@owlmeans/server-auth-otp 0.1.6

package/build/consts.d.ts

@@ -0,0 +1,4 @@
+export declare const SERVER_AUTH_OTP = "server-auth-otp";
+/** The OTP auth plugin type key — passed as credential.type in init requests */
+export { OTP_AUTH_TYPE, OTP_SERVICE, OTP_RESOURCE, OTP_TTL_SECONDS, OTP_CODE_LENGTH } from '@owlmeans/auth-otp';
+//# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,oBAAoB,CAAA;AAEhD,gFAAgF;AAChF,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA"}

package/build/consts.js

@@ -0,0 +1,4 @@
+export const SERVER_AUTH_OTP = 'server-auth-otp';
+/** The OTP auth plugin type key — passed as credential.type in init requests */
+export { OTP_AUTH_TYPE, OTP_SERVICE, OTP_RESOURCE, OTP_TTL_SECONDS, OTP_CODE_LENGTH } from '@owlmeans/auth-otp';
+//# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAEhD,gFAAgF;AAChF,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA"}

package/build/index.d.ts

@@ -0,0 +1,5 @@
+export type * from './types.js';
+export * from './consts.js';
+export * from './service.js';
+export * from './plugin.js';
+//# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA"}

package/build/index.js

@@ -0,0 +1,4 @@
+export * from './consts.js';
+export * from './service.js';
+export * from './plugin.js';
+//# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA"}

package/build/plugin.d.ts

@@ -0,0 +1,4 @@
+import type { OtpConfig, OtpContext } from './types.js';
+/** Register the email-OTP plugin into the server-auth plugin registry. Call once at context setup. */
+export declare const appendOtpPlugin: <C extends OtpConfig, T extends OtpContext<C>>(context: T) => T;
+//# sourceMappingURL=plugin.d.ts.map

package/build/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AA6DvD,sGAAsG;AACtG,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,KAAG,CAG1F,CAAA"}

package/build/plugin.js

@@ -0,0 +1,59 @@
+import { ALL_SCOPES, AuthenFailed, AuthRole, AuthenticationType } from '@owlmeans/auth';
+import { registerPlugin } from '@owlmeans/server-auth/manager/plugins';
+import { OTP_AUTH_TYPE, OTP_SERVICE } from '@owlmeans/auth-otp';
+import { AUTH_IDENTITY_LINKING } from '@owlmeans/server-auth-identity';
+/** Factory that creates the email-OTP AuthPlugin bound to the given context. */
+const otpPlugin = (context) => ({
+    type: OTP_AUTH_TYPE,
+    init: async (request) => {
+        if (request.userId == null || !request.userId.includes('@')) {
+            throw new AuthenFailed('otp:email');
+        }
+        const email = request.userId.trim().toLowerCase();
+        const otp = context.service(OTP_SERVICE);
+        await otp.issueChallenge(email);
+        // Store the email in the challenge so the envelope preserves it for authenticate.
+        return { challenge: email };
+    },
+    authenticate: async (credential) => {
+        // credential.challenge is the email (opened from the signed envelope in makeAuthModel).
+        const email = credential.challenge;
+        const code = credential.credential;
+        if (!email || !email.includes('@')) {
+            throw new AuthenFailed('otp:email');
+        }
+        if (!code) {
+            throw new AuthenFailed('otp:code');
+        }
+        const otp = context.service(OTP_SERVICE);
+        await otp.verifyChallenge(email, code);
+        const identityAlias = context.cfg.otp?.identityAlias ?? AUTH_IDENTITY_LINKING;
+        const identity = context.service(identityAlias);
+        const entityId = credential.entityId;
+        const details = {
+            type: OTP_AUTH_TYPE,
+            service: 'email',
+            clientId: entityId ?? 'default',
+            userId: email,
+            entityId,
+        };
+        let payload = await identity.getLinkedProfile(details);
+        if (payload == null) {
+            payload = await identity.linkProfile(details, { username: email });
+        }
+        // Set the resulting credential fields for the envelope.
+        credential.type = AuthenticationType.OneTimeToken;
+        credential.userId = payload.userId;
+        credential.profileId = payload.profileId;
+        credential.entityId = payload.entityId;
+        credential.role = payload.role ?? AuthRole.User;
+        credential.scopes = payload.scopes ?? [ALL_SCOPES];
+        return { token: '' };
+    },
+});
+/** Register the email-OTP plugin into the server-auth plugin registry. Call once at context setup. */
+export const appendOtpPlugin = (context) => {
+    registerPlugin(OTP_AUTH_TYPE, otpPlugin);
+    return context;
+};
+//# sourceMappingURL=plugin.js.map

package/build/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAEvF,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAEtE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAGtE,gFAAgF;AAChF,MAAM,SAAS,GAAG,CAA+C,OAAU,EAAc,EAAE,CAAC,CAAC;IAC3F,IAAI,EAAE,aAAa;IAEnB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;QACpB,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAa,WAAW,CAAC,CAAA;QACpD,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QAC/B,kFAAkF;QAClF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IAC7B,CAAC;IAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;QAC/B,wFAAwF;QACxF,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAA;QAClC,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAA;QAElC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,CAAA;QACpC,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAa,WAAW,CAAC,CAAA;QACpD,MAAM,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAEtC,MAAM,aAAa,GAAI,OAAO,CAAC,GAAW,CAAC,GAAG,EAAE,aAAa,IAAI,qBAAqB,CAAA;QACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAyB,aAAa,CAAC,CAAA;QAEvE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAA;QACpC,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,QAAQ,IAAI,SAAS;YAC/B,MAAM,EAAE,KAAK;YACb,QAAQ;SACT,CAAA;QAED,IAAI,OAAO,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;QACtD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;QACpE,CAAC;QAED,wDAAwD;QACxD,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAC,YAAY,CAAA;QACjD,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAClC,UAAU,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;QACxC,UAAU,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QACtC,UAAU,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAA;QAC/C,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAA;QAElD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAC,CAAA;AAEF,sGAAsG;AACtG,MAAM,CAAC,MAAM,eAAe,GAAG,CAA+C,OAAU,EAAK,EAAE;IAC7F,cAAc,CAAC,aAAa,EAAE,SAAiD,CAAC,CAAA;IAChF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/service.d.ts

@@ -0,0 +1,3 @@
+import type { OtpService } from '@owlmeans/auth-otp';
+export declare const makeOtpService: (alias?: string) => OtpService;
+//# sourceMappingURL=service.d.ts.map

package/build/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAgBpD,eAAO,MAAM,cAAc,GAAI,cAAmB,KAAG,UA+CpD,CAAA"}

package/build/service.js

@@ -0,0 +1,51 @@
+import { appendContextual } from '@owlmeans/context';
+import { AuthenFailed } from '@owlmeans/auth';
+import { OTP_SERVICE, OTP_RESOURCE, OTP_TTL_SECONDS, OTP_CODE_LENGTH } from '@owlmeans/auth-otp';
+import { MAILER_SERVICE } from '@owlmeans/mailer';
+const codeKey = (email) => email.toLowerCase().replace(/[^a-z0-9]/g, '_');
+export const makeOtpService = (alias = OTP_SERVICE) => {
+    const service = appendContextual(alias, {
+        issueChallenge: async (email) => {
+            const ctx = service.ctx;
+            const resourceAlias = ctx.cfg.otp?.resourceAlias ?? OTP_RESOURCE;
+            const mailerAlias = ctx.cfg.otp?.mailerAlias ?? MAILER_SERVICE;
+            const resource = ctx.resource(resourceAlias);
+            const mailer = ctx.service(mailerAlias);
+            const code = generateCode();
+            const id = codeKey(email);
+            // Upsert: delete previous code if any, then create fresh.
+            try {
+                await resource.delete(id);
+            }
+            catch { /* key may not exist */ }
+            await resource.create({ id, code }, { ttl: OTP_TTL_SECONDS });
+            await mailer.send({
+                to: email,
+                subject: 'Your login code',
+                text: `Your one-time login code is: ${code}\n\nIt expires in ${OTP_TTL_SECONDS / 60} minutes.`,
+                html: `<p>Your one-time login code is: <strong>${code}</strong></p><p>It expires in ${OTP_TTL_SECONDS / 60} minutes.</p>`,
+            });
+        },
+        verifyChallenge: async (email, code) => {
+            const ctx = service.ctx;
+            const resourceAlias = ctx.cfg.otp?.resourceAlias ?? OTP_RESOURCE;
+            const resource = ctx.resource(resourceAlias);
+            const id = codeKey(email);
+            const record = await resource.load(id);
+            if (record == null || record.code !== code.trim()) {
+                throw new AuthenFailed('otp:code');
+            }
+            // Consume: delete so the code cannot be reused.
+            try {
+                await resource.delete(id);
+            }
+            catch { /* already expired */ }
+        },
+    });
+    return service;
+};
+const generateCode = () => {
+    const digits = Math.floor(Math.random() * Math.pow(10, OTP_CODE_LENGTH));
+    return String(digits).padStart(OTP_CODE_LENGTH, '0');
+};
+//# sourceMappingURL=service.js.map

package/build/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE7C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAIhG,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAQjD,MAAM,OAAO,GAAG,CAAC,KAAa,EAAU,EAAE,CACxC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;AAEhD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,GAAG,WAAW,EAAc,EAAE;IAChE,MAAM,OAAO,GAAe,gBAAgB,CAAa,KAAK,EAAE;QAC9D,cAAc,EAAE,KAAK,EAAE,KAAa,EAAiB,EAAE;YACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAA4B,CAAA;YAChD,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,IAAI,YAAY,CAAA;YAChE,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,IAAI,cAAc,CAAA;YAC9D,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAA2B,aAAa,CAAC,CAAA;YACtE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAgB,WAAW,CAAC,CAAA;YAEtD,MAAM,IAAI,GAAG,YAAY,EAAE,CAAA;YAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;YAEzB,0DAA0D;YAC1D,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAC3B,CAAC;YAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAEnC,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAA;YAE7D,MAAM,MAAM,CAAC,IAAI,CAAC;gBAChB,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,iBAAiB;gBAC1B,IAAI,EAAE,gCAAgC,IAAI,qBAAqB,eAAe,GAAG,EAAE,WAAW;gBAC9F,IAAI,EAAE,2CAA2C,IAAI,iCAAiC,eAAe,GAAG,EAAE,eAAe;aAC1H,CAAC,CAAA;QACJ,CAAC;QAED,eAAe,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAiB,EAAE;YACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAA4B,CAAA;YAChD,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,IAAI,YAAY,CAAA;YAChE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAA2B,aAAa,CAAC,CAAA;YAEtE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;YACzB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAEtC,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBAClD,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,CAAA;YACpC,CAAC;YAED,gDAAgD;YAChD,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAC3B,CAAC;YAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;QACnC,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,GAAW,EAAE;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC,CAAA;IACxE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAA;AACtD,CAAC,CAAA"}

package/build/types.d.ts

@@ -0,0 +1,14 @@
+import type { ServerConfig, ServerContext } from '@owlmeans/server-context';
+export interface OtpConfig extends ServerConfig {
+    otp?: {
+        /** Alias of the registered MailerService. Defaults to MAILER_SERVICE. */
+        mailerAlias?: string;
+        /** Alias of the Redis resource for code storage. Defaults to OTP_RESOURCE. */
+        resourceAlias?: string;
+        /** Alias of the IdentityLinkingService. Defaults to AUTH_IDENTITY_LINKING. */
+        identityAlias?: string;
+    };
+}
+export interface OtpContext<C extends OtpConfig = OtpConfig> extends ServerContext<C> {
+}
+//# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAE3E,MAAM,WAAW,SAAU,SAAQ,YAAY;IAC7C,GAAG,CAAC,EAAE;QACJ,yEAAyE;QACzE,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,8EAA8E;QAC9E,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,8EAA8E;QAC9E,aAAa,CAAC,EAAE,MAAM,CAAA;KACvB,CAAA;CACF;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC;CAAG"}

package/build/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@owlmeans/server-auth-otp",
+  "version": "0.1.6",
+  "license": "MIT",
+  "type": "module",
+  "scripts": {
+    "build": "tsc -b",
+    "dev": "sleep 2 && nodemon -e ts,tsx,json --watch src --exec \"tsc -p ./tsconfig.json\"",
+    "watch": "tsc -b -w --preserveWatchOutput --pretty",
+    "test": "bun test ./tests"
+  },
+  "main": "build/index.js",
+  "module": "build/index.js",
+  "types": "build/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./build/index.js",
+      "require": "./build/index.js",
+      "default": "./build/index.js",
+      "module": "./build/index.js",
+      "types": "./build/index.d.ts"
+    }
+  },
+  "dependencies": {
+    "@owlmeans/auth": "^0.1.6",
+    "@owlmeans/auth-otp": "^0.1.6",
+    "@owlmeans/basic-ids": "^0.1.6",
+    "@owlmeans/context": "^0.1.6",
+    "@owlmeans/mailer": "^0.1.6",
+    "@owlmeans/oidc": "^0.1.6",
+    "@owlmeans/redis-resource": "^0.1.6",
+    "@owlmeans/resource": "^0.1.6",
+    "@owlmeans/server-auth": "^0.1.6",
+    "@owlmeans/server-auth-identity": "^0.1.6",
+    "@owlmeans/server-context": "^0.1.6"
+  },
+  "devDependencies": {
+    "@owlmeans/dep-config": "workspace:*",
+    "@types/bun": "^1.3.0",
+    "nodemon": "^3.1.11",
+    "npm-check": "^6.0.1",
+    "typescript": "^6.0.2"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/consts.ts

@@ -0,0 +1,4 @@
+export const SERVER_AUTH_OTP = 'server-auth-otp'
+
+/** The OTP auth plugin type key — passed as credential.type in init requests */
+export { OTP_AUTH_TYPE, OTP_SERVICE, OTP_RESOURCE, OTP_TTL_SECONDS, OTP_CODE_LENGTH } from '@owlmeans/auth-otp'

package/src/index.ts

@@ -0,0 +1,4 @@
+export type * from './types.js'
+export * from './consts.js'
+export * from './service.js'
+export * from './plugin.js'

package/src/plugin.ts

@@ -0,0 +1,73 @@
+import { ALL_SCOPES, AuthenFailed, AuthRole, AuthenticationType } from '@owlmeans/auth'
+import type { AuthPlugin } from '@owlmeans/server-auth/manager/plugins'
+import { registerPlugin } from '@owlmeans/server-auth/manager/plugins'
+import type { OtpService } from '@owlmeans/auth-otp'
+import { OTP_AUTH_TYPE, OTP_SERVICE } from '@owlmeans/auth-otp'
+import type { IdentityLinkingService } from '@owlmeans/server-auth-identity'
+import { AUTH_IDENTITY_LINKING } from '@owlmeans/server-auth-identity'
+import type { OtpConfig, OtpContext } from './types.js'
+
+/** Factory that creates the email-OTP AuthPlugin bound to the given context. */
+const otpPlugin = <C extends OtpConfig, T extends OtpContext<C>>(context: T): AuthPlugin => ({
+  type: OTP_AUTH_TYPE,
+
+  init: async request => {
+    if (request.userId == null || !request.userId.includes('@')) {
+      throw new AuthenFailed('otp:email')
+    }
+    const email = request.userId.trim().toLowerCase()
+    const otp = context.service<OtpService>(OTP_SERVICE)
+    await otp.issueChallenge(email)
+    // Store the email in the challenge so the envelope preserves it for authenticate.
+    return { challenge: email }
+  },
+
+  authenticate: async credential => {
+    // credential.challenge is the email (opened from the signed envelope in makeAuthModel).
+    const email = credential.challenge
+    const code = credential.credential
+
+    if (!email || !email.includes('@')) {
+      throw new AuthenFailed('otp:email')
+    }
+    if (!code) {
+      throw new AuthenFailed('otp:code')
+    }
+
+    const otp = context.service<OtpService>(OTP_SERVICE)
+    await otp.verifyChallenge(email, code)
+
+    const identityAlias = (context.cfg as any).otp?.identityAlias ?? AUTH_IDENTITY_LINKING
+    const identity = context.service<IdentityLinkingService>(identityAlias)
+
+    const entityId = credential.entityId
+    const details = {
+      type: OTP_AUTH_TYPE,
+      service: 'email',
+      clientId: entityId ?? 'default',
+      userId: email,
+      entityId,
+    }
+
+    let payload = await identity.getLinkedProfile(details)
+    if (payload == null) {
+      payload = await identity.linkProfile(details, { username: email })
+    }
+
+    // Set the resulting credential fields for the envelope.
+    credential.type = AuthenticationType.OneTimeToken
+    credential.userId = payload.userId
+    credential.profileId = payload.profileId
+    credential.entityId = payload.entityId
+    credential.role = payload.role ?? AuthRole.User
+    credential.scopes = payload.scopes ?? [ALL_SCOPES]
+
+    return { token: '' }
+  },
+})
+
+/** Register the email-OTP plugin into the server-auth plugin registry. Call once at context setup. */
+export const appendOtpPlugin = <C extends OtpConfig, T extends OtpContext<C>>(context: T): T => {
+  registerPlugin(OTP_AUTH_TYPE, otpPlugin as Parameters<typeof registerPlugin>[1])
+  return context
+}

package/src/service.ts

@@ -0,0 +1,71 @@
+import { appendContextual } from '@owlmeans/context'
+import { AuthenFailed } from '@owlmeans/auth'
+import type { OtpService } from '@owlmeans/auth-otp'
+import { OTP_SERVICE, OTP_RESOURCE, OTP_TTL_SECONDS, OTP_CODE_LENGTH } from '@owlmeans/auth-otp'
+import type { RedisResource } from '@owlmeans/redis-resource'
+import type { ResourceRecord } from '@owlmeans/resource'
+import type { MailerService } from '@owlmeans/mailer'
+import { MAILER_SERVICE } from '@owlmeans/mailer'
+import type { OtpConfig, OtpContext } from './types.js'
+
+interface OtpRecord extends ResourceRecord {
+  id: string
+  code: string
+}
+
+const codeKey = (email: string): string =>
+  email.toLowerCase().replace(/[^a-z0-9]/g, '_')
+
+export const makeOtpService = (alias = OTP_SERVICE): OtpService => {
+  const service: OtpService = appendContextual<OtpService>(alias, {
+    issueChallenge: async (email: string): Promise<void> => {
+      const ctx = service.ctx as OtpContext<OtpConfig>
+      const resourceAlias = ctx.cfg.otp?.resourceAlias ?? OTP_RESOURCE
+      const mailerAlias = ctx.cfg.otp?.mailerAlias ?? MAILER_SERVICE
+      const resource = ctx.resource<RedisResource<OtpRecord>>(resourceAlias)
+      const mailer = ctx.service<MailerService>(mailerAlias)
+
+      const code = generateCode()
+      const id = codeKey(email)
+
+      // Upsert: delete previous code if any, then create fresh.
+      try {
+        await resource.delete(id)
+      } catch { /* key may not exist */ }
+
+      await resource.create({ id, code }, { ttl: OTP_TTL_SECONDS })
+
+      await mailer.send({
+        to: email,
+        subject: 'Your login code',
+        text: `Your one-time login code is: ${code}\n\nIt expires in ${OTP_TTL_SECONDS / 60} minutes.`,
+        html: `<p>Your one-time login code is: <strong>${code}</strong></p><p>It expires in ${OTP_TTL_SECONDS / 60} minutes.</p>`,
+      })
+    },
+
+    verifyChallenge: async (email: string, code: string): Promise<void> => {
+      const ctx = service.ctx as OtpContext<OtpConfig>
+      const resourceAlias = ctx.cfg.otp?.resourceAlias ?? OTP_RESOURCE
+      const resource = ctx.resource<RedisResource<OtpRecord>>(resourceAlias)
+
+      const id = codeKey(email)
+      const record = await resource.load(id)
+
+      if (record == null || record.code !== code.trim()) {
+        throw new AuthenFailed('otp:code')
+      }
+
+      // Consume: delete so the code cannot be reused.
+      try {
+        await resource.delete(id)
+      } catch { /* already expired */ }
+    },
+  })
+
+  return service
+}
+
+const generateCode = (): string => {
+  const digits = Math.floor(Math.random() * Math.pow(10, OTP_CODE_LENGTH))
+  return String(digits).padStart(OTP_CODE_LENGTH, '0')
+}

package/src/types.ts

@@ -0,0 +1,14 @@
+import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
+
+export interface OtpConfig extends ServerConfig {
+  otp?: {
+    /** Alias of the registered MailerService. Defaults to MAILER_SERVICE. */
+    mailerAlias?: string
+    /** Alias of the Redis resource for code storage. Defaults to OTP_RESOURCE. */
+    resourceAlias?: string
+    /** Alias of the IdentityLinkingService. Defaults to AUTH_IDENTITY_LINKING. */
+    identityAlias?: string
+  }
+}
+
+export interface OtpContext<C extends OtpConfig = OtpConfig> extends ServerContext<C> {}

package/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": ["@owlmeans/dep-config/tsconfig.base.json", "@owlmeans/dep-config/tsconfig.server.json"],
+  "compilerOptions": {
+    "rootDir": "./src",
+    "outDir": "./build/"
+  },
+  "include": ["src"]
+}