@puzzle-ui/fullstack 0.0.0-stage → 0.5.1

package/dist/auth/server/mfa.cjs

@@ -0,0 +1,682 @@
+const require_session = require("./session.cjs");
+let _puzzle_ui_auth = require("@puzzle-ui/auth");
+let _puzzle_ui_session = require("@puzzle-ui/session");
+// src/auth/server/mfa.ts
+const MFA_CHALLENGE_COOKIE_NAME = "__Host-puzzle.mfa";
+const MAX_MFA_COOKIE_LIFETIME_SECONDS = 600;
+const isMfaEnrollmentPendingResult = (result) => "status" in result && result.status === "mfa-enrollment-pending";
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isMfaPendingResult = (result) => "status" in result && result.status === "mfa-pending";
+const jsonResponse = (value, status = 200, additionalHeaders) => {
+	const headers = new Headers(additionalHeaders);
+	headers.set("Content-Type", "application/json; charset=utf-8");
+	headers.set("Cache-Control", "no-store");
+	headers.set("Pragma", "no-cache");
+	return new Response(JSON.stringify(value), {
+		status,
+		headers
+	});
+};
+const toClientUser = (user) => ({
+	id: user.id,
+	email: user.email,
+	name: user.name,
+	image: user.image,
+	emailVerified: user.emailVerifiedAt !== null
+});
+const containsChallengeToken = (value) => {
+	if (Array.isArray(value)) return value.some(containsChallengeToken);
+	if (!isRecord(value)) return false;
+	return Object.entries(value).some(([key, nested]) => key === "challengeToken" || containsChallengeToken(nested));
+};
+const getErrorResponse = (error) => {
+	if (error instanceof _puzzle_ui_auth.AuthError) {
+		const status = error.code === "RATE_LIMITED" ? 429 : error.code === "INVALID_CREDENTIALS" || error.code === "SESSION" || error.code === "MFA_CHALLENGE" ? 401 : error.code === "PROVIDER" ? 503 : 400;
+		return jsonResponse({ error: {
+			code: error.code,
+			message: error.message
+		} }, status);
+	}
+	if (error instanceof Error && error.name === "AuthStepUpRequiredError") return jsonResponse({ error: {
+		code: "STEP_UP_REQUIRED",
+		message: "Recent MFA verification is required."
+	} }, 403);
+	if (error instanceof Error && (error.name === "SessionSecurityError" || error.name === "SessionConfigurationError")) return jsonResponse({ error: {
+		code: "REQUEST_FORBIDDEN",
+		message: "The request could not be authorized."
+	} }, 403);
+	return jsonResponse({ error: {
+		code: "INTERNAL_AUTH_ERROR",
+		message: "An authentication error occurred."
+	} }, 500);
+};
+const endpoint = (handler) => async (request) => {
+	try {
+		return await handler(request);
+	} catch (error) {
+		return getErrorResponse(error);
+	}
+};
+const readJsonObject = async (request) => {
+	let value;
+	try {
+		value = await request.json();
+	} catch {
+		throw new _puzzle_ui_auth.AuthValidationError("A valid JSON request body is required.");
+	}
+	if (!isRecord(value)) throw new _puzzle_ui_auth.AuthValidationError("The request body must be a JSON object.");
+	if (containsChallengeToken(value)) throw new _puzzle_ui_auth.AuthValidationError("MFA challenge tokens are managed by the HttpOnly cookie.");
+	return value;
+};
+const requiredString = (body, name, maximumLength = 2048) => {
+	const value = body[name];
+	if (typeof value !== "string" || value.trim().length === 0 || value.length > maximumLength) throw new _puzzle_ui_auth.AuthValidationError(`A valid ${name} value is required.`);
+	return value;
+};
+const optionalString = (body, name, maximumLength = 2048) => {
+	const value = body[name];
+	if (value === void 0 || value === null || value === "") return;
+	if (typeof value !== "string" || value.length > maximumLength) throw new _puzzle_ui_auth.AuthValidationError(`The ${name} value is invalid.`);
+	return value;
+};
+const requireRequestMethod = (request, expected) => {
+	if (request.method.toUpperCase() !== expected) throw new _puzzle_ui_auth.AuthValidationError(`This authentication endpoint requires ${expected}.`);
+};
+const protectPost = (request, options) => {
+	requireRequestMethod(request, "POST");
+	(0, _puzzle_ui_session.protectStateChangingRequest)(request, options.csrf);
+};
+const requireSignInChallengeToken = (request, options) => {
+	if (getSessionToken(request, options.cookie)) throw new _puzzle_ui_auth.AuthMfaChallengeError();
+	return requireMfaChallengeToken(request);
+};
+const requireMfaChallengeToken = (request) => {
+	const token = readMfaChallengeCookie(request.headers.get("cookie"));
+	if (!token) throw new _puzzle_ui_auth.AuthMfaChallengeError();
+	return token;
+};
+const getSessionToken = (request, cookie) => (0, _puzzle_ui_session.readSessionCookie)(request.headers.get("cookie"), cookie.name);
+const getAuthenticatedContext = async (request, options) => {
+	const sessionToken = getSessionToken(request, options.cookie);
+	if (!sessionToken) throw new _puzzle_ui_auth.AuthSessionError("An authenticated session is required.");
+	let session;
+	try {
+		session = await options.sessions.validate(sessionToken);
+	} catch (error) {
+		throw new _puzzle_ui_auth.AuthSessionError("Could not validate the authentication session.", { cause: error });
+	}
+	if (!session || session.kind !== "authenticated" || !session.userId || session.revokedAt !== null || session.expiresAt.getTime() <= Date.now()) throw new _puzzle_ui_auth.AuthSessionError("An authenticated session is required.");
+	return {
+		session,
+		sessionToken
+	};
+};
+const getClientIp = (request, options) => {
+	const ipAddress = options.resolveClientIp(request);
+	if (typeof ipAddress !== "string" || ipAddress.trim().length === 0 || ipAddress.length > 128) throw new _puzzle_ui_auth.AuthValidationError("The request does not contain a valid client IP address.");
+	return ipAddress.trim();
+};
+const withSetCookie = (response, cookie) => {
+	const headers = new Headers(response.headers);
+	headers.append("Set-Cookie", cookie);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+};
+const withClearedMfaChallengeCookie = (response) => withSetCookie(response, serializeClearedMfaChallengeCookie());
+const withClearedSessionCookie = (response, cookie) => withSetCookie(response, (0, _puzzle_ui_session.serializeClearedSessionCookie)(cookie));
+const maxAgeUntil = (expiresAt) => {
+	const seconds = Math.ceil((expiresAt.getTime() - Date.now()) / 1e3);
+	if (!Number.isFinite(seconds) || seconds <= 0) throw new _puzzle_ui_auth.AuthMfaChallengeError();
+	return Math.min(seconds, MAX_MFA_COOKIE_LIFETIME_SECONDS);
+};
+const createSessionResultResponse = (result, options) => {
+	const response = require_session.createSessionResponse(JSON.stringify({
+		status: "authenticated",
+		user: toClientUser(result.user)
+	}), result.token, {
+		sessions: options.sessions,
+		cookie: options.cookie
+	}, result.session.expiresAt);
+	return withClearedMfaChallengeCookie(response);
+};
+const createMfaEnrollmentPendingResponse = (challenge) => createMfaChallengeResponse(challenge.challengeToken, challenge.expiresAt, {
+	status: "mfa-enrollment-pending",
+	purpose: "enrollment",
+	challengeId: challenge.challengeId,
+	expiresAt: challenge.expiresAt.toISOString(),
+	availableFactors: challenge.availableFactors
+});
+const createEnrollmentSessionResultResponse = (completed, options) => {
+	const response = require_session.createSessionResponse(JSON.stringify({
+		status: "mfa-factor-added",
+		factor: completed.factor,
+		recoveryCodes: completed.recoveryCodes
+	}), completed.auth.token, {
+		sessions: options.sessions,
+		cookie: options.cookie
+	}, completed.auth.session.expiresAt);
+	return withClearedMfaChallengeCookie(response);
+};
+const serializeMfaChallengeCookie = (challengeToken, maxAgeSeconds) => {
+	if (typeof challengeToken !== "string" || !/^[a-f0-9]{64}$/i.test(challengeToken)) throw new _puzzle_ui_auth.AuthMfaChallengeError();
+	if (!Number.isInteger(maxAgeSeconds) || maxAgeSeconds < 1 || maxAgeSeconds > MAX_MFA_COOKIE_LIFETIME_SECONDS) throw new _puzzle_ui_auth.AuthValidationError("The MFA challenge cookie lifetime is invalid.");
+	return [
+		`${MFA_CHALLENGE_COOKIE_NAME}=${encodeURIComponent(challengeToken)}`,
+		"Path=/",
+		"HttpOnly",
+		"Secure",
+		"SameSite=Strict",
+		`Max-Age=${maxAgeSeconds}`
+	].join("; ");
+};
+const serializeClearedMfaChallengeCookie = () => [
+	`${MFA_CHALLENGE_COOKIE_NAME}=`,
+	"Path=/",
+	"HttpOnly",
+	"Secure",
+	"SameSite=Strict",
+	"Max-Age=0",
+	"Expires=Thu, 01 Jan 1970 00:00:00 GMT"
+].join("; ");
+const readMfaChallengeCookie = (cookieHeader) => {
+	if (!cookieHeader) return null;
+	for (const part of cookieHeader.split(";")) {
+		const separator = part.indexOf("=");
+		if (separator < 0) continue;
+		if (part.slice(0, separator).trim() !== "__Host-puzzle.mfa") continue;
+		let token;
+		try {
+			token = decodeURIComponent(part.slice(separator + 1).trim());
+		} catch {
+			return null;
+		}
+		return /^[a-f0-9]{64}$/i.test(token) ? token : null;
+	}
+	return null;
+};
+/**
+* Builds a safe public MFA-pending response.
+*
+* The raw challenge token is written only to Set-Cookie and is deliberately
+* excluded from the JSON body.
+*/
+const createMfaPendingResponse = (challenge, purpose = "sign-in") => createMfaChallengeResponse(challenge.challengeToken, challenge.expiresAt, {
+	status: "mfa-pending",
+	purpose,
+	challengeId: challenge.challengeId,
+	expiresAt: challenge.expiresAt.toISOString(),
+	availableFactors: challenge.availableFactors
+});
+const createMfaChallengeResponse = (challengeToken, expiresAt, body, status = 200) => {
+	if (containsChallengeToken(body)) throw new _puzzle_ui_auth.AuthValidationError("The raw MFA challenge token cannot be included in a response body.");
+	const headers = new Headers({
+		"Content-Type": "application/json; charset=utf-8",
+		"Cache-Control": "no-store",
+		Pragma: "no-cache"
+	});
+	headers.append("Set-Cookie", serializeMfaChallengeCookie(challengeToken, maxAgeUntil(expiresAt)));
+	return new Response(JSON.stringify(body), {
+		status,
+		headers
+	});
+};
+const createAuthMfaHandlers = (options) => {
+	const sessionOptions = {
+		sessions: options.sessions,
+		cookie: options.cookie
+	};
+	return {
+		register: endpoint(async (request) => {
+			protectPost(request, options);
+			const body = await readJsonObject(request);
+			const result = await options.auth.register({
+				email: requiredString(body, "email", 320),
+				password: requiredString(body, "password", 4096),
+				name: optionalString(body, "name", 128),
+				ipAddress: getClientIp(request, options)
+			});
+			if (isMfaEnrollmentPendingResult(result)) {
+				const pending = createMfaEnrollmentPendingResponse(result);
+				return withClearedSessionCookie(pending, options.cookie);
+			}
+			return createSessionResultResponse(result, options);
+		}),
+		signIn: endpoint(async (request) => {
+			protectPost(request, options);
+			const body = await readJsonObject(request);
+			const result = await options.auth.signIn({
+				email: requiredString(body, "email", 320),
+				password: requiredString(body, "password", 4096),
+				ipAddress: getClientIp(request, options)
+			});
+			if (isMfaEnrollmentPendingResult(result)) {
+				const pending = createMfaEnrollmentPendingResponse(result);
+				return withClearedSessionCookie(pending, options.cookie);
+			}
+			if (isMfaPendingResult(result)) {
+				const pending = createMfaPendingResponse(result, "sign-in");
+				return withClearedSessionCookie(pending, options.cookie);
+			}
+			return createSessionResultResponse(result, options);
+		}),
+		getAuthState: endpoint(async (request) => {
+			requireRequestMethod(request, "GET");
+			const challengeToken = readMfaChallengeCookie(request.headers.get("cookie"));
+			const sessionToken = getSessionToken(request, options.cookie);
+			if (challengeToken && sessionToken) {
+				const stepUpState = await options.stepUp.getPendingAuthState(challengeToken, sessionToken);
+				if (stepUpState) {
+					const availableFactors = await options.mfa.getAvailableFactors(challengeToken);
+					return jsonResponse({
+						status: "step-up-pending",
+						user: null,
+						mfa: {
+							purpose: "step-up",
+							challengeId: stepUpState.challengeId,
+							expiresAt: stepUpState.expiresAt.toISOString(),
+							availableFactors
+						}
+					});
+				}
+			} else if (challengeToken) {
+				const pending = await options.auth.getAuthState(challengeToken);
+				if (pending.status === "mfa-pending") {
+					const availableFactors = await options.mfa.getAvailableFactors(challengeToken);
+					return jsonResponse({
+						status: "mfa-pending",
+						user: null,
+						mfa: {
+							purpose: "sign-in",
+							challengeId: pending.challengeId,
+							expiresAt: pending.expiresAt.toISOString(),
+							availableFactors
+						}
+					});
+				}
+				if (pending.status === "mfa-enrollment-pending") return jsonResponse({
+					status: "mfa-enrollment-pending",
+					user: null,
+					mfa: {
+						purpose: "enrollment",
+						challengeId: pending.challengeId,
+						expiresAt: pending.expiresAt.toISOString(),
+						availableFactors: pending.availableFactors
+					}
+				});
+			}
+			if (!sessionToken) return jsonResponse({
+				status: "unauthenticated",
+				user: null
+			});
+			const state = await options.auth.getAuthState(sessionToken);
+			if (state.status === "mfa-enrollment-required") return jsonResponse({
+				status: "mfa-enrollment-required",
+				user: null
+			});
+			if (state.status !== "authenticated") return jsonResponse({
+				status: "unauthenticated",
+				user: null
+			});
+			const user = await options.auth.getCurrentUser(sessionToken);
+			if (!user) return jsonResponse({
+				status: "unauthenticated",
+				user: null
+			});
+			return jsonResponse({
+				status: "authenticated",
+				user: toClientUser(user)
+			});
+		}),
+		signOut: endpoint(async (request) => {
+			protectPost(request, options);
+			const sessionToken = getSessionToken(request, options.cookie);
+			if (sessionToken) await options.auth.signOut(sessionToken);
+			const response = require_session.clearSessionResponse(JSON.stringify({ success: true }), sessionOptions);
+			return withClearedMfaChallengeCookie(response);
+		}),
+		verifySignInTotp: endpoint(async (request) => {
+			protectPost(request, options);
+			const body = await readJsonObject(request);
+			const challengeToken = await requireSignInChallengeToken(request, options);
+			const result = await options.mfa.verifySignInTotp({
+				challengeToken,
+				code: requiredString(body, "code", 16),
+				ipAddress: getClientIp(request, options)
+			});
+			return createSessionResultResponse(result, options);
+		}),
+		verifySignInRecoveryCode: endpoint(async (request) => {
+			protectPost(request, options);
+			const body = await readJsonObject(request);
+			const challengeToken = await requireSignInChallengeToken(request, options);
+			const result = await options.mfa.verifySignInRecoveryCode({
+				challengeToken,
+				code: requiredString(body, "code", 128),
+				ipAddress: getClientIp(request, options)
+			});
+			return createSessionResultResponse(result, options);
+		}),
+		beginPasskeySignIn: endpoint(async (request) => {
+			protectPost(request, options);
+			const challenge = await options.mfa.beginPasskeySignIn({ ipAddress: getClientIp(request, options) });
+			return createMfaChallengeResponse(challenge.challengeToken, challenge.expiresAt, {
+				status: "mfa-pending",
+				purpose: "passkey-sign-in",
+				challengeId: challenge.challengeId,
+				expiresAt: challenge.expiresAt.toISOString(),
+				options: challenge.options
+			});
+		}),
+		finishPasskeySignIn: endpoint(async (request) => {
+			protectPost(request, options);
+			const response = (await readJsonObject(request)).response;
+			if (!isRecord(response)) throw new _puzzle_ui_auth.AuthValidationError("A valid passkey authentication response is required.");
+			const result = await options.mfa.finishPasskeySignIn({
+				challengeToken: requireMfaChallengeToken(request),
+				response,
+				ipAddress: getClientIp(request, options)
+			});
+			return createSessionResultResponse(result, options);
+		}),
+		beginPasskeyMfa: endpoint(async (request) => {
+			protectPost(request, options);
+			const challengeToken = await requireSignInChallengeToken(request, options);
+			const started = await options.mfa.beginPasskeyMfa(challengeToken, getClientIp(request, options));
+			const pending = await options.auth.getAuthState(challengeToken);
+			if (pending.status !== "mfa-pending") throw new _puzzle_ui_auth.AuthMfaChallengeError();
+			return createMfaChallengeResponse(challengeToken, started.expiresAt, {
+				status: "mfa-pending",
+				purpose: "sign-in",
+				challengeId: pending.challengeId,
+				expiresAt: started.expiresAt.toISOString(),
+				options: started.options
+			});
+		}),
+		finishPasskeyMfa: endpoint(async (request) => {
+			protectPost(request, options);
+			const response = (await readJsonObject(request)).response;
+			if (!isRecord(response)) throw new _puzzle_ui_auth.AuthValidationError("A valid passkey authentication response is required.");
+			const result = await options.mfa.finishPasskeyMfa({
+				challengeToken: await requireSignInChallengeToken(request, options),
+				response,
+				ipAddress: getClientIp(request, options)
+			});
+			return createSessionResultResponse(result, options);
+		}),
+		beginRequiredTotpEnrollment: endpoint(async (request) => {
+			protectPost(request, options);
+			const body = await readJsonObject(request);
+			const challengeToken = await requireSignInChallengeToken(request, options);
+			const enrollment = await options.mfa.beginRequiredTotpEnrollment({
+				challengeToken,
+				ipAddress: getClientIp(request, options),
+				label: optionalString(body, "label", 64)
+			});
+			return createMfaChallengeResponse(challengeToken, enrollment.expiresAt, {
+				status: "totp-enrollment-pending",
+				purpose: "enrollment",
+				factorId: enrollment.factorId,
+				secret: enrollment.secret,
+				otpauthUrl: enrollment.otpauthUrl,
+				expiresAt: enrollment.expiresAt.toISOString()
+			});
+		}),
+		verifyRequiredTotpEnrollment: endpoint(async (request) => {
+			protectPost(request, options);
+			const body = await readJsonObject(request);
+			const challengeToken = await requireSignInChallengeToken(request, options);
+			const completed = await options.mfa.verifyRequiredTotpEnrollment({
+				challengeToken,
+				factorId: requiredString(body, "factorId", 256),
+				code: requiredString(body, "code", 16),
+				ipAddress: getClientIp(request, options)
+			});
+			return createEnrollmentSessionResultResponse(completed, options);
+		}),
+		beginRequiredPasskeyEnrollment: endpoint(async (request) => {
+			protectPost(request, options);
+			const body = await readJsonObject(request);
+			const challengeToken = await requireSignInChallengeToken(request, options);
+			const started = await options.mfa.beginRequiredPasskeyEnrollment({
+				challengeToken,
+				ipAddress: getClientIp(request, options),
+				label: optionalString(body, "label", 64)
+			});
+			return createMfaChallengeResponse(challengeToken, started.expiresAt, {
+				status: "passkey-enrollment-pending",
+				purpose: "enrollment",
+				challengeId: started.challengeId,
+				expiresAt: started.expiresAt.toISOString(),
+				options: started.options
+			});
+		}),
+		finishRequiredPasskeyEnrollment: endpoint(async (request) => {
+			protectPost(request, options);
+			const body = await readJsonObject(request);
+			if (!isRecord(body.response)) throw new _puzzle_ui_auth.AuthValidationError("A valid passkey registration response is required.");
+			const challengeToken = await requireSignInChallengeToken(request, options);
+			const completed = await options.mfa.finishRequiredPasskeyEnrollment({
+				challengeToken,
+				response: body.response,
+				ipAddress: getClientIp(request, options)
+			});
+			return createEnrollmentSessionResultResponse(completed, options);
+		}),
+		beginTotpEnrollment: endpoint(async (request) => {
+			protectPost(request, options);
+			const context = await getAuthenticatedContext(request, options);
+			const body = await readJsonObject(request);
+			const enrollment = await options.mfa.beginTotpEnrollment({
+				sessionToken: context.sessionToken,
+				currentPassword: requiredString(body, "currentPassword", 4096),
+				ipAddress: getClientIp(request, options),
+				label: optionalString(body, "label", 64)
+			});
+			return jsonResponse({
+				status: "totp-enrollment-pending",
+				factorId: enrollment.factorId,
+				secret: enrollment.secret,
+				otpauthUrl: enrollment.otpauthUrl,
+				expiresAt: enrollment.expiresAt.toISOString()
+			});
+		}),
+		verifyTotpEnrollment: endpoint(async (request) => {
+			protectPost(request, options);
+			const context = await getAuthenticatedContext(request, options);
+			const body = await readJsonObject(request);
+			const completed = await options.mfa.verifyTotpEnrollment({
+				sessionToken: context.sessionToken,
+				factorId: requiredString(body, "factorId", 256),
+				code: requiredString(body, "code", 16),
+				ipAddress: getClientIp(request, options)
+			});
+			return jsonResponse({
+				status: "mfa-factor-added",
+				factor: completed.factor,
+				recoveryCodes: completed.recoveryCodes
+			});
+		}),
+		beginPasskeyRegistration: endpoint(async (request) => {
+			protectPost(request, options);
+			const context = await getAuthenticatedContext(request, options);
+			const body = await readJsonObject(request);
+			const started = await options.mfa.beginPasskeyRegistration({
+				sessionToken: context.sessionToken,
+				currentPassword: requiredString(body, "currentPassword", 4096),
+				ipAddress: getClientIp(request, options),
+				label: optionalString(body, "label", 64)
+			});
+			return createMfaChallengeResponse(started.challengeToken, started.expiresAt, {
+				status: "passkey-registration-pending",
+				challengeId: started.challengeId,
+				expiresAt: started.expiresAt.toISOString(),
+				options: started.options
+			});
+		}),
+		finishPasskeyRegistration: endpoint(async (request) => {
+			protectPost(request, options);
+			const context = await getAuthenticatedContext(request, options);
+			const body = await readJsonObject(request);
+			if (!isRecord(body.response)) throw new _puzzle_ui_auth.AuthValidationError("A valid passkey registration response is required.");
+			const completed = await options.mfa.finishPasskeyRegistration({
+				sessionToken: context.sessionToken,
+				challengeToken: requireMfaChallengeToken(request),
+				response: body.response,
+				ipAddress: getClientIp(request, options)
+			});
+			return withClearedMfaChallengeCookie(jsonResponse({
+				status: "mfa-factor-added",
+				factor: completed.factor,
+				recoveryCodes: completed.recoveryCodes
+			}));
+		}),
+		listMfaFactors: endpoint(async (request) => {
+			requireRequestMethod(request, "GET");
+			const context = await getAuthenticatedContext(request, options);
+			const factors = await options.mfa.listFactors(context.sessionToken);
+			const recoveryCodeCount = await options.mfa.getRecoveryCodeCount(context.sessionToken);
+			return jsonResponse({
+				factors,
+				recoveryCodeCount
+			});
+		}),
+		removeMfaFactor: endpoint(async (request) => {
+			protectPost(request, options);
+			const context = await getAuthenticatedContext(request, options);
+			const body = await readJsonObject(request);
+			await options.mfa.removeFactor({
+				sessionToken: context.sessionToken,
+				factorId: requiredString(body, "factorId", 256),
+				currentPassword: requiredString(body, "currentPassword", 4096),
+				ipAddress: getClientIp(request, options)
+			});
+			return jsonResponse({ success: true });
+		}),
+		regenerateRecoveryCodes: endpoint(async (request) => {
+			protectPost(request, options);
+			const context = await getAuthenticatedContext(request, options);
+			const body = await readJsonObject(request);
+			const recoveryCodes = await options.mfa.regenerateRecoveryCodes({
+				sessionToken: context.sessionToken,
+				currentPassword: requiredString(body, "currentPassword", 4096),
+				ipAddress: getClientIp(request, options)
+			});
+			return jsonResponse({
+				status: "recovery-codes-regenerated",
+				recoveryCodes
+			});
+		}),
+		beginStepUp: endpoint(async (request) => {
+			protectPost(request, options);
+			const context = await getAuthenticatedContext(request, options);
+			const challenge = await options.stepUp.beginStepUp({
+				sessionToken: context.sessionToken,
+				ipAddress: getClientIp(request, options)
+			});
+			return createMfaPendingResponse(challenge, "step-up");
+		}),
+		beginStepUpPasskey: endpoint(async (request) => {
+			protectPost(request, options);
+			const context = await getAuthenticatedContext(request, options);
+			const challengeToken = requireMfaChallengeToken(request);
+			const started = await options.stepUp.beginPasskey({
+				challengeToken,
+				sessionToken: context.sessionToken,
+				ipAddress: getClientIp(request, options)
+			});
+			const pending = await options.stepUp.getPendingAuthState(challengeToken, context.sessionToken);
+			if (!pending) throw new _puzzle_ui_auth.AuthMfaChallengeError();
+			return createMfaChallengeResponse(challengeToken, started.expiresAt, {
+				status: "step-up-pending",
+				purpose: "step-up",
+				challengeId: pending.challengeId,
+				expiresAt: started.expiresAt.toISOString(),
+				options: started.options
+			});
+		}),
+		verifyStepUpTotp: endpoint(async (request) => {
+			protectPost(request, options);
+			const context = await getAuthenticatedContext(request, options);
+			const body = await readJsonObject(request);
+			const result = await options.stepUp.verifyTotp({
+				challengeToken: requireMfaChallengeToken(request),
+				sessionToken: context.sessionToken,
+				code: requiredString(body, "code", 16),
+				ipAddress: getClientIp(request, options)
+			});
+			return createSessionResultResponse(result, options);
+		}),
+		verifyStepUpRecoveryCode: endpoint(async (request) => {
+			protectPost(request, options);
+			const context = await getAuthenticatedContext(request, options);
+			const body = await readJsonObject(request);
+			const result = await options.stepUp.verifyRecoveryCode({
+				challengeToken: requireMfaChallengeToken(request),
+				sessionToken: context.sessionToken,
+				code: requiredString(body, "code", 128),
+				ipAddress: getClientIp(request, options)
+			});
+			return createSessionResultResponse(result, options);
+		}),
+		finishStepUpPasskey: endpoint(async (request) => {
+			protectPost(request, options);
+			const context = await getAuthenticatedContext(request, options);
+			const body = await readJsonObject(request);
+			if (!isRecord(body.response)) throw new _puzzle_ui_auth.AuthValidationError("A valid passkey authentication response is required.");
+			const result = await options.stepUp.finishPasskey({
+				challengeToken: requireMfaChallengeToken(request),
+				sessionToken: context.sessionToken,
+				response: body.response,
+				ipAddress: getClientIp(request, options)
+			});
+			return createSessionResultResponse(result, options);
+		})
+	};
+};
+/**
+* Returns true when the current authenticated session has a recent,
+* successfully verified step-up.
+*
+* This can be used by sensitive server actions after `getRequestSession()`.
+*/
+const hasRecentStepUp = (session, maxAgeSeconds = 300, now = /* @__PURE__ */ new Date()) => {
+	if (!session || session.kind !== "authenticated" || !session.userId || !Number.isInteger(maxAgeSeconds) || maxAgeSeconds < 1 || maxAgeSeconds > 3600) return false;
+	const verifiedAt = session.metadata?.stepUpVerifiedAt;
+	const previousSessionId = session.metadata?.stepUpOfSessionId;
+	if (typeof verifiedAt !== "string" || typeof previousSessionId !== "string" || previousSessionId.length === 0) return false;
+	const timestamp = Date.parse(verifiedAt);
+	if (!Number.isFinite(timestamp)) return false;
+	const age = now.getTime() - timestamp;
+	return age >= -3e4 && age <= maxAgeSeconds * 1e3;
+};
+var AuthStepUpRequiredError = class extends Error {
+	constructor() {
+		super("Recent MFA verification is required.");
+		this.name = "AuthStepUpRequiredError";
+	}
+};
+/**
+* Use this from server actions that require recent MFA verification.
+*
+* The returned session has already been validated by SessionManager.
+*/
+const requireRecentStepUp = async (request, options, maxAgeSeconds = 300) => {
+	const session = await require_session.getRequestSession(request, options);
+	if (!session || !hasRecentStepUp(session, maxAgeSeconds)) throw new AuthStepUpRequiredError();
+	return session;
+};
+exports.AuthStepUpRequiredError = AuthStepUpRequiredError;
+exports.MFA_CHALLENGE_COOKIE_NAME = MFA_CHALLENGE_COOKIE_NAME;
+exports.createAuthMfaHandlers = createAuthMfaHandlers;
+exports.createMfaChallengeResponse = createMfaChallengeResponse;
+exports.createMfaPendingResponse = createMfaPendingResponse;
+exports.hasRecentStepUp = hasRecentStepUp;
+exports.readMfaChallengeCookie = readMfaChallengeCookie;
+exports.requireRecentStepUp = requireRecentStepUp;
+exports.serializeClearedMfaChallengeCookie = serializeClearedMfaChallengeCookie;
+exports.serializeMfaChallengeCookie = serializeMfaChallengeCookie;
+
+//# sourceMappingURL=mfa.cjs.map