@rakun-kit/core 1.0.0

package/dist/cjs/api/routes/manager/auth/media/prepareUpload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepareUpload.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/media/prepareUpload.ts"],"names":[],"mappings":";;;AAAA,sDAA0D;AAC1D,gDAM8B;AAE9B,yEAAsE;AAEtE,MAAM,aAAa,GAAG,CAAC,KAAc,EAAS,EAAE;IAC9C,IAAI,KAAK,YAAY,6BAAqB,EAAE,CAAC;QAC3C,IAAA,sBAAa,EAAC,YAAY,EAAE;YAC1B,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;SACrC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,YAAY,0BAAkB,EAAE,CAAC;QACxC,IAAA,sBAAa,EAAC,WAAW,EAAE;YACzB,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;IAED,IAAA,sBAAa,EAAC,UAAU,EAAE;QACxB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB;KACxE,CAAC,CAAC;AACL,CAAC,CAAC;AAEK,MAAM,oBAAoB,GAAG,KAAK,EAAE,EACzC,KAAK,EACL,GAAG,GAIJ,EAAgC,EAAE;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAE3B,IAAA,mCAAgB,EAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAE9C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAA,uBAAe,GAAE,CAAC;QAChC,OAAO,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC,CAAC;AAjBW,QAAA,oBAAoB,wBAiB/B"}

package/dist/cjs/api/routes/manager/auth/media/uploadBinary.js

@@ -0,0 +1,166 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleMediaBinaryUpload = handleMediaBinaryUpload;
+const zod_1 = __importDefault(require("zod"));
+const errors_1 = require("../../../../../lib/errors");
+const media_1 = require("../../../../../media");
+const imageOptimization_1 = require("../../../../../media/imageOptimization");
+const context_1 = require("../../../../context");
+const checkPermissions_1 = require("../../../../utils/checkPermissions");
+const uploadHeadersSchema = zod_1.default.object({
+    key: zod_1.default.string().min(1),
+    access: zod_1.default.enum(["public", "private"]).default("public"),
+    fileName: zod_1.default.string().min(1),
+    mime: zod_1.default.string().min(1).optional(),
+    optimizeRaw: zod_1.default.string().optional(),
+});
+const parseCookieHeader = (cookieHeader) => {
+    if (!cookieHeader)
+        return {};
+    return Object.fromEntries(cookieHeader
+        .split(";")
+        .map((part) => part.trim())
+        .filter(Boolean)
+        .map((part) => {
+        const idx = part.indexOf("=");
+        if (idx === -1)
+            return [part, ""];
+        return [part.slice(0, idx), decodeURIComponent(part.slice(idx + 1))];
+    }));
+};
+const getHeader = (req, name) => {
+    const header = req.headers[name.toLowerCase()];
+    if (Array.isArray(header)) {
+        return header[0];
+    }
+    return header;
+};
+const readBodyBuffer = async (req) => {
+    const chunks = [];
+    await new Promise((resolve, reject) => {
+        req.on("data", (chunk) => {
+            chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        });
+        req.on("end", () => resolve());
+        req.on("error", (error) => reject(error));
+    });
+    return Buffer.concat(chunks);
+};
+const sanitizeMime = (value) => {
+    if (!value)
+        return "application/octet-stream";
+    return value.split(";")[0]?.trim() || "application/octet-stream";
+};
+const sendJson = (res, statusCode, body) => {
+    res.statusCode = statusCode;
+    res.setHeader("Content-Type", "application/json; charset=utf-8");
+    res.end(JSON.stringify(body));
+};
+async function handleMediaBinaryUpload(req, res) {
+    try {
+        const ctx = await (0, context_1.createRequestContext)({
+            headers: req.headers,
+            cookies: parseCookieHeader(getHeader(req, "cookie")),
+            res,
+        });
+        const user = ctx.getUser();
+        (0, checkPermissions_1.checkPermissions)(user, ["content.Media.own"]);
+        const parsedHeaders = uploadHeadersSchema.parse({
+            key: getHeader(req, "x-cms-upload-key"),
+            access: getHeader(req, "x-cms-upload-access") || undefined,
+            fileName: getHeader(req, "x-cms-upload-file-name"),
+            mime: getHeader(req, "x-cms-upload-mime") || undefined,
+            optimizeRaw: getHeader(req, "x-cms-upload-optimize") || undefined,
+        });
+        const rawBody = await readBodyBuffer(req);
+        if (rawBody.length === 0) {
+            sendJson(res, 400, {
+                message: "Empty upload body",
+            });
+            return;
+        }
+        const optimizeOptions = parsedHeaders.optimizeRaw
+            ? (() => {
+                try {
+                    return JSON.parse(parsedHeaders.optimizeRaw);
+                }
+                catch {
+                    throw new zod_1.default.ZodError([
+                        {
+                            code: "custom",
+                            message: "Invalid optimize options JSON",
+                            path: ["x-cms-upload-optimize"],
+                        },
+                    ]);
+                }
+            })()
+            : undefined;
+        const mime = sanitizeMime(parsedHeaders.mime || getHeader(req, "content-type") || undefined);
+        const optimized = await (0, imageOptimization_1.optimizeImageUpload)({
+            buffer: rawBody,
+            mime,
+            fileName: parsedHeaders.fileName,
+            key: parsedHeaders.key,
+            optimizeOptions,
+        });
+        const media = (0, media_1.getMediaService)();
+        await media.rawAdapter.putObject({
+            key: optimized.key,
+            access: parsedHeaders.access,
+            mime: optimized.mime,
+            content: optimized.content,
+        });
+        if (optimized.preview) {
+            await media.rawAdapter.putObject({
+                key: optimized.preview.key,
+                access: parsedHeaders.access,
+                mime: optimized.preview.mime,
+                content: optimized.preview.content,
+            });
+        }
+        sendJson(res, 200, {
+            key: optimized.key,
+            access: parsedHeaders.access,
+            size: optimized.size,
+            mime: optimized.mime,
+            fileName: optimized.fileName,
+            width: optimized.width,
+            height: optimized.height,
+            orientation: optimized.orientation,
+            previewKey: optimized.preview?.key,
+            previewMime: optimized.preview?.mime,
+            optimized: optimized.optimized,
+            optimizedFormat: optimized.optimizedFormat,
+            optimizationQuality: optimized.optimizationQuality,
+            originalSize: optimized.originalSize,
+        });
+    }
+    catch (error) {
+        if ((0, errors_1.isAppError)(error)) {
+            sendJson(res, (0, errors_1.getAppErrorStatusCode)(error) ?? 500, {
+                message: error.message,
+            });
+            return;
+        }
+        if (error instanceof zod_1.default.ZodError) {
+            sendJson(res, 400, {
+                message: "Invalid upload headers",
+                issues: error.issues,
+            });
+            return;
+        }
+        if (error instanceof Error) {
+            sendJson(res, 500, {
+                message: error.message,
+            });
+            return;
+        }
+        sendJson(res, 500, {
+            message: "Unknown upload error",
+        });
+    }
+}
+//# sourceMappingURL=uploadBinary.js.map

package/dist/cjs/api/routes/manager/auth/media/uploadBinary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uploadBinary.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/media/uploadBinary.ts"],"names":[],"mappings":";;;;;AAsFA,0DAoHC;AA1MD,8CAAoB;AACpB,sDAA8E;AAC9E,gDAAuD;AACvD,8EAA6E;AAC7E,iDAA2D;AAC3D,yEAAsE;AAGtE,MAAM,mBAAmB,GAAG,aAAC,CAAC,MAAM,CAAC;IACnC,GAAG,EAAE,aAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,aAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvD,QAAQ,EAAE,aAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,aAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,aAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,YAAgC,EAAE,EAAE;IAC7D,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAC7B,OAAO,MAAM,CAAC,WAAW,CACvB,YAAY;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CACL,CAAC;AACJ,CAAC,CAAC;AAaF,MAAM,SAAS,GAAG,CAChB,GAA6B,EAC7B,IAAY,EACQ,EAAE;IACtB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAE/C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,KAAK,EAC1B,GAA0B,EACT,EAAE;IACnB,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YACxC,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,KAAyB,EAAU,EAAE;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,0BAA0B,CAAC;IAC9C,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,0BAA0B,CAAC;AACnE,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,CACf,GAA8B,EAC9B,UAAkB,EAClB,IAAa,EACb,EAAE;IACF,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;IAC5B,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;IACjE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC,CAAC;AAEK,KAAK,UAAU,uBAAuB,CAC3C,GAA6B,EAC7B,GAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAA,8BAAoB,EAAC;YACrC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,OAAO,EAAE,iBAAiB,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACpD,GAAG;SACJ,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAC3B,IAAA,mCAAgB,EAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAE9C,MAAM,aAAa,GAAG,mBAAmB,CAAC,KAAK,CAAC;YAC9C,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,kBAAkB,CAAC;YACvC,MAAM,EAAE,SAAS,CAAC,GAAG,EAAE,qBAAqB,CAAC,IAAI,SAAS;YAC1D,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE,wBAAwB,CAAC;YAClD,IAAI,EAAE,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,IAAI,SAAS;YACtD,WAAW,EAAE,SAAS,CAAC,GAAG,EAAE,uBAAuB,CAAC,IAAI,SAAS;SAClE,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,OAAO,EAAE,mBAAmB;aAC7B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,eAAe,GAAG,aAAa,CAAC,WAAW;YAC/C,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,IAAI,CAAC;oBACH,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;gBAC/C,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,aAAC,CAAC,QAAQ,CAAC;wBACnB;4BACE,IAAI,EAAE,QAAQ;4BACd,OAAO,EAAE,+BAA+B;4BACxC,IAAI,EAAE,CAAC,uBAAuB,CAAC;yBAChC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,EAAE;YACN,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,IAAI,GAAG,YAAY,CACvB,aAAa,CAAC,IAAI,IAAI,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,SAAS,CAClE,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,IAAA,uCAAmB,EAAC;YAC1C,MAAM,EAAE,OAAO;YACf,IAAI;YACJ,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,GAAG,EAAE,aAAa,CAAC,GAAG;YACtB,eAAe;SAChB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAA,uBAAe,GAAE,CAAC;QAChC,MAAM,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;YAC/B,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B,CAAC,CAAC;QAEH,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;gBAC/B,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG;gBAC1B,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC5B,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI;gBAC5B,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO;aACnC,CAAC,CAAC;QACL,CAAC;QAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACjB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,UAAU,EAAE,SAAS,CAAC,OAAO,EAAE,GAAG;YAClC,WAAW,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI;YACpC,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;YAClD,YAAY,EAAE,SAAS,CAAC,YAAY;SACrC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,IAAA,mBAAU,EAAC,KAAK,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,GAAG,EAAE,IAAA,8BAAqB,EAAC,KAAK,CAAC,IAAI,GAAG,EAAE;gBACjD,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,KAAK,YAAY,aAAC,CAAC,QAAQ,EAAE,CAAC;YAChC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,OAAO,EAAE,wBAAwB;gBACjC,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACjB,OAAO,EAAE,sBAAsB;SAChC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/cjs/api/routes/manager/auth/totp/confirmTotp.js

@@ -0,0 +1,73 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.confirmTotpHandler = void 0;
+const internal_content_types_1 = require("../../../../../internal-content-types");
+const orm_1 = require("../../../../../orm");
+const OTPAuth = __importStar(require("otpauth"));
+const confirmTotpHandler = async ({ input, ctx, }) => {
+    const db = await (0, orm_1.getMongoService)();
+    const user = ctx.getUser();
+    const { code } = input;
+    const mfa = await db.find(internal_content_types_1.UserMfa, { "user._id": user._id });
+    if (!mfa?.totpSecretPending) {
+        throw new Error("NO_PENDING_TOTP_ENROLLMENT");
+    }
+    const totp = new OTPAuth.TOTP({
+        issuer: "CMS",
+        label: user.email,
+        algorithm: "SHA1",
+        digits: 6,
+        period: 30,
+        secret: OTPAuth.Secret.fromBase32(mfa.totpSecretPending),
+    });
+    const delta = totp.validate({ token: code, window: 1 });
+    if (delta === null) {
+        throw new Error("INVALID_TOTP_CODE");
+    }
+    await db.update(internal_content_types_1.UserMfa, mfa._id, {
+        enabled: true,
+        preferredMethod: "totp",
+        totpSecret: mfa.totpSecretPending,
+        totpSecretPending: null,
+        totpVerifiedAt: new Date(),
+    });
+    await db.update(internal_content_types_1.ManagerUser, user._id, {
+        twoFactorEnabled: true,
+    });
+    return { ok: true };
+};
+exports.confirmTotpHandler = confirmTotpHandler;
+//# sourceMappingURL=confirmTotp.js.map

package/dist/cjs/api/routes/manager/auth/totp/confirmTotp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirmTotp.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/totp/confirmTotp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kFAA6E;AAC7E,4CAAqD;AAGrD,iDAAmC;AAE5B,MAAM,kBAAkB,GAAG,KAAK,EAAE,EACvC,KAAK,EACL,GAAG,GAIJ,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,IAAA,qBAAe,GAAE,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAEvB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,gCAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;QAC5B,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC;KACzD,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,CAAC,gCAAO,EAAE,GAAG,CAAC,GAAG,EAAE;QAChC,OAAO,EAAE,IAAI;QACb,eAAe,EAAE,MAAM;QACvB,UAAU,EAAE,GAAG,CAAC,iBAAiB;QACjC,iBAAiB,EAAE,IAAI;QACvB,cAAc,EAAE,IAAI,IAAI,EAAE;KAC3B,CAAC,CAAC;IAEH,MAAM,EAAE,CAAC,MAAM,CAAC,oCAAW,EAAE,IAAI,CAAC,GAAG,EAAE;QACrC,gBAAgB,EAAE,IAAI;KACvB,CAAC,CAAC;IAEH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC,CAAC;AA3CW,QAAA,kBAAkB,sBA2C7B"}

package/dist/cjs/api/routes/manager/auth/totp/enrollTotp.js

@@ -0,0 +1,93 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enrollTotpHandler = void 0;
+const crypto_1 = require("crypto");
+const OTPAuth = __importStar(require("otpauth"));
+const qrcode_1 = __importDefault(require("qrcode"));
+const internal_content_types_1 = require("../../../../../internal-content-types");
+const errors_1 = require("../../../../../lib/errors");
+const orm_1 = require("../../../../../orm");
+const enrollTotpHandler = async ({ ctx, }) => {
+    const db = await (0, orm_1.getMongoService)();
+    const user = ctx.getUser();
+    let mfa = await db.find(internal_content_types_1.UserMfa, { "user._id": user._id });
+    if (mfa?.enabled) {
+        (0, errors_1.throwAppError)("CONFLICT", {
+            message: "TOTP already enabled for this user",
+        });
+    }
+    if (!mfa)
+        mfa = await db.create(internal_content_types_1.UserMfa, {
+            user: {
+                _id: user._id,
+                contentType: internal_content_types_1.ManagerUser.name,
+                type: "existing",
+            },
+            enabled: false,
+            preferredMethod: "totp",
+            _type: "UserMfa",
+        });
+    const bytes = (0, crypto_1.randomBytes)(20);
+    const secret = new OTPAuth.Secret({
+        buffer: bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength),
+    });
+    const totp = new OTPAuth.TOTP({
+        issuer: "CMS",
+        label: user.email,
+        algorithm: "SHA1",
+        digits: 6,
+        period: 30,
+        secret,
+    });
+    const otpauthURL = totp.toString();
+    const qrDataURL = await qrcode_1.default.toDataURL(otpauthURL, {
+        errorCorrectionLevel: "M",
+        margin: 1,
+        scale: 6,
+    });
+    await db.update(internal_content_types_1.UserMfa, mfa._id, {
+        totpSecretPending: secret.base32,
+    });
+    return {
+        otpauthURL,
+        qrDataURL,
+    };
+};
+exports.enrollTotpHandler = enrollTotpHandler;
+//# sourceMappingURL=enrollTotp.js.map

package/dist/cjs/api/routes/manager/auth/totp/enrollTotp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollTotp.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/totp/enrollTotp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mCAAqC;AAErC,iDAAmC;AACnC,oDAA4B;AAC5B,kFAA6E;AAC7E,sDAA0D;AAC1D,4CAAqD;AAG9C,MAAM,iBAAiB,GAAG,KAAK,EAAE,EACtC,GAAG,GAGJ,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,IAAA,qBAAe,GAAE,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAE3B,IAAI,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,gCAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAE3D,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;QACjB,IAAA,sBAAa,EAAC,UAAU,EAAE;YACxB,OAAO,EAAE,oCAAoC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,GAAG;QACN,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,gCAAO,EAAE;YAC7B,IAAI,EAAE;gBACJ,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,WAAW,EAAE,oCAAW,CAAC,IAAI;gBAC7B,IAAI,EAAE,UAAU;aACjB;YACD,OAAO,EAAE,KAAK;YACd,eAAe,EAAE,MAAM;YACvB,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;IAEL,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;QAChC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CACxB,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CACpC;KACF,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;QAC5B,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,EAAE;QACV,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,gBAAM,CAAC,SAAS,CAAC,UAAU,EAAE;QACnD,oBAAoB,EAAE,GAAG;QACzB,MAAM,EAAE,CAAC;QACT,KAAK,EAAE,CAAC;KACT,CAAC,CAAC;IAEH,MAAM,EAAE,CAAC,MAAM,CAAC,gCAAO,EAAE,GAAG,CAAC,GAAG,EAAE;QAChC,iBAAiB,EAAE,MAAM,CAAC,MAAM;KACjC,CAAC,CAAC;IAEH,OAAO;QACL,UAAU;QACV,SAAS;KACV,CAAC;AACJ,CAAC,CAAC;AA5DW,QAAA,iBAAiB,qBA4D5B"}

package/dist/cjs/api/routes/manager/auth/totp/verifyTotp.js

@@ -0,0 +1,120 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyTotpHandler = void 0;
+const OTPAuth = __importStar(require("otpauth"));
+const internal_content_types_1 = require("../../../../../internal-content-types");
+const errors_1 = require("../../../../../lib/errors");
+const orm_1 = require("../../../../../orm");
+const verifyTotpHandler = async ({ input, }) => {
+    const db = await (0, orm_1.getMongoService)();
+    const { challenge, code } = input;
+    const mfaChallenge = await db.find(internal_content_types_1.MfaChallenge, { token: challenge });
+    if (!mfaChallenge) {
+        (0, errors_1.throwAppError)("NOT_FOUND", {
+            id: challenge,
+            resource: "MfaChallenge",
+        });
+    }
+    if (mfaChallenge.method !== "totp") {
+        (0, errors_1.throwAppError)("CONFLICT", {
+            message: `Unsupported MFA method: ${mfaChallenge.method}`,
+        });
+    }
+    if (mfaChallenge.consumedAt) {
+        (0, errors_1.throwAppError)("CONFLICT", {
+            message: "MFA challenge already consumed",
+        });
+    }
+    if (new Date(mfaChallenge.expiresAt).getTime() <= Date.now()) {
+        (0, errors_1.throwAppError)("CONFLICT", {
+            message: "MFA challenge expired",
+        });
+    }
+    const attempts = Number(mfaChallenge.attempts ?? 0);
+    if (attempts >= 8) {
+        (0, errors_1.throwAppError)("CONFLICT", {
+            message: "Too many failed attempts. Please request a new code.",
+        });
+    }
+    await db.update(internal_content_types_1.MfaChallenge, mfaChallenge._id, { attempts: attempts + 1 });
+    const userId = mfaChallenge.user._id;
+    const user = await db.find(internal_content_types_1.ManagerUser, { _id: userId });
+    if (!user) {
+        (0, errors_1.throwAppError)("NOT_FOUND", {
+            id: userId,
+            resource: "ManagerUser",
+        });
+    }
+    const mfa = await db.find(internal_content_types_1.UserMfa, { "user._id": userId });
+    if (!mfa?.enabled || !mfa?.totpSecret) {
+        (0, errors_1.throwAppError)("CONFLICT", {
+            message: "TOTP MFA not enabled for this user",
+        });
+    }
+    const totp = new OTPAuth.TOTP({
+        issuer: "CMS",
+        label: user.email,
+        algorithm: "SHA1",
+        digits: 6,
+        period: 30,
+        secret: OTPAuth.Secret.fromBase32(mfa.totpSecret),
+    });
+    const delta = totp.validate({ token: code, window: 1 });
+    if (delta === null) {
+        return {
+            error: "INVALID_CODE",
+        };
+    }
+    // consume challenge (así no se reutiliza)
+    await db.update(internal_content_types_1.MfaChallenge, mfaChallenge._id, { consumedAt: new Date() });
+    const token = crypto.randomUUID();
+    const expiresAt = new Date(Date.now() + 1000 * 60 * 60 * 24); // 1 day
+    await db.create(internal_content_types_1.Session, {
+        token,
+        user: {
+            _id: user._id,
+            contentType: internal_content_types_1.ManagerUser.name,
+            type: "existing",
+        },
+        expiresAt,
+        _type: "Session",
+    });
+    return {
+        token,
+    };
+};
+exports.verifyTotpHandler = verifyTotpHandler;
+//# sourceMappingURL=verifyTotp.js.map

package/dist/cjs/api/routes/manager/auth/totp/verifyTotp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyTotp.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/totp/verifyTotp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iDAAmC;AACnC,kFAK+C;AAC/C,sDAA0D;AAC1D,4CAAqD;AAG9C,MAAM,iBAAiB,GAAG,KAAK,EAAE,EACtC,KAAK,GAGN,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,IAAA,qBAAe,GAAE,CAAC;IAEnC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAElC,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,qCAAY,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,IAAA,sBAAa,EAAC,WAAW,EAAE;YACzB,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACnC,IAAA,sBAAa,EAAC,UAAU,EAAE;YACxB,OAAO,EAAE,2BAA2B,YAAY,CAAC,MAAM,EAAE;SAC1D,CAAC,CAAC;IACL,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;QAC5B,IAAA,sBAAa,EAAC,UAAU,EAAE;YACxB,OAAO,EAAE,gCAAgC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7D,IAAA,sBAAa,EAAC,UAAU,EAAE;YACxB,OAAO,EAAE,uBAAuB;SACjC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;IACpD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,IAAA,sBAAa,EAAC,UAAU,EAAE;YACxB,OAAO,EAAE,sDAAsD;SAChE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,CAAC,qCAAY,EAAE,YAAY,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAC;IAE5E,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;IAErC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,oCAAW,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAA,sBAAa,EAAC,WAAW,EAAE;YACzB,EAAE,EAAE,MAAM;YACV,QAAQ,EAAE,aAAa;SACxB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,gCAAO,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC;QACtC,IAAA,sBAAa,EAAC,UAAU,EAAE;YACxB,OAAO,EAAE,oCAAoC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;QAC5B,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC;KAClD,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO;YACL,KAAK,EAAE,cAAc;SACtB,CAAC;IACJ,CAAC;IAED,0CAA0C;IAC1C,MAAM,EAAE,CAAC,MAAM,CAAC,qCAAY,EAAE,YAAY,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IAE5E,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ;IAEtE,MAAM,EAAE,CAAC,MAAM,CAAC,gCAAO,EAAE;QACvB,KAAK;QACL,IAAI,EAAE;YACJ,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,oCAAW,CAAC,IAAI;YAC7B,IAAI,EAAE,UAAU;SACjB;QACD,SAAS;QACT,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;KACN,CAAC;AACJ,CAAC,CAAC;AAhGW,QAAA,iBAAiB,qBAgG5B"}

package/dist/cjs/api/routes/manager/auth/updatePassword.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.updatePasswordHandler = void 0;
+const internal_content_types_1 = require("../../../../internal-content-types");
+const orm_1 = require("../../../../orm");
+const passwords_1 = require("../../../utils/passwords");
+const updatePasswordHandler = async ({ input, ctx, }) => {
+    const db = await (0, orm_1.getMongoService)();
+    const user = ctx.getUser();
+    const password = (await db.get(internal_content_types_1.ManagerUser, user._id, ["password"])).password;
+    if (!(0, passwords_1.verifyPassword)(input.currentPassword, password)) {
+        throw new Error("Current password is incorrect");
+    }
+    await db.update(internal_content_types_1.ManagerUser, user._id, {
+        password: (0, passwords_1.hashPassword)(input.newPassword),
+    });
+    return { ok: true };
+};
+exports.updatePasswordHandler = updatePasswordHandler;
+//# sourceMappingURL=updatePassword.js.map

package/dist/cjs/api/routes/manager/auth/updatePassword.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"updatePassword.js","sourceRoot":"","sources":["../../../../../../src/api/routes/manager/auth/updatePassword.ts"],"names":[],"mappings":";;;AAAA,+EAAiE;AACjE,yCAAkD;AAGlD,wDAAwE;AAEjE,MAAM,qBAAqB,GAAG,KAAK,EAAE,EAC1C,KAAK,EACL,GAAG,GAIJ,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,IAAA,qBAAe,GAAE,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oCAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAE9E,IAAI,CAAC,IAAA,0BAAc,EAAC,KAAK,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,CAAC,oCAAW,EAAE,IAAI,CAAC,GAAG,EAAE;QACrC,QAAQ,EAAE,IAAA,wBAAY,EAAC,KAAK,CAAC,WAAW,CAAC;KAC1C,CAAC,CAAC;IAEH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC,CAAC;AApBW,QAAA,qBAAqB,yBAoBhC"}

package/dist/cjs/api/routes/manager/auth/webauthn/share.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toB64 = exports.toBase64URL = exports.ORIGIN = exports.RP_ID = void 0;
+const environment = process.env.ENVIRONMENT || 'local';
+const managerPrefix = process.env.MANAGER_PREFIX || 'manager';
+const baseDomain = process.env.BASE_DOMAIN || 'localhost';
+exports.RP_ID = environment === 'local' ? 'localhost' : `${managerPrefix}.${baseDomain}`;
+exports.ORIGIN = environment === 'local' ? `http://${exports.RP_ID}:3000` : `https://${exports.RP_ID}`;
+const toBase64URL = (credentialId) => {
+    if (!credentialId)
+        return credentialId;
+    if (!credentialId.includes('+') &&
+        !credentialId.includes('/') &&
+        !credentialId.includes('=')) {
+        return credentialId;
+    }
+    const decoded = Buffer.from(credentialId, 'base64');
+    const asUtf8 = decoded.toString('utf8');
+    // Legacy bug: id was stored as base64(utf8(base64urlId))
+    if (/^[A-Za-z0-9_-]+$/.test(asUtf8)) {
+        return asUtf8;
+    }
+    return decoded.toString('base64url');
+};
+exports.toBase64URL = toBase64URL;
+const toB64 = (buf) => buf.toString('base64');
+exports.toB64 = toB64;
+//# sourceMappingURL=share.js.map

package/dist/cjs/api/routes/manager/auth/webauthn/share.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/webauthn/share.ts"],"names":[],"mappings":";;;AAAA,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAA;AACtD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,SAAS,CAAA;AAC7D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,WAAW,CAAA;AAE5C,QAAA,KAAK,GAChB,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,aAAa,IAAI,UAAU,EAAE,CAAA;AAC7D,QAAA,MAAM,GAAG,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,aAAK,OAAO,CAAC,CAAC,CAAC,WAAW,aAAK,EAAE,CAAA;AAEpF,MAAM,WAAW,GAAG,CAAC,YAAoB,EAAE,EAAE;IAClD,IAAI,CAAC,YAAY;QAAE,OAAO,YAAY,CAAA;IAEtC,IACE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC3B,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC3B,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC3B,CAAC;QACD,OAAO,YAAY,CAAA;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACvC,yDAAyD;IACzD,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO,MAAM,CAAA;IACf,CAAC;IAED,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACtC,CAAC,CAAA;AAnBY,QAAA,WAAW,eAmBvB;AAEM,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAA/C,QAAA,KAAK,SAA0C"}

package/dist/cjs/api/routes/manager/auth/webauthn/webauthnAuthOptions.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.webauthnAuthOptionsHandler = void 0;
+const server_1 = require("@simplewebauthn/server");
+const internal_content_types_1 = require("../../../../../internal-content-types");
+const errors_1 = require("../../../../../lib/errors");
+const orm_1 = require("../../../../../orm");
+const share_1 = require("./share");
+const webauthnAuthOptionsHandler = async ({ input, }) => {
+    const db = await (0, orm_1.getMongoService)();
+    const ch = await db.find(internal_content_types_1.MfaChallenge, { token: input.challengeToken });
+    if (!ch) {
+        (0, errors_1.throwAppError)("NOT_FOUND", {
+            id: input.challengeToken,
+            resource: "MfaChallenge",
+        });
+    }
+    if (ch.method !== "webauthn") {
+        (0, errors_1.throwAppError)("CONFLICT", {
+            message: "Challenge method mismatch",
+        });
+    }
+    if (ch.consumedAt) {
+        (0, errors_1.throwAppError)("CONFLICT", {
+            message: "Challenge already consumed",
+        });
+    }
+    if (new Date(ch.expiresAt).getTime() <= Date.now()) {
+        (0, errors_1.throwAppError)("CONFLICT", {
+            message: "Challenge expired",
+        });
+    }
+    const userId = ch.user._id;
+    const creds = (await db.list(internal_content_types_1.WebAuthnCredential, { filter: { "user._id": userId } }))
+        ?.items ?? [];
+    const allowCredentials = creds.map((c) => ({
+        id: (0, share_1.toBase64URL)(c.credentialId),
+    }));
+    const options = await (0, server_1.generateAuthenticationOptions)({
+        rpID: share_1.RP_ID,
+        userVerification: "preferred",
+        allowCredentials,
+    });
+    await db.update(internal_content_types_1.MfaChallenge, ch._id, {
+        webAuthnChallenge: options.challenge,
+    });
+    return { options };
+};
+exports.webauthnAuthOptionsHandler = webauthnAuthOptionsHandler;
+//# sourceMappingURL=webauthnAuthOptions.js.map

package/dist/cjs/api/routes/manager/auth/webauthn/webauthnAuthOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthnAuthOptions.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/webauthn/webauthnAuthOptions.ts"],"names":[],"mappings":";;;AAAA,mDAAuE;AACvE,kFAG+C;AAC/C,sDAA0D;AAC1D,4CAAqD;AACrD,mCAA6C;AAEtC,MAAM,0BAA0B,GAAG,KAAK,EAAE,EAC/C,KAAK,GAGN,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,IAAA,qBAAe,GAAE,CAAC;IAEnC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,qCAAY,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,IAAA,sBAAa,EAAC,WAAW,EAAE;YACzB,EAAE,EAAE,KAAK,CAAC,cAAc;YACxB,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC7B,IAAA,sBAAa,EAAC,UAAU,EAAE;YACxB,OAAO,EAAE,2BAA2B;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;QAClB,IAAA,sBAAa,EAAC,UAAU,EAAE;YACxB,OAAO,EAAE,4BAA4B;SACtC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnD,IAAA,sBAAa,EAAC,UAAU,EAAE;YACxB,OAAO,EAAE,mBAAmB;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;IAC3B,MAAM,KAAK,GACT,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,2CAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACrE,EAAE,KAAK,IAAI,EAAE,CAAC;IAElB,MAAM,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,EAAE,EAAE,IAAA,mBAAW,EAAC,CAAC,CAAC,YAAY,CAAC;KAChC,CAAC,CAAC,CAAC;IAEJ,MAAM,OAAO,GAAG,MAAM,IAAA,sCAA6B,EAAC;QAClD,IAAI,EAAE,aAAK;QACX,gBAAgB,EAAE,WAAW;QAC7B,gBAAgB;KACjB,CAAC,CAAC;IAEH,MAAM,EAAE,CAAC,MAAM,CAAC,qCAAY,EAAE,EAAE,CAAC,GAAG,EAAE;QACpC,iBAAiB,EAAE,OAAO,CAAC,SAAS;KACrC,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC,CAAC;AAlDW,QAAA,0BAA0B,8BAkDrC"}