@portaidentity/server 1.7.0

package/dist/routes/stats.js

@@ -0,0 +1,65 @@
+/**
+ * Dashboard statistics API routes.
+ *
+ * Provides system-wide and per-organization statistics for the admin
+ * dashboard. All responses include Cache-Control headers for client-side
+ * caching (60s).
+ *
+ * Route structure:
+ *   GET /api/admin/stats/overview              — System-wide statistics
+ *   GET /api/admin/stats/organization/:orgId   — Per-organization statistics
+ *
+ * Both endpoints require `stats:read` permission.
+ *
+ * @see 05-dashboard-sessions-history.md
+ */
+import Router from '@koa/router';
+import { z } from 'zod';
+import { requireAdminAuth } from '../middleware/admin-auth.js';
+import { requirePermission } from '../middleware/require-permission.js';
+import { ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
+import * as statsService from '../lib/stats.js';
+// ---------------------------------------------------------------------------
+// Validation schemas
+// ---------------------------------------------------------------------------
+/** Schema for org stats path parameter */
+const orgIdParamSchema = z.object({
+    orgId: z.string().uuid(),
+});
+// ---------------------------------------------------------------------------
+// Router factory
+// ---------------------------------------------------------------------------
+/**
+ * Create the dashboard statistics router.
+ *
+ * All routes require admin authentication (Bearer JWT) and `stats:read`
+ * permission. Responses are cacheable for 60 seconds.
+ *
+ * Prefix: /api/admin/stats
+ *
+ * @returns Configured Koa Router
+ */
+export function createStatsRouter() {
+    const router = new Router({ prefix: '/api/admin/stats' });
+    // All routes require admin authentication
+    router.use(requireAdminAuth());
+    // -------------------------------------------------------------------------
+    // GET /overview — System-wide statistics
+    // -------------------------------------------------------------------------
+    router.get('/overview', requirePermission(ADMIN_PERMISSIONS.STATS_READ), async (ctx) => {
+        const stats = await statsService.getStatsOverview();
+        ctx.set('Cache-Control', 'private, max-age=60');
+        ctx.body = { data: stats };
+    });
+    // -------------------------------------------------------------------------
+    // GET /organization/:orgId — Per-organization statistics
+    // -------------------------------------------------------------------------
+    router.get('/organization/:orgId', requirePermission(ADMIN_PERMISSIONS.STATS_READ), async (ctx) => {
+        const { orgId } = orgIdParamSchema.parse(ctx.params);
+        const stats = await statsService.getOrgStats(orgId);
+        ctx.set('Cache-Control', 'private, max-age=60');
+        ctx.body = { data: stats };
+    });
+    return router;
+}
+//# sourceMappingURL=stats.js.map

package/dist/routes/stats.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stats.js","sourceRoot":"","sources":["../../src/routes/stats.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,YAAY,MAAM,iBAAiB,CAAC;AAEhD,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,0CAA0C;AAC1C,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CACzB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAE1D,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,yCAAyC;IACzC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrF,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,gBAAgB,EAAE,CAAC;QACpD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QAChD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,yDAAyD;IACzD,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChG,MAAM,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACpD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QAChD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/two-factor-admin.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Two-factor authentication admin API routes.
+ *
+ * Exports two router factories:
+ *   - createTwoFactorUserAdminRouter() — user-level 2FA management
+ *   - createTwoFactorOrgAdminRouter()  — org-level 2FA policy & statistics
+ *
+ * Both routers live in a single file because they share imports and concern (2FA admin),
+ * but require different path prefixes (per AR #87).
+ *
+ * User-Level Routes (prefix: /api/admin/organizations/:orgId/users/:userId/two-factor):
+ *   GET  /status                    — Get 2FA status for a user (MH-1)
+ *   POST /disable                   — Disable 2FA for a user (MH-2)
+ *   POST /reset                     — Reset 2FA (force re-enrollment) (MH-3)
+ *   POST /recovery-codes/regenerate — Regenerate recovery codes (MH-4)
+ *
+ * Org-Level Routes (prefix: /api/admin/organizations/:orgId/two-factor):
+ *   GET  /policy  — Get org 2FA policy (SH-1)
+ *   PUT  /policy  — Update org 2FA policy (SH-2)
+ *   GET  /summary — Get org 2FA enrollment summary (SH-3)
+ *
+ * Error mapping:
+ *   TwoFactorNotEnabledError  → 400
+ *   SuperAdminProtectionError → 403 (via global error handler)
+ *   ZodError                  → 400 with validation details
+ *   User not found / wrong org → 404
+ *
+ * @module routes/two-factor-admin
+ */
+import Router from '@koa/router';
+/**
+ * Create the user-level 2FA admin router.
+ *
+ * All routes require admin authentication with granular permissions.
+ * State-changing operations (disable, reset, regenerate) are protected
+ * against targeting the super-admin user.
+ *
+ * Prefix: /api/admin/organizations/:orgId/users/:userId/two-factor
+ *
+ * @returns Configured Koa Router
+ */
+export declare function createTwoFactorUserAdminRouter(): Router;
+/**
+ * Create the org-level 2FA admin router.
+ *
+ * Provides policy management and enrollment summary for an organization.
+ * PUT /policy uses ETag/If-Match for optimistic concurrency.
+ *
+ * Prefix: /api/admin/organizations/:orgId/two-factor
+ *
+ * @returns Configured Koa Router
+ */
+export declare function createTwoFactorOrgAdminRouter(): Router;
+//# sourceMappingURL=two-factor-admin.d.ts.map

package/dist/routes/two-factor-admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-admin.d.ts","sourceRoot":"","sources":["../../src/routes/two-factor-admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAwDjC;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,IAAI,MAAM,CAmJvD;AAuBD;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,IAAI,MAAM,CAkHtD"}

package/dist/routes/two-factor-admin.js

@@ -0,0 +1,344 @@
+/**
+ * Two-factor authentication admin API routes.
+ *
+ * Exports two router factories:
+ *   - createTwoFactorUserAdminRouter() — user-level 2FA management
+ *   - createTwoFactorOrgAdminRouter()  — org-level 2FA policy & statistics
+ *
+ * Both routers live in a single file because they share imports and concern (2FA admin),
+ * but require different path prefixes (per AR #87).
+ *
+ * User-Level Routes (prefix: /api/admin/organizations/:orgId/users/:userId/two-factor):
+ *   GET  /status                    — Get 2FA status for a user (MH-1)
+ *   POST /disable                   — Disable 2FA for a user (MH-2)
+ *   POST /reset                     — Reset 2FA (force re-enrollment) (MH-3)
+ *   POST /recovery-codes/regenerate — Regenerate recovery codes (MH-4)
+ *
+ * Org-Level Routes (prefix: /api/admin/organizations/:orgId/two-factor):
+ *   GET  /policy  — Get org 2FA policy (SH-1)
+ *   PUT  /policy  — Update org 2FA policy (SH-2)
+ *   GET  /summary — Get org 2FA enrollment summary (SH-3)
+ *
+ * Error mapping:
+ *   TwoFactorNotEnabledError  → 400
+ *   SuperAdminProtectionError → 403 (via global error handler)
+ *   ZodError                  → 400 with validation details
+ *   User not found / wrong org → 404
+ *
+ * @module routes/two-factor-admin
+ */
+import Router from '@koa/router';
+import { z } from 'zod';
+import { requireAdminAuth } from '../middleware/admin-auth.js';
+import { requirePermission } from '../middleware/require-permission.js';
+import { ADMIN_PERMISSIONS, isSuperAdminRole } from '../lib/admin-permissions.js';
+import { guardSuperAdmin } from '../lib/super-admin-protection.js';
+import { writeAuditLog } from '../lib/audit-log.js';
+import { getTwoFactorStatus, disableTwoFactor, regenerateRecoveryCodes, getTwoFactorSummary } from '../two-factor/service.js';
+import { TwoFactorNotEnabledError } from '../two-factor/errors.js';
+import { getUserById } from '../users/service.js';
+import { getOrganizationById, updateOrganization } from '../organizations/service.js';
+import { setETagHeader, checkIfMatch } from '../lib/etag.js';
+// ---------------------------------------------------------------------------
+// Validation schemas
+// ---------------------------------------------------------------------------
+/** Path parameters for user-level endpoints */
+const pathParamsSchema = z.object({
+    orgId: z.string().uuid(),
+    userId: z.string().uuid(),
+});
+// ---------------------------------------------------------------------------
+// Shared helpers
+// ---------------------------------------------------------------------------
+/**
+ * Validate that a user exists and belongs to the specified organization.
+ * Returns the user if valid. Returns null and sets 404 response if not.
+ *
+ * Uses 404 (not 403) for wrong-org to prevent organization enumeration (AR #75).
+ *
+ * @param ctx - Koa router context (reads params, sets response on failure)
+ * @returns User object if valid, null if not found or wrong org
+ */
+async function validateUserBelongsToOrg(ctx) {
+    const { orgId, userId } = pathParamsSchema.parse(ctx.params);
+    const user = await getUserById(userId);
+    if (!user || user.organizationId !== orgId) {
+        ctx.status = 404;
+        ctx.body = { error: 'User not found' };
+        return null;
+    }
+    return user;
+}
+// ---------------------------------------------------------------------------
+// User-level router factory
+// ---------------------------------------------------------------------------
+/**
+ * Create the user-level 2FA admin router.
+ *
+ * All routes require admin authentication with granular permissions.
+ * State-changing operations (disable, reset, regenerate) are protected
+ * against targeting the super-admin user.
+ *
+ * Prefix: /api/admin/organizations/:orgId/users/:userId/two-factor
+ *
+ * @returns Configured Koa Router
+ */
+export function createTwoFactorUserAdminRouter() {
+    const router = new Router({
+        prefix: '/api/admin/organizations/:orgId/users/:userId/two-factor',
+    });
+    // All routes require admin authentication
+    router.use(requireAdminAuth());
+    // -------------------------------------------------------------------------
+    // GET /status — Get 2FA status for a user (MH-1)
+    // Permission: admin:user:read
+    // -------------------------------------------------------------------------
+    router.get('/status', requirePermission(ADMIN_PERMISSIONS.USER_READ), async (ctx) => {
+        const user = await validateUserBelongsToOrg(ctx);
+        if (!user)
+            return;
+        const status = await getTwoFactorStatus(user.id);
+        ctx.body = { data: status };
+    });
+    // -------------------------------------------------------------------------
+    // POST /disable — Disable 2FA for a user (MH-2)
+    // Permission: admin:user:2fa
+    // Returns: 204 No Content on success (AR #84)
+    // -------------------------------------------------------------------------
+    router.post('/disable', requirePermission(ADMIN_PERMISSIONS.USER_2FA), async (ctx) => {
+        const user = await validateUserBelongsToOrg(ctx);
+        if (!user)
+            return;
+        // Super-admin protection (AR #74)
+        await guardSuperAdmin(user.id, 'manage-2fa');
+        // Get current status for audit log before disabling
+        const status = await getTwoFactorStatus(user.id);
+        try {
+            await disableTwoFactor(user.id);
+        }
+        catch (err) {
+            if (err instanceof TwoFactorNotEnabledError) {
+                ctx.status = 400;
+                ctx.body = { error: 'Two-factor authentication is not enabled for this user' };
+                return;
+            }
+            throw err;
+        }
+        // Admin-context audit entry (AR #78)
+        writeAuditLog({
+            organizationId: ctx.params.orgId,
+            userId: user.id,
+            actorId: ctx.state.adminUser?.id,
+            eventType: 'user.2fa.disabled',
+            eventCategory: 'admin',
+            description: `Admin disabled 2FA for user ${user.id}`,
+            metadata: { previousMethod: status.method },
+        });
+        ctx.status = 204;
+    });
+    // -------------------------------------------------------------------------
+    // POST /reset — Reset 2FA for a user, forcing re-enrollment (MH-3)
+    // Permission: admin:user:2fa
+    // Same logic as disable but different audit event for compliance reporting
+    // Returns: 204 No Content on success
+    // -------------------------------------------------------------------------
+    router.post('/reset', requirePermission(ADMIN_PERMISSIONS.USER_2FA), async (ctx) => {
+        const user = await validateUserBelongsToOrg(ctx);
+        if (!user)
+            return;
+        // Super-admin protection (AR #74)
+        await guardSuperAdmin(user.id, 'manage-2fa');
+        // Get current status for audit log before resetting
+        const status = await getTwoFactorStatus(user.id);
+        try {
+            await disableTwoFactor(user.id);
+        }
+        catch (err) {
+            if (err instanceof TwoFactorNotEnabledError) {
+                ctx.status = 400;
+                ctx.body = { error: 'Two-factor authentication is not enabled for this user' };
+                return;
+            }
+            throw err;
+        }
+        // Different audit event type for compliance reporting (AR #78)
+        writeAuditLog({
+            organizationId: ctx.params.orgId,
+            userId: user.id,
+            actorId: ctx.state.adminUser?.id,
+            eventType: 'user.2fa.reset',
+            eventCategory: 'admin',
+            description: `Admin reset 2FA for user ${user.id} (force re-enrollment)`,
+            metadata: { previousMethod: status.method },
+        });
+        ctx.status = 204;
+    });
+    // -------------------------------------------------------------------------
+    // POST /recovery-codes/regenerate — Regenerate recovery codes (MH-4)
+    // Permission: admin:user:2fa
+    // Recovery codes work for all 2FA methods (AR #83)
+    // Returns: 200 with new codes (shown once, never again)
+    // -------------------------------------------------------------------------
+    router.post('/recovery-codes/regenerate', requirePermission(ADMIN_PERMISSIONS.USER_2FA), async (ctx) => {
+        const user = await validateUserBelongsToOrg(ctx);
+        if (!user)
+            return;
+        // Super-admin protection (AR #74)
+        await guardSuperAdmin(user.id, 'manage-2fa');
+        let codes;
+        try {
+            codes = await regenerateRecoveryCodes(user.id);
+        }
+        catch (err) {
+            if (err instanceof TwoFactorNotEnabledError) {
+                ctx.status = 400;
+                ctx.body = { error: 'Two-factor authentication is not enabled for this user' };
+                return;
+            }
+            throw err;
+        }
+        // Audit log (AR #78)
+        writeAuditLog({
+            organizationId: ctx.params.orgId,
+            userId: user.id,
+            actorId: ctx.state.adminUser?.id,
+            eventType: 'user.2fa.codesRegenerated',
+            eventCategory: 'admin',
+            description: `Admin regenerated recovery codes for user ${user.id}`,
+            metadata: {},
+        });
+        ctx.body = {
+            data: {
+                recoveryCodes: codes,
+                count: codes.length,
+                warning: 'These codes will not be shown again. Provide them to the user securely.',
+            },
+        };
+    });
+    return router;
+}
+// ---------------------------------------------------------------------------
+// Org-level validation schemas
+// ---------------------------------------------------------------------------
+/** Path parameters for org-level endpoints */
+const orgPathParamsSchema = z.object({
+    orgId: z.string().uuid(),
+});
+/** Valid 2FA policy values */
+const VALID_POLICIES = ['optional', 'required_email', 'required_totp', 'required_any'];
+/** Body schema for PUT /policy */
+const updatePolicySchema = z.object({
+    twoFactorPolicy: z.enum(['optional', 'required_email', 'required_totp', 'required_any']),
+});
+// ---------------------------------------------------------------------------
+// Org-level router factory
+// ---------------------------------------------------------------------------
+/**
+ * Create the org-level 2FA admin router.
+ *
+ * Provides policy management and enrollment summary for an organization.
+ * PUT /policy uses ETag/If-Match for optimistic concurrency.
+ *
+ * Prefix: /api/admin/organizations/:orgId/two-factor
+ *
+ * @returns Configured Koa Router
+ */
+export function createTwoFactorOrgAdminRouter() {
+    const router = new Router({
+        prefix: '/api/admin/organizations/:orgId/two-factor',
+    });
+    // All routes require admin authentication
+    router.use(requireAdminAuth());
+    // -------------------------------------------------------------------------
+    // GET /policy — Get org 2FA policy (SH-1)
+    // Permission: admin:org:read
+    // -------------------------------------------------------------------------
+    router.get('/policy', requirePermission(ADMIN_PERMISSIONS.ORG_READ), async (ctx) => {
+        const { orgId } = orgPathParamsSchema.parse(ctx.params);
+        const org = await getOrganizationById(orgId);
+        if (!org) {
+            ctx.status = 404;
+            ctx.body = { error: 'Organization not found' };
+            return;
+        }
+        setETagHeader(ctx, 'organization', org.id, org.updatedAt);
+        ctx.body = {
+            data: {
+                twoFactorPolicy: org.twoFactorPolicy,
+                validPolicies: VALID_POLICIES,
+            },
+        };
+    });
+    // -------------------------------------------------------------------------
+    // PUT /policy — Update org 2FA policy (SH-2)
+    // Permission: admin:org:update
+    // Uses ETag/If-Match for optimistic concurrency
+    // Super-admin org policy changes are protected
+    // -------------------------------------------------------------------------
+    router.put('/policy', requirePermission(ADMIN_PERMISSIONS.ORG_UPDATE), async (ctx) => {
+        const { orgId } = orgPathParamsSchema.parse(ctx.params);
+        const body = updatePolicySchema.parse(ctx.request.body);
+        // ETag/If-Match optimistic concurrency (optional — backward compatible)
+        const current = await getOrganizationById(orgId);
+        if (!current) {
+            ctx.status = 404;
+            ctx.body = { error: 'Organization not found' };
+            return;
+        }
+        if (!checkIfMatch(ctx, 'organization', current.id, current.updatedAt, current))
+            return;
+        // Super-admin org protection (AR #82, AR #91):
+        // Non-super-admin actors cannot modify the super-admin org's policy.
+        // Super-admin actors CAN modify their own org (to strengthen security).
+        if (current.isSuperAdmin) {
+            const actorRoles = ctx.state.adminUser?.roles ?? [];
+            const actorIsSuperAdmin = actorRoles.some(isSuperAdminRole);
+            if (!actorIsSuperAdmin) {
+                ctx.status = 403;
+                ctx.body = { error: 'Cannot modify the super-admin organization policy' };
+                return;
+            }
+        }
+        const previousPolicy = current.twoFactorPolicy;
+        // Update org via existing organization service
+        const updated = await updateOrganization(orgId, {
+            twoFactorPolicy: body.twoFactorPolicy,
+        });
+        // Audit log (AR #78)
+        writeAuditLog({
+            organizationId: orgId,
+            actorId: ctx.state.adminUser?.id,
+            eventType: 'org.2fa.policyChanged',
+            eventCategory: 'admin',
+            description: `Admin changed 2FA policy from "${previousPolicy}" to "${body.twoFactorPolicy}"`,
+            metadata: { previousPolicy, newPolicy: body.twoFactorPolicy },
+        });
+        setETagHeader(ctx, 'organization', updated.id, updated.updatedAt);
+        ctx.body = {
+            data: {
+                twoFactorPolicy: updated.twoFactorPolicy,
+                validPolicies: VALID_POLICIES,
+            },
+        };
+    });
+    // -------------------------------------------------------------------------
+    // GET /summary — Get org 2FA enrollment summary (SH-3)
+    // Permission: admin:org:read + admin:user:read (dual permission per AR #85)
+    // Returns aggregate statistics with Cache-Control
+    // -------------------------------------------------------------------------
+    router.get('/summary', requirePermission(ADMIN_PERMISSIONS.ORG_READ, ADMIN_PERMISSIONS.USER_READ), async (ctx) => {
+        const { orgId } = orgPathParamsSchema.parse(ctx.params);
+        const org = await getOrganizationById(orgId);
+        if (!org) {
+            ctx.status = 404;
+            ctx.body = { error: 'Organization not found' };
+            return;
+        }
+        const summary = await getTwoFactorSummary(orgId);
+        // Short cache since summary is aggregate and not latency-critical (AR #92)
+        ctx.set('Cache-Control', 'private, max-age=30');
+        ctx.body = { data: summary };
+    });
+    return router;
+}
+//# sourceMappingURL=two-factor-admin.js.map

package/dist/routes/two-factor-admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-admin.js","sourceRoot":"","sources":["../../src/routes/two-factor-admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE9H,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG7D,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,+CAA+C;AAC/C,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CAC1B,CAAC,CAAC;AAEH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,KAAK,UAAU,wBAAwB,CAAC,GAAkB;IACxD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE7D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QAC3C,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,8BAA8B;IAC5C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,MAAM,EAAE,0DAA0D;KACnE,CAAC,CAAC;IAEH,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,iDAAiD;IACjD,8BAA8B;IAC9B,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClF,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,gDAAgD;IAChD,6BAA6B;IAC7B,8CAA8C;IAC9C,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnF,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,kCAAkC;QAClC,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAE7C,oDAAoD;QACpD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC;gBAC/E,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,qCAAqC;QACrC,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;YAChC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE;YAChC,SAAS,EAAE,mBAAmB;YAC9B,aAAa,EAAE,OAAO;YACtB,WAAW,EAAE,+BAA+B,IAAI,CAAC,EAAE,EAAE;YACrD,QAAQ,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE;SAC5C,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,mEAAmE;IACnE,6BAA6B;IAC7B,2EAA2E;IAC3E,qCAAqC;IACrC,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjF,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,kCAAkC;QAClC,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAE7C,oDAAoD;QACpD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC;gBAC/E,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,+DAA+D;QAC/D,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;YAChC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE;YAChC,SAAS,EAAE,gBAAgB;YAC3B,aAAa,EAAE,OAAO;YACtB,WAAW,EAAE,4BAA4B,IAAI,CAAC,EAAE,wBAAwB;YACxE,QAAQ,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE;SAC5C,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,qEAAqE;IACrE,6BAA6B;IAC7B,mDAAmD;IACnD,wDAAwD;IACxD,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrG,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,kCAAkC;QAClC,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAE7C,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC;gBAC/E,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,qBAAqB;QACrB,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;YAChC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE;YAChC,SAAS,EAAE,2BAA2B;YACtC,aAAa,EAAE,OAAO;YACtB,WAAW,EAAE,6CAA6C,IAAI,CAAC,EAAE,EAAE;YACnE,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,GAAG;YACT,IAAI,EAAE;gBACJ,aAAa,EAAE,KAAK;gBACpB,KAAK,EAAE,KAAK,CAAC,MAAM;gBACnB,OAAO,EAAE,yEAAyE;aACnF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,8CAA8C;AAC9C,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CACzB,CAAC,CAAC;AAEH,8BAA8B;AAC9B,MAAM,cAAc,GAAsB,CAAC,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC;AAE1G,kCAAkC;AAClC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC;CACzF,CAAC,CAAC;AAEH,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B;IAC3C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,MAAM,EAAE,4CAA4C;KACrD,CAAC,CAAC;IAEH,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,0CAA0C;IAC1C,6BAA6B;IAC7B,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjF,MAAM,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAExD,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QAED,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1D,GAAG,CAAC,IAAI,GAAG;YACT,IAAI,EAAE;gBACJ,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,aAAa,EAAE,cAAc;aAC9B;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6CAA6C;IAC7C,+BAA+B;IAC/B,gDAAgD;IAChD,+CAA+C;IAC/C,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnF,MAAM,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAExD,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAExD,wEAAwE;QACxE,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;YAAE,OAAO;QAEvF,+CAA+C;QAC/C,qEAAqE;QACrE,wEAAwE;QACxE,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,UAAU,GAAa,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC;YAC9D,MAAM,iBAAiB,GAAG,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC5D,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;gBAC1E,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;QAE/C,+CAA+C;QAC/C,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE;YAC9C,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CAAC;QAEH,qBAAqB;QACrB,aAAa,CAAC;YACZ,cAAc,EAAE,KAAK;YACrB,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE;YAChC,SAAS,EAAE,uBAAuB;YAClC,aAAa,EAAE,OAAO;YACtB,WAAW,EAAE,kCAAkC,cAAc,SAAS,IAAI,CAAC,eAAe,GAAG;YAC7F,QAAQ,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE;SAC9D,CAAC,CAAC;QAEH,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAClE,GAAG,CAAC,IAAI,GAAG;YACT,IAAI,EAAE;gBACJ,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,aAAa,EAAE,cAAc;aAC9B;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,uDAAuD;IACvD,4EAA4E;IAC5E,kDAAkD;IAClD,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC/G,MAAM,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAExD,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAEjD,2EAA2E;QAC3E,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QAChD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/two-factor.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Two-factor authentication route handlers.
+ *
+ * Handles the 2FA challenge during OIDC login interactions:
+ *   GET  /interaction/:uid/two-factor         → showTwoFactor (render verification page)
+ *   POST /interaction/:uid/two-factor         → verifyTwoFactor (verify code + finish login)
+ *   POST /interaction/:uid/two-factor/resend  → resendOtpCode (rate-limited OTP resend)
+ *   GET  /interaction/:uid/two-factor/setup   → showTwoFactorSetup (TOTP enrollment)
+ *   POST /interaction/:uid/two-factor/setup   → processTwoFactorSetup (confirm enrollment)
+ *
+ * Security features:
+ *   - CSRF protection on all POST endpoints
+ *   - Rate limiting on verification and resend
+ *   - Recovery code fallback support
+ *   - Audit logging for all 2FA events
+ *
+ * @module routes/two-factor
+ */
+import Router from '@koa/router';
+import type Provider from 'oidc-provider';
+/**
+ * Create the two-factor authentication router.
+ *
+ * Mounts 2FA verification, resend, and setup routes under /interaction/:uid/two-factor.
+ * Requires a Provider instance to read/write interaction state.
+ *
+ * @param provider - node-oidc-provider instance
+ * @returns Koa router with 2FA routes
+ */
+export declare function createTwoFactorRouter(provider: Provider): Router;
+//# sourceMappingURL=two-factor.d.ts.map

package/dist/routes/two-factor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor.d.ts","sourceRoot":"","sources":["../../src/routes/two-factor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AA4J1C;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CA6BhE"}