@openora/core 0.4.1-canary.140 → 0.4.1-canary.141

package/dist/pam/identity/service/identity.service.d.ts

@@ -2,7 +2,8 @@ import { type EventBus, type NodeHeaders, DrizzleService } from '@openora/core/s
 import type { SessionService } from './session.service.js';
 import type { TrustedDeviceService } from './trusted-device.service.js';
 import type { TwoFactorLockoutService } from './two-factor-lockout.service.js';
-import type { CacheAdapter, RateLimiterAdapter, RateLimitKey, MailDispatchPort, LoginInput, RegisterInput, Enable2faInput, Verify2faInput, Disable2faInput, RegenerateBackupCodesInput, TrustCurrentDeviceInput, RequestPasswordResetInput, VerifyPasswordResetOtpInput, ResetPasswordInput, ResendEmailVerificationInput, VerifyEmailInput, UpdateProfileInput, User, IdentityReader, ChangePasswordInput, ChangeEmailInput, IdentityServiceOptions, PlatformConfig, ClientMeta, GeoCheckCommands, PlayerProvisioning, SecurityControls, SetLoginWithdrawalAlertsInput } from '@openora/core/contracts';
+import { type TwoFactorDeliveryService } from './two-factor-delivery.service.js';
+import type { CacheAdapter, RateLimiterAdapter, RateLimitKey, MailDispatchPort, LoginInput, RegisterInput, Enable2faInput, Enable2faResult, Verify2faInput, TwoFactorStatus, Disable2faInput, RegenerateBackupCodesInput, TrustCurrentDeviceInput, RequestPasswordResetInput, VerifyPasswordResetOtpInput, ResetPasswordInput, ResendEmailVerificationInput, VerifyEmailInput, UpdateProfileInput, User, IdentityReader, ChangePasswordInput, ChangeEmailInput, IdentityServiceOptions, PlatformConfig, ClientMeta, GeoCheckCommands, PlayerProvisioning, SecurityControls, SetLoginWithdrawalAlertsInput } from '@openora/core/contracts';
 export declare const UserNotFoundError: new (id: string) => Error & {
     data?: Record<string, string>;
 };
@@ -23,6 +24,7 @@ export type IdentityServiceDeps = {
     cache?: CacheAdapter;
     trustedDevices?: TrustedDeviceService;
     twoFactorLockout?: TwoFactorLockoutService;
+    twoFactorDelivery: TwoFactorDeliveryService;
     sessions?: SessionService;
 };
 /**
@@ -49,8 +51,9 @@ export declare class IdentityService {
     private readonly existingAccountSignUps;
     private readonly trustedDevices?;
     private readonly twoFactorLockout?;
+    private readonly twoFactorDelivery;
     private readonly sessions?;
-    constructor({ drizzle, events, identityReader, mailDispatch, options, limiter, platformConfig, geoCheck, playerProvisioning, cache, trustedDevices, twoFactorLockout, sessions, }: IdentityServiceDeps);
+    constructor({ drizzle, events, identityReader, mailDispatch, options, limiter, platformConfig, geoCheck, playerProvisioning, cache, trustedDevices, twoFactorLockout, twoFactorDelivery, sessions, }: IdentityServiceDeps);
     private findUserByEmail;
     private get api();
     private forwardCookies;
@@ -90,6 +93,7 @@ export declare class IdentityService {
      * read a stale count and slip past the lockout threshold.
      */
     login(input: LoginInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
+        twoFactorMethod?: "email" | "app" | "sms" | undefined;
         twoFactorRedirect: boolean;
         user?: undefined;
         session?: undefined;
@@ -127,7 +131,6 @@ export declare class IdentityService {
             attemptsRemaining: number;
             lockoutUntil: string | null;
         };
-        twoFactorRedirect?: undefined;
     }>;
     private clearLockout;
     private resetLockoutTier;
@@ -156,10 +159,47 @@ export declare class IdentityService {
         createdAt: string;
         updatedAt: string;
     } | null>;
-    enableTwoFactor(input: Enable2faInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
-        totpUri: string;
-        backupCodes: string[];
+    /**
+     * Starts enrolment. All three methods share the one secret better-auth mints here;
+     * `method` only decides how the code that activates it arrives, and is written
+     * before the send so the delivery hook knows where to route. better-auth flips
+     * `twoFactorEnabled` only once the first code clears, so abandoning a first
+     * enrolment leaves the account unprotected exactly as it was.
+     *
+     * A transport failure on the first send throws (see `sendOtpForCurrentMethod`)
+     * after `two_factor_method` is already written, but that write is inert on its
+     * own: `twoFactorStatus` reports it only once `enabled` is true, and the CONFLICT
+     * guard below only fires once it is. The caller recovers by retrying either
+     * `sendTwoFactorOtp` (resend) or this route again - both read the method that was
+     * already persisted, so neither loses the player's choice.
+     */
+    enableTwoFactor(input: Enable2faInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<Enable2faResult>;
+    /**
+     * Re-sends the one-time code for an account on the `email` or `sms` method - the
+     * "Resend code" action during enrolment, and the send leg of a login challenge.
+     * Resolves its subject from a live session first and the pending-challenge cookie
+     * second, because at login there is no session yet.
+     */
+    sendTwoFactorOtp(reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
+        maskedDestination: string;
     }>;
+    /** Whether a second factor is active, which method it uses, and where a code can go. */
+    twoFactorStatus(reqHeaders: NodeHeaders): Promise<TwoFactorStatus>;
+    /**
+     * Rejects a method the account cannot actually receive a code on. Enrolling into
+     * `sms` without a verified phone would mint a secret the player can never clear,
+     * locking them out of their own account at the next login.
+     */
+    private assertMethodAvailable;
+    /**
+     * The account's delivery method, defaulting to `app`: an enrolment that predates the
+     * column reads as null, and every one of those was an authenticator.
+     */
+    private resolveTwoFactorMethod;
+    private isTwoFactorEnabled;
+    private setTwoFactorMethod;
+    private verifyChallengeCode;
+    private sendOtpForCurrentMethod;
     verifyTwoFactor(input: Verify2faInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
         success: true;
     }>;

package/dist/pam/identity/service/identity.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/identity.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,cAAc,EAQf,MAAM,sBAAsB,CAAC;AAM9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,cAAc,EACd,cAAc,EACd,eAAe,EACf,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,2BAA2B,EAC3B,kBAAkB,EAClB,4BAA4B,EAC5B,gBAAgB,EAChB,kBAAkB,EAElB,IAAI,EACJ,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,UAAU,EAEV,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,6BAA6B,EAC9B,MAAM,yBAAyB,CAAC;AAyJjC,eAAO,MAAM,iBAAiB;QAvM5B,CAAA;CAuMwD,CAAC;AAC3D,eAAO,MAAM,qBAAqB;QAxMhC,CAAA;CAwM8F,CAAC;AA+CjG,eAAO,MAAM,2BAA2B,QAAoB,CAAC;AAkF7D,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,cAAc,EAAE,cAAc,CAAC;IAC/B,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,OAAO,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAG3C,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAmB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAyB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAiB;IACjD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAe;IAMtC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAqB;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAuB;IACvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAA0B;IAC5D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAiB;gBAE/B,EACV,OAAO,EACP,MAAM,EACN,cAAc,EACd,YAAY,EACZ,OAAO,EACP,OAAO,EACP,cAAc,EACd,QAAQ,EACR,kBAAkB,EAClB,KAAK,EACL,cAAc,EACd,gBAAgB,EAChB,QAAQ,GACT,EAAE,mBAAmB;YAgER,eAAe;IAS7B,OAAO,KAAK,GAAG,GAId;IAED,OAAO,CAAC,cAAc;YAOR,aAAa;YAKb,mBAAmB;IASjC,OAAO,CAAC,uBAAuB;IAU/B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAcxB,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW;;;YAiH9C,oBAAoB;YASpB,iBAAiB;IAS/B;;;;OAIG;YACW,yBAAyB;IAoCjC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW;;;IAUjE;;;;;;;;;;;OAWG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAgV3E,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,gBAAgB;YAaV,cAAc;YAYd,cAAc;IAW5B,OAAO,CAAC,2BAA2B;YAIrB,oBAAoB;IAiB5B,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAuCpF,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAiCrE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAmBnD,EAAE,CAAC,UAAU,EAAE,WAAW;;;;;;;;;;;;IAS1B,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;IAmBnF,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAyEzF;;;;;OAKG;IACG,kBAAkB,CACtB,KAAK,EAAE,uBAAuB,EAC9B,UAAU,EAAE,WAAW,EACvB,UAAU,EAAE,OAAO;;;IA4ErB;;;;;OAKG;YACW,uBAAuB;IAmB/B,qBAAqB,CACzB,KAAK,EAAE,0BAA0B,EACjC,UAAU,EAAE,WAAW,EACvB,UAAU,EAAE,OAAO;;;IAqCf,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAqCrF,oBAAoB,CAAC,KAAK,EAAE,yBAAyB;;;IAsBrD,sBAAsB,CAAC,KAAK,EAAE,2BAA2B;;;IAgBzD,aAAa,CAAC,KAAK,EAAE,kBAAkB;;;IAqBvC,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAwBvF,mBAAmB,CAAC,UAAU,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAQvE,wBAAwB,CAC5B,KAAK,EAAE,6BAA6B,EACpC,UAAU,EAAE,WAAW,GACtB,OAAO,CAAC,gBAAgB,CAAC;IAmD5B;;;;;;OAMG;IACG,qBAAqB,CAAC,KAAK,EAAE,4BAA4B,EAAE,UAAU,EAAE,WAAW;;;IAsBxF;;;;;;OAMG;IACG,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAwFjF,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IA4CjF,aAAa,CAAC,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;CAgC5F"}
+{"version":3,"file":"identity.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/identity.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,cAAc,EAQf,MAAM,sBAAsB,CAAC;AAM9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,cAAc,EACd,eAAe,EACf,cAAc,EAGd,eAAe,EACf,eAAe,EACf,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,2BAA2B,EAC3B,kBAAkB,EAClB,4BAA4B,EAC5B,gBAAgB,EAChB,kBAAkB,EAElB,IAAI,EACJ,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,UAAU,EAEV,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,6BAA6B,EAC9B,MAAM,yBAAyB,CAAC;AA+JjC,eAAO,MAAM,iBAAiB;QAtN5B,CAAA;CAsNwD,CAAC;AAC3D,eAAO,MAAM,qBAAqB;QAvNhC,CAAA;CAuN8F,CAAC;AA+CjG,eAAO,MAAM,2BAA2B,QAAoB,CAAC;AA0F7D,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,cAAc,EAAE,cAAc,CAAC;IAC/B,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,OAAO,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAI3C,iBAAiB,EAAE,wBAAwB,CAAC;IAG5C,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAmB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAyB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAiB;IACjD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAe;IAMtC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAqB;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAuB;IACvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAA0B;IAC5D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;IAC7D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAiB;gBAE/B,EACV,OAAO,EACP,MAAM,EACN,cAAc,EACd,YAAY,EACZ,OAAO,EACP,OAAO,EACP,cAAc,EACd,QAAQ,EACR,kBAAkB,EAClB,KAAK,EACL,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,QAAQ,GACT,EAAE,mBAAmB;YAoER,eAAe;IAS7B,OAAO,KAAK,GAAG,GAId;IAED,OAAO,CAAC,cAAc;YAOR,aAAa;YAKb,mBAAmB;IASjC,OAAO,CAAC,uBAAuB;IAU/B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAcxB,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW;;;YAiH9C,oBAAoB;YASpB,iBAAiB;IAS/B;;;;OAIG;YACW,yBAAyB;IAoCjC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW;;;IAUjE;;;;;;;;;;;OAWG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAwV3E,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,gBAAgB;YAaV,cAAc;YAYd,cAAc;IAW5B,OAAO,CAAC,2BAA2B;YAIrB,oBAAoB;IAiB5B,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAuCpF,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAiCrE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAmBnD,EAAE,CAAC,UAAU,EAAE,WAAW;;;;;;;;;;;;IAShC;;;;;;;;;;;;;OAaG;IACG,eAAe,CACnB,KAAK,EAAE,cAAc,EACrB,UAAU,EAAE,WAAW,EACvB,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC,eAAe,CAAC;IA8C3B;;;;;OAKG;IACG,gBAAgB,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAgBnE,wFAAwF;IAClF,eAAe,CAAC,UAAU,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;IA+BxE;;;;OAIG;YACW,qBAAqB;IAgCnC;;;OAGG;YACW,sBAAsB;YAStB,kBAAkB;YASlB,kBAAkB;IAOhC,OAAO,CAAC,mBAAmB;YAQb,uBAAuB;IA4B/B,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAuEzF;;;;;OAKG;IACG,kBAAkB,CACtB,KAAK,EAAE,uBAAuB,EAC9B,UAAU,EAAE,WAAW,EACvB,UAAU,EAAE,OAAO;;;IAqFrB;;;;;OAKG;YACW,uBAAuB;IAmB/B,qBAAqB,CACzB,KAAK,EAAE,0BAA0B,EACjC,UAAU,EAAE,WAAW,EACvB,UAAU,EAAE,OAAO;;;IAqCf,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IA0CrF,oBAAoB,CAAC,KAAK,EAAE,yBAAyB;;;IAsBrD,sBAAsB,CAAC,KAAK,EAAE,2BAA2B;;;IAgBzD,aAAa,CAAC,KAAK,EAAE,kBAAkB;;;IAqBvC,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAwBvF,mBAAmB,CAAC,UAAU,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAQvE,wBAAwB,CAC5B,KAAK,EAAE,6BAA6B,EACpC,UAAU,EAAE,WAAW,GACtB,OAAO,CAAC,gBAAgB,CAAC;IAmD5B;;;;;;OAMG;IACG,qBAAqB,CAAC,KAAK,EAAE,4BAA4B,EAAE,UAAU,EAAE,WAAW;;;IAsBxF;;;;;;OAMG;IACG,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAwFjF,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IA4CjF,aAAa,CAAC,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;CAgC5F"}

package/dist/pam/identity/service/identity.service.js

@@ -6,11 +6,13 @@ import { and, eq, isNull, sql } from 'drizzle-orm';
 import * as z from 'zod';
 import { user, session, account, verification, twoFactor } from '../schema/index.js';
 import { captureTimezone } from './capture-timezone.service.js';
+import { maskEmail, maskPhone, } from './two-factor-delivery.service.js';
 import { RATE_LIMIT_KEYS, makeRateLimitKey } from '@openora/core/contracts';
 import { assertSupportedLanguage } from '../../shared/language.js';
 import { assertAccountNotBlocked } from './rg-guard.service.js';
 import { DEFAULT_LOCKOUT_DURATION_MS, DEFAULT_MAX_LOGIN_ATTEMPTS, computeLockoutTier, createAccountLockedError, hasFailedLoginWindowExpired, makeLoginSecurityState, } from './lockout-policy.service.js';
 import { getSecurityControls } from './security-controls.service.js';
+import { resolveChallengeMethod, verifyChallengeCode } from './two-factor-challenge.service.js';
 function nodeHeadersToHeaders(nodeHeaders) {
     const headers = new Headers();
     for (const [key, value] of Object.entries(nodeHeaders)) {
@@ -188,6 +190,14 @@ const VERIFY_EMAIL_RATE_LIMIT = {
 };
 const CHANGE_PASSWORD_RATE_LIMIT = { limit: 5, windowMs: 15 * MINUTE_MS };
 const TWO_FACTOR_PASSWORD_RATE_LIMIT = { limit: 5, windowMs: 5 * MINUTE_MS };
+// Fails closed: every call spends real money on an `sms` enrolment and fills a mailbox
+// on an `email` one, and better-auth issues a fresh code per send, so an unbounded
+// resend loop is both a toll-fraud channel and an unbounded guess budget.
+const SEND_2FA_OTP_RATE_LIMIT = {
+    limit: 3,
+    windowMs: 5 * MINUTE_MS,
+    onUnavailable: 'deny',
+};
 const FAKE_LOGIN_SHADOW_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 function loginShadowKey(email) {
     return `login-shadow:${email}`;
@@ -234,8 +244,9 @@ export class IdentityService {
     existingAccountSignUps = new Set();
     trustedDevices;
     twoFactorLockout;
+    twoFactorDelivery;
     sessions;
-    constructor({ drizzle, events, identityReader, mailDispatch, options, limiter, platformConfig, geoCheck, playerProvisioning, cache, trustedDevices, twoFactorLockout, sessions, }) {
+    constructor({ drizzle, events, identityReader, mailDispatch, options, limiter, platformConfig, geoCheck, playerProvisioning, cache, trustedDevices, twoFactorLockout, twoFactorDelivery, sessions, }) {
         this.drizzle = drizzle;
         this.events = events;
         this.identityReader = identityReader;
@@ -248,6 +259,7 @@ export class IdentityService {
         this.cache = cache;
         this.trustedDevices = trustedDevices;
         this.twoFactorLockout = twoFactorLockout;
+        this.twoFactorDelivery = twoFactorDelivery;
         this.sessions = sessions;
         this.auth = createAuth({
             db: drizzle.db,
@@ -265,6 +277,9 @@ export class IdentityService {
                     },
                 }
                 : {}),
+            // Binds the plugin's OTP hook to the transport fan-out. Without it better-auth
+            // still mints codes for the `email`/`sms` methods and drops them on the floor.
+            twoFactor: { sendOtp: (args) => twoFactorDelivery.deliver(args) },
             requireEmailVerification: this.platformConfig?.registration?.requireEmailVerification ?? false,
             isExistingAccountSignUp: (lookupEmail) => this.existingAccountSignUps.has(lookupEmail.toLowerCase()),
             isAdminPasswordReset: (lookupEmail) => this.isAdminPasswordReset(lookupEmail),
@@ -613,7 +628,15 @@ export class IdentityService {
             this.forwardCookies(authResponse, resHeaders);
             const body = (await authResponse.json());
             if (body.twoFactorRedirect || !body.user || !body.token) {
-                return { twoFactorRedirect: true };
+                // The challenge screen has to know whether to ask for an authenticator code or
+                // to push one, and there is no session yet to read the account's method from.
+                // Naming it here reveals nothing the challenge would not show anyway.
+                return {
+                    twoFactorRedirect: true,
+                    ...(existingUser
+                        ? { twoFactorMethod: await this.resolveTwoFactorMethod(existingUser.id) }
+                        : {}),
+                };
             }
             if (lockoutEnabled && existingUser) {
                 await this.clearLockout(existingUser.id);
@@ -945,10 +968,39 @@ export class IdentityService {
         }
         return toUser(session.user);
     }
+    /**
+     * Starts enrolment. All three methods share the one secret better-auth mints here;
+     * `method` only decides how the code that activates it arrives, and is written
+     * before the send so the delivery hook knows where to route. better-auth flips
+     * `twoFactorEnabled` only once the first code clears, so abandoning a first
+     * enrolment leaves the account unprotected exactly as it was.
+     *
+     * A transport failure on the first send throws (see `sendOtpForCurrentMethod`)
+     * after `two_factor_method` is already written, but that write is inert on its
+     * own: `twoFactorStatus` reports it only once `enabled` is true, and the CONFLICT
+     * guard below only fires once it is. The caller recovers by retrying either
+     * `sendTwoFactorOtp` (resend) or this route again - both read the method that was
+     * already persisted, so neither loses the player's choice.
+     */
     async enableTwoFactor(input, reqHeaders, resHeaders) {
         const headers = nodeHeadersToHeaders(reqHeaders);
         const userId = await this.currentUserId(headers);
         await assertRateLimit(this.limiter, `enable2fa:${userId ?? 'anonymous'}`, TWO_FACTOR_PASSWORD_RATE_LIMIT);
+        if (!userId) {
+            throw new ORPCError('UNAUTHORIZED', { message: 'Not signed in' });
+        }
+        await this.assertMethodAvailable(userId, input.method);
+        // There is no switch-in-place: a player changes method by disabling and enrolling
+        // again. better-auth's enable leg deletes and recreates the `twoFactor` row with a
+        // fresh secret and fresh backup codes, and marks it verified straight away when one
+        // was already verified - so re-running it on a live account destroys the working
+        // authenticator the moment the call lands, and abandoning the step strands the
+        // player on a secret they never scanned with `two_factor_enabled` still true.
+        if (await this.isTwoFactorEnabled(userId)) {
+            throw new ORPCError('CONFLICT', {
+                message: 'Two-factor authentication is already enabled. Disable it first to change method.',
+            });
+        }
         const res = await this.api.enableTwoFactor({
             body: { password: input.password },
             headers,
@@ -957,7 +1009,148 @@ export class IdentityService {
         await ensureOk(res);
         this.forwardCookies(res, resHeaders);
         const body = (await res.json());
-        return { totpUri: body.totpURI, backupCodes: body.backupCodes };
+        await this.setTwoFactorMethod(userId, input.method);
+        if (input.method === 'app') {
+            return { totpUri: body.totpURI, backupCodes: body.backupCodes };
+        }
+        // The first code has to reach the player before they can activate the method, so
+        // the send belongs to enrolment rather than a separate call the client must know
+        // to make. "Resend code" then replays it through sendTwoFactorOtp.
+        const masked = await this.sendOtpForCurrentMethod(userId, headers, resHeaders);
+        return { backupCodes: body.backupCodes, maskedDestination: masked };
+    }
+    /**
+     * Re-sends the one-time code for an account on the `email` or `sms` method - the
+     * "Resend code" action during enrolment, and the send leg of a login challenge.
+     * Resolves its subject from a live session first and the pending-challenge cookie
+     * second, because at login there is no session yet.
+     */
+    async sendTwoFactorOtp(reqHeaders, resHeaders) {
+        const headers = nodeHeadersToHeaders(reqHeaders);
+        const pendingCookie = twoFactorPendingCookieValue(headers);
+        const userId = (await this.currentUserId(headers)) ??
+            (await this.twoFactorLockout?.resolvePendingUserId(pendingCookie));
+        if (!userId) {
+            throw new ORPCError('UNAUTHORIZED', { message: 'Not signed in' });
+        }
+        await assertRateLimit(this.limiter, `send2faOtp:${userId}`, SEND_2FA_OTP_RATE_LIMIT);
+        // An account inside a lockout window cannot spend a code, so minting one only
+        // hands out fresh guesses - and, on `sms`, bills the operator for them.
+        await this.twoFactorLockout?.assertNotLocked(userId);
+        return { maskedDestination: await this.sendOtpForCurrentMethod(userId, headers, resHeaders) };
+    }
+    /** Whether a second factor is active, which method it uses, and where a code can go. */
+    async twoFactorStatus(reqHeaders) {
+        const headers = nodeHeadersToHeaders(reqHeaders);
+        const userId = await this.currentUserId(headers);
+        if (!userId) {
+            throw new ORPCError('UNAUTHORIZED', { message: 'Not signed in' });
+        }
+        const [row] = await this.drizzle.db
+            .select({
+            email: user.email,
+            phoneNumber: user.phoneNumber,
+            phoneVerified: user.phoneVerified,
+            twoFactorEnabled: user.twoFactorEnabled,
+            twoFactorMethod: user.twoFactorMethod,
+        })
+            .from(user)
+            .where(eq(user.id, userId))
+            .limit(1);
+        if (!row) {
+            throw new UserNotFoundError(userId);
+        }
+        const enabled = row.twoFactorEnabled ?? false;
+        return {
+            enabled,
+            // The column outlives an abandoned enrolment, so an account that never cleared
+            // its first code must still read as having no active method.
+            method: enabled ? (row.twoFactorMethod ?? null) : null,
+            maskedEmail: maskEmail(row.email),
+            maskedPhone: row.phoneVerified && row.phoneNumber ? maskPhone(row.phoneNumber) : null,
+        };
+    }
+    /**
+     * Rejects a method the account cannot actually receive a code on. Enrolling into
+     * `sms` without a verified phone would mint a secret the player can never clear,
+     * locking them out of their own account at the next login.
+     */
+    async assertMethodAvailable(userId, method) {
+        if (method === 'app') {
+            return;
+        }
+        const [row] = await this.drizzle.db
+            .select({
+            emailVerified: user.emailVerified,
+            phoneNumber: user.phoneNumber,
+            phoneVerified: user.phoneVerified,
+        })
+            .from(user)
+            .where(eq(user.id, userId))
+            .limit(1);
+        // A code can only guard the account if the address it goes to is one the account
+        // has proven it holds. `registration.requireEmailVerification` is off by default,
+        // so an unverified or mistyped address would otherwise enrol and lock the player
+        // out at the next login - the same failure the phone check already prevents.
+        if (method === 'email' && !row?.emailVerified) {
+            throw new ORPCError('BAD_REQUEST', {
+                message: 'Verify your email address before using email for two-factor authentication',
+            });
+        }
+        if (method === 'sms' && (!row?.phoneNumber || !row.phoneVerified)) {
+            throw new ORPCError('BAD_REQUEST', {
+                message: 'Add and verify a phone number before using SMS for two-factor authentication',
+            });
+        }
+    }
+    /**
+     * The account's delivery method, defaulting to `app`: an enrolment that predates the
+     * column reads as null, and every one of those was an authenticator.
+     */
+    async resolveTwoFactorMethod(userId) {
+        const [row] = await this.drizzle.db
+            .select({ twoFactorMethod: user.twoFactorMethod })
+            .from(user)
+            .where(eq(user.id, userId))
+            .limit(1);
+        return row?.twoFactorMethod ?? 'app';
+    }
+    async isTwoFactorEnabled(userId) {
+        const [row] = await this.drizzle.db
+            .select({ twoFactorEnabled: user.twoFactorEnabled })
+            .from(user)
+            .where(eq(user.id, userId))
+            .limit(1);
+        return row?.twoFactorEnabled ?? false;
+    }
+    async setTwoFactorMethod(userId, method) {
+        await this.drizzle.db.update(user).set({ twoFactorMethod: method }).where(eq(user.id, userId));
+    }
+    verifyChallengeCode(method, body, headers) {
+        return verifyChallengeCode(this.api, method, body, headers);
+    }
+    async sendOtpForCurrentMethod(userId, headers, resHeaders) {
+        const destination = await this.twoFactorDelivery.describeDestination(userId);
+        if (!destination) {
+            throw new ORPCError('BAD_REQUEST', {
+                message: 'This account does not receive two-factor codes by email or SMS',
+            });
+        }
+        const res = await this.api.sendTwoFactorOTP({ body: {}, headers, asResponse: true });
+        await ensureOk(res);
+        // A 200 here means the code was minted, not that it left the building: the send
+        // hook is wrapped in `.catch(logger.error)` upstream. Telling the player a code is
+        // on its way when the transport just failed strands them on a screen waiting for
+        // something that is never coming.
+        const failure = this.twoFactorDelivery.takeFailure(userId);
+        if (failure) {
+            throw new ORPCError('SERVICE_UNAVAILABLE', {
+                message: 'Could not send your verification code. Please try again.',
+                cause: failure,
+            });
+        }
+        this.forwardCookies(res, resHeaders);
+        return destination.masked;
     }
     async verifyTwoFactor(input, reqHeaders, resHeaders) {
         const { ip, userAgent } = extractClientMeta(reqHeaders);
@@ -971,12 +1164,11 @@ export class IdentityService {
             await this.twoFactorLockout?.assertNotLocked(challengedUserId);
         }
         // A backup code is a single-use recovery credential, not a second factor to bind a
-        // browser to: it clears the challenge but never buys the trust window.
-        const trustDevice = input.trustDevice && input.method === 'totp' && this.trustedDevices !== undefined;
+        // browser to: it clears the challenge but never buys the trust window. A pushed
+        // `otp` is a real factor and does, the same as a live authenticator code.
+        const trustDevice = input.trustDevice && input.method !== 'backup_code' && this.trustedDevices !== undefined;
         const body = { code: input.code, trustDevice };
-        const res = input.method === 'backup_code'
-            ? await this.api.verifyBackupCode({ body, headers, asResponse: true })
-            : await this.api.verifyTOTP({ body, headers, asResponse: true });
+        const res = await this.verifyChallengeCode(input.method, body, headers);
         if (!res.ok && challengedUserId) {
             await this.twoFactorLockout?.recordFailure(challengedUserId, { ip, userAgent });
         }
@@ -1065,13 +1257,18 @@ export class IdentityService {
         const challengeHeaders = new Headers(headers);
         challengeHeaders.set('cookie', requestCookieHeader(signIn));
         await this.twoFactorLockout?.assertNotLocked(userId);
-        // Only a live authenticator earns the trust window - a backup code is a recovery
-        // credential and the schema never lets one reach this route.
-        const verified = await this.api.verifyTOTP({
-            body: { code: input.code, trustDevice: true },
-            headers: challengeHeaders,
-            asResponse: true,
-        });
+        // Authenticator accounts only. This route replays a fresh sign-in leg, and
+        // better-auth keys a pushed code by the pending-challenge cookie that leg mints -
+        // so an `email`/`sms` account has no code that can answer this challenge, and
+        // letting the call through would only spend its lockout budget on a credential it
+        // is impossible to present. Refusing says so instead of failing as a wrong code.
+        const challengeMethod = await resolveChallengeMethod(this.drizzle, userId);
+        if (challengeMethod !== 'totp') {
+            throw new ORPCError('CONFLICT', {
+                message: 'Trusting this device requires an authenticator app.',
+            });
+        }
+        const verified = await this.verifyChallengeCode(challengeMethod, { code: input.code, trustDevice: true }, challengeHeaders);
         if (!verified.ok) {
             await this.twoFactorLockout?.recordFailure(userId, { ip, userAgent });
         }
@@ -1083,7 +1280,7 @@ export class IdentityService {
         this.events.emit('identity.2fa.verified', {
             userId,
             playerId,
-            method: 'totp',
+            method: challengeMethod,
             trustedDevice: true,
             ip,
             userAgent,
@@ -1108,11 +1305,7 @@ export class IdentityService {
      */
     async assertFreshSecondFactor(userId, headers, meta, code) {
         await this.twoFactorLockout?.assertNotLocked(userId);
-        const res = await this.api.verifyTOTP({
-            body: { code, trustDevice: false },
-            headers,
-            asResponse: true,
-        });
+        const res = await this.verifyChallengeCode(await resolveChallengeMethod(this.drizzle, userId), { code, trustDevice: false }, headers);
         if (!res.ok) {
             await this.twoFactorLockout?.recordFailure(userId, meta);
         }
@@ -1156,6 +1349,9 @@ export class IdentityService {
             throw new ORPCError('UNAUTHORIZED', { message: 'Not signed in' });
         }
         await this.assertFreshSecondFactor(userId, headers, { ip, userAgent }, input.code);
+        // Read before the teardown clears it, so the audit trail records which method the
+        // account was actually protected by rather than a blank.
+        const disabledMethod = await resolveChallengeMethod(this.drizzle, userId);
         const res = await this.api.disableTwoFactor({
             body: { password: input.password },
             headers,
@@ -1163,6 +1359,7 @@ export class IdentityService {
         });
         await ensureOk(res);
         this.forwardCookies(res, resHeaders);
+        await this.setTwoFactorMethod(userId, null);
         // Dropping the second factor takes every standing bypass with it, the same teardown
         // a Super Admin reset performs - a browser must not keep the access 2FA was guarding.
         await this.trustedDevices?.revokeAllForUser(userId, userId);
@@ -1170,7 +1367,7 @@ export class IdentityService {
         this.events.emit('identity.2fa.disabled', {
             userId,
             playerId: await this.identityReader.getPlayerIdByUserIdSafe(userId),
-            method: 'totp',
+            method: disabledMethod,
             ip,
             userAgent,
         });