@pondoknusa/telegram-2fa 2.2.0

package/dist/code-generator.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @pondoknusa/telegram-2fa — Secure code generator.
+ *
+ * Generates cryptographically random numeric codes and hashes them
+ * with SHA-256 so plaintext codes are never stored.
+ */
+export interface CodePair {
+    /** Plaintext code — sent to the user, never stored */
+    plaintext: string;
+    /** SHA-256 hex digest — stored in cache for verification */
+    hashed: string;
+}
+/**
+ * Generate a cryptographically random numeric code.
+ * @param length Number of digits (default: 6)
+ */
+export declare function generateCode(length?: number): CodePair;
+/**
+ * Hash a plaintext code with SHA-256.
+ */
+export declare function hashCode(code: string): string;
+/**
+ * Constant-time comparison to prevent timing attacks.
+ * Returns true if both strings are identical.
+ */
+export declare function constantTimeEqual(a: string, b: string): boolean;
+//# sourceMappingURL=code-generator.d.ts.map

package/dist/code-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-generator.d.ts","sourceRoot":"","sources":["../src/code-generator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,WAAW,QAAQ;IACvB,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,GAAE,MAAU,GAAG,QAAQ,CAUzD;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAc/D"}

package/dist/code-generator.js

@@ -0,0 +1,47 @@
+/**
+ * @pondoknusa/telegram-2fa — Secure code generator.
+ *
+ * Generates cryptographically random numeric codes and hashes them
+ * with SHA-256 so plaintext codes are never stored.
+ */
+import { randomInt, createHash } from 'node:crypto';
+/**
+ * Generate a cryptographically random numeric code.
+ * @param length Number of digits (default: 6)
+ */
+export function generateCode(length = 6) {
+    const digits = [];
+    for (let i = 0; i < length; i++) {
+        digits.push(String(randomInt(0, 10)));
+    }
+    const plaintext = digits.join('');
+    return {
+        plaintext,
+        hashed: hashCode(plaintext),
+    };
+}
+/**
+ * Hash a plaintext code with SHA-256.
+ */
+export function hashCode(code) {
+    return createHash('sha256').update(code).digest('hex');
+}
+/**
+ * Constant-time comparison to prevent timing attacks.
+ * Returns true if both strings are identical.
+ */
+export function constantTimeEqual(a, b) {
+    if (a.length !== b.length) {
+        // Compare a dummy length to avoid leaking the actual length
+        const dummy = createHash('sha256').update('').digest();
+        createHash('sha256').update(a).digest(); // still consume a
+        createHash('sha256').update(b).digest(); // still consume b
+        return false;
+    }
+    let result = 0;
+    for (let i = 0; i < a.length; i++) {
+        result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return result === 0;
+}
+//# sourceMappingURL=code-generator.js.map

package/dist/code-generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-generator.js","sourceRoot":"","sources":["../src/code-generator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASpD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB,CAAC;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClC,OAAO;QACL,SAAS;QACT,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,4DAA4D;QAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACvD,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,kBAAkB;QAC3D,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,kBAAkB;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC"}

package/dist/facade.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @pondoknusa/telegram-2fa — Facade.
+ */
+import type { Application } from '@pondoknusa/core';
+import type { TwoFactorManager } from './two-factor-manager.js';
+export declare class TwoFactor {
+    private static app;
+    static setApplication(app: Application): void;
+    static manager(): TwoFactorManager;
+    /**
+     * Mark the current session as 2FA-verified.
+     * Call this after a successful code verification.
+     */
+    static markVerified(request: {
+        session?: {
+            put(key: string, value: unknown): void;
+        };
+    }, sessionKey?: string): void;
+    /**
+     * Check whether the current request's session is 2FA-verified.
+     */
+    static isVerified(request: {
+        session?: {
+            get<T>(key: string): T | undefined;
+        };
+    }, sessionKey?: string): boolean;
+}
+//# sourceMappingURL=facade.d.ts.map

package/dist/facade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facade.d.ts","sourceRoot":"","sources":["../src/facade.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAC,GAAG,CAA4B;IAE9C,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI;IAI7C,MAAM,CAAC,OAAO,IAAI,gBAAgB;IAOlC;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE;YAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAA;SAAE,CAAA;KAAE,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAKjH;;OAEG;IACH,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE;YAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAA;SAAE,CAAA;KAAE,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO;CAK/G"}

package/dist/facade.js

@@ -0,0 +1,33 @@
+/**
+ * @pondoknusa/telegram-2fa — Facade.
+ */
+import { TWO_FACTOR_MANAGER } from './telegram-2fa-service-provider.js';
+export class TwoFactor {
+    static app = null;
+    static setApplication(app) {
+        TwoFactor.app = app;
+    }
+    static manager() {
+        if (!TwoFactor.app) {
+            throw new Error('TwoFactor facade not initialized. Call TwoFactor.setApplication(app) first.');
+        }
+        return TwoFactor.app.make(TWO_FACTOR_MANAGER);
+    }
+    /**
+     * Mark the current session as 2FA-verified.
+     * Call this after a successful code verification.
+     */
+    static markVerified(request, sessionKey) {
+        const key = sessionKey ?? 'telegram_2fa_verified';
+        request.session?.put(key, Date.now());
+    }
+    /**
+     * Check whether the current request's session is 2FA-verified.
+     */
+    static isVerified(request, sessionKey) {
+        const key = sessionKey ?? 'telegram_2fa_verified';
+        const verified = request.session?.get(key);
+        return verified !== undefined && verified !== null;
+    }
+}
+//# sourceMappingURL=facade.js.map

package/dist/facade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"facade.js","sourceRoot":"","sources":["../src/facade.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAExE,MAAM,OAAO,SAAS;IACZ,MAAM,CAAC,GAAG,GAAuB,IAAI,CAAC;IAE9C,MAAM,CAAC,cAAc,CAAC,GAAgB;QACpC,SAAS,CAAC,GAAG,GAAG,GAAG,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,OAAO;QACZ,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAmB,kBAAkB,CAAC,CAAC;IAClE,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,OAAiE,EAAE,UAAmB;QACxG,MAAM,GAAG,GAAG,UAAU,IAAI,uBAAuB,CAAC;QAClD,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,CAAC,OAA6D,EAAE,UAAmB;QAClG,MAAM,GAAG,GAAG,UAAU,IAAI,uBAAuB,CAAC;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAS,GAAG,CAAC,CAAC;QACnD,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC;IACrD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export type { Telegram2FaConfig, TwoFactorCodePayload, TwoFactorVerifyResult, TelegramChatIdResolver, TwoFactorUser, } from './types.js';
+export { generateCode, hashCode, constantTimeEqual } from './code-generator.js';
+export type { CodePair } from './code-generator.js';
+export { TwoFactorManager, TwoFactorError } from './two-factor-manager.js';
+export { Telegram2FaServiceProvider, TWO_FACTOR_MANAGER, TWO_FACTOR_CONFIG, } from './telegram-2fa-service-provider.js';
+export { createRequireTwoFactorMiddleware } from './two-factor-middleware.js';
+export type { RequireTwoFactorOptions } from './two-factor-middleware.js';
+export { TwoFactor } from './facade.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,aAAa,GACd,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAChF,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAG3E,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,YAAY,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAG1E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,11 @@
+// ── Code generator ──────────────────────────────────────────
+export { generateCode, hashCode, constantTimeEqual } from './code-generator.js';
+// ── Two-factor manager ──────────────────────────────────────
+export { TwoFactorManager, TwoFactorError } from './two-factor-manager.js';
+// ── Service provider ─────────────────────────────────────────
+export { Telegram2FaServiceProvider, TWO_FACTOR_MANAGER, TWO_FACTOR_CONFIG, } from './telegram-2fa-service-provider.js';
+// ── Middleware ───────────────────────────────────────────────
+export { createRequireTwoFactorMiddleware } from './two-factor-middleware.js';
+// ── Facade ───────────────────────────────────────────────────
+export { TwoFactor } from './facade.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,+DAA+D;AAC/D,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGhF,+DAA+D;AAC/D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE3E,gEAAgE;AAChE,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,oCAAoC,CAAC;AAE5C,gEAAgE;AAChE,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAG9E,gEAAgE;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC"}

package/dist/telegram-2fa-service-provider.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @pondoknusa/telegram-2fa — Service provider.
+ */
+import { ServiceProvider } from '@pondoknusa/core';
+import type { TelegramChatIdResolver } from './types.js';
+export declare const TWO_FACTOR_MANAGER = "telegram-2fa.manager";
+export declare const TWO_FACTOR_CONFIG = "telegram-2fa.config";
+export declare class Telegram2FaServiceProvider extends ServiceProvider {
+    register(): void;
+    /**
+     * Override to provide a custom Telegram chat ID resolver.
+     * By default, reads `telegram_chat_id` from the user model attribute
+     * or calls `routeNotificationForTelegram()`.
+     */
+    protected resolveChatIdResolver(): TelegramChatIdResolver | undefined;
+}
+//# sourceMappingURL=telegram-2fa-service-provider.d.ts.map

package/dist/telegram-2fa-service-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telegram-2fa-service-provider.d.ts","sourceRoot":"","sources":["../src/telegram-2fa-service-provider.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAMnD,OAAO,KAAK,EAAqB,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAE5E,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AACzD,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AAEvD,qBAAa,0BAA2B,SAAQ,eAAe;IACpD,QAAQ,IAAI,IAAI;IAezB;;;;OAIG;IACH,SAAS,CAAC,qBAAqB,IAAI,sBAAsB,GAAG,SAAS;CAGtE"}

package/dist/telegram-2fa-service-provider.js

@@ -0,0 +1,31 @@
+/**
+ * @pondoknusa/telegram-2fa — Service provider.
+ */
+import { ServiceProvider } from '@pondoknusa/core';
+import { TELEGRAM_BOT } from '@pondoknusa/telegram';
+import { TwoFactorManager } from './two-factor-manager.js';
+export const TWO_FACTOR_MANAGER = 'telegram-2fa.manager';
+export const TWO_FACTOR_CONFIG = 'telegram-2fa.config';
+export class Telegram2FaServiceProvider extends ServiceProvider {
+    register() {
+        this.app.bind(TWO_FACTOR_CONFIG, () => {
+            return this.app.make('config').get('telegram-2fa') ?? {};
+        });
+        this.app.bind(TWO_FACTOR_MANAGER, () => {
+            const config = this.app.make(TWO_FACTOR_CONFIG);
+            const cache = this.app.make('cache');
+            const bot = this.app.make(TELEGRAM_BOT);
+            const resolver = this.resolveChatIdResolver();
+            return new TwoFactorManager(config, cache, bot, resolver);
+        });
+    }
+    /**
+     * Override to provide a custom Telegram chat ID resolver.
+     * By default, reads `telegram_chat_id` from the user model attribute
+     * or calls `routeNotificationForTelegram()`.
+     */
+    resolveChatIdResolver() {
+        return undefined;
+    }
+}
+//# sourceMappingURL=telegram-2fa-service-provider.js.map

package/dist/telegram-2fa-service-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telegram-2fa-service-provider.js","sourceRoot":"","sources":["../src/telegram-2fa-service-provider.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAInD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AACzD,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAEvD,MAAM,OAAO,0BAA2B,SAAQ,eAAe;IACpD,QAAQ;QACf,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,EAAE;YACpC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAmB,QAAQ,CAAC,CAAC,GAAG,CAAoB,cAAc,CAAC,IAAI,EAAE,CAAC;QAChG,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAoB,iBAAiB,CAAC,CAAC;YACnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAkB,OAAO,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAc,YAAY,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAE9C,OAAO,IAAI,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACO,qBAAqB;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/dist/two-factor-manager.d.ts

@@ -0,0 +1,47 @@
+/**
+ * @pondoknusa/telegram-2fa — Two-factor authentication manager.
+ *
+ * Orchestrates the 2FA lifecycle: send a code, verify, and invalidate.
+ * Codes are hashed with SHA-256 before storage in the cache store.
+ */
+import type { CacheRepository } from '@pondoknusa/cache';
+import type { TelegramBot } from '@pondoknusa/telegram';
+import type { Telegram2FaConfig, TwoFactorVerifyResult, TelegramChatIdResolver, TwoFactorUser } from './types.js';
+export declare class TwoFactorManager {
+    private readonly config;
+    private readonly cache;
+    private readonly bot;
+    private readonly chatIdResolver?;
+    constructor(config: Telegram2FaConfig, cache: CacheRepository, bot: TelegramBot, chatIdResolver?: TelegramChatIdResolver | undefined);
+    get codeLength(): number;
+    get codeTtlSeconds(): number;
+    get maxAttempts(): number;
+    get cachePrefix(): string;
+    get sessionKey(): string;
+    get sessionTtlSeconds(): number;
+    get messageTemplate(): string;
+    private cacheKey;
+    /**
+     * Generate a new 2FA code and send it to the user's Telegram chat.
+     * Returns the plaintext code on success (for logging/testing), or the
+     * Telegram message result.
+     */
+    send(user: TwoFactorUser): Promise<{
+        code: string;
+        messageId?: number;
+    }>;
+    /**
+     * Verify a user-submitted code against the stored hash.
+     * Returns a detailed result with the reason.
+     */
+    verify(user: TwoFactorUser, code: string): Promise<TwoFactorVerifyResult>;
+    /**
+     * Invalidate any pending 2FA code for the user.
+     */
+    invalidate(user: TwoFactorUser): Promise<void>;
+    private resolveChatId;
+}
+export declare class TwoFactorError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=two-factor-manager.d.ts.map

package/dist/two-factor-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-manager.d.ts","sourceRoot":"","sources":["../src/two-factor-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAKxD,OAAO,KAAK,EACV,iBAAiB,EAEjB,qBAAqB,EACrB,sBAAsB,EACtB,aAAa,EACd,MAAM,YAAY,CAAC;AAEpB,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAHf,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,WAAW,EAChB,cAAc,CAAC,EAAE,sBAAsB,YAAA;IAK1D,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IAED,IAAI,eAAe,IAAI,MAAM,CAE5B;IAED,OAAO,CAAC,QAAQ;IAMhB;;;;OAIG;IACG,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAuC9E;;;OAGG;IACG,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAgD/E;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;YAMtC,aAAa;CAqB5B;AAID,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAI5B"}

package/dist/two-factor-manager.js

@@ -0,0 +1,150 @@
+/**
+ * @pondoknusa/telegram-2fa — Two-factor authentication manager.
+ *
+ * Orchestrates the 2FA lifecycle: send a code, verify, and invalidate.
+ * Codes are hashed with SHA-256 before storage in the cache store.
+ */
+import { generateCode, hashCode, constantTimeEqual } from './code-generator.js';
+export class TwoFactorManager {
+    config;
+    cache;
+    bot;
+    chatIdResolver;
+    constructor(config, cache, bot, chatIdResolver) {
+        this.config = config;
+        this.cache = cache;
+        this.bot = bot;
+        this.chatIdResolver = chatIdResolver;
+    }
+    // ── Configuration helpers ──────────────────────────────────
+    get codeLength() {
+        return this.config.code_length ?? 6;
+    }
+    get codeTtlSeconds() {
+        return this.config.code_ttl_seconds ?? 300;
+    }
+    get maxAttempts() {
+        return this.config.max_attempts ?? 3;
+    }
+    get cachePrefix() {
+        return this.config.cache_prefix ?? 'telegram-2fa';
+    }
+    get sessionKey() {
+        return this.config.session_key ?? 'telegram_2fa_verified';
+    }
+    get sessionTtlSeconds() {
+        return this.config.session_ttl_seconds ?? 3600;
+    }
+    get messageTemplate() {
+        return this.config.message_template ?? 'Your verification code: {{code}}';
+    }
+    cacheKey(userId) {
+        return `${this.cachePrefix}:${userId}`;
+    }
+    // ── Send a code ────────────────────────────────────────────
+    /**
+     * Generate a new 2FA code and send it to the user's Telegram chat.
+     * Returns the plaintext code on success (for logging/testing), or the
+     * Telegram message result.
+     */
+    async send(user) {
+        // Invalidate any existing code first
+        await this.invalidate(user);
+        const { plaintext, hashed } = generateCode(this.codeLength);
+        const chatId = await this.resolveChatId(user);
+        if (!chatId) {
+            throw new TwoFactorError(`Cannot send 2FA code: user ${user.getAuthIdentifier()} has no Telegram chat ID configured.`);
+        }
+        // Store the hash in cache with TTL
+        const payload = {
+            hash: hashed,
+            attempts_remaining: this.maxAttempts,
+            issued_at: Date.now(),
+        };
+        await this.cache.put(this.cacheKey(user.getAuthIdentifier()), payload, this.codeTtlSeconds);
+        // Send via Telegram
+        const message = this.messageTemplate.replace(/\{\{code\}\}/g, plaintext);
+        const result = await this.bot.sendMessage({
+            chat_id: chatId,
+            text: message,
+            parse_mode: this.config.parse_mode ?? 'Markdown',
+        });
+        return { code: plaintext, messageId: result.message_id };
+    }
+    // ── Verify a code ──────────────────────────────────────────
+    /**
+     * Verify a user-submitted code against the stored hash.
+     * Returns a detailed result with the reason.
+     */
+    async verify(user, code) {
+        const userId = user.getAuthIdentifier();
+        const payload = await this.cache.get(this.cacheKey(userId));
+        if (!payload) {
+            return { success: false, reason: 'expired' };
+        }
+        // Check expiry (belt-and-suspenders — cache TTL should handle it, but
+        // verify in case the cache backend doesn't expire reliably)
+        const elapsed = Date.now() - payload.issued_at;
+        if (elapsed > this.codeTtlSeconds * 1000) {
+            await this.cache.forget(this.cacheKey(userId));
+            return { success: false, reason: 'expired' };
+        }
+        if (payload.attempts_remaining <= 0) {
+            await this.cache.forget(this.cacheKey(userId));
+            return { success: false, reason: 'max_attempts' };
+        }
+        // Decrement attempts
+        payload.attempts_remaining -= 1;
+        await this.cache.put(this.cacheKey(userId), payload, this.codeTtlSeconds);
+        if (!constantTimeEqual(code, payload.hash)) {
+            // Actually compare the hash of the submitted code against the stored hash
+            const submittedHash = hashCode(code);
+            if (!constantTimeEqual(submittedHash, payload.hash)) {
+                return {
+                    success: false,
+                    reason: 'invalid',
+                    attempts_remaining: payload.attempts_remaining,
+                };
+            }
+        }
+        // Success — invalidate the code so it can't be reused
+        await this.cache.forget(this.cacheKey(userId));
+        // Mark the session as 2FA verified (if session is available)
+        // This is done by the middleware or caller
+        return { success: true, reason: 'ok' };
+    }
+    // ── Invalidate ─────────────────────────────────────────────
+    /**
+     * Invalidate any pending 2FA code for the user.
+     */
+    async invalidate(user) {
+        await this.cache.forget(this.cacheKey(user.getAuthIdentifier()));
+    }
+    // ── Chat ID resolution ─────────────────────────────────────
+    async resolveChatId(user) {
+        // Use the custom resolver if provided
+        if (this.chatIdResolver) {
+            return this.chatIdResolver(user);
+        }
+        // Try checking the user model for a telegram_chat_id attribute
+        if (typeof user.getAttribute === 'function') {
+            const chatId = user.getAttribute('telegram_chat_id');
+            if (chatId !== undefined && chatId !== null) {
+                return chatId;
+            }
+        }
+        // Try routeNotificationForTelegram
+        if (typeof user.routeNotificationForTelegram === 'function') {
+            return user.routeNotificationForTelegram();
+        }
+        return null;
+    }
+}
+// ── Error ────────────────────────────────────────────────────
+export class TwoFactorError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'TwoFactorError';
+    }
+}
+//# sourceMappingURL=two-factor-manager.js.map

package/dist/two-factor-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-manager.js","sourceRoot":"","sources":["../src/two-factor-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAShF,MAAM,OAAO,gBAAgB;IAER;IACA;IACA;IACA;IAJnB,YACmB,MAAyB,EACzB,KAAsB,EACtB,GAAgB,EAChB,cAAuC;QAHvC,WAAM,GAAN,MAAM,CAAmB;QACzB,UAAK,GAAL,KAAK,CAAiB;QACtB,QAAG,GAAH,GAAG,CAAa;QAChB,mBAAc,GAAd,cAAc,CAAyB;IACvD,CAAC;IAEJ,8DAA8D;IAE9D,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,GAAG,CAAC;IAC7C,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,cAAc,CAAC;IACpD,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,uBAAuB,CAAC;IAC5D,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAAC;IACjD,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,kCAAkC,CAAC;IAC5E,CAAC;IAEO,QAAQ,CAAC,MAAuB;QACtC,OAAO,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,EAAE,CAAC;IACzC,CAAC;IAED,8DAA8D;IAE9D;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,IAAmB;QAC5B,qCAAqC;QACrC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE5B,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAE9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,cAAc,CACtB,8BAA8B,IAAI,CAAC,iBAAiB,EAAE,sCAAsC,CAC7F,CAAC;QACJ,CAAC;QAED,mCAAmC;QACnC,MAAM,OAAO,GAAyB;YACpC,IAAI,EAAE,MAAM;YACZ,kBAAkB,EAAE,IAAI,CAAC,WAAW;YACpC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAClB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,EACvC,OAAO,EACP,IAAI,CAAC,cAAc,CACpB,CAAC;QAEF,oBAAoB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;YACxC,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,UAAU;SACjD,CAAC,CAAC;QAEH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;IAC3D,CAAC;IAED,8DAA8D;IAE9D;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,IAAmB,EAAE,IAAY;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAElF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/C,CAAC;QAED,sEAAsE;QACtE,4DAA4D;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;QAC/C,IAAI,OAAO,GAAG,IAAI,CAAC,cAAc,GAAG,IAAI,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/C,CAAC;QAED,IAAI,OAAO,CAAC,kBAAkB,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACpD,CAAC;QAED,qBAAqB;QACrB,OAAO,CAAC,kBAAkB,IAAI,CAAC,CAAC;QAChC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAE1E,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,0EAA0E;YAC1E,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,SAAS;oBACjB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;iBAC/C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,sDAAsD;QACtD,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAE/C,6DAA6D;QAC7D,2CAA2C;QAE3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IAED,8DAA8D;IAE9D;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,IAAmB;QAClC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,8DAA8D;IAEtD,KAAK,CAAC,aAAa,CAAC,IAAqC;QAC/D,sCAAsC;QACtC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,+DAA+D;QAC/D,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;YACrD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAC5C,OAAO,MAAyB,CAAC;YACnC,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,OAAQ,IAAY,CAAC,4BAA4B,KAAK,UAAU,EAAE,CAAC;YACrE,OAAQ,IAAY,CAAC,4BAA4B,EAAE,CAAC;QACtD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,gEAAgE;AAEhE,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF"}

package/dist/two-factor-middleware.d.ts

@@ -0,0 +1,51 @@
+/**
+ * @pondoknusa/telegram-2fa — Middleware for 2FA challenge enforcement.
+ *
+ * Attach to routes or groups that should require a verified 2FA session.
+ * The user must have completed a 2FA verification within the session TTL
+ * window, otherwise the middleware returns a 403 JSON error or redirects.
+ *
+ * Usage in routes/web.ts:
+ *
+ *   import { createRequireTwoFactorMiddleware } from '@pondoknusa/telegram-2fa';
+ *
+ *   Route.middleware('2fa', createRequireTwoFactorMiddleware()).get('/admin', handler);
+ *
+ * Or with custom behaviour:
+ *
+ *   Route.middleware('2fa', createRequireTwoFactorMiddleware({
+ *     onChallengeRequired: (request) => Response.json({ error: '2FA required' }, 401),
+ *   })).get('/admin', handler);
+ *
+ * The verification flow:
+ *   1. User authenticates (password / session login)
+ *   2. Application calls TwoFactor.send(user) to send code via Telegram
+ *   3. User submits the code to a verify endpoint
+ *   4. Application calls TwoFactor.verify(user, code)
+ *   5. On success, mark the session: TwoFactor.markVerified(request, user)
+ *   6. The middleware checks this session flag on subsequent requests
+ */
+import type { Middleware, PondoknusaRequest } from '@pondoknusa/http';
+export interface RequireTwoFactorOptions {
+    /**
+     * Custom JSON body when 2FA challenge is required.
+     * Default: { error: '2FA required', code: '2FA_REQUIRED' }
+     */
+    onChallengeRequired?: (request: PondoknusaRequest) => Response;
+    /**
+     * Session key to check for 2FA verification.
+     * Default: 'telegram_2fa_verified'
+     */
+    sessionKey?: string;
+    /**
+     * Whether to skip 2FA for GET/HEAD requests (allows page loads).
+     * The user will get challenged when they try a mutating action.
+     * Default: false
+     */
+    skipSafeMethods?: boolean;
+}
+/**
+ * Create a middleware that requires 2FA verification in the session.
+ */
+export declare function createRequireTwoFactorMiddleware(options?: RequireTwoFactorOptions): Middleware;
+//# sourceMappingURL=two-factor-middleware.d.ts.map

package/dist/two-factor-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-middleware.d.ts","sourceRoot":"","sources":["../src/two-factor-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGtE,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,QAAQ,CAAC;IAE/D;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,GAAE,uBAA4B,GACpC,UAAU,CA2CZ"}

package/dist/two-factor-middleware.js

@@ -0,0 +1,67 @@
+/**
+ * @pondoknusa/telegram-2fa — Middleware for 2FA challenge enforcement.
+ *
+ * Attach to routes or groups that should require a verified 2FA session.
+ * The user must have completed a 2FA verification within the session TTL
+ * window, otherwise the middleware returns a 403 JSON error or redirects.
+ *
+ * Usage in routes/web.ts:
+ *
+ *   import { createRequireTwoFactorMiddleware } from '@pondoknusa/telegram-2fa';
+ *
+ *   Route.middleware('2fa', createRequireTwoFactorMiddleware()).get('/admin', handler);
+ *
+ * Or with custom behaviour:
+ *
+ *   Route.middleware('2fa', createRequireTwoFactorMiddleware({
+ *     onChallengeRequired: (request) => Response.json({ error: '2FA required' }, 401),
+ *   })).get('/admin', handler);
+ *
+ * The verification flow:
+ *   1. User authenticates (password / session login)
+ *   2. Application calls TwoFactor.send(user) to send code via Telegram
+ *   3. User submits the code to a verify endpoint
+ *   4. Application calls TwoFactor.verify(user, code)
+ *   5. On success, mark the session: TwoFactor.markVerified(request, user)
+ *   6. The middleware checks this session flag on subsequent requests
+ */
+import { Response } from '@pondoknusa/http';
+/**
+ * Create a middleware that requires 2FA verification in the session.
+ */
+export function createRequireTwoFactorMiddleware(options = {}) {
+    const sessionKey = options.sessionKey ?? 'telegram_2fa_verified';
+    return async (request, next) => {
+        // Skip safe methods if configured
+        if (options.skipSafeMethods && ['GET', 'HEAD', 'OPTIONS'].includes(request.method)) {
+            return next();
+        }
+        const user = request.user;
+        // No authenticated user — let other auth middleware handle it
+        if (!user) {
+            return next();
+        }
+        // Check for verified flag in session
+        const verified = request.session?.get(sessionKey);
+        if (verified) {
+            // Check if the verification is still within the TTL window
+            const ttl = options.sessionTtl ?? 3600;
+            const elapsed = (Date.now() - verified) / 1000;
+            if (elapsed < ttl) {
+                return next();
+            }
+            // Session TTL expired — clear and require re-verification
+            request.session?.forget(sessionKey);
+        }
+        // 2FA required
+        if (options.onChallengeRequired) {
+            return options.onChallengeRequired(request);
+        }
+        return Response.json({
+            error: 'Two-factor authentication required.',
+            message: 'Please verify your identity via Telegram.',
+            code: '2FA_REQUIRED',
+        }, { status: 403 });
+    };
+}
+//# sourceMappingURL=two-factor-middleware.js.map

package/dist/two-factor-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-middleware.js","sourceRoot":"","sources":["../src/two-factor-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAyB5C;;GAEG;AACH,MAAM,UAAU,gCAAgC,CAC9C,UAAmC,EAAE;IAErC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,uBAAuB,CAAC;IAEjE,OAAO,KAAK,EAAE,OAA0B,EAAE,IAA6B,EAAE,EAAE;QACzE,kCAAkC;QAClC,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnF,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAA4B,CAAC;QAElD,8DAA8D;QAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,qCAAqC;QACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAS,UAAU,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,CAAC;YACb,2DAA2D;YAC3D,MAAM,GAAG,GAAI,OAAe,CAAC,UAAU,IAAI,IAAI,CAAC;YAChD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC;YAC/C,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;gBAClB,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,0DAA0D;YAC1D,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACtC,CAAC;QAED,eAAe;QACf,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAClB;YACE,KAAK,EAAE,qCAAqC;YAC5C,OAAO,EAAE,2CAA2C;YACpD,IAAI,EAAE,cAAc;SACrB,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,47 @@
+/**
+ * @pondoknusa/telegram-2fa — Type definitions.
+ */
+import type { Model } from '@pondoknusa/database';
+export interface Telegram2FaConfig {
+    /** Length of the generated code. Default: 6 */
+    code_length?: number;
+    /** Code expiration in seconds. Default: 300 (5 min) */
+    code_ttl_seconds?: number;
+    /** Max failed verification attempts before invalidation. Default: 3 */
+    max_attempts?: number;
+    /** Cache store connection name. Default: uses app default */
+    cache_connection?: string;
+    /** Cache key prefix. Default: 'telegram-2fa' */
+    cache_prefix?: string;
+    /** Telegram message template. Default: 'Your verification code: {{code}}' */
+    message_template?: string;
+    /** Parse mode for the Telegram message. Default: 'Markdown' */
+    parse_mode?: 'Markdown' | 'MarkdownV2' | 'HTML';
+    /** Whether to require 2FA for all authenticated routes by default. Default: false */
+    require_all?: boolean;
+    /** Session key used to store 2FA verification state. Default: 'telegram_2fa_verified' */
+    session_key?: string;
+    /** How long a 2FA session verification lasts (seconds). Default: 3600 (1 hour) */
+    session_ttl_seconds?: number;
+}
+export interface TwoFactorCodePayload {
+    /** SHA-256 hash of the code */
+    hash: string;
+    /** Remaining verification attempts */
+    attempts_remaining: number;
+    /** When the code was issued (Unix ms) */
+    issued_at: number;
+}
+export interface TwoFactorVerifyResult {
+    success: boolean;
+    reason?: 'expired' | 'max_attempts' | 'invalid' | 'ok';
+    attempts_remaining?: number;
+}
+export interface TelegramChatIdResolver {
+    (user: Model & Record<string, unknown>): number | string | Promise<number | string>;
+}
+/** A user that can authenticate and has model attributes */
+export type TwoFactorUser = Model & {
+    getAuthIdentifier(): string | number;
+} & Record<string, unknown>;
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAIlD,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,UAAU,CAAC,EAAE,UAAU,GAAG,YAAY,GAAG,MAAM,CAAC;IAChD,qFAAqF;IACrF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,yFAAyF;IACzF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kFAAkF;IAClF,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAID,MAAM,WAAW,oBAAoB;IACnC,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,SAAS,GAAG,cAAc,GAAG,SAAS,GAAG,IAAI,CAAC;IACvD,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAID,MAAM,WAAW,sBAAsB;IACrC,CAAC,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;CACrF;AAED,4DAA4D;AAC5D,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG;IAAE,iBAAiB,IAAI,MAAM,GAAG,MAAM,CAAC;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC"}

package/dist/types.js

@@ -0,0 +1,5 @@
+/**
+ * @pondoknusa/telegram-2fa — Type definitions.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@pondoknusa/telegram-2fa",
+  "version": "2.2.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "dependencies": {
+    "@pondoknusa/auth": "2.2.0",
+    "@pondoknusa/cache": "2.2.0",
+    "@pondoknusa/config": "2.2.0",
+    "@pondoknusa/core": "2.2.0",
+    "@pondoknusa/http": "2.2.0",
+    "@pondoknusa/support": "2.2.0",
+    "@pondoknusa/telegram": "2.2.0"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=26"
+  },
+  "devDependencies": {
+    "@types/node": "^26.0.1"
+  },
+  "description": "Two-factor auth via Telegram for Pondoknusa",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pondoknusa/pondoknusa.git",
+    "directory": "packages/telegram-2fa"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}