@rakun-kit/core 1.0.0

package/dist/esm/api/routes/manager/auth/media/uploadBinary.js

@@ -0,0 +1,160 @@
+import z from "zod";
+import { getAppErrorStatusCode, isAppError } from "../../../../../lib/errors";
+import { getMediaService } from "../../../../../media";
+import { optimizeImageUpload } from "../../../../../media/imageOptimization";
+import { createRequestContext } from "../../../../context";
+import { checkPermissions } from "../../../../utils/checkPermissions";
+const uploadHeadersSchema = z.object({
+    key: z.string().min(1),
+    access: z.enum(["public", "private"]).default("public"),
+    fileName: z.string().min(1),
+    mime: z.string().min(1).optional(),
+    optimizeRaw: z.string().optional(),
+});
+const parseCookieHeader = (cookieHeader) => {
+    if (!cookieHeader)
+        return {};
+    return Object.fromEntries(cookieHeader
+        .split(";")
+        .map((part) => part.trim())
+        .filter(Boolean)
+        .map((part) => {
+        const idx = part.indexOf("=");
+        if (idx === -1)
+            return [part, ""];
+        return [part.slice(0, idx), decodeURIComponent(part.slice(idx + 1))];
+    }));
+};
+const getHeader = (req, name) => {
+    const header = req.headers[name.toLowerCase()];
+    if (Array.isArray(header)) {
+        return header[0];
+    }
+    return header;
+};
+const readBodyBuffer = async (req) => {
+    const chunks = [];
+    await new Promise((resolve, reject) => {
+        req.on("data", (chunk) => {
+            chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        });
+        req.on("end", () => resolve());
+        req.on("error", (error) => reject(error));
+    });
+    return Buffer.concat(chunks);
+};
+const sanitizeMime = (value) => {
+    if (!value)
+        return "application/octet-stream";
+    return value.split(";")[0]?.trim() || "application/octet-stream";
+};
+const sendJson = (res, statusCode, body) => {
+    res.statusCode = statusCode;
+    res.setHeader("Content-Type", "application/json; charset=utf-8");
+    res.end(JSON.stringify(body));
+};
+export async function handleMediaBinaryUpload(req, res) {
+    try {
+        const ctx = await createRequestContext({
+            headers: req.headers,
+            cookies: parseCookieHeader(getHeader(req, "cookie")),
+            res,
+        });
+        const user = ctx.getUser();
+        checkPermissions(user, ["content.Media.own"]);
+        const parsedHeaders = uploadHeadersSchema.parse({
+            key: getHeader(req, "x-cms-upload-key"),
+            access: getHeader(req, "x-cms-upload-access") || undefined,
+            fileName: getHeader(req, "x-cms-upload-file-name"),
+            mime: getHeader(req, "x-cms-upload-mime") || undefined,
+            optimizeRaw: getHeader(req, "x-cms-upload-optimize") || undefined,
+        });
+        const rawBody = await readBodyBuffer(req);
+        if (rawBody.length === 0) {
+            sendJson(res, 400, {
+                message: "Empty upload body",
+            });
+            return;
+        }
+        const optimizeOptions = parsedHeaders.optimizeRaw
+            ? (() => {
+                try {
+                    return JSON.parse(parsedHeaders.optimizeRaw);
+                }
+                catch {
+                    throw new z.ZodError([
+                        {
+                            code: "custom",
+                            message: "Invalid optimize options JSON",
+                            path: ["x-cms-upload-optimize"],
+                        },
+                    ]);
+                }
+            })()
+            : undefined;
+        const mime = sanitizeMime(parsedHeaders.mime || getHeader(req, "content-type") || undefined);
+        const optimized = await optimizeImageUpload({
+            buffer: rawBody,
+            mime,
+            fileName: parsedHeaders.fileName,
+            key: parsedHeaders.key,
+            optimizeOptions,
+        });
+        const media = getMediaService();
+        await media.rawAdapter.putObject({
+            key: optimized.key,
+            access: parsedHeaders.access,
+            mime: optimized.mime,
+            content: optimized.content,
+        });
+        if (optimized.preview) {
+            await media.rawAdapter.putObject({
+                key: optimized.preview.key,
+                access: parsedHeaders.access,
+                mime: optimized.preview.mime,
+                content: optimized.preview.content,
+            });
+        }
+        sendJson(res, 200, {
+            key: optimized.key,
+            access: parsedHeaders.access,
+            size: optimized.size,
+            mime: optimized.mime,
+            fileName: optimized.fileName,
+            width: optimized.width,
+            height: optimized.height,
+            orientation: optimized.orientation,
+            previewKey: optimized.preview?.key,
+            previewMime: optimized.preview?.mime,
+            optimized: optimized.optimized,
+            optimizedFormat: optimized.optimizedFormat,
+            optimizationQuality: optimized.optimizationQuality,
+            originalSize: optimized.originalSize,
+        });
+    }
+    catch (error) {
+        if (isAppError(error)) {
+            sendJson(res, getAppErrorStatusCode(error) ?? 500, {
+                message: error.message,
+            });
+            return;
+        }
+        if (error instanceof z.ZodError) {
+            sendJson(res, 400, {
+                message: "Invalid upload headers",
+                issues: error.issues,
+            });
+            return;
+        }
+        if (error instanceof Error) {
+            sendJson(res, 500, {
+                message: error.message,
+            });
+            return;
+        }
+        sendJson(res, 500, {
+            message: "Unknown upload error",
+        });
+    }
+}
+//# sourceMappingURL=uploadBinary.js.map

package/dist/esm/api/routes/manager/auth/media/uploadBinary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uploadBinary.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/media/uploadBinary.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAGtE,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,YAAgC,EAAE,EAAE;IAC7D,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAC7B,OAAO,MAAM,CAAC,WAAW,CACvB,YAAY;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CACL,CAAC;AACJ,CAAC,CAAC;AAaF,MAAM,SAAS,GAAG,CAChB,GAA6B,EAC7B,IAAY,EACQ,EAAE;IACtB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAE/C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,KAAK,EAC1B,GAA0B,EACT,EAAE;IACnB,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YACxC,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,KAAyB,EAAU,EAAE;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,0BAA0B,CAAC;IAC9C,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,0BAA0B,CAAC;AACnE,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,CACf,GAA8B,EAC9B,UAAkB,EAClB,IAAa,EACb,EAAE;IACF,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;IAC5B,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;IACjE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAA6B,EAC7B,GAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,OAAO,EAAE,iBAAiB,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACpD,GAAG;SACJ,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAC3B,gBAAgB,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAE9C,MAAM,aAAa,GAAG,mBAAmB,CAAC,KAAK,CAAC;YAC9C,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,kBAAkB,CAAC;YACvC,MAAM,EAAE,SAAS,CAAC,GAAG,EAAE,qBAAqB,CAAC,IAAI,SAAS;YAC1D,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE,wBAAwB,CAAC;YAClD,IAAI,EAAE,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,IAAI,SAAS;YACtD,WAAW,EAAE,SAAS,CAAC,GAAG,EAAE,uBAAuB,CAAC,IAAI,SAAS;SAClE,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,OAAO,EAAE,mBAAmB;aAC7B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,eAAe,GAAG,aAAa,CAAC,WAAW;YAC/C,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,IAAI,CAAC;oBACH,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;gBAC/C,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC;wBACnB;4BACE,IAAI,EAAE,QAAQ;4BACd,OAAO,EAAE,+BAA+B;4BACxC,IAAI,EAAE,CAAC,uBAAuB,CAAC;yBAChC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,EAAE;YACN,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,IAAI,GAAG,YAAY,CACvB,aAAa,CAAC,IAAI,IAAI,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,SAAS,CAClE,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC;YAC1C,MAAM,EAAE,OAAO;YACf,IAAI;YACJ,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,GAAG,EAAE,aAAa,CAAC,GAAG;YACtB,eAAe;SAChB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;YAC/B,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B,CAAC,CAAC;QAEH,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;gBAC/B,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG;gBAC1B,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC5B,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI;gBAC5B,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO;aACnC,CAAC,CAAC;QACL,CAAC;QAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACjB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,UAAU,EAAE,SAAS,CAAC,OAAO,EAAE,GAAG;YAClC,WAAW,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI;YACpC,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;YAClD,YAAY,EAAE,SAAS,CAAC,YAAY;SACrC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE;gBACjD,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,OAAO,EAAE,wBAAwB;gBACjC,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACjB,OAAO,EAAE,sBAAsB;SAChC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/esm/api/routes/manager/auth/totp/confirmTotp.d.ts

@@ -0,0 +1,9 @@
+import { RakunRequestContext } from "../../../../context";
+import { ConfirmTotpInput } from "../../../../../schemas/manager/auth/totp/confirmTotp";
+export declare const confirmTotpHandler: ({ input, ctx, }: {
+    input: ConfirmTotpInput;
+    ctx: RakunRequestContext;
+}) => Promise<{
+    ok: boolean;
+}>;
+//# sourceMappingURL=confirmTotp.d.ts.map

package/dist/esm/api/routes/manager/auth/totp/confirmTotp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirmTotp.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/totp/confirmTotp.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAGxF,eAAO,MAAM,kBAAkB,GAAU,iBAGtC;IACD,KAAK,EAAE,gBAAgB,CAAC;IACxB,GAAG,EAAE,mBAAmB,CAAC;CAC1B;;EAqCA,CAAC"}

package/dist/esm/api/routes/manager/auth/totp/confirmTotp.js

@@ -0,0 +1,36 @@
+import { UserMfa, ManagerUser } from "../../../../../internal-content-types";
+import { getMongoService } from "../../../../../orm";
+import * as OTPAuth from "otpauth";
+export const confirmTotpHandler = async ({ input, ctx, }) => {
+    const db = await getMongoService();
+    const user = ctx.getUser();
+    const { code } = input;
+    const mfa = await db.find(UserMfa, { "user._id": user._id });
+    if (!mfa?.totpSecretPending) {
+        throw new Error("NO_PENDING_TOTP_ENROLLMENT");
+    }
+    const totp = new OTPAuth.TOTP({
+        issuer: "CMS",
+        label: user.email,
+        algorithm: "SHA1",
+        digits: 6,
+        period: 30,
+        secret: OTPAuth.Secret.fromBase32(mfa.totpSecretPending),
+    });
+    const delta = totp.validate({ token: code, window: 1 });
+    if (delta === null) {
+        throw new Error("INVALID_TOTP_CODE");
+    }
+    await db.update(UserMfa, mfa._id, {
+        enabled: true,
+        preferredMethod: "totp",
+        totpSecret: mfa.totpSecretPending,
+        totpSecretPending: null,
+        totpVerifiedAt: new Date(),
+    });
+    await db.update(ManagerUser, user._id, {
+        twoFactorEnabled: true,
+    });
+    return { ok: true };
+};
+//# sourceMappingURL=confirmTotp.js.map

package/dist/esm/api/routes/manager/auth/totp/confirmTotp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirmTotp.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/totp/confirmTotp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAEnC,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EAAE,EACvC,KAAK,EACL,GAAG,GAIJ,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAEvB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;QAC5B,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC;KACzD,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE;QAChC,OAAO,EAAE,IAAI;QACb,eAAe,EAAE,MAAM;QACvB,UAAU,EAAE,GAAG,CAAC,iBAAiB;QACjC,iBAAiB,EAAE,IAAI;QACvB,cAAc,EAAE,IAAI,IAAI,EAAE;KAC3B,CAAC,CAAC;IAEH,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;QACrC,gBAAgB,EAAE,IAAI;KACvB,CAAC,CAAC;IAEH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC,CAAC"}

package/dist/esm/api/routes/manager/auth/totp/enrollTotp.d.ts

@@ -0,0 +1,8 @@
+import { RakunRequestContext } from "../../../../context";
+export declare const enrollTotpHandler: ({ ctx, }: {
+    ctx: RakunRequestContext;
+}) => Promise<{
+    otpauthURL: string;
+    qrDataURL: string;
+}>;
+//# sourceMappingURL=enrollTotp.d.ts.map

package/dist/esm/api/routes/manager/auth/totp/enrollTotp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollTotp.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/totp/enrollTotp.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,eAAO,MAAM,iBAAiB,GAAU,UAErC;IACD,GAAG,EAAE,mBAAmB,CAAC;CAC1B;;;EAwDA,CAAC"}

package/dist/esm/api/routes/manager/auth/totp/enrollTotp.js

@@ -0,0 +1,53 @@
+import { randomBytes } from "crypto";
+import * as OTPAuth from "otpauth";
+import QRCode from "qrcode";
+import { UserMfa, ManagerUser } from "../../../../../internal-content-types";
+import { throwAppError } from "../../../../../lib/errors";
+import { getMongoService } from "../../../../../orm";
+export const enrollTotpHandler = async ({ ctx, }) => {
+    const db = await getMongoService();
+    const user = ctx.getUser();
+    let mfa = await db.find(UserMfa, { "user._id": user._id });
+    if (mfa?.enabled) {
+        throwAppError("CONFLICT", {
+            message: "TOTP already enabled for this user",
+        });
+    }
+    if (!mfa)
+        mfa = await db.create(UserMfa, {
+            user: {
+                _id: user._id,
+                contentType: ManagerUser.name,
+                type: "existing",
+            },
+            enabled: false,
+            preferredMethod: "totp",
+            _type: "UserMfa",
+        });
+    const bytes = randomBytes(20);
+    const secret = new OTPAuth.Secret({
+        buffer: bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength),
+    });
+    const totp = new OTPAuth.TOTP({
+        issuer: "CMS",
+        label: user.email,
+        algorithm: "SHA1",
+        digits: 6,
+        period: 30,
+        secret,
+    });
+    const otpauthURL = totp.toString();
+    const qrDataURL = await QRCode.toDataURL(otpauthURL, {
+        errorCorrectionLevel: "M",
+        margin: 1,
+        scale: 6,
+    });
+    await db.update(UserMfa, mfa._id, {
+        totpSecretPending: secret.base32,
+    });
+    return {
+        otpauthURL,
+        qrDataURL,
+    };
+};
+//# sourceMappingURL=enrollTotp.js.map

package/dist/esm/api/routes/manager/auth/totp/enrollTotp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollTotp.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/totp/enrollTotp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,EACtC,GAAG,GAGJ,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAE3B,IAAI,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAE3D,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;QACjB,aAAa,CAAC,UAAU,EAAE;YACxB,OAAO,EAAE,oCAAoC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,GAAG;QACN,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;YAC7B,IAAI,EAAE;gBACJ,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,WAAW,EAAE,WAAW,CAAC,IAAI;gBAC7B,IAAI,EAAE,UAAU;aACjB;YACD,OAAO,EAAE,KAAK;YACd,eAAe,EAAE,MAAM;YACvB,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;IAEL,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;QAChC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CACxB,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CACpC;KACF,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;QAC5B,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,EAAE;QACV,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE;QACnD,oBAAoB,EAAE,GAAG;QACzB,MAAM,EAAE,CAAC;QACT,KAAK,EAAE,CAAC;KACT,CAAC,CAAC;IAEH,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE;QAChC,iBAAiB,EAAE,MAAM,CAAC,MAAM;KACjC,CAAC,CAAC;IAEH,OAAO;QACL,UAAU;QACV,SAAS;KACV,CAAC;AACJ,CAAC,CAAC"}

package/dist/esm/api/routes/manager/auth/totp/verifyTotp.d.ts

@@ -0,0 +1,11 @@
+import { VerifyTotpInput } from "../../../../../schemas/manager/auth/totp/verifyTotp";
+export declare const verifyTotpHandler: ({ input, }: {
+    input: VerifyTotpInput;
+}) => Promise<{
+    error: string;
+    token?: undefined;
+} | {
+    token: `${string}-${string}-${string}-${string}-${string}`;
+    error?: undefined;
+}>;
+//# sourceMappingURL=verifyTotp.d.ts.map

package/dist/esm/api/routes/manager/auth/totp/verifyTotp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyTotp.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/totp/verifyTotp.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,eAAe,EAAE,MAAM,qDAAqD,CAAC;AAEtF,eAAO,MAAM,iBAAiB,GAAU,YAErC;IACD,KAAK,EAAE,eAAe,CAAC;CACxB;;;;;;EA4FA,CAAC"}

package/dist/esm/api/routes/manager/auth/totp/verifyTotp.js

@@ -0,0 +1,83 @@
+import * as OTPAuth from "otpauth";
+import { MfaChallenge, ManagerUser, UserMfa, Session, } from "../../../../../internal-content-types";
+import { throwAppError } from "../../../../../lib/errors";
+import { getMongoService } from "../../../../../orm";
+export const verifyTotpHandler = async ({ input, }) => {
+    const db = await getMongoService();
+    const { challenge, code } = input;
+    const mfaChallenge = await db.find(MfaChallenge, { token: challenge });
+    if (!mfaChallenge) {
+        throwAppError("NOT_FOUND", {
+            id: challenge,
+            resource: "MfaChallenge",
+        });
+    }
+    if (mfaChallenge.method !== "totp") {
+        throwAppError("CONFLICT", {
+            message: `Unsupported MFA method: ${mfaChallenge.method}`,
+        });
+    }
+    if (mfaChallenge.consumedAt) {
+        throwAppError("CONFLICT", {
+            message: "MFA challenge already consumed",
+        });
+    }
+    if (new Date(mfaChallenge.expiresAt).getTime() <= Date.now()) {
+        throwAppError("CONFLICT", {
+            message: "MFA challenge expired",
+        });
+    }
+    const attempts = Number(mfaChallenge.attempts ?? 0);
+    if (attempts >= 8) {
+        throwAppError("CONFLICT", {
+            message: "Too many failed attempts. Please request a new code.",
+        });
+    }
+    await db.update(MfaChallenge, mfaChallenge._id, { attempts: attempts + 1 });
+    const userId = mfaChallenge.user._id;
+    const user = await db.find(ManagerUser, { _id: userId });
+    if (!user) {
+        throwAppError("NOT_FOUND", {
+            id: userId,
+            resource: "ManagerUser",
+        });
+    }
+    const mfa = await db.find(UserMfa, { "user._id": userId });
+    if (!mfa?.enabled || !mfa?.totpSecret) {
+        throwAppError("CONFLICT", {
+            message: "TOTP MFA not enabled for this user",
+        });
+    }
+    const totp = new OTPAuth.TOTP({
+        issuer: "CMS",
+        label: user.email,
+        algorithm: "SHA1",
+        digits: 6,
+        period: 30,
+        secret: OTPAuth.Secret.fromBase32(mfa.totpSecret),
+    });
+    const delta = totp.validate({ token: code, window: 1 });
+    if (delta === null) {
+        return {
+            error: "INVALID_CODE",
+        };
+    }
+    // consume challenge (así no se reutiliza)
+    await db.update(MfaChallenge, mfaChallenge._id, { consumedAt: new Date() });
+    const token = crypto.randomUUID();
+    const expiresAt = new Date(Date.now() + 1000 * 60 * 60 * 24); // 1 day
+    await db.create(Session, {
+        token,
+        user: {
+            _id: user._id,
+            contentType: ManagerUser.name,
+            type: "existing",
+        },
+        expiresAt,
+        _type: "Session",
+    });
+    return {
+        token,
+    };
+};
+//# sourceMappingURL=verifyTotp.js.map

package/dist/esm/api/routes/manager/auth/totp/verifyTotp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyTotp.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/totp/verifyTotp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,EACL,YAAY,EACZ,WAAW,EACX,OAAO,EACP,OAAO,GACR,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,EACtC,KAAK,GAGN,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAEnC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAElC,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,aAAa,CAAC,WAAW,EAAE;YACzB,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACnC,aAAa,CAAC,UAAU,EAAE;YACxB,OAAO,EAAE,2BAA2B,YAAY,CAAC,MAAM,EAAE;SAC1D,CAAC,CAAC;IACL,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;QAC5B,aAAa,CAAC,UAAU,EAAE;YACxB,OAAO,EAAE,gCAAgC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7D,aAAa,CAAC,UAAU,EAAE;YACxB,OAAO,EAAE,uBAAuB;SACjC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;IACpD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,aAAa,CAAC,UAAU,EAAE;YACxB,OAAO,EAAE,sDAAsD;SAChE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAC;IAE5E,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;IAErC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,aAAa,CAAC,WAAW,EAAE;YACzB,EAAE,EAAE,MAAM;YACV,QAAQ,EAAE,aAAa;SACxB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC;QACtC,aAAa,CAAC,UAAU,EAAE;YACxB,OAAO,EAAE,oCAAoC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;QAC5B,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC;KAClD,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO;YACL,KAAK,EAAE,cAAc;SACtB,CAAC;IACJ,CAAC;IAED,0CAA0C;IAC1C,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IAE5E,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ;IAEtE,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;QACvB,KAAK;QACL,IAAI,EAAE;YACJ,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,WAAW,CAAC,IAAI;YAC7B,IAAI,EAAE,UAAU;SACjB;QACD,SAAS;QACT,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;KACN,CAAC;AACJ,CAAC,CAAC"}

package/dist/esm/api/routes/manager/auth/updatePassword.d.ts

@@ -0,0 +1,9 @@
+import { RakunRequestContext } from "../../../context";
+import { UpdatePasswordInput } from "../../../../schemas/manager/updatePassword";
+export declare const updatePasswordHandler: ({ input, ctx, }: {
+    input: UpdatePasswordInput;
+    ctx: RakunRequestContext;
+}) => Promise<{
+    ok: boolean;
+}>;
+//# sourceMappingURL=updatePassword.d.ts.map

package/dist/esm/api/routes/manager/auth/updatePassword.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"updatePassword.d.ts","sourceRoot":"","sources":["../../../../../../src/api/routes/manager/auth/updatePassword.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AAGjF,eAAO,MAAM,qBAAqB,GAAU,iBAGzC;IACD,KAAK,EAAE,mBAAmB,CAAC;IAC3B,GAAG,EAAE,mBAAmB,CAAC;CAC1B;;EAcA,CAAC"}

package/dist/esm/api/routes/manager/auth/updatePassword.js

@@ -0,0 +1,16 @@
+import { ManagerUser } from "../../../../internal-content-types";
+import { getMongoService } from "../../../../orm";
+import { verifyPassword, hashPassword } from "../../../utils/passwords";
+export const updatePasswordHandler = async ({ input, ctx, }) => {
+    const db = await getMongoService();
+    const user = ctx.getUser();
+    const password = (await db.get(ManagerUser, user._id, ["password"])).password;
+    if (!verifyPassword(input.currentPassword, password)) {
+        throw new Error("Current password is incorrect");
+    }
+    await db.update(ManagerUser, user._id, {
+        password: hashPassword(input.newPassword),
+    });
+    return { ok: true };
+};
+//# sourceMappingURL=updatePassword.js.map

package/dist/esm/api/routes/manager/auth/updatePassword.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"updatePassword.js","sourceRoot":"","sources":["../../../../../../src/api/routes/manager/auth/updatePassword.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGlD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExE,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EAAE,EAC1C,KAAK,EACL,GAAG,GAIJ,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAE9E,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;QACrC,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC;KAC1C,CAAC,CAAC;IAEH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC,CAAC"}

package/dist/esm/api/routes/manager/auth/webauthn/share.d.ts

@@ -0,0 +1,5 @@
+export declare const RP_ID: string;
+export declare const ORIGIN: string;
+export declare const toBase64URL: (credentialId: string) => string;
+export declare const toB64: (buf: Buffer) => string;
+//# sourceMappingURL=share.d.ts.map

package/dist/esm/api/routes/manager/auth/webauthn/share.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/webauthn/share.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,KAAK,QACwD,CAAA;AAC1E,eAAO,MAAM,MAAM,QAAwE,CAAA;AAE3F,eAAO,MAAM,WAAW,GAAI,cAAc,MAAM,WAmB/C,CAAA;AAED,eAAO,MAAM,KAAK,GAAI,KAAK,MAAM,WAA2B,CAAA"}

package/dist/esm/api/routes/manager/auth/webauthn/share.js

@@ -0,0 +1,23 @@
+const environment = process.env.ENVIRONMENT || 'local';
+const managerPrefix = process.env.MANAGER_PREFIX || 'manager';
+const baseDomain = process.env.BASE_DOMAIN || 'localhost';
+export const RP_ID = environment === 'local' ? 'localhost' : `${managerPrefix}.${baseDomain}`;
+export const ORIGIN = environment === 'local' ? `http://${RP_ID}:3000` : `https://${RP_ID}`;
+export const toBase64URL = (credentialId) => {
+    if (!credentialId)
+        return credentialId;
+    if (!credentialId.includes('+') &&
+        !credentialId.includes('/') &&
+        !credentialId.includes('=')) {
+        return credentialId;
+    }
+    const decoded = Buffer.from(credentialId, 'base64');
+    const asUtf8 = decoded.toString('utf8');
+    // Legacy bug: id was stored as base64(utf8(base64urlId))
+    if (/^[A-Za-z0-9_-]+$/.test(asUtf8)) {
+        return asUtf8;
+    }
+    return decoded.toString('base64url');
+};
+export const toB64 = (buf) => buf.toString('base64');
+//# sourceMappingURL=share.js.map

package/dist/esm/api/routes/manager/auth/webauthn/share.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/webauthn/share.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAA;AACtD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,SAAS,CAAA;AAC7D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,WAAW,CAAA;AAEzD,MAAM,CAAC,MAAM,KAAK,GAChB,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,aAAa,IAAI,UAAU,EAAE,CAAA;AAC1E,MAAM,CAAC,MAAM,MAAM,GAAG,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAA;AAE3F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,YAAoB,EAAE,EAAE;IAClD,IAAI,CAAC,YAAY;QAAE,OAAO,YAAY,CAAA;IAEtC,IACE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC3B,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC3B,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC3B,CAAC;QACD,OAAO,YAAY,CAAA;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACvC,yDAAyD;IACzD,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO,MAAM,CAAA;IACf,CAAC;IAED,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACtC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA"}

package/dist/esm/api/routes/manager/auth/webauthn/webauthnAuthOptions.d.ts

@@ -0,0 +1,8 @@
+export declare const webauthnAuthOptionsHandler: ({ input, }: {
+    input: {
+        challengeToken: string;
+    };
+}) => Promise<{
+    options: import("@simplewebauthn/server").PublicKeyCredentialRequestOptionsJSON;
+}>;
+//# sourceMappingURL=webauthnAuthOptions.d.ts.map

package/dist/esm/api/routes/manager/auth/webauthn/webauthnAuthOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthnAuthOptions.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/webauthn/webauthnAuthOptions.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,0BAA0B,GAAU,YAE9C;IACD,KAAK,EAAE;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;CACnC;;EA8CA,CAAC"}

package/dist/esm/api/routes/manager/auth/webauthn/webauthnAuthOptions.js

@@ -0,0 +1,46 @@
+import { generateAuthenticationOptions } from "@simplewebauthn/server";
+import { MfaChallenge, WebAuthnCredential, } from "../../../../../internal-content-types";
+import { throwAppError } from "../../../../../lib/errors";
+import { getMongoService } from "../../../../../orm";
+import { RP_ID, toBase64URL } from "./share";
+export const webauthnAuthOptionsHandler = async ({ input, }) => {
+    const db = await getMongoService();
+    const ch = await db.find(MfaChallenge, { token: input.challengeToken });
+    if (!ch) {
+        throwAppError("NOT_FOUND", {
+            id: input.challengeToken,
+            resource: "MfaChallenge",
+        });
+    }
+    if (ch.method !== "webauthn") {
+        throwAppError("CONFLICT", {
+            message: "Challenge method mismatch",
+        });
+    }
+    if (ch.consumedAt) {
+        throwAppError("CONFLICT", {
+            message: "Challenge already consumed",
+        });
+    }
+    if (new Date(ch.expiresAt).getTime() <= Date.now()) {
+        throwAppError("CONFLICT", {
+            message: "Challenge expired",
+        });
+    }
+    const userId = ch.user._id;
+    const creds = (await db.list(WebAuthnCredential, { filter: { "user._id": userId } }))
+        ?.items ?? [];
+    const allowCredentials = creds.map((c) => ({
+        id: toBase64URL(c.credentialId),
+    }));
+    const options = await generateAuthenticationOptions({
+        rpID: RP_ID,
+        userVerification: "preferred",
+        allowCredentials,
+    });
+    await db.update(MfaChallenge, ch._id, {
+        webAuthnChallenge: options.challenge,
+    });
+    return { options };
+};
+//# sourceMappingURL=webauthnAuthOptions.js.map

package/dist/esm/api/routes/manager/auth/webauthn/webauthnAuthOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthnAuthOptions.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/webauthn/webauthnAuthOptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EACL,YAAY,EACZ,kBAAkB,GACnB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE7C,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,EAAE,EAC/C,KAAK,GAGN,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAEnC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,aAAa,CAAC,WAAW,EAAE;YACzB,EAAE,EAAE,KAAK,CAAC,cAAc;YACxB,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC7B,aAAa,CAAC,UAAU,EAAE;YACxB,OAAO,EAAE,2BAA2B;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;QAClB,aAAa,CAAC,UAAU,EAAE;YACxB,OAAO,EAAE,4BAA4B;SACtC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnD,aAAa,CAAC,UAAU,EAAE;YACxB,OAAO,EAAE,mBAAmB;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;IAC3B,MAAM,KAAK,GACT,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACrE,EAAE,KAAK,IAAI,EAAE,CAAC;IAElB,MAAM,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;KAChC,CAAC,CAAC,CAAC;IAEJ,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;QAClD,IAAI,EAAE,KAAK;QACX,gBAAgB,EAAE,WAAW;QAC7B,gBAAgB;KACjB,CAAC,CAAC;IAEH,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,GAAG,EAAE;QACpC,iBAAiB,EAAE,OAAO,CAAC,SAAS;KACrC,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC,CAAC"}

package/dist/esm/api/routes/manager/auth/webauthn/webauthnAuthVerify.d.ts

@@ -0,0 +1,10 @@
+import { AuthenticationResponseJSON } from "@simplewebauthn/server";
+export declare const webauthnAuthVerifyHandler: ({ input, }: {
+    input: {
+        challengeToken: string;
+        response: AuthenticationResponseJSON;
+    };
+}) => Promise<{
+    token: `${string}-${string}-${string}-${string}-${string}`;
+}>;
+//# sourceMappingURL=webauthnAuthVerify.d.ts.map

package/dist/esm/api/routes/manager/auth/webauthn/webauthnAuthVerify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthnAuthVerify.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/webauthn/webauthnAuthVerify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAE3B,MAAM,wBAAwB,CAAC;AAYhC,eAAO,MAAM,yBAAyB,GAAU,YAE7C;IACD,KAAK,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,0BAA0B,CAAA;KAAE,CAAC;CACzE;;EAuFA,CAAC"}