: r }) => D(e, r.output.stepUpToken)
           },
           onError: {
             target: "failed",
@@ -1025,7 +1062,7 @@ function x(t) {
           },
           onDone: {
             target: "verified",
-            actions: ({ context: e, event: r }) => R(e, r.output.stepUpToken)
+            actions: ({ context: e, event: r }) => D(e, r.output.stepUpToken)
           },
           onError: {
             target: "awaitingCode",
@@ -1050,7 +1087,7 @@ function x(t) {
 function I(t, e) {
   t.methodType = e.type, t.expiresAt = e.expiresAt ?? null, t.resendAvailableAt = e.resendAvailableAt ?? null, t.optionsJson = e.optionsJson ?? null, t.errorCode = null, t.errorMessage = null;
 }
-function R(t, e) {
+function D(t, e) {
   t.stepUpToken = e, t.errorCode = null, t.errorMessage = null;
 }
 function A({ context: t }) {
@@ -1059,9 +1096,8 @@ function A({ context: t }) {
 function g(t, e) {
   e instanceof s ? (t.errorCode = e.code, t.errorMessage = e.message) : (t.errorCode = "UNKNOWN", t.errorMessage = e instanceof Error ? e.message : null);
 }
-const oe = "X-Omni2FA-StepUp";
 function se(t) {
-  const e = new K(t), r = u($(e)), n = u(V(e)), o = u(B(e)), l = u(X(e)), p = u(x(e)), f = u(z(e));
+  const e = new $(t), r = u(H(e)), n = u(Y(e)), o = u(B(e)), l = u(X(e)), p = u(ee(e)), f = u(Z(e));
   return r.start(), n.start(), o.start(), l.start(), p.start(), f.start(), {
     client: e,
     totpEnrollment: r,
@@ -1076,22 +1112,22 @@ function se(t) {
   };
 }
 export {
-  ne as LocalStorageStorage,
+  oe as LocalStorageStorage,
   _ as MemoryStorage,
   s as Omni2FaApiError,
-  K as Omni2FaClient,
+  $ as Omni2FaClient,
   a as Omni2FaErrorCodes,
-  oe as STEP_UP_HEADER,
-  te as SessionStorageStorage,
+  W as STEP_UP_HEADER,
+  ne as SessionStorageStorage,
   X as createChallengeMachine,
-  V as createEmailEnrollmentMachine,
-  z as createMethodsMachine,
+  Y as createEmailEnrollmentMachine,
+  Z as createMethodsMachine,
   se as createOmni2Fa,
-  x as createStepUpMachine,
-  $ as createTotpEnrollmentMachine,
+  ee as createStepUpMachine,
+  H as createTotpEnrollmentMachine,
   B as createWebAuthnEnrollmentMachine,
   T as getDefaultMessage,
   P as startAuthentication,
-  Y as startRegistration
+  q as startRegistration
 };
 //# sourceMappingURL=index.js.map