@puzzle-ui/auth 0.0.0-stage → 0.5.1

package/dist/providers/simplewebauthn-provider.js

@@ -0,0 +1,185 @@
+import { AuthConfigurationError, AuthValidationError } from "../errors/auth.errors.js";
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from "@simplewebauthn/server";
+// src/providers/simplewebauthn-provider.ts
+const BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+const isRecord = (value) => typeof value === "object" && value !== null;
+const encodeBase64Url = (input) => {
+	let output = "";
+	let index = 0;
+	while (index + 2 < input.length) {
+		const first = input[index++];
+		const second = input[index++];
+		const third = input[index++];
+		output += BASE64URL_ALPHABET.charAt(first >> 2);
+		output += BASE64URL_ALPHABET.charAt((first & 3) << 4 | second >> 4);
+		output += BASE64URL_ALPHABET.charAt((second & 15) << 2 | third >> 6);
+		output += BASE64URL_ALPHABET.charAt(third & 63);
+	}
+	if (index < input.length) {
+		const first = input[index++];
+		output += BASE64URL_ALPHABET.charAt(first >> 2);
+		if (index < input.length) {
+			const second = input[index];
+			output += BASE64URL_ALPHABET.charAt((first & 3) << 4 | second >> 4);
+			output += BASE64URL_ALPHABET.charAt((second & 15) << 2);
+		} else output += BASE64URL_ALPHABET.charAt((first & 3) << 4);
+	}
+	return output;
+};
+const decodeBase64Url = (value, errorMessage = "The stored passkey public key is invalid.") => {
+	if (typeof value !== "string" || value.length === 0 || value.length % 4 === 1 || !/^[A-Za-z0-9_-]+$/.test(value)) throw new AuthValidationError(errorMessage);
+	const output = [];
+	let buffer = 0;
+	let bits = 0;
+	for (const character of value) {
+		const decoded = BASE64URL_ALPHABET.indexOf(character);
+		if (decoded < 0) throw new AuthValidationError(errorMessage);
+		buffer = buffer << 6 | decoded;
+		bits += 6;
+		if (bits >= 8) {
+			bits -= 8;
+			output.push(buffer >>> bits & 255);
+		}
+	}
+	return new Uint8Array(output);
+};
+const toArrayBuffer = (bytes) => {
+	const buffer = new ArrayBuffer(bytes.byteLength);
+	new Uint8Array(buffer).set(bytes);
+	return buffer;
+};
+const toRegistrationResponse = (value) => {
+	if (!isRecord(value) || typeof value.id !== "string" || typeof value.rawId !== "string" || value.type !== "public-key" || !isRecord(value.response)) throw new AuthValidationError("The passkey registration response is invalid.");
+	return value;
+};
+const toAuthenticationResponse = (value) => {
+	if (!isRecord(value) || typeof value.id !== "string" || typeof value.rawId !== "string" || value.type !== "public-key" || !isRecord(value.response)) throw new AuthValidationError("The passkey authentication response is invalid.");
+	return value;
+};
+/**
+* Derives a stable, opaque WebAuthn user handle from the internal Puzzle user ID.
+*
+* WebAuthn user handles are bytes, not application IDs. Hashing also prevents
+* the internal user ID from being directly exposed in authenticator data.
+*/
+const deriveWebAuthnUserId = async (userId) => {
+	if (typeof userId !== "string" || userId.trim().length === 0) throw new AuthValidationError("A valid WebAuthn user ID is required.");
+	const cryptoApi = globalThis.crypto;
+	if (!cryptoApi?.subtle) throw new AuthConfigurationError("This runtime does not provide the required Web Crypto APIs.");
+	const input = new TextEncoder().encode(`puzzle-webauthn-user:v1:${userId}`);
+	const digest = await cryptoApi.subtle.digest("SHA-256", toArrayBuffer(input));
+	return new Uint8Array(digest);
+};
+const validateChallenge = (challenge) => {
+	if (typeof challenge !== "string" || challenge.length < 32 || challenge.length > 256 || !/^[A-Za-z0-9_-]+$/.test(challenge)) throw new AuthValidationError("A valid WebAuthn challenge is required.");
+};
+const validateRpId = (rpId) => {
+	if (typeof rpId !== "string" || rpId.trim().length === 0 || rpId.length > 253 || rpId.includes("/") || rpId.includes(":")) throw new AuthConfigurationError("The WebAuthn RP ID is invalid.");
+};
+var SimpleWebAuthnProvider = class {
+	async generateRegistrationOptions(input) {
+		validateChallenge(input.challenge);
+		validateRpId(input.rpId);
+		if (typeof input.rpName !== "string" || input.rpName.trim().length === 0 || typeof input.userName !== "string" || input.userName.trim().length === 0) throw new AuthValidationError("A WebAuthn RP name and user name are required.");
+		const excludeCredentials = input.excludeCredentialIds.map((id) => {
+			if (!id || !/^[A-Za-z0-9_-]+$/.test(id)) throw new AuthValidationError("A stored passkey credential ID is invalid.");
+			return { id };
+		});
+		const options = await generateRegistrationOptions({
+			rpID: input.rpId,
+			rpName: input.rpName.trim(),
+			userID: await deriveWebAuthnUserId(input.userId),
+			userName: input.userName.trim(),
+			userDisplayName: input.userName.trim(),
+			challenge: decodeBase64Url(input.challenge, "A valid WebAuthn challenge is required."),
+			attestationType: "none",
+			authenticatorSelection: {
+				residentKey: "required",
+				userVerification: "required"
+			},
+			excludeCredentials
+		});
+		if (options.challenge !== input.challenge) throw new AuthConfigurationError("SimpleWebAuthn returned an unexpected registration challenge.");
+		return options;
+	}
+	async verifyRegistrationResponse(input) {
+		validateChallenge(input.expectedChallenge);
+		validateRpId(input.expectedRpId);
+		if (typeof input.expectedOrigin !== "string" || input.expectedOrigin.length === 0) throw new AuthConfigurationError("A WebAuthn verification origin is required.");
+		const response = toRegistrationResponse(input.response);
+		const verification = await verifyRegistrationResponse({
+			response,
+			expectedChallenge: input.expectedChallenge,
+			expectedOrigin: input.expectedOrigin,
+			expectedRPID: input.expectedRpId,
+			requireUserVerification: true
+		});
+		if (!verification.verified) return {
+			verified: false,
+			userVerified: false
+		};
+		const registration = verification.registrationInfo;
+		const credential = registration.credential;
+		return {
+			verified: true,
+			userVerified: registration.userVerified,
+			credential: {
+				credentialId: credential.id,
+				publicKey: encodeBase64Url(credential.publicKey),
+				counter: credential.counter,
+				transports: credential.transports ?? []
+			}
+		};
+	}
+	async generateAuthenticationOptions(input) {
+		validateChallenge(input.challenge);
+		validateRpId(input.rpId);
+		const allowCredentials = input.allowCredentialIds?.map((id) => {
+			if (!id || !/^[A-Za-z0-9_-]+$/.test(id)) throw new AuthValidationError("A stored passkey credential ID is invalid.");
+			return { id };
+		});
+		const options = await generateAuthenticationOptions({
+			rpID: input.rpId,
+			challenge: decodeBase64Url(input.challenge, "A valid WebAuthn challenge is required."),
+			userVerification: "required",
+			...allowCredentials ? { allowCredentials } : {}
+		});
+		if (options.challenge !== input.challenge) throw new AuthConfigurationError("SimpleWebAuthn returned an unexpected authentication challenge.");
+		return options;
+	}
+	async verifyAuthenticationResponse(input) {
+		validateChallenge(input.expectedChallenge);
+		validateRpId(input.expectedRpId);
+		if (typeof input.expectedOrigin !== "string" || input.expectedOrigin.length === 0) throw new AuthConfigurationError("A WebAuthn verification origin is required.");
+		const response = toAuthenticationResponse(input.response);
+		if (response.id !== input.credential.credentialId) return {
+			verified: false,
+			userVerified: false,
+			credentialId: response.id,
+			newCounter: input.credential.counter
+		};
+		if (!Number.isSafeInteger(input.credential.counter) || input.credential.counter < 0) throw new AuthValidationError("The stored passkey counter is invalid.");
+		const credential = {
+			id: input.credential.credentialId,
+			publicKey: decodeBase64Url(input.credential.publicKey),
+			counter: input.credential.counter
+		};
+		const verification = await verifyAuthenticationResponse({
+			response,
+			expectedChallenge: input.expectedChallenge,
+			expectedOrigin: input.expectedOrigin,
+			expectedRPID: input.expectedRpId,
+			credential,
+			requireUserVerification: true
+		});
+		return {
+			verified: verification.verified,
+			userVerified: verification.verified && verification.authenticationInfo.userVerified,
+			credentialId: verification.authenticationInfo.credentialID,
+			newCounter: verification.authenticationInfo.newCounter
+		};
+	}
+};
+export { SimpleWebAuthnProvider };
+
+//# sourceMappingURL=simplewebauthn-provider.js.map

package/dist/providers/simplewebauthn-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"simplewebauthn-provider.js","names":[],"sources":["../../src/providers/simplewebauthn-provider.ts"],"sourcesContent":["import {\n  generateAuthenticationOptions,\n  generateRegistrationOptions,\n  verifyAuthenticationResponse,\n  verifyRegistrationResponse,\n  type AuthenticationResponseJSON,\n  type RegistrationResponseJSON,\n  type WebAuthnCredential,\n} from \"@simplewebauthn/server\";\n\nimport {\n  AuthConfigurationError,\n  AuthValidationError,\n} from \"../errors/auth.errors\";\n\nimport type {\n  WebAuthnAuthenticationVerification,\n  WebAuthnOptionsJSON,\n  WebAuthnProvider,\n  WebAuthnRegistrationVerification,\n} from \"./mfa-provider.types\";\n\nconst BASE64URL_ALPHABET =\n  \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null;\n\nconst encodeBase64Url = (input: Uint8Array): string => {\n  let output = \"\";\n  let index = 0;\n\n  while (index + 2 < input.length) {\n    const first = input[index++]!;\n    const second = input[index++]!;\n    const third = input[index++]!;\n\n    output += BASE64URL_ALPHABET.charAt(first >> 2);\n    output += BASE64URL_ALPHABET.charAt(((first & 3) << 4) | (second >> 4));\n    output += BASE64URL_ALPHABET.charAt(((second & 15) << 2) | (third >> 6));\n    output += BASE64URL_ALPHABET.charAt(third & 63);\n  }\n\n  if (index < input.length) {\n    const first = input[index++]!;\n\n    output += BASE64URL_ALPHABET.charAt(first >> 2);\n\n    if (index < input.length) {\n      const second = input[index]!;\n\n      output += BASE64URL_ALPHABET.charAt(((first & 3) << 4) | (second >> 4));\n      output += BASE64URL_ALPHABET.charAt((second & 15) << 2);\n    } else {\n      output += BASE64URL_ALPHABET.charAt((first & 3) << 4);\n    }\n  }\n\n  return output;\n};\n\nconst decodeBase64Url = (\n  value: string,\n  errorMessage = \"The stored passkey public key is invalid.\",\n): Uint8Array<ArrayBuffer> => {\n  if (\n    typeof value !== \"string\" ||\n    value.length === 0 ||\n    value.length % 4 === 1 ||\n    !/^[A-Za-z0-9_-]+$/.test(value)\n  ) {\n    throw new AuthValidationError(errorMessage);\n  }\n\n  const output: number[] = [];\n  let buffer = 0;\n  let bits = 0;\n\n  for (const character of value) {\n    const decoded = BASE64URL_ALPHABET.indexOf(character);\n\n    if (decoded < 0) {\n      throw new AuthValidationError(errorMessage);\n    }\n\n    buffer = (buffer << 6) | decoded;\n    bits += 6;\n\n    if (bits >= 8) {\n      bits -= 8;\n      output.push((buffer >>> bits) & 255);\n    }\n  }\n\n  return new Uint8Array(output);\n};\n\nconst toArrayBuffer = (bytes: Uint8Array): ArrayBuffer => {\n  const buffer = new ArrayBuffer(bytes.byteLength);\n  new Uint8Array(buffer).set(bytes);\n\n  return buffer;\n};\n\nconst toRegistrationResponse = (value: unknown): RegistrationResponseJSON => {\n  if (\n    !isRecord(value) ||\n    typeof value.id !== \"string\" ||\n    typeof value.rawId !== \"string\" ||\n    value.type !== \"public-key\" ||\n    !isRecord(value.response)\n  ) {\n    throw new AuthValidationError(\n      \"The passkey registration response is invalid.\",\n    );\n  }\n\n  return value as unknown as RegistrationResponseJSON;\n};\n\nconst toAuthenticationResponse = (\n  value: unknown,\n): AuthenticationResponseJSON => {\n  if (\n    !isRecord(value) ||\n    typeof value.id !== \"string\" ||\n    typeof value.rawId !== \"string\" ||\n    value.type !== \"public-key\" ||\n    !isRecord(value.response)\n  ) {\n    throw new AuthValidationError(\n      \"The passkey authentication response is invalid.\",\n    );\n  }\n\n  return value as unknown as AuthenticationResponseJSON;\n};\n\n/**\n * Derives a stable, opaque WebAuthn user handle from the internal Puzzle user ID.\n *\n * WebAuthn user handles are bytes, not application IDs. Hashing also prevents\n * the internal user ID from being directly exposed in authenticator data.\n */\nconst deriveWebAuthnUserId = async (\n  userId: string,\n): Promise<Uint8Array<ArrayBuffer>> => {\n  if (typeof userId !== \"string\" || userId.trim().length === 0) {\n    throw new AuthValidationError(\"A valid WebAuthn user ID is required.\");\n  }\n\n  const cryptoApi = globalThis.crypto;\n\n  if (!cryptoApi?.subtle) {\n    throw new AuthConfigurationError(\n      \"This runtime does not provide the required Web Crypto APIs.\",\n    );\n  }\n\n  const input = new TextEncoder().encode(`puzzle-webauthn-user:v1:${userId}`);\n\n  const digest = await cryptoApi.subtle.digest(\"SHA-256\", toArrayBuffer(input));\n\n  return new Uint8Array(digest);\n};\n\nconst validateChallenge = (challenge: string): void => {\n  if (\n    typeof challenge !== \"string\" ||\n    challenge.length < 32 ||\n    challenge.length > 256 ||\n    !/^[A-Za-z0-9_-]+$/.test(challenge)\n  ) {\n    throw new AuthValidationError(\"A valid WebAuthn challenge is required.\");\n  }\n};\n\nconst validateRpId = (rpId: string): void => {\n  if (\n    typeof rpId !== \"string\" ||\n    rpId.trim().length === 0 ||\n    rpId.length > 253 ||\n    rpId.includes(\"/\") ||\n    rpId.includes(\":\")\n  ) {\n    throw new AuthConfigurationError(\"The WebAuthn RP ID is invalid.\");\n  }\n};\n\nexport class SimpleWebAuthnProvider implements WebAuthnProvider {\n  async generateRegistrationOptions(input: {\n    readonly challenge: string;\n    readonly rpId: string;\n    readonly rpName: string;\n    readonly userId: string;\n    readonly userName: string;\n    readonly excludeCredentialIds: readonly string[];\n  }): Promise<WebAuthnOptionsJSON> {\n    validateChallenge(input.challenge);\n    validateRpId(input.rpId);\n\n    if (\n      typeof input.rpName !== \"string\" ||\n      input.rpName.trim().length === 0 ||\n      typeof input.userName !== \"string\" ||\n      input.userName.trim().length === 0\n    ) {\n      throw new AuthValidationError(\n        \"A WebAuthn RP name and user name are required.\",\n      );\n    }\n\n    const excludeCredentials = input.excludeCredentialIds.map((id) => {\n      if (!id || !/^[A-Za-z0-9_-]+$/.test(id)) {\n        throw new AuthValidationError(\n          \"A stored passkey credential ID is invalid.\",\n        );\n      }\n\n      return { id };\n    });\n\n    const options = await generateRegistrationOptions({\n      rpID: input.rpId,\n      rpName: input.rpName.trim(),\n      userID: await deriveWebAuthnUserId(input.userId),\n      userName: input.userName.trim(),\n      userDisplayName: input.userName.trim(),\n      challenge: decodeBase64Url(\n        input.challenge,\n        \"A valid WebAuthn challenge is required.\",\n      ),\n      attestationType: \"none\",\n      authenticatorSelection: {\n        residentKey: \"required\",\n        userVerification: \"required\",\n      },\n      excludeCredentials,\n    });\n\n    if (options.challenge !== input.challenge) {\n      throw new AuthConfigurationError(\n        \"SimpleWebAuthn returned an unexpected registration challenge.\",\n      );\n    }\n\n    return options as unknown as WebAuthnOptionsJSON;\n  }\n\n  async verifyRegistrationResponse(input: {\n    readonly response: unknown;\n    readonly expectedChallenge: string;\n    readonly expectedOrigin: string;\n    readonly expectedRpId: string;\n  }): Promise<WebAuthnRegistrationVerification> {\n    validateChallenge(input.expectedChallenge);\n    validateRpId(input.expectedRpId);\n\n    if (\n      typeof input.expectedOrigin !== \"string\" ||\n      input.expectedOrigin.length === 0\n    ) {\n      throw new AuthConfigurationError(\n        \"A WebAuthn verification origin is required.\",\n      );\n    }\n\n    const response = toRegistrationResponse(input.response);\n\n    const verification = await verifyRegistrationResponse({\n      response,\n      expectedChallenge: input.expectedChallenge,\n      expectedOrigin: input.expectedOrigin,\n      expectedRPID: input.expectedRpId,\n      requireUserVerification: true,\n    });\n\n    if (!verification.verified) {\n      return {\n        verified: false,\n        userVerified: false,\n      };\n    }\n\n    const registration = verification.registrationInfo;\n    const credential = registration.credential;\n\n    return {\n      verified: true,\n      userVerified: registration.userVerified,\n      credential: {\n        credentialId: credential.id,\n        publicKey: encodeBase64Url(credential.publicKey),\n        counter: credential.counter,\n        transports: credential.transports ?? [],\n      },\n    };\n  }\n\n  async generateAuthenticationOptions(input: {\n    readonly challenge: string;\n    readonly rpId: string;\n    readonly allowCredentialIds?: readonly string[];\n    readonly userVerification: \"required\";\n  }): Promise<WebAuthnOptionsJSON> {\n    validateChallenge(input.challenge);\n    validateRpId(input.rpId);\n\n    const allowCredentials = input.allowCredentialIds?.map((id) => {\n      if (!id || !/^[A-Za-z0-9_-]+$/.test(id)) {\n        throw new AuthValidationError(\n          \"A stored passkey credential ID is invalid.\",\n        );\n      }\n\n      return { id };\n    });\n\n    const options = await generateAuthenticationOptions({\n      rpID: input.rpId,\n      challenge: decodeBase64Url(\n        input.challenge,\n        \"A valid WebAuthn challenge is required.\",\n      ),\n      userVerification: \"required\",\n      ...(allowCredentials\n        ? {\n            allowCredentials,\n          }\n        : {}),\n    });\n\n    if (options.challenge !== input.challenge) {\n      throw new AuthConfigurationError(\n        \"SimpleWebAuthn returned an unexpected authentication challenge.\",\n      );\n    }\n\n    return options as unknown as WebAuthnOptionsJSON;\n  }\n\n  async verifyAuthenticationResponse(input: {\n    readonly response: unknown;\n    readonly expectedChallenge: string;\n    readonly expectedOrigin: string;\n    readonly expectedRpId: string;\n    readonly credential: {\n      readonly credentialId: string;\n      readonly publicKey: string;\n      readonly counter: number;\n      readonly transports?: readonly string[];\n    };\n  }): Promise<WebAuthnAuthenticationVerification> {\n    validateChallenge(input.expectedChallenge);\n    validateRpId(input.expectedRpId);\n\n    if (\n      typeof input.expectedOrigin !== \"string\" ||\n      input.expectedOrigin.length === 0\n    ) {\n      throw new AuthConfigurationError(\n        \"A WebAuthn verification origin is required.\",\n      );\n    }\n\n    const response = toAuthenticationResponse(input.response);\n\n    if (response.id !== input.credential.credentialId) {\n      return {\n        verified: false,\n        userVerified: false,\n        credentialId: response.id,\n        newCounter: input.credential.counter,\n      };\n    }\n\n    if (\n      !Number.isSafeInteger(input.credential.counter) ||\n      input.credential.counter < 0\n    ) {\n      throw new AuthValidationError(\"The stored passkey counter is invalid.\");\n    }\n\n    const credential: WebAuthnCredential = {\n      id: input.credential.credentialId,\n      publicKey: decodeBase64Url(input.credential.publicKey),\n      counter: input.credential.counter,\n    };\n\n    const verification = await verifyAuthenticationResponse({\n      response,\n      expectedChallenge: input.expectedChallenge,\n      expectedOrigin: input.expectedOrigin,\n      expectedRPID: input.expectedRpId,\n      credential,\n      requireUserVerification: true,\n    });\n\n    return {\n      verified: verification.verified,\n      userVerified:\n        verification.verified && verification.authenticationInfo.userVerified,\n      credentialId: verification.authenticationInfo.credentialID,\n      newCounter: verification.authenticationInfo.newCounter,\n    };\n  }\n}\n"],"mappings":";;;AAsBA,MAAM,qBACJ;AAEF,MAAM,YAAY,UAChB,OAAO,UAAU,YAAY,UAAU;AAEzC,MAAM,mBAAmB,UAA8B;CACrD,IAAI,SAAS;CACb,IAAI,QAAQ;CAEZ,OAAO,QAAQ,IAAI,MAAM,QAAQ;EAC/B,MAAM,QAAQ,MAAM;EACpB,MAAM,SAAS,MAAM;EACrB,MAAM,QAAQ,MAAM;EAEpB,UAAU,mBAAmB,OAAO,SAAS,CAAC;EAC9C,UAAU,mBAAmB,QAAS,QAAQ,MAAM,IAAM,UAAU,CAAE;EACtE,UAAU,mBAAmB,QAAS,SAAS,OAAO,IAAM,SAAS,CAAE;EACvE,UAAU,mBAAmB,OAAO,QAAQ,EAAE;CAChD;CAEA,IAAI,QAAQ,MAAM,QAAQ;EACxB,MAAM,QAAQ,MAAM;EAEpB,UAAU,mBAAmB,OAAO,SAAS,CAAC;EAE9C,IAAI,QAAQ,MAAM,QAAQ;GACxB,MAAM,SAAS,MAAM;GAErB,UAAU,mBAAmB,QAAS,QAAQ,MAAM,IAAM,UAAU,CAAE;GACtE,UAAU,mBAAmB,QAAQ,SAAS,OAAO,CAAC;EACxD,OACE,UAAU,mBAAmB,QAAQ,QAAQ,MAAM,CAAC;CAExD;CAEA,OAAO;AACT;AAEA,MAAM,mBACJ,OACA,eAAe,gDACa;CAC5B,IACE,OAAO,UAAU,YACjB,MAAM,WAAW,KACjB,MAAM,SAAS,MAAM,KACrB,CAAC,mBAAmB,KAAK,KAAK,GAE9B,MAAM,IAAI,oBAAoB,YAAY;CAG5C,MAAM,SAAmB,CAAC;CAC1B,IAAI,SAAS;CACb,IAAI,OAAO;CAEX,KAAK,MAAM,aAAa,OAAO;EAC7B,MAAM,UAAU,mBAAmB,QAAQ,SAAS;EAEpD,IAAI,UAAU,GACZ,MAAM,IAAI,oBAAoB,YAAY;EAG5C,SAAU,UAAU,IAAK;EACzB,QAAQ;EAER,IAAI,QAAQ,GAAG;GACb,QAAQ;GACR,OAAO,KAAM,WAAW,OAAQ,GAAG;EACrC;CACF;CAEA,OAAO,IAAI,WAAW,MAAM;AAC9B;AAEA,MAAM,iBAAiB,UAAmC;CACxD,MAAM,SAAS,IAAI,YAAY,MAAM,UAAU;CAC/C,IAAI,WAAW,MAAM,CAAC,CAAC,IAAI,KAAK;CAEhC,OAAO;AACT;AAEA,MAAM,0BAA0B,UAA6C;CAC3E,IACE,CAAC,SAAS,KAAK,KACf,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,UAAU,YACvB,MAAM,SAAS,gBACf,CAAC,SAAS,MAAM,QAAQ,GAExB,MAAM,IAAI,oBACR,+CACF;CAGF,OAAO;AACT;AAEA,MAAM,4BACJ,UAC+B;CAC/B,IACE,CAAC,SAAS,KAAK,KACf,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,UAAU,YACvB,MAAM,SAAS,gBACf,CAAC,SAAS,MAAM,QAAQ,GAExB,MAAM,IAAI,oBACR,iDACF;CAGF,OAAO;AACT;;;;;;;AAQA,MAAM,uBAAuB,OAC3B,WACqC;CACrC,IAAI,OAAO,WAAW,YAAY,OAAO,KAAK,CAAC,CAAC,WAAW,GACzD,MAAM,IAAI,oBAAoB,uCAAuC;CAGvE,MAAM,YAAY,WAAW;CAE7B,IAAI,CAAC,WAAW,QACd,MAAM,IAAI,uBACR,6DACF;CAGF,MAAM,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,2BAA2B,QAAQ;CAE1E,MAAM,SAAS,MAAM,UAAU,OAAO,OAAO,WAAW,cAAc,KAAK,CAAC;CAE5E,OAAO,IAAI,WAAW,MAAM;AAC9B;AAEA,MAAM,qBAAqB,cAA4B;CACrD,IACE,OAAO,cAAc,YACrB,UAAU,SAAS,MACnB,UAAU,SAAS,OACnB,CAAC,mBAAmB,KAAK,SAAS,GAElC,MAAM,IAAI,oBAAoB,yCAAyC;AAE3E;AAEA,MAAM,gBAAgB,SAAuB;CAC3C,IACE,OAAO,SAAS,YAChB,KAAK,KAAK,CAAC,CAAC,WAAW,KACvB,KAAK,SAAS,OACd,KAAK,SAAS,GAAG,KACjB,KAAK,SAAS,GAAG,GAEjB,MAAM,IAAI,uBAAuB,gCAAgC;AAErE;AAEA,IAAa,yBAAb,MAAgE;CAC9D,MAAM,4BAA4B,OAOD;EAC/B,kBAAkB,MAAM,SAAS;EACjC,aAAa,MAAM,IAAI;EAEvB,IACE,OAAO,MAAM,WAAW,YACxB,MAAM,OAAO,KAAK,CAAC,CAAC,WAAW,KAC/B,OAAO,MAAM,aAAa,YAC1B,MAAM,SAAS,KAAK,CAAC,CAAC,WAAW,GAEjC,MAAM,IAAI,oBACR,gDACF;EAGF,MAAM,qBAAqB,MAAM,qBAAqB,KAAK,OAAO;GAChE,IAAI,CAAC,MAAM,CAAC,mBAAmB,KAAK,EAAE,GACpC,MAAM,IAAI,oBACR,4CACF;GAGF,OAAO,EAAE,GAAG;EACd,CAAC;EAED,MAAM,UAAU,MAAM,4BAA4B;GAChD,MAAM,MAAM;GACZ,QAAQ,MAAM,OAAO,KAAK;GAC1B,QAAQ,MAAM,qBAAqB,MAAM,MAAM;GAC/C,UAAU,MAAM,SAAS,KAAK;GAC9B,iBAAiB,MAAM,SAAS,KAAK;GACrC,WAAW,gBACT,MAAM,WACN,yCACF;GACA,iBAAiB;GACjB,wBAAwB;IACtB,aAAa;IACb,kBAAkB;GACpB;GACA;EACF,CAAC;EAED,IAAI,QAAQ,cAAc,MAAM,WAC9B,MAAM,IAAI,uBACR,+DACF;EAGF,OAAO;CACT;CAEA,MAAM,2BAA2B,OAKa;EAC5C,kBAAkB,MAAM,iBAAiB;EACzC,aAAa,MAAM,YAAY;EAE/B,IACE,OAAO,MAAM,mBAAmB,YAChC,MAAM,eAAe,WAAW,GAEhC,MAAM,IAAI,uBACR,6CACF;EAGF,MAAM,WAAW,uBAAuB,MAAM,QAAQ;EAEtD,MAAM,eAAe,MAAM,2BAA2B;GACpD;GACA,mBAAmB,MAAM;GACzB,gBAAgB,MAAM;GACtB,cAAc,MAAM;GACpB,yBAAyB;EAC3B,CAAC;EAED,IAAI,CAAC,aAAa,UAChB,OAAO;GACL,UAAU;GACV,cAAc;EAChB;EAGF,MAAM,eAAe,aAAa;EAClC,MAAM,aAAa,aAAa;EAEhC,OAAO;GACL,UAAU;GACV,cAAc,aAAa;GAC3B,YAAY;IACV,cAAc,WAAW;IACzB,WAAW,gBAAgB,WAAW,SAAS;IAC/C,SAAS,WAAW;IACpB,YAAY,WAAW,cAAc,CAAC;GACxC;EACF;CACF;CAEA,MAAM,8BAA8B,OAKH;EAC/B,kBAAkB,MAAM,SAAS;EACjC,aAAa,MAAM,IAAI;EAEvB,MAAM,mBAAmB,MAAM,oBAAoB,KAAK,OAAO;GAC7D,IAAI,CAAC,MAAM,CAAC,mBAAmB,KAAK,EAAE,GACpC,MAAM,IAAI,oBACR,4CACF;GAGF,OAAO,EAAE,GAAG;EACd,CAAC;EAED,MAAM,UAAU,MAAM,8BAA8B;GAClD,MAAM,MAAM;GACZ,WAAW,gBACT,MAAM,WACN,yCACF;GACA,kBAAkB;GAClB,GAAI,mBACA,EACE,iBACF,IACA,CAAC;EACP,CAAC;EAED,IAAI,QAAQ,cAAc,MAAM,WAC9B,MAAM,IAAI,uBACR,iEACF;EAGF,OAAO;CACT;CAEA,MAAM,6BAA6B,OAWa;EAC9C,kBAAkB,MAAM,iBAAiB;EACzC,aAAa,MAAM,YAAY;EAE/B,IACE,OAAO,MAAM,mBAAmB,YAChC,MAAM,eAAe,WAAW,GAEhC,MAAM,IAAI,uBACR,6CACF;EAGF,MAAM,WAAW,yBAAyB,MAAM,QAAQ;EAExD,IAAI,SAAS,OAAO,MAAM,WAAW,cACnC,OAAO;GACL,UAAU;GACV,cAAc;GACd,cAAc,SAAS;GACvB,YAAY,MAAM,WAAW;EAC/B;EAGF,IACE,CAAC,OAAO,cAAc,MAAM,WAAW,OAAO,KAC9C,MAAM,WAAW,UAAU,GAE3B,MAAM,IAAI,oBAAoB,wCAAwC;EAGxE,MAAM,aAAiC;GACrC,IAAI,MAAM,WAAW;GACrB,WAAW,gBAAgB,MAAM,WAAW,SAAS;GACrD,SAAS,MAAM,WAAW;EAC5B;EAEA,MAAM,eAAe,MAAM,6BAA6B;GACtD;GACA,mBAAmB,MAAM;GACzB,gBAAgB,MAAM;GACtB,cAAc,MAAM;GACpB;GACA,yBAAyB;EAC3B,CAAC;EAED,OAAO;GACL,UAAU,aAAa;GACvB,cACE,aAAa,YAAY,aAAa,mBAAmB;GAC3D,cAAc,aAAa,mBAAmB;GAC9C,YAAY,aAAa,mBAAmB;EAC9C;CACF;AACF"}

package/dist/providers/webcrypto-secret-protector.cjs

@@ -0,0 +1,118 @@
+const require_auth_errors = require("../errors/auth.errors.cjs");
+// src/providers/webcrypto-secret-protector.ts
+const BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+const ADDITIONAL_DATA_PREFIX = "puzzle-auth:totp:v1:";
+const getCrypto = () => {
+	const cryptoApi = globalThis.crypto;
+	if (!cryptoApi?.getRandomValues || !cryptoApi.subtle) throw new require_auth_errors.AuthConfigurationError("This runtime does not provide the required Web Crypto APIs.");
+	return cryptoApi;
+};
+const encodeBase64Url = (bytes) => {
+	let result = "";
+	let index = 0;
+	while (index + 2 < bytes.length) {
+		const first = bytes[index++];
+		const second = bytes[index++];
+		const third = bytes[index++];
+		result += BASE64URL_ALPHABET[first >> 2];
+		result += BASE64URL_ALPHABET[(first & 3) << 4 | second >> 4];
+		result += BASE64URL_ALPHABET[(second & 15) << 2 | third >> 6];
+		result += BASE64URL_ALPHABET[third & 63];
+	}
+	if (index < bytes.length) {
+		const first = bytes[index++];
+		result += BASE64URL_ALPHABET[first >> 2];
+		if (index < bytes.length) {
+			const second = bytes[index];
+			result += BASE64URL_ALPHABET[(first & 3) << 4 | second >> 4];
+			result += BASE64URL_ALPHABET[(second & 15) << 2];
+		} else result += BASE64URL_ALPHABET[(first & 3) << 4];
+	}
+	return result;
+};
+const decodeBase64Url = (value) => {
+	if (typeof value !== "string" || value.length === 0 || !/^[A-Za-z0-9_-]+$/.test(value) || value.length % 4 === 1) throw new require_auth_errors.AuthConfigurationError("The encrypted authentication secret is malformed.");
+	const bytes = [];
+	let buffer = 0;
+	let bits = 0;
+	for (const character of value) {
+		const decoded = BASE64URL_ALPHABET.indexOf(character);
+		if (decoded < 0) throw new require_auth_errors.AuthConfigurationError("The encrypted authentication secret is malformed.");
+		buffer = buffer << 6 | decoded;
+		bits += 6;
+		if (bits >= 8) {
+			bits -= 8;
+			bytes.push(buffer >>> bits & 255);
+		}
+	}
+	return new Uint8Array(bytes);
+};
+const toArrayBuffer = (bytes) => bytes.slice().buffer;
+var WebCryptoAuthSecretProtector = class {
+	currentKeyId;
+	keys;
+	importedKeys = /* @__PURE__ */ new Map();
+	constructor(options) {
+		if (typeof options.currentKeyId !== "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(options.currentKeyId)) throw new require_auth_errors.AuthConfigurationError("A valid authentication encryption key ID is required.");
+		const keys = {};
+		for (const [keyId, key] of Object.entries(options.keys)) {
+			if (!/^[A-Za-z0-9_-]{1,64}$/.test(keyId) || !(key instanceof Uint8Array) || key.byteLength !== 32) throw new require_auth_errors.AuthConfigurationError("Authentication encryption keys must be 32-byte Uint8Array values with valid IDs.");
+			keys[keyId] = key.slice();
+		}
+		if (!keys[options.currentKeyId]) throw new require_auth_errors.AuthConfigurationError("The current authentication encryption key is not configured.");
+		this.currentKeyId = options.currentKeyId;
+		this.keys = keys;
+	}
+	getKey(keyId) {
+		const existing = this.importedKeys.get(keyId);
+		if (existing) return existing;
+		const rawKey = this.keys[keyId];
+		if (!rawKey) throw new require_auth_errors.AuthConfigurationError(`Authentication encryption key "${keyId}" is unavailable.`);
+		const imported = getCrypto().subtle.importKey("raw", toArrayBuffer(rawKey), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+		this.importedKeys.set(keyId, imported);
+		return imported;
+	}
+	async encrypt(plaintext) {
+		if (typeof plaintext !== "string" || plaintext.length === 0) throw new require_auth_errors.AuthConfigurationError("A non-empty authentication secret is required.");
+		const cryptoApi = getCrypto();
+		const iv = /* @__PURE__ */ new Uint8Array(12);
+		cryptoApi.getRandomValues(iv);
+		try {
+			const key = await this.getKey(this.currentKeyId);
+			const encrypted = await cryptoApi.subtle.encrypt({
+				name: "AES-GCM",
+				iv: toArrayBuffer(iv),
+				additionalData: toArrayBuffer(new TextEncoder().encode(`${ADDITIONAL_DATA_PREFIX}${this.currentKeyId}`)),
+				tagLength: 128
+			}, key, toArrayBuffer(new TextEncoder().encode(plaintext)));
+			return {
+				ciphertext: encodeBase64Url(new Uint8Array(encrypted)),
+				iv: encodeBase64Url(iv),
+				keyId: this.currentKeyId
+			};
+		} catch (error) {
+			throw new require_auth_errors.AuthConfigurationError("Could not encrypt the authentication secret.", { cause: error });
+		}
+	}
+	async decrypt(secret) {
+		if (!secret || typeof secret.keyId !== "string" || typeof secret.ciphertext !== "string" || typeof secret.iv !== "string") throw new require_auth_errors.AuthConfigurationError("The encrypted authentication secret is incomplete.");
+		const iv = decodeBase64Url(secret.iv);
+		const ciphertext = decodeBase64Url(secret.ciphertext);
+		if (iv.byteLength !== 12 || ciphertext.byteLength < 16) throw new require_auth_errors.AuthConfigurationError("The encrypted authentication secret is malformed.");
+		try {
+			const key = await this.getKey(secret.keyId);
+			const plaintext = await getCrypto().subtle.decrypt({
+				name: "AES-GCM",
+				iv: toArrayBuffer(iv),
+				additionalData: toArrayBuffer(new TextEncoder().encode(`${ADDITIONAL_DATA_PREFIX}${secret.keyId}`)),
+				tagLength: 128
+			}, key, toArrayBuffer(ciphertext));
+			return new TextDecoder("utf-8", { fatal: true }).decode(plaintext);
+		} catch (error) {
+			throw new require_auth_errors.AuthConfigurationError("Could not decrypt the authentication secret.", { cause: error });
+		}
+	}
+};
+exports.WebCryptoAuthSecretProtector = WebCryptoAuthSecretProtector;
+
+//# sourceMappingURL=webcrypto-secret-protector.cjs.map

package/dist/providers/webcrypto-secret-protector.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"webcrypto-secret-protector.cjs","names":["AuthConfigurationError"],"sources":["../../src/providers/webcrypto-secret-protector.ts"],"sourcesContent":["import { AuthConfigurationError } from \"../errors/auth.errors\";\n\nimport type {\n  AuthSecretProtector,\n  ProtectedAuthSecret,\n} from \"./mfa-provider.types\";\n\nexport type WebCryptoAuthSecretProtectorOptions = {\n  readonly currentKeyId: string;\n  readonly keys: Readonly<Record<string, Uint8Array>>;\n};\n\nconst BASE64URL_ALPHABET =\n  \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n\nconst ADDITIONAL_DATA_PREFIX = \"puzzle-auth:totp:v1:\";\n\nconst getCrypto = (): Crypto => {\n  const cryptoApi = globalThis.crypto;\n\n  if (!cryptoApi?.getRandomValues || !cryptoApi.subtle) {\n    throw new AuthConfigurationError(\n      \"This runtime does not provide the required Web Crypto APIs.\",\n    );\n  }\n\n  return cryptoApi;\n};\n\nconst encodeBase64Url = (bytes: Uint8Array): string => {\n  let result = \"\";\n  let index = 0;\n\n  while (index + 2 < bytes.length) {\n    const first = bytes[index++]!;\n    const second = bytes[index++]!;\n    const third = bytes[index++]!;\n\n    result += BASE64URL_ALPHABET[first >> 2];\n    result += BASE64URL_ALPHABET[((first & 3) << 4) | (second >> 4)];\n    result += BASE64URL_ALPHABET[((second & 15) << 2) | (third >> 6)];\n    result += BASE64URL_ALPHABET[third & 63];\n  }\n\n  if (index < bytes.length) {\n    const first = bytes[index++]!;\n\n    result += BASE64URL_ALPHABET[first >> 2];\n\n    if (index < bytes.length) {\n      const second = bytes[index]!;\n\n      result += BASE64URL_ALPHABET[((first & 3) << 4) | (second >> 4)];\n      result += BASE64URL_ALPHABET[(second & 15) << 2];\n    } else {\n      result += BASE64URL_ALPHABET[(first & 3) << 4];\n    }\n  }\n\n  return result;\n};\n\nconst decodeBase64Url = (value: string): Uint8Array => {\n  if (\n    typeof value !== \"string\" ||\n    value.length === 0 ||\n    !/^[A-Za-z0-9_-]+$/.test(value) ||\n    value.length % 4 === 1\n  ) {\n    throw new AuthConfigurationError(\n      \"The encrypted authentication secret is malformed.\",\n    );\n  }\n\n  const bytes: number[] = [];\n  let buffer = 0;\n  let bits = 0;\n\n  for (const character of value) {\n    const decoded = BASE64URL_ALPHABET.indexOf(character);\n\n    if (decoded < 0) {\n      throw new AuthConfigurationError(\n        \"The encrypted authentication secret is malformed.\",\n      );\n    }\n\n    buffer = (buffer << 6) | decoded;\n    bits += 6;\n\n    if (bits >= 8) {\n      bits -= 8;\n      bytes.push((buffer >>> bits) & 255);\n    }\n  }\n\n  return new Uint8Array(bytes);\n};\n\nconst toArrayBuffer = (bytes: Uint8Array): ArrayBuffer =>\n  bytes.slice().buffer as ArrayBuffer;\n\nexport class WebCryptoAuthSecretProtector implements AuthSecretProtector {\n  private readonly currentKeyId: string;\n  private readonly keys: Readonly<Record<string, Uint8Array>>;\n\n  private readonly importedKeys = new Map<string, Promise<CryptoKey>>();\n\n  constructor(options: WebCryptoAuthSecretProtectorOptions) {\n    if (\n      typeof options.currentKeyId !== \"string\" ||\n      !/^[A-Za-z0-9_-]{1,64}$/.test(options.currentKeyId)\n    ) {\n      throw new AuthConfigurationError(\n        \"A valid authentication encryption key ID is required.\",\n      );\n    }\n\n    const keys: Record<string, Uint8Array> = {};\n\n    for (const [keyId, key] of Object.entries(options.keys)) {\n      if (\n        !/^[A-Za-z0-9_-]{1,64}$/.test(keyId) ||\n        !(key instanceof Uint8Array) ||\n        key.byteLength !== 32\n      ) {\n        throw new AuthConfigurationError(\n          \"Authentication encryption keys must be 32-byte Uint8Array values with valid IDs.\",\n        );\n      }\n\n      keys[keyId] = key.slice();\n    }\n\n    if (!keys[options.currentKeyId]) {\n      throw new AuthConfigurationError(\n        \"The current authentication encryption key is not configured.\",\n      );\n    }\n\n    this.currentKeyId = options.currentKeyId;\n    this.keys = keys;\n  }\n\n  private getKey(keyId: string): Promise<CryptoKey> {\n    const existing = this.importedKeys.get(keyId);\n\n    if (existing) return existing;\n\n    const rawKey = this.keys[keyId];\n\n    if (!rawKey) {\n      throw new AuthConfigurationError(\n        `Authentication encryption key \"${keyId}\" is unavailable.`,\n      );\n    }\n\n    const imported = getCrypto().subtle.importKey(\n      \"raw\",\n      toArrayBuffer(rawKey),\n      { name: \"AES-GCM\" },\n      false,\n      [\"encrypt\", \"decrypt\"],\n    );\n\n    this.importedKeys.set(keyId, imported);\n\n    return imported;\n  }\n\n  async encrypt(plaintext: string): Promise<ProtectedAuthSecret> {\n    if (typeof plaintext !== \"string\" || plaintext.length === 0) {\n      throw new AuthConfigurationError(\n        \"A non-empty authentication secret is required.\",\n      );\n    }\n\n    const cryptoApi = getCrypto();\n    const iv = new Uint8Array(12);\n\n    cryptoApi.getRandomValues(iv);\n\n    try {\n      const key = await this.getKey(this.currentKeyId);\n\n      const encrypted = await cryptoApi.subtle.encrypt(\n        {\n          name: \"AES-GCM\",\n          iv: toArrayBuffer(iv),\n          additionalData: toArrayBuffer(\n            new TextEncoder().encode(\n              `${ADDITIONAL_DATA_PREFIX}${this.currentKeyId}`,\n            ),\n          ),\n          tagLength: 128,\n        },\n        key,\n        toArrayBuffer(new TextEncoder().encode(plaintext)),\n      );\n\n      return {\n        ciphertext: encodeBase64Url(new Uint8Array(encrypted)),\n        iv: encodeBase64Url(iv),\n        keyId: this.currentKeyId,\n      };\n    } catch (error) {\n      throw new AuthConfigurationError(\n        \"Could not encrypt the authentication secret.\",\n        { cause: error },\n      );\n    }\n  }\n\n  async decrypt(secret: ProtectedAuthSecret): Promise<string> {\n    if (\n      !secret ||\n      typeof secret.keyId !== \"string\" ||\n      typeof secret.ciphertext !== \"string\" ||\n      typeof secret.iv !== \"string\"\n    ) {\n      throw new AuthConfigurationError(\n        \"The encrypted authentication secret is incomplete.\",\n      );\n    }\n\n    const iv = decodeBase64Url(secret.iv);\n    const ciphertext = decodeBase64Url(secret.ciphertext);\n\n    if (iv.byteLength !== 12 || ciphertext.byteLength < 16) {\n      throw new AuthConfigurationError(\n        \"The encrypted authentication secret is malformed.\",\n      );\n    }\n\n    try {\n      const key = await this.getKey(secret.keyId);\n\n      const plaintext = await getCrypto().subtle.decrypt(\n        {\n          name: \"AES-GCM\",\n          iv: toArrayBuffer(iv),\n          additionalData: toArrayBuffer(\n            new TextEncoder().encode(\n              `${ADDITIONAL_DATA_PREFIX}${secret.keyId}`,\n            ),\n          ),\n          tagLength: 128,\n        },\n        key,\n        toArrayBuffer(ciphertext),\n      );\n\n      return new TextDecoder(\"utf-8\", { fatal: true }).decode(plaintext);\n    } catch (error) {\n      throw new AuthConfigurationError(\n        \"Could not decrypt the authentication secret.\",\n        { cause: error },\n      );\n    }\n  }\n}\n"],"mappings":";;AAYA,MAAM,qBACJ;AAEF,MAAM,yBAAyB;AAE/B,MAAM,kBAA0B;CAC9B,MAAM,YAAY,WAAW;CAE7B,IAAI,CAAC,WAAW,mBAAmB,CAAC,UAAU,QAC5C,MAAM,IAAIA,oBAAAA,uBACR,6DACF;CAGF,OAAO;AACT;AAEA,MAAM,mBAAmB,UAA8B;CACrD,IAAI,SAAS;CACb,IAAI,QAAQ;CAEZ,OAAO,QAAQ,IAAI,MAAM,QAAQ;EAC/B,MAAM,QAAQ,MAAM;EACpB,MAAM,SAAS,MAAM;EACrB,MAAM,QAAQ,MAAM;EAEpB,UAAU,mBAAmB,SAAS;EACtC,UAAU,oBAAqB,QAAQ,MAAM,IAAM,UAAU;EAC7D,UAAU,oBAAqB,SAAS,OAAO,IAAM,SAAS;EAC9D,UAAU,mBAAmB,QAAQ;CACvC;CAEA,IAAI,QAAQ,MAAM,QAAQ;EACxB,MAAM,QAAQ,MAAM;EAEpB,UAAU,mBAAmB,SAAS;EAEtC,IAAI,QAAQ,MAAM,QAAQ;GACxB,MAAM,SAAS,MAAM;GAErB,UAAU,oBAAqB,QAAQ,MAAM,IAAM,UAAU;GAC7D,UAAU,oBAAoB,SAAS,OAAO;EAChD,OACE,UAAU,oBAAoB,QAAQ,MAAM;CAEhD;CAEA,OAAO;AACT;AAEA,MAAM,mBAAmB,UAA8B;CACrD,IACE,OAAO,UAAU,YACjB,MAAM,WAAW,KACjB,CAAC,mBAAmB,KAAK,KAAK,KAC9B,MAAM,SAAS,MAAM,GAErB,MAAM,IAAIA,oBAAAA,uBACR,mDACF;CAGF,MAAM,QAAkB,CAAC;CACzB,IAAI,SAAS;CACb,IAAI,OAAO;CAEX,KAAK,MAAM,aAAa,OAAO;EAC7B,MAAM,UAAU,mBAAmB,QAAQ,SAAS;EAEpD,IAAI,UAAU,GACZ,MAAM,IAAIA,oBAAAA,uBACR,mDACF;EAGF,SAAU,UAAU,IAAK;EACzB,QAAQ;EAER,IAAI,QAAQ,GAAG;GACb,QAAQ;GACR,MAAM,KAAM,WAAW,OAAQ,GAAG;EACpC;CACF;CAEA,OAAO,IAAI,WAAW,KAAK;AAC7B;AAEA,MAAM,iBAAiB,UACrB,MAAM,MAAM,CAAC,CAAC;AAEhB,IAAa,+BAAb,MAAyE;CACvE;CACA;CAEA,+BAAgC,IAAI,IAAgC;CAEpE,YAAY,SAA8C;EACxD,IACE,OAAO,QAAQ,iBAAiB,YAChC,CAAC,wBAAwB,KAAK,QAAQ,YAAY,GAElD,MAAM,IAAIA,oBAAAA,uBACR,uDACF;EAGF,MAAM,OAAmC,CAAC;EAE1C,KAAK,MAAM,CAAC,OAAO,QAAQ,OAAO,QAAQ,QAAQ,IAAI,GAAG;GACvD,IACE,CAAC,wBAAwB,KAAK,KAAK,KACnC,EAAE,eAAe,eACjB,IAAI,eAAe,IAEnB,MAAM,IAAIA,oBAAAA,uBACR,kFACF;GAGF,KAAK,SAAS,IAAI,MAAM;EAC1B;EAEA,IAAI,CAAC,KAAK,QAAQ,eAChB,MAAM,IAAIA,oBAAAA,uBACR,8DACF;EAGF,KAAK,eAAe,QAAQ;EAC5B,KAAK,OAAO;CACd;CAEA,OAAe,OAAmC;EAChD,MAAM,WAAW,KAAK,aAAa,IAAI,KAAK;EAE5C,IAAI,UAAU,OAAO;EAErB,MAAM,SAAS,KAAK,KAAK;EAEzB,IAAI,CAAC,QACH,MAAM,IAAIA,oBAAAA,uBACR,kCAAkC,MAAM,kBAC1C;EAGF,MAAM,WAAW,UAAU,CAAC,CAAC,OAAO,UAClC,OACA,cAAc,MAAM,GACpB,EAAE,MAAM,UAAU,GAClB,OACA,CAAC,WAAW,SAAS,CACvB;EAEA,KAAK,aAAa,IAAI,OAAO,QAAQ;EAErC,OAAO;CACT;CAEA,MAAM,QAAQ,WAAiD;EAC7D,IAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GACxD,MAAM,IAAIA,oBAAAA,uBACR,gDACF;EAGF,MAAM,YAAY,UAAU;EAC5B,MAAM,qBAAK,IAAI,WAAW,EAAE;EAE5B,UAAU,gBAAgB,EAAE;EAE5B,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,OAAO,KAAK,YAAY;GAE/C,MAAM,YAAY,MAAM,UAAU,OAAO,QACvC;IACE,MAAM;IACN,IAAI,cAAc,EAAE;IACpB,gBAAgB,cACd,IAAI,YAAY,CAAC,CAAC,OAChB,GAAG,yBAAyB,KAAK,cACnC,CACF;IACA,WAAW;GACb,GACA,KACA,cAAc,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS,CAAC,CACnD;GAEA,OAAO;IACL,YAAY,gBAAgB,IAAI,WAAW,SAAS,CAAC;IACrD,IAAI,gBAAgB,EAAE;IACtB,OAAO,KAAK;GACd;EACF,SAAS,OAAO;GACd,MAAM,IAAIA,oBAAAA,uBACR,gDACA,EAAE,OAAO,MAAM,CACjB;EACF;CACF;CAEA,MAAM,QAAQ,QAA8C;EAC1D,IACE,CAAC,UACD,OAAO,OAAO,UAAU,YACxB,OAAO,OAAO,eAAe,YAC7B,OAAO,OAAO,OAAO,UAErB,MAAM,IAAIA,oBAAAA,uBACR,oDACF;EAGF,MAAM,KAAK,gBAAgB,OAAO,EAAE;EACpC,MAAM,aAAa,gBAAgB,OAAO,UAAU;EAEpD,IAAI,GAAG,eAAe,MAAM,WAAW,aAAa,IAClD,MAAM,IAAIA,oBAAAA,uBACR,mDACF;EAGF,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,OAAO,OAAO,KAAK;GAE1C,MAAM,YAAY,MAAM,UAAU,CAAC,CAAC,OAAO,QACzC;IACE,MAAM;IACN,IAAI,cAAc,EAAE;IACpB,gBAAgB,cACd,IAAI,YAAY,CAAC,CAAC,OAChB,GAAG,yBAAyB,OAAO,OACrC,CACF;IACA,WAAW;GACb,GACA,KACA,cAAc,UAAU,CAC1B;GAEA,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,SAAS;EACnE,SAAS,OAAO;GACd,MAAM,IAAIA,oBAAAA,uBACR,gDACA,EAAE,OAAO,MAAM,CACjB;EACF;CACF;AACF"}

package/dist/providers/webcrypto-secret-protector.d.cts

@@ -0,0 +1,14 @@
+import { AuthSecretProtector, ProtectedAuthSecret } from "./mfa-provider.types.cjs";
+export type WebCryptoAuthSecretProtectorOptions = {
+  readonly currentKeyId: string;
+  readonly keys: Readonly<Record<string, Uint8Array>>;
+};
+export declare class WebCryptoAuthSecretProtector implements AuthSecretProtector {
+  private readonly currentKeyId;
+  private readonly keys;
+  private readonly importedKeys;
+  constructor(options: WebCryptoAuthSecretProtectorOptions);
+  private getKey;
+  encrypt(plaintext: string): Promise<ProtectedAuthSecret>;
+  decrypt(secret: ProtectedAuthSecret): Promise<string>;
+}

package/dist/providers/webcrypto-secret-protector.d.ts

@@ -0,0 +1,14 @@
+import { AuthSecretProtector, ProtectedAuthSecret } from "./mfa-provider.types.js";
+export type WebCryptoAuthSecretProtectorOptions = {
+  readonly currentKeyId: string;
+  readonly keys: Readonly<Record<string, Uint8Array>>;
+};
+export declare class WebCryptoAuthSecretProtector implements AuthSecretProtector {
+  private readonly currentKeyId;
+  private readonly keys;
+  private readonly importedKeys;
+  constructor(options: WebCryptoAuthSecretProtectorOptions);
+  private getKey;
+  encrypt(plaintext: string): Promise<ProtectedAuthSecret>;
+  decrypt(secret: ProtectedAuthSecret): Promise<string>;
+}

package/dist/providers/webcrypto-secret-protector.js

@@ -0,0 +1,118 @@
+import { AuthConfigurationError } from "../errors/auth.errors.js";
+// src/providers/webcrypto-secret-protector.ts
+const BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+const ADDITIONAL_DATA_PREFIX = "puzzle-auth:totp:v1:";
+const getCrypto = () => {
+	const cryptoApi = globalThis.crypto;
+	if (!cryptoApi?.getRandomValues || !cryptoApi.subtle) throw new AuthConfigurationError("This runtime does not provide the required Web Crypto APIs.");
+	return cryptoApi;
+};
+const encodeBase64Url = (bytes) => {
+	let result = "";
+	let index = 0;
+	while (index + 2 < bytes.length) {
+		const first = bytes[index++];
+		const second = bytes[index++];
+		const third = bytes[index++];
+		result += BASE64URL_ALPHABET[first >> 2];
+		result += BASE64URL_ALPHABET[(first & 3) << 4 | second >> 4];
+		result += BASE64URL_ALPHABET[(second & 15) << 2 | third >> 6];
+		result += BASE64URL_ALPHABET[third & 63];
+	}
+	if (index < bytes.length) {
+		const first = bytes[index++];
+		result += BASE64URL_ALPHABET[first >> 2];
+		if (index < bytes.length) {
+			const second = bytes[index];
+			result += BASE64URL_ALPHABET[(first & 3) << 4 | second >> 4];
+			result += BASE64URL_ALPHABET[(second & 15) << 2];
+		} else result += BASE64URL_ALPHABET[(first & 3) << 4];
+	}
+	return result;
+};
+const decodeBase64Url = (value) => {
+	if (typeof value !== "string" || value.length === 0 || !/^[A-Za-z0-9_-]+$/.test(value) || value.length % 4 === 1) throw new AuthConfigurationError("The encrypted authentication secret is malformed.");
+	const bytes = [];
+	let buffer = 0;
+	let bits = 0;
+	for (const character of value) {
+		const decoded = BASE64URL_ALPHABET.indexOf(character);
+		if (decoded < 0) throw new AuthConfigurationError("The encrypted authentication secret is malformed.");
+		buffer = buffer << 6 | decoded;
+		bits += 6;
+		if (bits >= 8) {
+			bits -= 8;
+			bytes.push(buffer >>> bits & 255);
+		}
+	}
+	return new Uint8Array(bytes);
+};
+const toArrayBuffer = (bytes) => bytes.slice().buffer;
+var WebCryptoAuthSecretProtector = class {
+	currentKeyId;
+	keys;
+	importedKeys = /* @__PURE__ */ new Map();
+	constructor(options) {
+		if (typeof options.currentKeyId !== "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(options.currentKeyId)) throw new AuthConfigurationError("A valid authentication encryption key ID is required.");
+		const keys = {};
+		for (const [keyId, key] of Object.entries(options.keys)) {
+			if (!/^[A-Za-z0-9_-]{1,64}$/.test(keyId) || !(key instanceof Uint8Array) || key.byteLength !== 32) throw new AuthConfigurationError("Authentication encryption keys must be 32-byte Uint8Array values with valid IDs.");
+			keys[keyId] = key.slice();
+		}
+		if (!keys[options.currentKeyId]) throw new AuthConfigurationError("The current authentication encryption key is not configured.");
+		this.currentKeyId = options.currentKeyId;
+		this.keys = keys;
+	}
+	getKey(keyId) {
+		const existing = this.importedKeys.get(keyId);
+		if (existing) return existing;
+		const rawKey = this.keys[keyId];
+		if (!rawKey) throw new AuthConfigurationError(`Authentication encryption key "${keyId}" is unavailable.`);
+		const imported = getCrypto().subtle.importKey("raw", toArrayBuffer(rawKey), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+		this.importedKeys.set(keyId, imported);
+		return imported;
+	}
+	async encrypt(plaintext) {
+		if (typeof plaintext !== "string" || plaintext.length === 0) throw new AuthConfigurationError("A non-empty authentication secret is required.");
+		const cryptoApi = getCrypto();
+		const iv = /* @__PURE__ */ new Uint8Array(12);
+		cryptoApi.getRandomValues(iv);
+		try {
+			const key = await this.getKey(this.currentKeyId);
+			const encrypted = await cryptoApi.subtle.encrypt({
+				name: "AES-GCM",
+				iv: toArrayBuffer(iv),
+				additionalData: toArrayBuffer(new TextEncoder().encode(`${ADDITIONAL_DATA_PREFIX}${this.currentKeyId}`)),
+				tagLength: 128
+			}, key, toArrayBuffer(new TextEncoder().encode(plaintext)));
+			return {
+				ciphertext: encodeBase64Url(new Uint8Array(encrypted)),
+				iv: encodeBase64Url(iv),
+				keyId: this.currentKeyId
+			};
+		} catch (error) {
+			throw new AuthConfigurationError("Could not encrypt the authentication secret.", { cause: error });
+		}
+	}
+	async decrypt(secret) {
+		if (!secret || typeof secret.keyId !== "string" || typeof secret.ciphertext !== "string" || typeof secret.iv !== "string") throw new AuthConfigurationError("The encrypted authentication secret is incomplete.");
+		const iv = decodeBase64Url(secret.iv);
+		const ciphertext = decodeBase64Url(secret.ciphertext);
+		if (iv.byteLength !== 12 || ciphertext.byteLength < 16) throw new AuthConfigurationError("The encrypted authentication secret is malformed.");
+		try {
+			const key = await this.getKey(secret.keyId);
+			const plaintext = await getCrypto().subtle.decrypt({
+				name: "AES-GCM",
+				iv: toArrayBuffer(iv),
+				additionalData: toArrayBuffer(new TextEncoder().encode(`${ADDITIONAL_DATA_PREFIX}${secret.keyId}`)),
+				tagLength: 128
+			}, key, toArrayBuffer(ciphertext));
+			return new TextDecoder("utf-8", { fatal: true }).decode(plaintext);
+		} catch (error) {
+			throw new AuthConfigurationError("Could not decrypt the authentication secret.", { cause: error });
+		}
+	}
+};
+export { WebCryptoAuthSecretProtector };
+
+//# sourceMappingURL=webcrypto-secret-protector.js.map

package/dist/providers/webcrypto-secret-protector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webcrypto-secret-protector.js","names":[],"sources":["../../src/providers/webcrypto-secret-protector.ts"],"sourcesContent":["import { AuthConfigurationError } from \"../errors/auth.errors\";\n\nimport type {\n  AuthSecretProtector,\n  ProtectedAuthSecret,\n} from \"./mfa-provider.types\";\n\nexport type WebCryptoAuthSecretProtectorOptions = {\n  readonly currentKeyId: string;\n  readonly keys: Readonly<Record<string, Uint8Array>>;\n};\n\nconst BASE64URL_ALPHABET =\n  \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n\nconst ADDITIONAL_DATA_PREFIX = \"puzzle-auth:totp:v1:\";\n\nconst getCrypto = (): Crypto => {\n  const cryptoApi = globalThis.crypto;\n\n  if (!cryptoApi?.getRandomValues || !cryptoApi.subtle) {\n    throw new AuthConfigurationError(\n      \"This runtime does not provide the required Web Crypto APIs.\",\n    );\n  }\n\n  return cryptoApi;\n};\n\nconst encodeBase64Url = (bytes: Uint8Array): string => {\n  let result = \"\";\n  let index = 0;\n\n  while (index + 2 < bytes.length) {\n    const first = bytes[index++]!;\n    const second = bytes[index++]!;\n    const third = bytes[index++]!;\n\n    result += BASE64URL_ALPHABET[first >> 2];\n    result += BASE64URL_ALPHABET[((first & 3) << 4) | (second >> 4)];\n    result += BASE64URL_ALPHABET[((second & 15) << 2) | (third >> 6)];\n    result += BASE64URL_ALPHABET[third & 63];\n  }\n\n  if (index < bytes.length) {\n    const first = bytes[index++]!;\n\n    result += BASE64URL_ALPHABET[first >> 2];\n\n    if (index < bytes.length) {\n      const second = bytes[index]!;\n\n      result += BASE64URL_ALPHABET[((first & 3) << 4) | (second >> 4)];\n      result += BASE64URL_ALPHABET[(second & 15) << 2];\n    } else {\n      result += BASE64URL_ALPHABET[(first & 3) << 4];\n    }\n  }\n\n  return result;\n};\n\nconst decodeBase64Url = (value: string): Uint8Array => {\n  if (\n    typeof value !== \"string\" ||\n    value.length === 0 ||\n    !/^[A-Za-z0-9_-]+$/.test(value) ||\n    value.length % 4 === 1\n  ) {\n    throw new AuthConfigurationError(\n      \"The encrypted authentication secret is malformed.\",\n    );\n  }\n\n  const bytes: number[] = [];\n  let buffer = 0;\n  let bits = 0;\n\n  for (const character of value) {\n    const decoded = BASE64URL_ALPHABET.indexOf(character);\n\n    if (decoded < 0) {\n      throw new AuthConfigurationError(\n        \"The encrypted authentication secret is malformed.\",\n      );\n    }\n\n    buffer = (buffer << 6) | decoded;\n    bits += 6;\n\n    if (bits >= 8) {\n      bits -= 8;\n      bytes.push((buffer >>> bits) & 255);\n    }\n  }\n\n  return new Uint8Array(bytes);\n};\n\nconst toArrayBuffer = (bytes: Uint8Array): ArrayBuffer =>\n  bytes.slice().buffer as ArrayBuffer;\n\nexport class WebCryptoAuthSecretProtector implements AuthSecretProtector {\n  private readonly currentKeyId: string;\n  private readonly keys: Readonly<Record<string, Uint8Array>>;\n\n  private readonly importedKeys = new Map<string, Promise<CryptoKey>>();\n\n  constructor(options: WebCryptoAuthSecretProtectorOptions) {\n    if (\n      typeof options.currentKeyId !== \"string\" ||\n      !/^[A-Za-z0-9_-]{1,64}$/.test(options.currentKeyId)\n    ) {\n      throw new AuthConfigurationError(\n        \"A valid authentication encryption key ID is required.\",\n      );\n    }\n\n    const keys: Record<string, Uint8Array> = {};\n\n    for (const [keyId, key] of Object.entries(options.keys)) {\n      if (\n        !/^[A-Za-z0-9_-]{1,64}$/.test(keyId) ||\n        !(key instanceof Uint8Array) ||\n        key.byteLength !== 32\n      ) {\n        throw new AuthConfigurationError(\n          \"Authentication encryption keys must be 32-byte Uint8Array values with valid IDs.\",\n        );\n      }\n\n      keys[keyId] = key.slice();\n    }\n\n    if (!keys[options.currentKeyId]) {\n      throw new AuthConfigurationError(\n        \"The current authentication encryption key is not configured.\",\n      );\n    }\n\n    this.currentKeyId = options.currentKeyId;\n    this.keys = keys;\n  }\n\n  private getKey(keyId: string): Promise<CryptoKey> {\n    const existing = this.importedKeys.get(keyId);\n\n    if (existing) return existing;\n\n    const rawKey = this.keys[keyId];\n\n    if (!rawKey) {\n      throw new AuthConfigurationError(\n        `Authentication encryption key \"${keyId}\" is unavailable.`,\n      );\n    }\n\n    const imported = getCrypto().subtle.importKey(\n      \"raw\",\n      toArrayBuffer(rawKey),\n      { name: \"AES-GCM\" },\n      false,\n      [\"encrypt\", \"decrypt\"],\n    );\n\n    this.importedKeys.set(keyId, imported);\n\n    return imported;\n  }\n\n  async encrypt(plaintext: string): Promise<ProtectedAuthSecret> {\n    if (typeof plaintext !== \"string\" || plaintext.length === 0) {\n      throw new AuthConfigurationError(\n        \"A non-empty authentication secret is required.\",\n      );\n    }\n\n    const cryptoApi = getCrypto();\n    const iv = new Uint8Array(12);\n\n    cryptoApi.getRandomValues(iv);\n\n    try {\n      const key = await this.getKey(this.currentKeyId);\n\n      const encrypted = await cryptoApi.subtle.encrypt(\n        {\n          name: \"AES-GCM\",\n          iv: toArrayBuffer(iv),\n          additionalData: toArrayBuffer(\n            new TextEncoder().encode(\n              `${ADDITIONAL_DATA_PREFIX}${this.currentKeyId}`,\n            ),\n          ),\n          tagLength: 128,\n        },\n        key,\n        toArrayBuffer(new TextEncoder().encode(plaintext)),\n      );\n\n      return {\n        ciphertext: encodeBase64Url(new Uint8Array(encrypted)),\n        iv: encodeBase64Url(iv),\n        keyId: this.currentKeyId,\n      };\n    } catch (error) {\n      throw new AuthConfigurationError(\n        \"Could not encrypt the authentication secret.\",\n        { cause: error },\n      );\n    }\n  }\n\n  async decrypt(secret: ProtectedAuthSecret): Promise<string> {\n    if (\n      !secret ||\n      typeof secret.keyId !== \"string\" ||\n      typeof secret.ciphertext !== \"string\" ||\n      typeof secret.iv !== \"string\"\n    ) {\n      throw new AuthConfigurationError(\n        \"The encrypted authentication secret is incomplete.\",\n      );\n    }\n\n    const iv = decodeBase64Url(secret.iv);\n    const ciphertext = decodeBase64Url(secret.ciphertext);\n\n    if (iv.byteLength !== 12 || ciphertext.byteLength < 16) {\n      throw new AuthConfigurationError(\n        \"The encrypted authentication secret is malformed.\",\n      );\n    }\n\n    try {\n      const key = await this.getKey(secret.keyId);\n\n      const plaintext = await getCrypto().subtle.decrypt(\n        {\n          name: \"AES-GCM\",\n          iv: toArrayBuffer(iv),\n          additionalData: toArrayBuffer(\n            new TextEncoder().encode(\n              `${ADDITIONAL_DATA_PREFIX}${secret.keyId}`,\n            ),\n          ),\n          tagLength: 128,\n        },\n        key,\n        toArrayBuffer(ciphertext),\n      );\n\n      return new TextDecoder(\"utf-8\", { fatal: true }).decode(plaintext);\n    } catch (error) {\n      throw new AuthConfigurationError(\n        \"Could not decrypt the authentication secret.\",\n        { cause: error },\n      );\n    }\n  }\n}\n"],"mappings":";;AAYA,MAAM,qBACJ;AAEF,MAAM,yBAAyB;AAE/B,MAAM,kBAA0B;CAC9B,MAAM,YAAY,WAAW;CAE7B,IAAI,CAAC,WAAW,mBAAmB,CAAC,UAAU,QAC5C,MAAM,IAAI,uBACR,6DACF;CAGF,OAAO;AACT;AAEA,MAAM,mBAAmB,UAA8B;CACrD,IAAI,SAAS;CACb,IAAI,QAAQ;CAEZ,OAAO,QAAQ,IAAI,MAAM,QAAQ;EAC/B,MAAM,QAAQ,MAAM;EACpB,MAAM,SAAS,MAAM;EACrB,MAAM,QAAQ,MAAM;EAEpB,UAAU,mBAAmB,SAAS;EACtC,UAAU,oBAAqB,QAAQ,MAAM,IAAM,UAAU;EAC7D,UAAU,oBAAqB,SAAS,OAAO,IAAM,SAAS;EAC9D,UAAU,mBAAmB,QAAQ;CACvC;CAEA,IAAI,QAAQ,MAAM,QAAQ;EACxB,MAAM,QAAQ,MAAM;EAEpB,UAAU,mBAAmB,SAAS;EAEtC,IAAI,QAAQ,MAAM,QAAQ;GACxB,MAAM,SAAS,MAAM;GAErB,UAAU,oBAAqB,QAAQ,MAAM,IAAM,UAAU;GAC7D,UAAU,oBAAoB,SAAS,OAAO;EAChD,OACE,UAAU,oBAAoB,QAAQ,MAAM;CAEhD;CAEA,OAAO;AACT;AAEA,MAAM,mBAAmB,UAA8B;CACrD,IACE,OAAO,UAAU,YACjB,MAAM,WAAW,KACjB,CAAC,mBAAmB,KAAK,KAAK,KAC9B,MAAM,SAAS,MAAM,GAErB,MAAM,IAAI,uBACR,mDACF;CAGF,MAAM,QAAkB,CAAC;CACzB,IAAI,SAAS;CACb,IAAI,OAAO;CAEX,KAAK,MAAM,aAAa,OAAO;EAC7B,MAAM,UAAU,mBAAmB,QAAQ,SAAS;EAEpD,IAAI,UAAU,GACZ,MAAM,IAAI,uBACR,mDACF;EAGF,SAAU,UAAU,IAAK;EACzB,QAAQ;EAER,IAAI,QAAQ,GAAG;GACb,QAAQ;GACR,MAAM,KAAM,WAAW,OAAQ,GAAG;EACpC;CACF;CAEA,OAAO,IAAI,WAAW,KAAK;AAC7B;AAEA,MAAM,iBAAiB,UACrB,MAAM,MAAM,CAAC,CAAC;AAEhB,IAAa,+BAAb,MAAyE;CACvE;CACA;CAEA,+BAAgC,IAAI,IAAgC;CAEpE,YAAY,SAA8C;EACxD,IACE,OAAO,QAAQ,iBAAiB,YAChC,CAAC,wBAAwB,KAAK,QAAQ,YAAY,GAElD,MAAM,IAAI,uBACR,uDACF;EAGF,MAAM,OAAmC,CAAC;EAE1C,KAAK,MAAM,CAAC,OAAO,QAAQ,OAAO,QAAQ,QAAQ,IAAI,GAAG;GACvD,IACE,CAAC,wBAAwB,KAAK,KAAK,KACnC,EAAE,eAAe,eACjB,IAAI,eAAe,IAEnB,MAAM,IAAI,uBACR,kFACF;GAGF,KAAK,SAAS,IAAI,MAAM;EAC1B;EAEA,IAAI,CAAC,KAAK,QAAQ,eAChB,MAAM,IAAI,uBACR,8DACF;EAGF,KAAK,eAAe,QAAQ;EAC5B,KAAK,OAAO;CACd;CAEA,OAAe,OAAmC;EAChD,MAAM,WAAW,KAAK,aAAa,IAAI,KAAK;EAE5C,IAAI,UAAU,OAAO;EAErB,MAAM,SAAS,KAAK,KAAK;EAEzB,IAAI,CAAC,QACH,MAAM,IAAI,uBACR,kCAAkC,MAAM,kBAC1C;EAGF,MAAM,WAAW,UAAU,CAAC,CAAC,OAAO,UAClC,OACA,cAAc,MAAM,GACpB,EAAE,MAAM,UAAU,GAClB,OACA,CAAC,WAAW,SAAS,CACvB;EAEA,KAAK,aAAa,IAAI,OAAO,QAAQ;EAErC,OAAO;CACT;CAEA,MAAM,QAAQ,WAAiD;EAC7D,IAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GACxD,MAAM,IAAI,uBACR,gDACF;EAGF,MAAM,YAAY,UAAU;EAC5B,MAAM,qBAAK,IAAI,WAAW,EAAE;EAE5B,UAAU,gBAAgB,EAAE;EAE5B,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,OAAO,KAAK,YAAY;GAE/C,MAAM,YAAY,MAAM,UAAU,OAAO,QACvC;IACE,MAAM;IACN,IAAI,cAAc,EAAE;IACpB,gBAAgB,cACd,IAAI,YAAY,CAAC,CAAC,OAChB,GAAG,yBAAyB,KAAK,cACnC,CACF;IACA,WAAW;GACb,GACA,KACA,cAAc,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS,CAAC,CACnD;GAEA,OAAO;IACL,YAAY,gBAAgB,IAAI,WAAW,SAAS,CAAC;IACrD,IAAI,gBAAgB,EAAE;IACtB,OAAO,KAAK;GACd;EACF,SAAS,OAAO;GACd,MAAM,IAAI,uBACR,gDACA,EAAE,OAAO,MAAM,CACjB;EACF;CACF;CAEA,MAAM,QAAQ,QAA8C;EAC1D,IACE,CAAC,UACD,OAAO,OAAO,UAAU,YACxB,OAAO,OAAO,eAAe,YAC7B,OAAO,OAAO,OAAO,UAErB,MAAM,IAAI,uBACR,oDACF;EAGF,MAAM,KAAK,gBAAgB,OAAO,EAAE;EACpC,MAAM,aAAa,gBAAgB,OAAO,UAAU;EAEpD,IAAI,GAAG,eAAe,MAAM,WAAW,aAAa,IAClD,MAAM,IAAI,uBACR,mDACF;EAGF,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,OAAO,OAAO,KAAK;GAE1C,MAAM,YAAY,MAAM,UAAU,CAAC,CAAC,OAAO,QACzC;IACE,MAAM;IACN,IAAI,cAAc,EAAE;IACpB,gBAAgB,cACd,IAAI,YAAY,CAAC,CAAC,OAChB,GAAG,yBAAyB,OAAO,OACrC,CACF;IACA,WAAW;GACb,GACA,KACA,cAAc,UAAU,CAC1B;GAEA,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,SAAS;EACnE,SAAS,OAAO;GACd,MAAM,IAAI,uBACR,gDACA,EAAE,OAAO,MAAM,CACjB;EACF;CACF;AACF"}

package/dist/types/auth-lifecycle.types.d.cts

@@ -0,0 +1,53 @@
+import { StorageRecord } from "@puzzle-ui/storage";
+export type AuthActionTokenPurpose = "email-verification" | "password-reset" | "email-change";
+export type AuthActionTokenStorageRecord = StorageRecord & {
+  readonly userId: string;
+  readonly purpose: AuthActionTokenPurpose;
+  readonly tokenHash: string;
+  readonly expiresAt: Date;
+  readonly consumedAt: Date | null;
+  readonly targetEmail: string | null;
+};
+export type AuthAuditAction = "account-registered" | "sign-in" | "sign-in-failed" | "sign-out" | "sign-out-everywhere" | "email-verification-requested" | "email-verified" | "password-reset-requested" | "password-reset-completed" | "password-changed" | "profile-updated" | "email-change-requested" | "email-changed" | "account-deactivated" | "account-deleted" | "mfa-challenge-created" | "mfa-challenge-failed" | "mfa-completed" | "mfa-factor-added" | "mfa-factor-removed" | "mfa-recovery-codes-regenerated" | "passkey-registered" | "passkey-authenticated";
+export type AuthAuditEventStorageRecord = StorageRecord & {
+  readonly action: AuthAuditAction;
+  readonly userId: string | null;
+  readonly sessionId: string | null;
+  readonly metadata?: Readonly<Record<string, string | number | boolean | null>>;
+};
+export type AuthRateLimitStorageRecord = StorageRecord & {
+  readonly windowStartedAt: Date;
+  readonly resetAt: Date;
+  readonly windowSeconds: number;
+  readonly count: number;
+};
+export type AuthRateLimitRule = {
+  readonly limit: number;
+  readonly windowSeconds: number;
+};
+export type AuthLifecycleRateLimitAction = "emailVerification" | "passwordReset" | "emailChange";
+export type AuthLifecycleRateLimitPolicy = {
+  readonly email?: AuthRateLimitRule;
+  readonly ip?: AuthRateLimitRule;
+};
+export type AuthLifecycleRateLimitPolicies = Partial<Record<AuthLifecycleRateLimitAction, AuthLifecycleRateLimitPolicy>>;
+export type AuthLifecycleManagerOptions = {
+  readonly rateLimitKeySecret: string;
+  readonly usersCollection?: string;
+  readonly credentialsCollection?: string;
+  readonly actionTokensCollection?: string;
+  readonly auditCollection?: string;
+  readonly rateLimitsCollection?: string;
+  readonly minimumPasswordLength?: number;
+  readonly maximumPasswordLength?: number;
+  readonly emailVerificationTokenLifetimeSeconds?: number;
+  readonly passwordResetTokenLifetimeSeconds?: number;
+  readonly emailChangeTokenLifetimeSeconds?: number;
+  readonly emailTemplates?: Partial<Record<"emailVerification" | "passwordReset" | "emailChange", string>>;
+  readonly emailSubjects?: Partial<Record<"emailVerification" | "passwordReset" | "emailChange", string>>;
+  readonly rateLimits?: AuthLifecycleRateLimitPolicies;
+  readonly clock?: () => Date;
+  readonly requireVerifiedEmail?: boolean;
+  readonly onEmailDeliveryError?: (error: unknown) => void;
+  readonly onSessionRevocationError?: (error: unknown) => void;
+};

package/dist/types/auth-lifecycle.types.d.ts

@@ -0,0 +1,53 @@
+import { StorageRecord } from "@puzzle-ui/storage";
+export type AuthActionTokenPurpose = "email-verification" | "password-reset" | "email-change";
+export type AuthActionTokenStorageRecord = StorageRecord & {
+  readonly userId: string;
+  readonly purpose: AuthActionTokenPurpose;
+  readonly tokenHash: string;
+  readonly expiresAt: Date;
+  readonly consumedAt: Date | null;
+  readonly targetEmail: string | null;
+};
+export type AuthAuditAction = "account-registered" | "sign-in" | "sign-in-failed" | "sign-out" | "sign-out-everywhere" | "email-verification-requested" | "email-verified" | "password-reset-requested" | "password-reset-completed" | "password-changed" | "profile-updated" | "email-change-requested" | "email-changed" | "account-deactivated" | "account-deleted" | "mfa-challenge-created" | "mfa-challenge-failed" | "mfa-completed" | "mfa-factor-added" | "mfa-factor-removed" | "mfa-recovery-codes-regenerated" | "passkey-registered" | "passkey-authenticated";
+export type AuthAuditEventStorageRecord = StorageRecord & {
+  readonly action: AuthAuditAction;
+  readonly userId: string | null;
+  readonly sessionId: string | null;
+  readonly metadata?: Readonly<Record<string, string | number | boolean | null>>;
+};
+export type AuthRateLimitStorageRecord = StorageRecord & {
+  readonly windowStartedAt: Date;
+  readonly resetAt: Date;
+  readonly windowSeconds: number;
+  readonly count: number;
+};
+export type AuthRateLimitRule = {
+  readonly limit: number;
+  readonly windowSeconds: number;
+};
+export type AuthLifecycleRateLimitAction = "emailVerification" | "passwordReset" | "emailChange";
+export type AuthLifecycleRateLimitPolicy = {
+  readonly email?: AuthRateLimitRule;
+  readonly ip?: AuthRateLimitRule;
+};
+export type AuthLifecycleRateLimitPolicies = Partial<Record<AuthLifecycleRateLimitAction, AuthLifecycleRateLimitPolicy>>;
+export type AuthLifecycleManagerOptions = {
+  readonly rateLimitKeySecret: string;
+  readonly usersCollection?: string;
+  readonly credentialsCollection?: string;
+  readonly actionTokensCollection?: string;
+  readonly auditCollection?: string;
+  readonly rateLimitsCollection?: string;
+  readonly minimumPasswordLength?: number;
+  readonly maximumPasswordLength?: number;
+  readonly emailVerificationTokenLifetimeSeconds?: number;
+  readonly passwordResetTokenLifetimeSeconds?: number;
+  readonly emailChangeTokenLifetimeSeconds?: number;
+  readonly emailTemplates?: Partial<Record<"emailVerification" | "passwordReset" | "emailChange", string>>;
+  readonly emailSubjects?: Partial<Record<"emailVerification" | "passwordReset" | "emailChange", string>>;
+  readonly rateLimits?: AuthLifecycleRateLimitPolicies;
+  readonly clock?: () => Date;
+  readonly requireVerifiedEmail?: boolean;
+  readonly onEmailDeliveryError?: (error: unknown) => void;
+  readonly onSessionRevocationError?: (error: unknown) => void;
+};