@opensyber/tokenforge 0.1.1 → 1.0.0

package/dist/server/totp.js

@@ -1,114 +0,0 @@
-export const TOTP_MAX_ATTEMPTS = 5;
-export const TOTP_LOCKOUT_WINDOW_SECONDS = 300; // 5 min — matches the OWASP ASVS V6.2.6 guidance
-export class TotpLockedOutError extends Error {
-    retryAfterSeconds;
-    constructor(retryAfterSeconds) {
-        super(`Too many failed TOTP attempts; locked out for ${retryAfterSeconds}s`);
-        this.retryAfterSeconds = retryAfterSeconds;
-        this.name = 'TotpLockedOutError';
-    }
-}
-/**
- * TOTP verification (RFC 6238) using HMAC-SHA1.
- * Time step: 30 seconds, window: +/-1 step tolerance.
- *
- * Rate-limiting: when `options.rateLimiter` is provided, the user is
- * locked out for TOTP_LOCKOUT_WINDOW_SECONDS after TOTP_MAX_ATTEMPTS
- * failures. A TotpLockedOutError is thrown while locked so callers can
- * return a distinct 429 to the client instead of a generic "invalid
- * code". A successful verification resets the counter immediately.
- *
- * @param code - The 6-digit TOTP code from the user.
- * @param userId - User whose TOTP secret to look up.
- * @param options - Server options; must include `getTotpSecret` callback.
- * @returns True if the code is valid for the current or adjacent time window.
- * @throws TotpLockedOutError if the user is currently locked out.
- */
-export async function verifyTotp(code, userId, options) {
-    if (!options.getTotpSecret)
-        return false;
-    const limiter = options.rateLimiter;
-    if (limiter) {
-        const attempts = await limiter.getFailedAttempts(userId);
-        if (attempts >= TOTP_MAX_ATTEMPTS) {
-            throw new TotpLockedOutError(TOTP_LOCKOUT_WINDOW_SECONDS);
-        }
-    }
-    const secret = await options.getTotpSecret(userId);
-    if (!secret) {
-        if (limiter)
-            await limiter.recordFailedAttempt(userId, TOTP_LOCKOUT_WINDOW_SECONDS);
-        return false;
-    }
-    const now = Math.floor(Date.now() / 1000);
-    const timeStep = 30;
-    // Check current window and ±1 step for clock skew tolerance
-    for (const offset of [-1, 0, 1]) {
-        const counter = Math.floor((now + offset * timeStep) / timeStep);
-        const expected = await generateTotp(secret, counter);
-        if (timingSafeEqual(code, expected)) {
-            if (limiter)
-                await limiter.resetFailedAttempts(userId);
-            return true;
-        }
-    }
-    if (limiter)
-        await limiter.recordFailedAttempt(userId, TOTP_LOCKOUT_WINDOW_SECONDS);
-    return false;
-}
-/**
- * Generate a TOTP code for a given counter value.
- * Uses HMAC-SHA1 per RFC 4226, with 6-digit output.
- * @param secretBase32 - Base32-encoded shared secret.
- * @param counter - HMAC counter value (typically `floor(time / 30)`).
- * @returns A 6-digit zero-padded TOTP code.
- */
-export async function generateTotp(secretBase32, counter) {
-    const keyBytes = base32Decode(secretBase32);
-    const counterBytes = new ArrayBuffer(8);
-    const view = new DataView(counterBytes);
-    view.setBigUint64(0, BigInt(counter));
-    const key = await crypto.subtle.importKey('raw', keyBytes.buffer, { name: 'HMAC', hash: 'SHA-1' }, false, ['sign']);
-    const hmac = await crypto.subtle.sign('HMAC', key, counterBytes);
-    const hmacArray = new Uint8Array(hmac);
-    // Dynamic truncation (RFC 4226 section 5.3)
-    const offset = hmacArray[hmacArray.length - 1] & 0x0f;
-    const binary = ((hmacArray[offset] & 0x7f) << 24) |
-        ((hmacArray[offset + 1] & 0xff) << 16) |
-        ((hmacArray[offset + 2] & 0xff) << 8) |
-        (hmacArray[offset + 3] & 0xff);
-    return (binary % 1000000).toString().padStart(6, '0');
-}
-/** Decode a base32-encoded string (RFC 4648, no padding required) */
-function base32Decode(input) {
-    const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
-    const clean = input.replace(/[= ]/g, '').toUpperCase();
-    const bits = [];
-    for (const char of clean) {
-        const val = alphabet.indexOf(char);
-        if (val === -1)
-            continue;
-        for (let i = 4; i >= 0; i--) {
-            bits.push((val >> i) & 1);
-        }
-    }
-    const bytes = new Uint8Array(Math.floor(bits.length / 8));
-    for (let i = 0; i < bytes.length; i++) {
-        let byte = 0;
-        for (let j = 0; j < 8; j++) {
-            byte = (byte << 1) | (bits[i * 8 + j] ?? 0);
-        }
-        bytes[i] = byte;
-    }
-    return bytes;
-}
-/** Constant-time string comparison to prevent timing attacks */
-function timingSafeEqual(a, b) {
-    const maxLen = Math.max(a.length, b.length);
-    let result = a.length ^ b.length; // length mismatch contributes to failure
-    for (let i = 0; i < maxLen; i++) {
-        result |= (a.charCodeAt(i) || 0) ^ (b.charCodeAt(i) || 0);
-    }
-    return result === 0;
-}
-//# sourceMappingURL=totp.js.map

package/dist/server/totp.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../src/server/totp.ts"],"names":[],"mappings":"AAoBA,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC,CAAC,iDAAiD;AAEjG,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACtB;IAArB,YAAqB,iBAAyB;QAC5C,KAAK,CAAC,iDAAiD,iBAAiB,GAAG,CAAC,CAAC;QAD1D,sBAAiB,GAAjB,iBAAiB,CAAQ;QAE5C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,MAAc,EACd,OAGC;IAED,IAAI,CAAC,OAAO,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IAEzC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IACpC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,QAAQ,IAAI,iBAAiB,EAAE,CAAC;YAClC,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;QACpF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,EAAE,CAAC;IAEpB,4DAA4D;IAC5D,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,MAAM,GAAG,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpC,IAAI,OAAO;gBAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,OAAO;QAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IACpF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,YAAoB,EAAE,OAAe;IACtE,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC;IACxC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAEtC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EAAE,QAAQ,CAAC,MAAqB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CACxF,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAEvC,4CAA4C;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC;IACvD,MAAM,MAAM,GACV,CAAC,CAAC,SAAS,CAAC,MAAM,CAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACvC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,CAAC;IAElC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,qEAAqE;AACrE,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,QAAQ,GAAG,kCAAkC,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,SAAS;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gEAAgE;AAChE,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,yCAAyC;IAC3E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC"}