@oneuptime/common 12.0.21 → 12.0.22

package/build/dist/Server/Services/UserTwoFactorBackupCodeService.js

@@ -0,0 +1,327 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/UserTwoFactorBackupCode";
+import TwoFactorBackupCode, { BackupCodeSetSize, } from "../Utils/TwoFactorBackupCode";
+import QueryHelper from "../Types/Database/QueryHelper";
+import BadDataException from "../../Types/Exception/BadDataException";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import SortOrder from "../../Types/BaseDatabase/SortOrder";
+import OneUptimeDate from "../../Types/Date";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import logger from "../Utils/Logger";
+export class Service extends DatabaseService {
+    constructor() {
+        super(Model);
+    }
+    /*
+     * The model denies create to everyone, so the only way a row is written is
+     * `regenerateForUser` below, as root. This hook is the second lock on the
+     * same door: it refuses any create that did not come through there.
+     *
+     * Worth having both because the two guards fail differently. The table
+     * permission is enforced by the CRUD API layer and is bypassed wholesale by
+     * `isRoot`, which every internal caller uses -- so a future service that
+     * reaches for `UserTwoFactorBackupCodeService.create()` with a plaintext
+     * code, or with no owner, would sail past it. What lands in `codeHash` is
+     * the credential; there is no recovering from writing the wrong thing there.
+     */
+    async onBeforeCreate(createBy) {
+        if (!createBy.data.userId) {
+            throw new BadDataException("User id is required");
+        }
+        if (!createBy.data.codeHash) {
+            throw new BadDataException("Backup code hash is required");
+        }
+        /*
+         * A code that arrives already spent is a caller confusing itself about
+         * which end of the lifecycle it is at. Codes are minted usable and are
+         * spent only by `consumeCode`.
+         *
+         * Deleted rather than set to undefined: `exactOptionalPropertyTypes` is on,
+         * so the property being ABSENT and the property holding `undefined` are
+         * different things to the compiler, and only the first is allowed here.
+         */
+        delete createBy.data.usedAt;
+        return {
+            createBy: createBy,
+            carryForward: {},
+        };
+    }
+    /**
+     * Mint a fresh set of backup codes for one user, replacing whatever they
+     * had, and return the PLAINTEXT codes.
+     *
+     * This is the only moment the plaintext exists anywhere. The caller shows it
+     * to the user once and then it is gone -- only the keyed digests are stored,
+     * so nothing (not this service, not a master admin, not a database dump) can
+     * produce the codes again. That is the property the feature is worth having
+     * for, and it is why the API route wraps this in a response the UI is
+     * expected to make the user acknowledge.
+     *
+     * REPLACING rather than adding is deliberate. "Generate more codes" would
+     * leave the codes from a list the user printed, lost and then regenerated
+     * over still working, which defeats the point of regenerating after a
+     * suspected compromise.
+     *
+     * ALL OR NOTHING, and this is the part that needs care. The old set is
+     * deleted first, then the new rows are written one at a time -- so a failure
+     * partway through the loop would otherwise leave the account holding a few
+     * rows that WERE written and that the caller, having thrown, never showed to
+     * anybody. `getStatusForUser` would then report "4 backup codes" to a user
+     * who has never seen one of them: codes that are unusable in practice and
+     * that hide the fact that they have no recovery route left. That is the
+     * worst state this feature can produce, because it looks exactly like the
+     * good one.
+     *
+     * So a failure is compensated: everything written for this user is removed,
+     * and the account ends with NO codes and an error on screen. "You have no
+     * backup codes" is a state the profile page already tells the user to fix;
+     * "you have four codes you have never seen" is not.
+     *
+     * The compensating delete is itself best-effort -- if it also fails there is
+     * nothing further to try -- but it turns a silent, permanent trap into two
+     * consecutive infrastructure failures.
+     */
+    async regenerateForUser(data) {
+        const count = data.count || BackupCodeSetSize;
+        await this.deleteAllForUser({ userId: data.userId });
+        const codes = TwoFactorBackupCode.generateCodeSet(count);
+        try {
+            for (const code of codes) {
+                const backupCode = new Model();
+                backupCode.userId = data.userId;
+                backupCode.codeHash = TwoFactorBackupCode.hashCode({
+                    code: code,
+                    userId: data.userId,
+                });
+                await this.create({
+                    data: backupCode,
+                    props: {
+                        isRoot: true,
+                    },
+                });
+            }
+        }
+        catch (err) {
+            try {
+                await this.deleteAllForUser({ userId: data.userId });
+            }
+            catch (cleanupError) {
+                /*
+                 * Swallowed so the ORIGINAL failure is what the caller sees. The
+                 * cleanup error is the less useful of the two -- it explains why the
+                 * rollback did not happen, not why the write did not.
+                 */
+                logger.error(cleanupError);
+            }
+            throw err;
+        }
+        return codes;
+    }
+    /**
+     * Spend one of this user's backup codes, if the submitted code is one of
+     * them and has not been used already.
+     *
+     * ONE STATEMENT, ON PURPOSE
+     *
+     * The obvious shape -- find the row, check `usedAt`, then update it -- has a
+     * window between the read and the write, and "single use" is the entire
+     * guarantee a backup code offers. Two sign-in attempts carrying the same
+     * code that arrive together would both read a null `usedAt` and both be let
+     * in, which is precisely the property an attacker who has watched somebody
+     * type a code off a printed list would exploit.
+     *
+     * `usedAt IS NULL` in the WHERE clause moves the decision inside Postgres,
+     * where the row lock settles it: the first statement to reach the row
+     * updates it, the second matches nothing. `RETURNING "_id"` is what turns
+     * that into an answer for the caller -- an UPDATE that matched no rows and
+     * an UPDATE that matched one are otherwise indistinguishable from here.
+     *
+     * Written as raw parameterized SQL rather than through the ORM because no
+     * write path on DatabaseService both takes a non-primary-key predicate and
+     * reports what it matched. Column and table names are literals in this file,
+     * never caller input, and all three values are bound parameters.
+     *
+     * `deletedAt IS NULL` is included because soft-deleted rows are still
+     * physically present; without it, a code from a set that regeneration
+     * replaced would still sign somebody in.
+     *
+     * @returns true when a code was spent, false when the code was wrong,
+     *          already used, or belongs to somebody else.
+     */
+    async consumeCode(data) {
+        const normalizedCode = TwoFactorBackupCode.normalizeCode(data.code);
+        /*
+         * Refused before the query rather than hashed and looked up. An empty
+         * submission cannot be anybody's code, and letting it through would mean
+         * one round trip per empty request on a route an attacker can call.
+         */
+        if (!normalizedCode) {
+            return false;
+        }
+        const codeHash = TwoFactorBackupCode.hashCode({
+            code: normalizedCode,
+            userId: data.userId,
+        });
+        const rows = await this.getRepository()
+            .manager.query(`UPDATE "UserTwoFactorBackupCode"
+            SET "usedAt" = $1, "updatedAt" = CURRENT_TIMESTAMP
+          WHERE "userId" = $2
+            AND "codeHash" = $3
+            AND "usedAt" IS NULL
+            AND "deletedAt" IS NULL
+      RETURNING "_id"`, [OneUptimeDate.getCurrentDate(), data.userId.toString(), codeHash])
+            /*
+             * For an UPDATE the postgres driver hands back `[rows, rowCount]` rather
+             * than a bare row array, so the rows have to be unwrapped. Written
+             * defensively: a driver that returns the bare array instead must read as
+             * "no code was spent", never as a silent success.
+             */
+            .then((result) => {
+            if (!Array.isArray(result)) {
+                return [];
+            }
+            const first = result[0];
+            return Array.isArray(first) ? first : [];
+        });
+        return rows.length > 0;
+    }
+    /**
+     * How many codes this user has, and how many are still spendable.
+     *
+     * Counted rather than fetched: the rows carry a credential digest and there
+     * is no caller that needs them, so nothing is loaded that a stray log line
+     * could then print.
+     */
+    async getStatusForUser(data) {
+        const total = await this.countBy({
+            query: {
+                userId: data.userId,
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        if (total.toNumber() === 0) {
+            return {
+                total: 0,
+                unused: 0,
+                generatedAt: null,
+            };
+        }
+        const unused = await this.countUnusedForUser({
+            userId: data.userId,
+        });
+        const newest = await this.findOneBy({
+            query: {
+                userId: data.userId,
+            },
+            select: {
+                createdAt: true,
+            },
+            sort: {
+                createdAt: SortOrder.Descending,
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        return {
+            total: total.toNumber(),
+            unused: unused,
+            generatedAt: (newest === null || newest === void 0 ? void 0 : newest.createdAt) || null,
+        };
+    }
+    /**
+     * How many unused codes this user has left.
+     *
+     * Split out from `getStatusForUser` because the login path needs exactly
+     * this number and nothing else: it decides whether the two factor challenge
+     * screen offers "use a backup code" at all, and it is answered on every
+     * two-factor sign-in.
+     *
+     * `usedAt: QueryHelper.isNull()` rather than `usedAt: null`. A bare null
+     * predicate is dropped by TypeORM rather than compiled to `IS NULL`, so the
+     * count would silently include spent codes and the login page would offer a
+     * recovery route to a user with nothing left to recover with.
+     */
+    async countUnusedForUser(data) {
+        const unused = await this.countBy({
+            query: {
+                userId: data.userId,
+                usedAt: QueryHelper.isNull(),
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        return unused.toNumber();
+    }
+    /**
+     * Drop every backup code this user has.
+     *
+     * Called by regeneration, and by UserService.resetTwoFactorAuth -- an
+     * operator resetting two factor auth for somebody who lost a device must
+     * take the recovery codes with it. Leaving them behind would mean the reset
+     * did not actually revoke the account's second-factor material, which is the
+     * one thing the operator pressed the button to do.
+     */
+    async deleteAllForUser(data) {
+        await this.deleteBy({
+            query: {
+                userId: data.userId,
+            },
+            limit: LIMIT_MAX,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+    }
+}
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeCreate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "regenerateForUser", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "consumeCode", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "getStatusForUser", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "countUnusedForUser", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "deleteAllForUser", null);
+export default new Service();
+//# sourceMappingURL=UserTwoFactorBackupCodeService.js.map

package/build/dist/Server/Services/UserTwoFactorBackupCodeService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserTwoFactorBackupCodeService.js","sourceRoot":"","sources":["../../../../Server/Services/UserTwoFactorBackupCodeService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,qDAAqD,CAAC;AACxE,OAAO,mBAAmB,EAAE,EAC1B,iBAAiB,GAClB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,WAAW,MAAM,+BAA+B,CAAC;AACxD,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,SAAS,MAAM,+BAA+B,CAAC;AACtD,OAAO,SAAS,MAAM,oCAAoC,CAAC;AAG3D,OAAO,aAAa,MAAM,kBAAkB,CAAC;AAC7C,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,MAAM,MAAM,iBAAiB,CAAC;AAyBrC,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAED;;;;;;;;;;;OAWG;IAEsB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CAAC,8BAA8B,CAAC,CAAC;QAC7D,CAAC;QAED;;;;;;;;WAQG;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAE5B,OAAO;YACL,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,EAAE;SACjB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IAEU,AAAN,KAAK,CAAC,iBAAiB,CAAC,IAG9B;QACC,MAAM,KAAK,GAAW,IAAI,CAAC,KAAK,IAAI,iBAAiB,CAAC;QAEtD,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAErD,MAAM,KAAK,GAAkB,mBAAmB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,UAAU,GAAU,IAAI,KAAK,EAAE,CAAC;gBACtC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAChC,UAAU,CAAC,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC;oBACjD,IAAI,EAAE,IAAI;oBACV,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC,CAAC;gBAEH,MAAM,IAAI,CAAC,MAAM,CAAC;oBAChB,IAAI,EAAE,UAAU;oBAChB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,YAAY,EAAE,CAAC;gBACtB;;;;mBAIG;gBACH,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC7B,CAAC;YAED,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IAEU,AAAN,KAAK,CAAC,WAAW,CAAC,IAGxB;QACC,MAAM,cAAc,GAAW,mBAAmB,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE5E;;;;WAIG;QACH,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAW,mBAAmB,CAAC,QAAQ,CAAC;YACpD,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,MAAM,IAAI,GAA2B,MAAM,IAAI,CAAC,aAAa,EAAE;aAC5D,OAAO,CAAC,KAAK,CACZ;;;;;;sBAMc,EACd,CAAC,aAAa,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CACnE;YACD;;;;;eAKG;aACF,IAAI,CAAC,CAAC,MAAe,EAA0B,EAAE;YAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,MAAM,KAAK,GAAY,MAAM,CAAC,CAAC,CAAC,CAAC;YAEjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;QAEL,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IAEU,AAAN,KAAK,CAAC,gBAAgB,CAAC,IAE7B;QACC,MAAM,KAAK,GAAmB,MAAM,IAAI,CAAC,OAAO,CAAC;YAC/C,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,WAAW,EAAE,IAAI;aAClB,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAW,MAAM,IAAI,CAAC,kBAAkB,CAAC;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;YAChD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB;YACD,MAAM,EAAE;gBACN,SAAS,EAAE,IAAI;aAChB;YACD,IAAI,EAAE;gBACJ,SAAS,EAAE,SAAS,CAAC,UAAU;aAChC;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE;YACvB,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,KAAI,IAAI;SACvC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IAEU,AAAN,KAAK,CAAC,kBAAkB,CAAC,IAA0B;QACxD,MAAM,MAAM,GAAmB,MAAM,IAAI,CAAC,OAAO,CAAC;YAChD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE;aAC7B;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,gBAAgB,CAAC,IAA0B;QACtD,MAAM,IAAI,CAAC,QAAQ,CAAC;YAClB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB;YACD,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAtS0B;IADxB,WAAW,EAAE;;;;6CA2Bb;AAsCY;IADZ,WAAW,EAAE;;;;gDA2Cb;AAkCY;IADZ,WAAW,EAAE;;;;0CAiDb;AAUY;IADZ,WAAW,EAAE;;;;+CA6Cb;AAgBY;IADZ,WAAW,EAAE;;;;iDAab;AAYY;IADZ,WAAW,EAAE;;;;+CAYb;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}

package/build/dist/Server/Utils/TwoFactorBackupCode.js

@@ -0,0 +1,269 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { EncryptionSecret } from "../EnvironmentConfig";
+import CaptureSpan from "./Telemetry/CaptureSpan";
+import crypto from "crypto";
+/*
+ * Single-use recovery codes for an account whose second factor is gone --
+ * the phone that held the authenticator app, or the security key that is now
+ * in a taxi somewhere.
+ *
+ * WHY THIS IS SERVER-ONLY
+ *
+ * Nothing in this file falls back to Math.random. Common/Utils/UUID does, on
+ * purpose, because it is bundled into the dashboard and has to keep producing
+ * well-formed ids in a browser with no Web Crypto -- which is exactly why
+ * ObjectID.generate() must never mint a code here. A backup code is a
+ * password-equivalent credential; if the platform cannot produce secure
+ * randomness, generation must throw rather than quietly emit something
+ * predictable. Common/Server/Utils/VerificationCode.ts makes the same call for
+ * the same reason.
+ *
+ * THE CODE SPACE
+ *
+ * Ten characters drawn uniformly from a 32 symbol alphabet is 2^50 codes, and
+ * a user holds ten of them at once -- so a blind guess lands with probability
+ * ~10/2^50, about one in 10^14. That is far beyond anything the rate limiter
+ * needs to defend, which matters because it settles the design question a TOTP
+ * code cannot settle: the six digit space is small enough that the limiter IS
+ * the control, whereas here the code itself is.
+ *
+ * THE HASH
+ *
+ * Codes are stored as HMAC-SHA256 keyed by the instance's EncryptionSecret,
+ * never in the clear, and the fast keyed-digest lane is the RIGHT one here
+ * rather than scrypt. scrypt exists to make guessing a low-entropy,
+ * human-chosen secret expensive; a code minted above has no low-entropy
+ * structure to guess, so the cost would buy nothing and would be paid on every
+ * verification. Keying with the EncryptionSecret is what a bare SHA-256 would
+ * miss: it lives in configuration rather than in Postgres, so a database dump
+ * on its own cannot be run through a dictionary of every possible code.
+ *
+ * The digest is deterministic given (userId, code), which is deliberate and is
+ * what makes single-use consumption a single conditional UPDATE rather than a
+ * read of every one of the user's rows followed by a comparison of each. A
+ * per-row salt would forfeit that for no gain -- see the note on domain
+ * separation below for the property it would have been bought for, which the
+ * userId already provides.
+ */
+/**
+ * Crockford's Base32 alphabet: the digits and the uppercase letters, minus
+ * I, L, O and U.
+ *
+ * These codes get read off a screen and typed back in months later, possibly
+ * from a piece of paper in a drawer, so the alphabet is chosen for the eye
+ * rather than for density. I/1, L/1 and O/0 are the pairs people transcribe
+ * wrongly; U is dropped by Crockford so that no code can spell an obscenity
+ * at a user who did nothing to deserve one.
+ *
+ * Exactly 32 symbols, so each character carries a clean five bits and the
+ * entropy arithmetic in the header comment is exact rather than approximate.
+ */
+export const BackupCodeAlphabet = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+/** Characters per code. Ten symbols over a 32 symbol alphabet is 2^50. */
+export const BackupCodeLength = 10;
+/**
+ * How many codes a user is issued at once.
+ *
+ * Ten is enough that losing a phone does not become an emergency after the
+ * second sign-in, and small enough that the printed list is one short block a
+ * person will actually keep.
+ */
+export const BackupCodeSetSize = 10;
+/** Characters per group in the displayed form, e.g. `AB3D5-9XZQ2`. */
+const DISPLAY_GROUP_LENGTH = 5;
+/*
+ * Prefixed into every digest so a stored hash is bound to the scheme that
+ * produced it. If the construction below ever has to change, old rows keep
+ * verifying under the version they were written with instead of silently
+ * failing to match and locking a user out of their own recovery codes.
+ */
+const HASH_SCHEME_VERSION = "v1";
+/*
+ * Characters a person plausibly types in place of a symbol that is not in the
+ * alphabet. Applied before the strip below, so `O` becomes `0` rather than
+ * being deleted -- deleting it would shorten the code and guarantee a
+ * mismatch, which is the confusing failure this map exists to avoid.
+ */
+const AMBIGUOUS_CHARACTER_MAP = {
+    I: "1",
+    L: "1",
+    O: "0",
+};
+export default class TwoFactorBackupCode {
+    /**
+     * One code, drawn uniformly from the alphabet above.
+     *
+     * `crypto.randomInt` per character rather than `randomBytes(n) % 32`. The
+     * modulo version happens to be uniform for this alphabet only because 32
+     * divides 256, and it stops being uniform the moment somebody edits the
+     * alphabet -- silently, with no test that would notice. `randomInt` rejects
+     * out-of-range draws internally for whatever bound it is given, so the
+     * uniformity does not depend on a coincidence nobody wrote down.
+     */
+    static generateCode() {
+        let code = "";
+        for (let index = 0; index < BackupCodeLength; index++) {
+            code += BackupCodeAlphabet.charAt(crypto.randomInt(0, BackupCodeAlphabet.length));
+        }
+        return code;
+    }
+    /**
+     * A full set of distinct codes.
+     *
+     * Duplicates are not a security problem -- at 2^50 the birthday odds across
+     * ten draws are around 4e-14 -- but a duplicate WOULD be a correctness
+     * problem downstream: two rows sharing a digest means consuming one leaves a
+     * second, identical, still-valid code behind, so a "single-use" code would
+     * work twice. Cheaper to rule out here than to reason about there.
+     */
+    static generateCodeSet(count = BackupCodeSetSize) {
+        const codes = new Set();
+        while (codes.size < count) {
+            codes.add(TwoFactorBackupCode.generateCode());
+        }
+        return Array.from(codes);
+    }
+    /**
+     * The form shown to the user: one hyphen in the middle, for the same reason
+     * the alphabet drops ambiguous letters -- a ten character run is hard to
+     * read back without losing your place.
+     *
+     * Purely cosmetic. `normalizeCode` strips the hyphen straight back out, so
+     * a user may type the code with it, without it, or with the spaces their
+     * password manager pasted in.
+     */
+    static formatForDisplay(code) {
+        const groups = [];
+        for (let index = 0; index < code.length; index += DISPLAY_GROUP_LENGTH) {
+            groups.push(code.substring(index, index + DISPLAY_GROUP_LENGTH));
+        }
+        return groups.join("-");
+    }
+    /**
+     * Reduce whatever the user typed to the canonical form the digest is
+     * computed over.
+     *
+     * Everything here is about not rejecting somebody who supplied exactly the
+     * right secret material: the display hyphen, the spaces a clipboard adds,
+     * lowercase from a phone keyboard, and the three transcription confusions
+     * the alphabet was chosen to make survivable. Anything still outside the
+     * alphabet after that is dropped rather than rejected -- this is a
+     * canonicaliser, not a validator; the digest comparison is what decides
+     * whether a code is real.
+     *
+     * @param rawCode - The code exactly as submitted.
+     * @returns The code reduced to alphabet symbols, uppercase.
+     */
+    static normalizeCode(rawCode) {
+        /*
+         * The code arrives straight off a JSON body, so it is only a string
+         * because the client chose to send one. A number or an object here must
+         * fail verification, not throw out of `.toUpperCase` and surface as a 500.
+         */
+        if (typeof rawCode !== "string" || !rawCode) {
+            return "";
+        }
+        let normalized = "";
+        for (const character of rawCode.toUpperCase()) {
+            const mapped = AMBIGUOUS_CHARACTER_MAP[character] || character;
+            if (BackupCodeAlphabet.includes(mapped)) {
+                normalized += mapped;
+            }
+        }
+        return normalized;
+    }
+    /**
+     * The digest stored for one of `userId`'s codes.
+     *
+     * Domain separated by the owning user, which is what stops one precomputed
+     * table from inverting every account's codes at once and stops two users who
+     * happen to be issued the same code from being visibly linked by a matching
+     * row. The user id is known at verification time -- the password has already
+     * been accepted by then -- so binding to it costs nothing.
+     *
+     * Both parts are LENGTH-PREFIXED into the message rather than merely
+     * concatenated, so no pair of (userId, code) values can be rearranged into
+     * the same byte string as another pair. Concatenation alone is a real
+     * ambiguity, not a theoretical one: without prefixes, ("ab", "cd") and
+     * ("abc", "d") hash identically.
+     */
+    static hashCode(data) {
+        const message = [
+            HASH_SCHEME_VERSION,
+            data.userId.toString(),
+            TwoFactorBackupCode.normalizeCode(data.code),
+        ]
+            .map((part) => {
+            return `${part.length}:${part}`;
+        })
+            .join("");
+        return crypto
+            .createHmac("sha256", EncryptionSecret.toString())
+            .update(message)
+            .digest("hex");
+    }
+    /**
+     * Compare two digests without leaking, through timing, how many leading
+     * characters matched.
+     *
+     * The consume path compares digests in Postgres rather than here, so this is
+     * for callers that already hold both -- but it exists so that nobody writing
+     * one reaches for `===` and hands an attacker a way to recover a stored hash
+     * one character at a time.
+     *
+     * Lengths are compared first because `crypto.timingSafeEqual` THROWS on a
+     * length mismatch. Digests here are always 64 hex characters, so an early
+     * exit only happens on malformed input, where the length is not the secret.
+     */
+    static isHashEqual(a, b) {
+        if (!a || !b || a.length !== b.length) {
+            return false;
+        }
+        return crypto.timingSafeEqual(Buffer.from(a, "utf8"), Buffer.from(b, "utf8"));
+    }
+}
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", String)
+], TwoFactorBackupCode, "generateCode", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Number]),
+    __metadata("design:returntype", Array)
+], TwoFactorBackupCode, "generateCodeSet", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", String)
+], TwoFactorBackupCode, "formatForDisplay", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", String)
+], TwoFactorBackupCode, "normalizeCode", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", String)
+], TwoFactorBackupCode, "hashCode", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String]),
+    __metadata("design:returntype", Boolean)
+], TwoFactorBackupCode, "isHashEqual", null);
+//# sourceMappingURL=TwoFactorBackupCode.js.map

package/build/dist/Server/Utils/TwoFactorBackupCode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TwoFactorBackupCode.js","sourceRoot":"","sources":["../../../../Server/Utils/TwoFactorBackupCode.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAClD,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAW,kCAAkC,CAAC;AAE7E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAW,EAAE,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAW,EAAE,CAAC;AAE5C,sEAAsE;AACtE,MAAM,oBAAoB,GAAW,CAAC,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,mBAAmB,GAAW,IAAI,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,uBAAuB,GAA2B;IACtD,CAAC,EAAE,GAAG;IACN,CAAC,EAAE,GAAG;IACN,CAAC,EAAE,GAAG;CACP,CAAC;AAEF,MAAM,CAAC,OAAO,OAAO,mBAAmB;IACtC;;;;;;;;;OASG;IAEW,AAAP,MAAM,CAAC,YAAY;QACxB,IAAI,IAAI,GAAW,EAAE,CAAC;QAEtB,KAAK,IAAI,KAAK,GAAW,CAAC,EAAE,KAAK,GAAG,gBAAgB,EAAE,KAAK,EAAE,EAAE,CAAC;YAC9D,IAAI,IAAI,kBAAkB,CAAC,MAAM,CAC/B,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAC/C,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IAEW,AAAP,MAAM,CAAC,eAAe,CAC3B,QAAgB,iBAAiB;QAEjC,MAAM,KAAK,GAAgB,IAAI,GAAG,EAAU,CAAC;QAE7C,OAAO,KAAK,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;YAC1B,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,YAAY,EAAE,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;;OAQG;IAEW,AAAP,MAAM,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,MAAM,GAAkB,EAAE,CAAC;QAEjC,KACE,IAAI,KAAK,GAAW,CAAC,EACrB,KAAK,GAAG,IAAI,CAAC,MAAM,EACnB,KAAK,IAAI,oBAAoB,EAC7B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,oBAAoB,CAAC,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;;;;;OAcG;IAEW,AAAP,MAAM,CAAC,aAAa,CAAC,OAAe;QACzC;;;;WAIG;QACH,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,UAAU,GAAW,EAAE,CAAC;QAE5B,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAW,uBAAuB,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;YAEvE,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxC,UAAU,IAAI,MAAM,CAAC;YACvB,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;;;;OAcG;IAEW,AAAP,MAAM,CAAC,QAAQ,CAAC,IAAwC;QAC7D,MAAM,OAAO,GAAW;YACtB,mBAAmB;YACnB,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;YACtB,mBAAmB,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;SAC7C;aACE,GAAG,CAAC,CAAC,IAAY,EAAE,EAAE;YACpB,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QAClC,CAAC,CAAC;aACD,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ,OAAO,MAAM;aACV,UAAU,CAAC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,EAAE,CAAC;aACjD,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;OAYG;IAEW,AAAP,MAAM,CAAC,WAAW,CAAC,CAAS,EAAE,CAAS;QAC5C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,EACtB,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CACvB,CAAC;IACJ,CAAC;CACF;AA1Je;IADb,WAAW,EAAE;;;;6CAWb;AAYa;IADb,WAAW,EAAE;;;oCAGX,KAAK;gDAQP;AAYa;IADb,WAAW,EAAE;;;;iDAab;AAkBa;IADb,WAAW,EAAE;;;;8CAsBb;AAkBa;IADb,WAAW,EAAE;;;;yCAgBb;AAgBa;IADb,WAAW,EAAE;;;;4CAUb"}

package/build/dist/Types/Email/EmailTemplateType.js

@@ -11,6 +11,8 @@ var EmailTemplateType;
     EmailTemplateType["ConfirmStatusPageSubscription"] = "ConfirmStatusPageSubscription.hbs";
     EmailTemplateType["EmailVerified"] = "EmailVerified.hbs";
     EmailTemplateType["PasswordChanged"] = "PasswordChanged.hbs";
+    EmailTemplateType["TwoFactorBackupCodeUsed"] = "TwoFactorBackupCodeUsed.hbs";
+    EmailTemplateType["TwoFactorBackupCodesRegenerated"] = "TwoFactorBackupCodesRegenerated.hbs";
     EmailTemplateType["ProbeOwnerAdded"] = "ProbeOwnerAdded.hbs";
     EmailTemplateType["InviteMember"] = "InviteMember.hbs";
     EmailTemplateType["EmailChanged"] = "EmailChanged.hbs";

package/build/dist/Types/Email/EmailTemplateType.js.map

@@ -1 +1 @@
-{"version":3,"file":"EmailTemplateType.js","sourceRoot":"","sources":["../../../../Types/Email/EmailTemplateType.ts"],"names":[],"mappings":"AAAA,IAAK,iBAgGJ;AAhGD,WAAK,iBAAiB;IACpB,wDAAmC,CAAA;IACnC,0DAAqC,CAAA;IACrC,sDAAiC,CAAA;IACjC,kEAA6C,CAAA;IAC7C,sEAAiD,CAAA;IACjD,oFAA+D,CAAA;IAC/D,wFAAmE,CAAA;IACnE,gEAA2C,CAAA;IAC3C,wFAAmE,CAAA;IACnE,wDAAmC,CAAA;IACnC,4DAAuC,CAAA;IACvC,4DAAuC,CAAA;IACvC,sDAAiC,CAAA;IACjC,sDAAiC,CAAA;IACjC,0EAAqD,CAAA;IACrD,wFAAmE,CAAA;IACnE,gFAA2D,CAAA;IAC3D,oGAA+E,CAAA;IAC/E,kFAA6D,CAAA;IAC7D,wFAAmE,CAAA;IACnE,0FAAqE,CAAA;IACrE,kHAA6F,CAAA;IAC7F,0HAAqG,CAAA;IACrG,4HAAuG,CAAA;IACvG,8EAAyD,CAAA;IACzD,gFAA2D,CAAA;IAC3D,0EAAqD,CAAA;IACrD,0HAAqG,CAAA;IACrG,8CAAyB,CAAA;IACzB,gEAA2C,CAAA;IAC3C,oFAA+D,CAAA;IAC/D,oEAA+C,CAAA;IAC/C,gFAA2D,CAAA;IAE3D,wEAAmD,CAAA;IAEnD,kEAA6C,CAAA;IAC7C,gFAA2D,CAAA;IAC3D,4EAAuD,CAAA;IACvD,sFAAiE,CAAA;IACjE,oEAA+C,CAAA;IAC/C,4FAAuE,CAAA;IAEvE,4DAAuC,CAAA;IACvC,0EAAqD,CAAA;IACrD,sEAAiD,CAAA;IACjD,gFAA2D,CAAA;IAC3D,sFAAiE,CAAA;IAEjE,0EAAqD,CAAA;IACrD,wFAAmE,CAAA;IACnE,oFAA+D,CAAA;IAC/D,8FAAyE,CAAA;IACzE,oFAA+D,CAAA;IAE/D,gFAA2D,CAAA;IAC3D,8FAAyE,CAAA;IACzE,0FAAqE,CAAA;IACrE,oGAA+E,CAAA;IAC/E,gGAA2E,CAAA;IAE3E,8EAAyD,CAAA;IACzD,wFAAmE,CAAA;IACnE,sFAAiE,CAAA;IAEjE,oGAA+E,CAAA;IAC/E,0FAAqE,CAAA;IACrE,wGAAmF,CAAA;IACnF,8GAAyF,CAAA;IACzF,oHAA+F,CAAA;IAC/F,0FAAqE,CAAA;IACrE,sEAAiD,CAAA;IACjD,gGAA2E,CAAA;IAC3E,wDAAmC,CAAA;IACnC,8DAAyC,CAAA;IACzC,oEAA+C,CAAA;IAC/C,8DAAyC,CAAA;IACzC,4EAAuD,CAAA;IACvD,kFAA6D,CAAA;IAE7D,4EAAuD,CAAA;IACvD,oFAA+D,CAAA;IAC/D,oFAA+D,CAAA;IAC/D,0EAAqD,CAAA;IACrD,8FAAyE,CAAA;IAEzE,kFAA6D,CAAA;IAC7D,4CAAuB,CAAA;IAEvB,gFAA2D,CAAA;IAC3D,kEAA6C,CAAA;IAC7C,wEAAmD,CAAA;IAEnD,8FAAyE,CAAA;IACzE,4FAAuE,CAAA;AACzE,CAAC,EAhGI,iBAAiB,KAAjB,iBAAiB,QAgGrB;AAED,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"EmailTemplateType.js","sourceRoot":"","sources":["../../../../Types/Email/EmailTemplateType.ts"],"names":[],"mappings":"AAAA,IAAK,iBAkGJ;AAlGD,WAAK,iBAAiB;IACpB,wDAAmC,CAAA;IACnC,0DAAqC,CAAA;IACrC,sDAAiC,CAAA;IACjC,kEAA6C,CAAA;IAC7C,sEAAiD,CAAA;IACjD,oFAA+D,CAAA;IAC/D,wFAAmE,CAAA;IACnE,gEAA2C,CAAA;IAC3C,wFAAmE,CAAA;IACnE,wDAAmC,CAAA;IACnC,4DAAuC,CAAA;IACvC,4EAAuD,CAAA;IACvD,4FAAuE,CAAA;IACvE,4DAAuC,CAAA;IACvC,sDAAiC,CAAA;IACjC,sDAAiC,CAAA;IACjC,0EAAqD,CAAA;IACrD,wFAAmE,CAAA;IACnE,gFAA2D,CAAA;IAC3D,oGAA+E,CAAA;IAC/E,kFAA6D,CAAA;IAC7D,wFAAmE,CAAA;IACnE,0FAAqE,CAAA;IACrE,kHAA6F,CAAA;IAC7F,0HAAqG,CAAA;IACrG,4HAAuG,CAAA;IACvG,8EAAyD,CAAA;IACzD,gFAA2D,CAAA;IAC3D,0EAAqD,CAAA;IACrD,0HAAqG,CAAA;IACrG,8CAAyB,CAAA;IACzB,gEAA2C,CAAA;IAC3C,oFAA+D,CAAA;IAC/D,oEAA+C,CAAA;IAC/C,gFAA2D,CAAA;IAE3D,wEAAmD,CAAA;IAEnD,kEAA6C,CAAA;IAC7C,gFAA2D,CAAA;IAC3D,4EAAuD,CAAA;IACvD,sFAAiE,CAAA;IACjE,oEAA+C,CAAA;IAC/C,4FAAuE,CAAA;IAEvE,4DAAuC,CAAA;IACvC,0EAAqD,CAAA;IACrD,sEAAiD,CAAA;IACjD,gFAA2D,CAAA;IAC3D,sFAAiE,CAAA;IAEjE,0EAAqD,CAAA;IACrD,wFAAmE,CAAA;IACnE,oFAA+D,CAAA;IAC/D,8FAAyE,CAAA;IACzE,oFAA+D,CAAA;IAE/D,gFAA2D,CAAA;IAC3D,8FAAyE,CAAA;IACzE,0FAAqE,CAAA;IACrE,oGAA+E,CAAA;IAC/E,gGAA2E,CAAA;IAE3E,8EAAyD,CAAA;IACzD,wFAAmE,CAAA;IACnE,sFAAiE,CAAA;IAEjE,oGAA+E,CAAA;IAC/E,0FAAqE,CAAA;IACrE,wGAAmF,CAAA;IACnF,8GAAyF,CAAA;IACzF,oHAA+F,CAAA;IAC/F,0FAAqE,CAAA;IACrE,sEAAiD,CAAA;IACjD,gGAA2E,CAAA;IAC3E,wDAAmC,CAAA;IACnC,8DAAyC,CAAA;IACzC,oEAA+C,CAAA;IAC/C,8DAAyC,CAAA;IACzC,4EAAuD,CAAA;IACvD,kFAA6D,CAAA;IAE7D,4EAAuD,CAAA;IACvD,oFAA+D,CAAA;IAC/D,oFAA+D,CAAA;IAC/D,0EAAqD,CAAA;IACrD,8FAAyE,CAAA;IAEzE,kFAA6D,CAAA;IAC7D,4CAAuB,CAAA;IAEvB,gFAA2D,CAAA;IAC3D,kEAA6C,CAAA;IAC7C,wEAAmD,CAAA;IAEnD,8FAAyE,CAAA;IACzE,4FAAuE,CAAA;AACzE,CAAC,EAlGI,iBAAiB,KAAjB,iBAAiB,QAkGrB;AAED,eAAe,iBAAiB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneuptime/common",
-  "version": "12.0.21",
+  "version": "12.0.22",
   "description": "",
   "repository": {
     "type": "git",