@rakun-kit/core 1.4.10 → 1.5.0

package/dist/cjs/api/routes/manager/auth/externalLogin.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.externalLoginCompleteHandler = exports.externalLoginStartHandler = void 0;
+const crypto_1 = require("crypto");
+const completePrimaryAuthentication_1 = require("../../../../auth/completePrimaryAuthentication");
+const bootstrapState_1 = require("../../../../bootstrapState");
+const internal_content_types_1 = require("../../../../internal-content-types");
+const errors_1 = require("../../../../lib/errors");
+const orm_1 = require("../../../../orm");
+const authEvents_1 = require("../../../utils/authEvents");
+const authRateLimit_1 = require("../../../utils/authRateLimit");
+const LOGIN_FLOW_COOKIE = 'rakun_login_flow';
+const LOGIN_FLOW_MAX_AGE_MS = 10 * 60 * 1000;
+const getAdapter = (provider) => {
+    const adapter = (0, bootstrapState_1.getRakunBootstrapOptions)()?.login?.adapters?.find((candidate) => candidate.id === provider);
+    if (!adapter)
+        (0, errors_1.throwAppError)('FORBIDDEN', { reason: 'LOGIN_PROVIDER_NOT_FOUND' });
+    return adapter;
+};
+const setFlowCookie = (ctx, flow) => {
+    const value = flow ? Buffer.from(JSON.stringify(flow)).toString('base64url') : '';
+    const maxAge = flow ? LOGIN_FLOW_MAX_AGE_MS : 0;
+    if (ctx?.res?.cookie) {
+        ctx.res.cookie(LOGIN_FLOW_COOKIE, value, {
+            httpOnly: true,
+            sameSite: 'lax',
+            path: '/',
+            maxAge,
+            secure: true,
+        });
+        return;
+    }
+    ctx?.res?.setHeader('Set-Cookie', `${LOGIN_FLOW_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Secure; Max-Age=${Math.floor(maxAge / 1000)}`);
+};
+const getFlowCookie = (ctx) => {
+    const value = ctx?.req?.cookies?.[LOGIN_FLOW_COOKIE];
+    if (!value)
+        return null;
+    try {
+        const parsed = JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));
+        if (typeof parsed.provider !== 'string' ||
+            typeof parsed.state !== 'string' ||
+            typeof parsed.codeVerifier !== 'string' ||
+            typeof parsed.expiresAt !== 'number') {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+};
+const statesMatch = (left, right) => {
+    const leftBuffer = Buffer.from(left);
+    const rightBuffer = Buffer.from(right);
+    return leftBuffer.length === rightBuffer.length && (0, crypto_1.timingSafeEqual)(leftBuffer, rightBuffer);
+};
+const externalLoginStartHandler = async ({ input, ctx, }) => {
+    const adapter = getAdapter(input.provider);
+    const state = `${adapter.id}.${(0, crypto_1.randomBytes)(32).toString('base64url')}`;
+    const codeVerifier = (0, crypto_1.randomBytes)(48).toString('base64url');
+    const codeChallenge = (0, crypto_1.createHash)('sha256').update(codeVerifier).digest('base64url');
+    setFlowCookie(ctx, {
+        provider: adapter.id,
+        state,
+        codeVerifier,
+        expiresAt: Date.now() + LOGIN_FLOW_MAX_AGE_MS,
+    });
+    return {
+        url: await adapter.createAuthorizationUrl({ state, codeChallenge }),
+    };
+};
+exports.externalLoginStartHandler = externalLoginStartHandler;
+const externalLoginCompleteHandler = async ({ input, ctx, }) => {
+    const rateLimitKey = `external-login:${(0, authRateLimit_1.getRequestRateLimitIdentifier)(ctx)}:${input.provider}`;
+    (0, authRateLimit_1.assertAuthRateLimit)({
+        key: rateLimitKey,
+        limit: 8,
+        windowMs: 15 * 60 * 1000,
+    });
+    const flow = getFlowCookie(ctx);
+    setFlowCookie(ctx, null);
+    if (!flow ||
+        flow.expiresAt <= Date.now() ||
+        flow.provider !== input.provider ||
+        !statesMatch(flow.state, input.state)) {
+        (0, errors_1.throwAppError)('FORBIDDEN', { reason: 'INVALID_LOGIN_FLOW' });
+    }
+    const adapter = getAdapter(input.provider);
+    let identity;
+    try {
+        identity = await adapter.authenticate({
+            code: input.code,
+            codeVerifier: flow.codeVerifier,
+        });
+    }
+    catch {
+        (0, errors_1.throwAppError)('FORBIDDEN', { reason: 'INVALID_CREDENTIALS' });
+    }
+    if (!identity.emailVerified) {
+        (0, errors_1.throwAppError)('FORBIDDEN', { reason: 'INVALID_CREDENTIALS' });
+    }
+    const db = await (0, orm_1.getMongoService)();
+    const user = await db.find(internal_content_types_1.ManagerUser, {
+        email: identity.email.trim().toLowerCase(),
+    });
+    if (!user)
+        (0, errors_1.throwAppError)('FORBIDDEN', { reason: 'INVALID_CREDENTIALS' });
+    (0, authRateLimit_1.resetAuthRateLimit)(rateLimitKey);
+    const result = await (0, completePrimaryAuthentication_1.completePrimaryAuthentication)(user._id);
+    await (0, authEvents_1.recordAuthEvent)({
+        type: 'auth.external-login.succeeded',
+        outcome: 'success',
+        ctx,
+        actor: { type: 'ManagerUser', id: String(user._id) },
+        resource: { type: 'ManagerUser', id: String(user._id) },
+        tags: ['external-login', adapter.id],
+        data: {
+            provider: adapter.id,
+            mfaRequired: 'challenge' in result,
+        },
+    });
+    return result;
+};
+exports.externalLoginCompleteHandler = externalLoginCompleteHandler;
+//# sourceMappingURL=externalLogin.js.map

package/dist/cjs/api/routes/manager/auth/externalLogin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"externalLogin.js","sourceRoot":"","sources":["../../../../../../src/api/routes/manager/auth/externalLogin.ts"],"names":[],"mappings":";;;AAAA,mCAAiE;AAEjE,kGAA8F;AAE9F,+DAAqE;AACrE,+EAAgE;AAChE,mDAAsD;AACtD,yCAAiD;AAQjD,0DAA2D;AAC3D,gEAIqC;AAErC,MAAM,iBAAiB,GAAG,kBAAkB,CAAA;AAC5C,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAS5C,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAgB,EAAE;IACpD,MAAM,OAAO,GAAG,IAAA,yCAAwB,GAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAC/D,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CACzC,CAAA;IAED,IAAI,CAAC,OAAO;QAAE,IAAA,sBAAa,EAAC,WAAW,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAA;IAChF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,GAAoC,EAAE,IAAsB,EAAE,EAAE;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACjF,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAA;IAE/C,IAAI,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACrB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,KAAK,EAAE;YACvC,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG;YACT,MAAM;YACN,MAAM,EAAE,IAAI;SACb,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IAED,GAAG,EAAE,GAAG,EAAE,SAAS,CACjB,YAAY,EACZ,GAAG,iBAAiB,IAAI,kBAAkB,CAAC,KAAK,CAAC,qDAAqD,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAClI,CAAA;AACH,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,GAAyB,EAAoB,EAAE;IACpE,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAA;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC3B,CAAA;QAEvB,IACE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;YACvC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EACpC,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,MAAmB,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE;IAClD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtC,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,IAAI,IAAA,wBAAe,EAAC,UAAU,EAAE,WAAW,CAAC,CAAA;AAC7F,CAAC,CAAA;AAEM,MAAM,yBAAyB,GAAG,KAAK,EAAE,EAC9C,KAAK,EACL,GAAG,GAIJ,EAAqC,EAAE;IACtC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,EAAE,IAAI,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAA;IACtE,MAAM,YAAY,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC1D,MAAM,aAAa,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAEnF,aAAa,CAAC,GAAG,EAAE;QACjB,QAAQ,EAAE,OAAO,CAAC,EAAE;QACpB,KAAK;QACL,YAAY;QACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB;KAC9C,CAAC,CAAA;IAEF,OAAO;QACL,GAAG,EAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;KACpE,CAAA;AACH,CAAC,CAAA;AAtBY,QAAA,yBAAyB,6BAsBrC;AAEM,MAAM,4BAA4B,GAAG,KAAK,EAAE,EACjD,KAAK,EACL,GAAG,GAIJ,EAAwC,EAAE;IACzC,MAAM,YAAY,GAAG,kBAAkB,IAAA,6CAA6B,EAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;IAC7F,IAAA,mCAAmB,EAAC;QAClB,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,CAAC;QACR,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;KACzB,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IAC/B,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACxB,IACE,CAAC,IAAI;QACL,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAC5B,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAChC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EACrC,CAAC;QACD,IAAA,sBAAa,EAAC,WAAW,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,QAAQ,CAAA;IACZ,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,IAAA,sBAAa,EAAC,WAAW,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC5B,IAAA,sBAAa,EAAC,WAAW,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,IAAA,qBAAe,GAAE,CAAA;IAClC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,oCAAW,EAAE;QACtC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;KAC3C,CAAC,CAAA;IACF,IAAI,CAAC,IAAI;QAAE,IAAA,sBAAa,EAAC,WAAW,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAExE,IAAA,kCAAkB,EAAC,YAAY,CAAC,CAAA;IAChC,MAAM,MAAM,GAAG,MAAM,IAAA,6DAA6B,EAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5D,MAAM,IAAA,4BAAe,EAAC;QACpB,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,SAAS;QAClB,GAAG;QACH,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACpD,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACvD,IAAI,EAAE,CAAC,gBAAgB,EAAE,OAAO,CAAC,EAAE,CAAC;QACpC,IAAI,EAAE;YACJ,QAAQ,EAAE,OAAO,CAAC,EAAE;YACpB,WAAW,EAAE,WAAW,IAAI,MAAM;SACnC;KACF,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AA9DY,QAAA,4BAA4B,gCA8DxC"}

package/dist/cjs/api/routes/manager/auth/login.js

@@ -1,76 +1,73 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loginHandler = void 0;
-const crypto_1 = require("crypto");
+const completePrimaryAuthentication_1 = require("../../../../auth/completePrimaryAuthentication");
+const passwordFail2ban_1 = require("../../../../auth/passwordFail2ban");
+const bootstrapState_1 = require("../../../../bootstrapState");
 const internal_content_types_1 = require("../../../../internal-content-types");
 const errors_1 = require("../../../../lib/errors");
 const orm_1 = require("../../../../orm");
-const sessionCookie_1 = require("../../../sessionCookie");
-const authRateLimit_1 = require("../../../utils/authRateLimit");
+const authEvents_1 = require("../../../utils/authEvents");
+const apiEventLog_1 = require("../../../operations/apiEventLog");
 const passwords_1 = require("../../../utils/passwords");
 const loginHandler = async ({ input, ctx, }) => {
+    if ((0, bootstrapState_1.getRakunBootstrapOptions)()?.login?.password === false) {
+        (0, errors_1.throwAppError)("FORBIDDEN", { reason: "LOGIN_METHOD_DISABLED" });
+    }
     const { username, password } = input;
     const db = await (0, orm_1.getMongoService)();
-    const rateLimitKey = `login:${(0, authRateLimit_1.getRequestRateLimitIdentifier)(ctx)}:${username.toLowerCase()}`;
-    (0, authRateLimit_1.assertAuthRateLimit)({
-        key: rateLimitKey,
-        limit: 8,
-        windowMs: 15 * 60 * 1000,
-    });
-    const user = await db.find(internal_content_types_1.ManagerUser, { email: username });
-    if (!user)
+    const ip = (0, passwordFail2ban_1.resolvePasswordLoginIp)(ctx);
+    const existingBlock = await (0, passwordFail2ban_1.getBlockedPasswordIp)(ip);
+    if (existingBlock) {
+        (0, apiEventLog_1.setApiErrorEventData)(ctx, {
+            passwordLogin: {
+                ip: ip ?? null,
+                failedAttempts: existingBlock.failedAttempts,
+                blocked: true,
+            },
+        });
+        (0, errors_1.throwAppError)('FORBIDDEN', { reason: 'IP_BLOCKED' });
+    }
+    const rejectInvalidCredentials = async () => {
+        const failure = await (0, passwordFail2ban_1.recordPasswordFailure)(ip);
+        (0, apiEventLog_1.setApiErrorEventData)(ctx, {
+            passwordLogin: {
+                ip: ip ?? null,
+                failedAttempts: failure.failedAttempts ?? 0,
+                blocked: failure.blocked,
+            },
+        });
+        if (failure.newlyBlocked) {
+            await (0, authEvents_1.recordAuthEvent)({
+                type: 'auth.password.ip-blocked',
+                outcome: 'failure',
+                severity: 'warning',
+                ctx,
+                actor: { type: 'anonymous' },
+                resource: failure.recordId
+                    ? { type: internal_content_types_1.LoginIpBlock.name, id: failure.recordId }
+                    : { type: internal_content_types_1.LoginIpBlock.name },
+                tags: ['password-login', 'ip-block'],
+                data: { failedAttempts: failure.failedAttempts ?? 0 },
+            });
+        }
         (0, errors_1.throwAppError)("FORBIDDEN", {
-            reason: "INVALID_CREDENTIALS",
+            reason: failure.blocked ? 'IP_BLOCKED' : "INVALID_CREDENTIALS",
         });
+    };
+    const user = await db.find(internal_content_types_1.ManagerUser, { email: username });
+    if (!user)
+        return rejectInvalidCredentials();
     const passwordCheck = (0, passwords_1.verifyStoredPassword)(password, user.password);
     if (!passwordCheck.valid)
-        (0, errors_1.throwAppError)("FORBIDDEN", {
-            reason: "INVALID_CREDENTIALS",
-        });
+        return rejectInvalidCredentials();
     if (passwordCheck.needsRehash) {
         await db.update(internal_content_types_1.ManagerUser, user._id, {
             password: (0, passwords_1.hashPassword)(password),
         });
     }
-    (0, authRateLimit_1.resetAuthRateLimit)(rateLimitKey);
-    const mfa = await db.find(internal_content_types_1.UserMfa, { "user._id": user._id });
-    if (mfa?.enabled) {
-        const challenge = (0, crypto_1.randomBytes)(32).toString("hex");
-        const expiresAt = new Date(Date.now() + 1000 * 60 * 5); // 5 minutes
-        await db.create(internal_content_types_1.MfaChallenge, {
-            token: challenge,
-            user: {
-                _id: user._id,
-                contentType: internal_content_types_1.ManagerUser.name,
-                type: "existing",
-            },
-            method: mfa.preferredMethod ?? "totp",
-            expiresAt,
-            attempts: 0,
-            _type: "MfaChallenge",
-        });
-        return {
-            challenge,
-            method: mfa.preferredMethod ?? "totp",
-            expiresAt: expiresAt.toISOString(),
-        };
-    }
-    const token = crypto.randomUUID();
-    const expiresAt = new Date(Date.now() + sessionCookie_1.SESSION_MAX_AGE_MS);
-    await db.create(internal_content_types_1.Session, {
-        token,
-        user: {
-            _id: user._id,
-            contentType: internal_content_types_1.ManagerUser.name,
-            type: "existing",
-        },
-        expiresAt,
-        _type: "Session",
-    });
-    return {
-        token,
-        expiresAt: expiresAt.toISOString(),
-    };
+    await (0, passwordFail2ban_1.clearPasswordFailures)(ip);
+    return (0, completePrimaryAuthentication_1.completePrimaryAuthentication)(user._id);
 };
 exports.loginHandler = loginHandler;
 //# sourceMappingURL=login.js.map

package/dist/cjs/api/routes/manager/auth/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../../../../src/api/routes/manager/auth/login.ts"],"names":[],"mappings":";;;AAAA,mCAAqC;AAErC,+EAK4C;AAC5C,mDAAuD;AACvD,yCAAkD;AAMlD,0DAA4D;AAC5D,gEAIsC;AACtC,wDAA8E;AAEvE,MAAM,YAAY,GAAG,KAAK,EAAE,EACjC,KAAK,EACL,GAAG,GAIJ,EAAwB,EAAE;IACzB,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,EAAE,GAAG,MAAM,IAAA,qBAAe,GAAE,CAAC;IACnC,MAAM,YAAY,GAAG,SAAS,IAAA,6CAA6B,EAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;IAE7F,IAAA,mCAAmB,EAAC;QAClB,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,CAAC;QACR,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;KACzB,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,oCAAW,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI;QACP,IAAA,sBAAa,EAAC,WAAW,EAAE;YACzB,MAAM,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IAEL,MAAM,aAAa,GAAG,IAAA,gCAAoB,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpE,IAAI,CAAC,aAAa,CAAC,KAAK;QACtB,IAAA,sBAAa,EAAC,WAAW,EAAE;YACzB,MAAM,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IAEL,IAAI,aAAa,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,EAAE,CAAC,MAAM,CAAC,oCAAW,EAAE,IAAI,CAAC,GAAG,EAAE;YACrC,QAAQ,EAAE,IAAA,wBAAY,EAAC,QAAQ,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IACD,IAAA,kCAAkB,EAAC,YAAY,CAAC,CAAC;IAEjC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,gCAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAElD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY;QAEpE,MAAM,EAAE,CAAC,MAAM,CAAC,qCAAY,EAAE;YAC5B,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE;gBACJ,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,WAAW,EAAE,oCAAW,CAAC,IAAI;gBAC7B,IAAI,EAAE,UAAU;aACjB;YACD,MAAM,EAAE,GAAG,CAAC,eAAe,IAAI,MAAM;YACrC,SAAS;YACT,QAAQ,EAAE,CAAC;YACX,KAAK,EAAE,cAAc;SACtB,CAAC,CAAC;QAEH,OAAO;YACL,SAAS;YACT,MAAM,EAAE,GAAG,CAAC,eAAe,IAAI,MAAM;YACrC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;SACnC,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kCAAkB,CAAC,CAAC;IAE5D,MAAM,EAAE,CAAC,MAAM,CAAC,gCAAO,EAAE;QACvB,KAAK;QACL,IAAI,EAAE;YACJ,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,oCAAW,CAAC,IAAI;YAC7B,IAAI,EAAE,UAAU;SACjB;QACD,SAAS;QACT,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;QACL,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;KACnC,CAAC;AACJ,CAAC,CAAC;AAhFW,QAAA,YAAY,gBAgFvB"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../../../../src/api/routes/manager/auth/login.ts"],"names":[],"mappings":";;;AAAA,kGAA+F;AAC/F,wEAK0C;AAC1C,+DAAsE;AACtE,+EAA+E;AAC/E,mDAAuD;AACvD,yCAAkD;AAMlD,0DAA2D;AAC3D,iEAAsE;AACtE,wDAA8E;AAEvE,MAAM,YAAY,GAAG,KAAK,EAAE,EACjC,KAAK,EACL,GAAG,GAIJ,EAAwB,EAAE;IACzB,IAAI,IAAA,yCAAwB,GAAE,EAAE,KAAK,EAAE,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC1D,IAAA,sBAAa,EAAC,WAAW,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,EAAE,GAAG,MAAM,IAAA,qBAAe,GAAE,CAAC;IACnC,MAAM,EAAE,GAAG,IAAA,yCAAsB,EAAC,GAAG,CAAC,CAAA;IACtC,MAAM,aAAa,GAAG,MAAM,IAAA,uCAAoB,EAAC,EAAE,CAAC,CAAA;IACpD,IAAI,aAAa,EAAE,CAAC;QAClB,IAAA,kCAAoB,EAAC,GAAG,EAAE;YACxB,aAAa,EAAE;gBACb,EAAE,EAAE,EAAE,IAAI,IAAI;gBACd,cAAc,EAAE,aAAa,CAAC,cAAc;gBAC5C,OAAO,EAAE,IAAI;aACd;SACF,CAAC,CAAA;QACF,IAAA,sBAAa,EAAC,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,wBAAwB,GAAG,KAAK,IAAoB,EAAE;QAC1D,MAAM,OAAO,GAAG,MAAM,IAAA,wCAAqB,EAAC,EAAE,CAAC,CAAA;QAC/C,IAAA,kCAAoB,EAAC,GAAG,EAAE;YACxB,aAAa,EAAE;gBACb,EAAE,EAAE,EAAE,IAAI,IAAI;gBACd,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC;gBAC3C,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB;SACF,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,IAAA,4BAAe,EAAC;gBACpB,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EAAE,SAAS;gBAClB,QAAQ,EAAE,SAAS;gBACnB,GAAG;gBACH,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBACxB,CAAC,CAAC,EAAE,IAAI,EAAE,qCAAY,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE;oBACnD,CAAC,CAAC,EAAE,IAAI,EAAE,qCAAY,CAAC,IAAI,EAAE;gBAC/B,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,CAAC;gBACpC,IAAI,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC,EAAE;aACtD,CAAC,CAAA;QACJ,CAAC;QAED,IAAA,sBAAa,EAAC,WAAW,EAAE;YACzB,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB;SAC/D,CAAC,CAAC;IACL,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,oCAAW,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI;QAAE,OAAO,wBAAwB,EAAE,CAAA;IAE5C,MAAM,aAAa,GAAG,IAAA,gCAAoB,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpE,IAAI,CAAC,aAAa,CAAC,KAAK;QAAE,OAAO,wBAAwB,EAAE,CAAA;IAE3D,IAAI,aAAa,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,EAAE,CAAC,MAAM,CAAC,oCAAW,EAAE,IAAI,CAAC,GAAG,EAAE;YACrC,QAAQ,EAAE,IAAA,wBAAY,EAAC,QAAQ,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAA,wCAAqB,EAAC,EAAE,CAAC,CAAA;IAE/B,OAAO,IAAA,6DAA6B,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjD,CAAC,CAAC;AArEW,QAAA,YAAY,gBAqEvB"}

package/dist/cjs/api/routes/manager/auth/mfa/regenerateRecoveryCodes.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.regenerateRecoveryCodesHandler = void 0;
+const internal_content_types_1 = require("../../../../../internal-content-types");
+const errors_1 = require("../../../../../lib/errors");
+const orm_1 = require("../../../../../orm");
+const passwords_1 = require("../../../../utils/passwords");
+const recoveryCodes_1 = require("../../../../utils/recoveryCodes");
+const authEvents_1 = require("../../../../utils/authEvents");
+const regenerateRecoveryCodesHandler = async ({ input, ctx, }) => {
+    const db = await (0, orm_1.getMongoService)();
+    const user = ctx.getUser();
+    const storedUser = await db.get(internal_content_types_1.ManagerUser, user._id, ['password']);
+    if (!(0, passwords_1.verifyStoredPassword)(input.currentPassword, storedUser.password).valid) {
+        (0, errors_1.throwAppError)('FORBIDDEN', {
+            reason: 'INVALID_CREDENTIALS',
+        });
+    }
+    const mfa = await db.find(internal_content_types_1.UserMfa, { 'user._id': user._id });
+    if (!mfa?.enabled) {
+        (0, errors_1.throwAppError)('CONFLICT', {
+            key: 'MFA_NOT_ENABLED',
+            message: 'MFA must be enabled before generating recovery codes',
+        });
+    }
+    const recovery = (0, recoveryCodes_1.generateRecoveryCodes)();
+    await db.update(internal_content_types_1.UserMfa, mfa._id, {
+        recoveryCodeHashes: recovery.hashes,
+        recoveryCodesGeneratedAt: new Date(),
+    }, { reason: 'mfa recovery codes regenerated' });
+    await (0, authEvents_1.recordAuthEvent)({
+        type: 'auth.mfa.recovery-codes.regenerated',
+        outcome: 'success',
+        ctx,
+        actor: { type: 'manager-user', id: String(user._id) },
+        resource: { type: 'ManagerUser', id: String(user._id) },
+        tags: ['mfa', 'recovery-code'],
+        data: { recoveryCodeCount: recovery.codes.length },
+    });
+    return {
+        ok: true,
+        recoveryCodes: recovery.codes,
+    };
+};
+exports.regenerateRecoveryCodesHandler = regenerateRecoveryCodesHandler;
+//# sourceMappingURL=regenerateRecoveryCodes.js.map

package/dist/cjs/api/routes/manager/auth/mfa/regenerateRecoveryCodes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regenerateRecoveryCodes.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/mfa/regenerateRecoveryCodes.ts"],"names":[],"mappings":";;;AAAA,kFAG8C;AAC9C,sDAAyD;AACzD,4CAAoD;AAGpD,2DAAkE;AAClE,mEAAuE;AACvE,6DAA8D;AAEvD,MAAM,8BAA8B,GAAG,KAAK,EAAE,EACnD,KAAK,EACL,GAAG,GAIJ,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,IAAA,qBAAe,GAAE,CAAA;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAA;IAC1B,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,oCAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;IAEpE,IAAI,CAAC,IAAA,gCAAoB,EAAC,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;QAC5E,IAAA,sBAAa,EAAC,WAAW,EAAE;YACzB,MAAM,EAAE,qBAAqB;SAC9B,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,gCAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC5D,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;QAClB,IAAA,sBAAa,EAAC,UAAU,EAAE;YACxB,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,sDAAsD;SAChE,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,qCAAqB,GAAE,CAAA;IACxC,MAAM,EAAE,CAAC,MAAM,CACb,gCAAO,EACP,GAAG,CAAC,GAAG,EACP;QACE,kBAAkB,EAAE,QAAQ,CAAC,MAAM;QACnC,wBAAwB,EAAE,IAAI,IAAI,EAAE;KACrC,EACD,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAC7C,CAAA;IAED,MAAM,IAAA,4BAAe,EAAC;QACpB,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EAAE,SAAS;QAClB,GAAG;QACH,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrD,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACvD,IAAI,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC;QAC9B,IAAI,EAAE,EAAE,iBAAiB,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE;KACnD,CAAC,CAAA;IAEF,OAAO;QACL,EAAE,EAAE,IAAa;QACjB,aAAa,EAAE,QAAQ,CAAC,KAAK;KAC9B,CAAA;AACH,CAAC,CAAA;AAlDY,QAAA,8BAA8B,kCAkD1C"}

package/dist/cjs/api/routes/manager/auth/mfa/verifyRecoveryCode.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyRecoveryCodeHandler = void 0;
+const internal_content_types_1 = require("../../../../../internal-content-types");
+const errors_1 = require("../../../../../lib/errors");
+const orm_1 = require("../../../../../orm");
+const sessionCookie_1 = require("../../../../sessionCookie");
+const authRateLimit_1 = require("../../../../utils/authRateLimit");
+const recoveryCodes_1 = require("../../../../utils/recoveryCodes");
+const authEvents_1 = require("../../../../utils/authEvents");
+const verifyRecoveryCodeHandler = async ({ input, ctx, }) => {
+    const db = await (0, orm_1.getMongoService)();
+    const rateLimitKey = `mfa:recovery:${input.challenge}`;
+    (0, authRateLimit_1.assertAuthRateLimit)({
+        key: rateLimitKey,
+        limit: 8,
+        windowMs: 5 * 60 * 1000,
+    });
+    const challenge = await db.find(internal_content_types_1.MfaChallenge, { token: input.challenge });
+    if (!challenge) {
+        (0, errors_1.throwAppError)('NOT_FOUND', {
+            id: input.challenge,
+            resource: 'MfaChallenge',
+        });
+    }
+    if (challenge.consumedAt ||
+        new Date(challenge.expiresAt).getTime() <= Date.now()) {
+        (0, errors_1.throwAppError)('CONFLICT', {
+            key: 'INVALID_MFA_CHALLENGE',
+            message: 'MFA challenge is invalid or expired',
+        });
+    }
+    const attempts = Number(challenge.attempts ?? 0);
+    if (attempts >= 8) {
+        (0, errors_1.throwAppError)('CONFLICT', {
+            key: 'MFA_ATTEMPTS_EXHAUSTED',
+            message: 'Too many failed attempts',
+        });
+    }
+    await db.update(internal_content_types_1.MfaChallenge, challenge._id, { attempts: attempts + 1 });
+    const userId = challenge.user._id;
+    const mfa = await db.find(internal_content_types_1.UserMfa, { 'user._id': userId });
+    const hashes = (mfa?.recoveryCodeHashes ?? []).filter((hash) => typeof hash === 'string');
+    const usedHash = (0, recoveryCodes_1.findRecoveryCodeHash)(input.code, hashes);
+    if (!mfa?.enabled || !usedHash) {
+        return { error: 'INVALID_CODE' };
+    }
+    await db.update(internal_content_types_1.UserMfa, mfa._id, {
+        recoveryCodeHashes: hashes.filter((hash) => hash !== usedHash),
+    }, { reason: 'mfa recovery code consumed' });
+    await db.update(internal_content_types_1.MfaChallenge, challenge._id, { consumedAt: new Date() });
+    (0, authRateLimit_1.resetAuthRateLimit)(rateLimitKey);
+    const token = crypto.randomUUID();
+    const expiresAt = new Date(Date.now() + sessionCookie_1.SESSION_MAX_AGE_MS);
+    await db.create(internal_content_types_1.Session, {
+        token,
+        user: {
+            _id: userId,
+            contentType: internal_content_types_1.ManagerUser.name,
+            type: 'existing',
+        },
+        expiresAt,
+        _type: 'Session',
+    });
+    await (0, authEvents_1.recordAuthEvent)({
+        type: 'auth.mfa.recovery-code.used',
+        outcome: 'success',
+        ctx,
+        actor: { type: 'manager-user', id: String(userId) },
+        resource: { type: 'ManagerUser', id: String(userId) },
+        tags: ['mfa', 'recovery-code'],
+        data: { remainingRecoveryCodes: hashes.length - 1 },
+    });
+    return {
+        token,
+        expiresAt: expiresAt.toISOString(),
+    };
+};
+exports.verifyRecoveryCodeHandler = verifyRecoveryCodeHandler;
+//# sourceMappingURL=verifyRecoveryCode.js.map

package/dist/cjs/api/routes/manager/auth/mfa/verifyRecoveryCode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyRecoveryCode.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/mfa/verifyRecoveryCode.ts"],"names":[],"mappings":";;;AAAA,kFAK8C;AAC9C,sDAAyD;AACzD,4CAAoD;AAEpD,6DAA8D;AAC9D,mEAGwC;AACxC,mEAAsE;AACtE,6DAA8D;AAGvD,MAAM,yBAAyB,GAAG,KAAK,EAAE,EAC9C,KAAK,EACL,GAAG,GAIJ,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,IAAA,qBAAe,GAAE,CAAA;IAClC,MAAM,YAAY,GAAG,gBAAgB,KAAK,CAAC,SAAS,EAAE,CAAA;IAEtD,IAAA,mCAAmB,EAAC;QAClB,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,CAAC;QACR,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;KACxB,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,qCAAY,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAA;IACzE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAA,sBAAa,EAAC,WAAW,EAAE;YACzB,EAAE,EAAE,KAAK,CAAC,SAAS;YACnB,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAA;IACJ,CAAC;IAED,IACE,SAAS,CAAC,UAAU;QACpB,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EACrD,CAAC;QACD,IAAA,sBAAa,EAAC,UAAU,EAAE;YACxB,GAAG,EAAE,uBAAuB;YAC5B,OAAO,EAAE,qCAAqC;SAC/C,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAA;IAChD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,IAAA,sBAAa,EAAC,UAAU,EAAE;YACxB,GAAG,EAAE,wBAAwB;YAC7B,OAAO,EAAE,0BAA0B;SACpC,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,CAAC,qCAAY,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAA;IAExE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAA;IACjC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,gCAAO,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC,MAAM,CACnD,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CACnD,CAAA;IACD,MAAM,QAAQ,GAAG,IAAA,oCAAoB,EAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAEzD,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,cAAuB,EAAE,CAAA;IAC3C,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,CACb,gCAAO,EACP,GAAG,CAAC,GAAG,EACP;QACE,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC;KAC/D,EACD,EAAE,MAAM,EAAE,4BAA4B,EAAE,CACzC,CAAA;IACD,MAAM,EAAE,CAAC,MAAM,CAAC,qCAAY,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;IACxE,IAAA,kCAAkB,EAAC,YAAY,CAAC,CAAA;IAEhC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IACjC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kCAAkB,CAAC,CAAA;IAE3D,MAAM,EAAE,CAAC,MAAM,CAAC,gCAAO,EAAE;QACvB,KAAK;QACL,IAAI,EAAE;YACJ,GAAG,EAAE,MAAM;YACX,WAAW,EAAE,oCAAW,CAAC,IAAI;YAC7B,IAAI,EAAE,UAAU;SACjB;QACD,SAAS;QACT,KAAK,EAAE,SAAS;KACjB,CAAC,CAAA;IAEF,MAAM,IAAA,4BAAe,EAAC;QACpB,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,SAAS;QAClB,GAAG;QACH,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;QACnD,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;QACrD,IAAI,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC;QAC9B,IAAI,EAAE,EAAE,sBAAsB,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE;KACpD,CAAC,CAAA;IAEF,OAAO;QACL,KAAK;QACL,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;KACnC,CAAA;AACH,CAAC,CAAA;AA9FY,QAAA,yBAAyB,6BA8FrC"}

package/dist/cjs/api/routes/manager/auth/passwordIpBlocks.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.unblockPasswordIpHandler = exports.listPasswordIpBlocksHandler = void 0;
+const passwordFail2ban_1 = require("../../../../auth/passwordFail2ban");
+const internal_content_types_1 = require("../../../../internal-content-types");
+const eventLog_1 = require("../../../../eventLog");
+const errors_1 = require("../../../../lib/errors");
+const Permissions_1 = require("../../../../lib/Permissions");
+const orm_1 = require("../../../../orm");
+const authEvents_1 = require("../../../utils/authEvents");
+const checkPermissions_1 = require("../../../utils/checkPermissions");
+const requireManagePermission = (ctx) => {
+    const user = ctx.getUser();
+    (0, checkPermissions_1.checkPermissions)(user, [Permissions_1.AUTH_IP_BLOCK_MANAGE_PERMISSION]);
+    return user;
+};
+const listPasswordIpBlocksHandler = async ({ ctx, }) => {
+    requireManagePermission(ctx);
+    const db = await (0, orm_1.getMongoService)();
+    const [result, recentFailures] = await Promise.all([
+        db.list(internal_content_types_1.LoginIpBlock, {
+            filter: { blockedAt: { $exists: true } },
+            options: { limit: 'all', sort: { blockedAt: 'desc' } },
+        }),
+        (0, eventLog_1.getEventLogService)().query({
+            types: ['api.operation.failed'],
+            operations: ['manager.auth.login'],
+            limit: 25,
+        }),
+    ]);
+    return {
+        maxAttempts: (0, passwordFail2ban_1.getPasswordFail2banConfig)()?.maxAttempts ?? 0,
+        items: result.items.flatMap((record) => record.blockedAt
+            ? [
+                {
+                    id: record._id,
+                    ip: record.ip,
+                    failedAttempts: record.failedAttempts,
+                    lastFailedAt: record.lastFailedAt.toISOString(),
+                    blockedAt: record.blockedAt.toISOString(),
+                },
+            ]
+            : []),
+        recentFailures: recentFailures.items.map((event) => {
+            const context = event.data?.context;
+            const passwordLogin = context && typeof context === 'object' && !Array.isArray(context)
+                ? context.passwordLogin
+                : undefined;
+            const details = passwordLogin &&
+                typeof passwordLogin === 'object' &&
+                !Array.isArray(passwordLogin)
+                ? passwordLogin
+                : undefined;
+            return {
+                id: event.id,
+                occurredAt: event.occurredAt.toISOString(),
+                ip: typeof details?.ip === 'string' ? details.ip : undefined,
+                failedAttempts: typeof details?.failedAttempts === 'number'
+                    ? details.failedAttempts
+                    : 0,
+                blocked: details?.blocked === true,
+            };
+        }),
+    };
+};
+exports.listPasswordIpBlocksHandler = listPasswordIpBlocksHandler;
+const unblockPasswordIpHandler = async ({ input, ctx, }) => {
+    const user = requireManagePermission(ctx);
+    const db = await (0, orm_1.getMongoService)();
+    const record = await db.find(internal_content_types_1.LoginIpBlock, { _id: input.id });
+    if (!record?.blockedAt) {
+        (0, errors_1.throwAppError)('NOT_FOUND', {
+            resource: internal_content_types_1.LoginIpBlock.name,
+            id: input.id,
+        });
+    }
+    await db.delete(internal_content_types_1.LoginIpBlock, { _id: record._id }, { actorId: user._id });
+    await (0, authEvents_1.recordAuthEvent)({
+        type: 'auth.password.ip-unblocked',
+        outcome: 'success',
+        ctx,
+        actor: { type: 'ManagerUser', id: String(user._id) },
+        resource: { type: internal_content_types_1.LoginIpBlock.name, id: record._id },
+        tags: ['password-login', 'ip-block'],
+        data: { failedAttempts: record.failedAttempts },
+    });
+    return { unblocked: true };
+};
+exports.unblockPasswordIpHandler = unblockPasswordIpHandler;
+//# sourceMappingURL=passwordIpBlocks.js.map

package/dist/cjs/api/routes/manager/auth/passwordIpBlocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordIpBlocks.js","sourceRoot":"","sources":["../../../../../../src/api/routes/manager/auth/passwordIpBlocks.ts"],"names":[],"mappings":";;;AAAA,wEAA6E;AAC7E,+EAAiE;AACjE,mDAAyD;AACzD,mDAAsD;AACtD,6DAA6E;AAC7E,yCAAiD;AAOjD,0DAA2D;AAC3D,sEAAkE;AAElE,MAAM,uBAAuB,GAAG,CAAC,GAAwB,EAAE,EAAE;IAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAA;IAC1B,IAAA,mCAAgB,EAAC,IAAI,EAAE,CAAC,6CAA+B,CAAC,CAAC,CAAA;IACzD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAEM,MAAM,2BAA2B,GAAG,KAAK,EAAE,EAChD,GAAG,GAGJ,EAAuC,EAAE;IACxC,uBAAuB,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,EAAE,GAAG,MAAM,IAAA,qBAAe,GAAE,CAAA;IAClC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,EAAE,CAAC,IAAI,CAAC,qCAAY,EAAE;YACpB,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAW;YACjD,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAW,EAAE;SAChE,CAAC;QACF,IAAA,6BAAkB,GAAE,CAAC,KAAK,CAAC;YACzB,KAAK,EAAE,CAAC,sBAAsB,CAAC;YAC/B,UAAU,EAAE,CAAC,oBAAoB,CAAC;YAClC,KAAK,EAAE,EAAE;SACV,CAAC;KACH,CAAC,CAAA;IAEF,OAAO;QACL,WAAW,EAAE,IAAA,4CAAyB,GAAE,EAAE,WAAW,IAAI,CAAC;QAC1D,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACrC,MAAM,CAAC,SAAS;YACd,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,MAAM,CAAC,GAAG;oBACd,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE;oBAC/C,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;iBAC1C;aACF;YACH,CAAC,CAAC,EAAE,CACP;QACD,cAAc,EAAE,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACjD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,OAAO,CAAA;YACnC,MAAM,aAAa,GACjB,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC/D,CAAC,CAAC,OAAO,CAAC,aAAa;gBACvB,CAAC,CAAC,SAAS,CAAA;YACf,MAAM,OAAO,GACX,aAAa;gBACb,OAAO,aAAa,KAAK,QAAQ;gBACjC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;gBAC3B,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,SAAS,CAAA;YAEf,OAAO;gBACL,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE;gBAC1C,EAAE,EAAE,OAAO,OAAO,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;gBAC5D,cAAc,EACZ,OAAO,OAAO,EAAE,cAAc,KAAK,QAAQ;oBACzC,CAAC,CAAC,OAAO,CAAC,cAAc;oBACxB,CAAC,CAAC,CAAC;gBACP,OAAO,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI;aACnC,CAAA;QACH,CAAC,CAAC;KACH,CAAA;AACH,CAAC,CAAA;AA3DY,QAAA,2BAA2B,+BA2DvC;AAEM,MAAM,wBAAwB,GAAG,KAAK,EAAE,EAC7C,KAAK,EACL,GAAG,GAIJ,EAAoC,EAAE;IACrC,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,EAAE,GAAG,MAAM,IAAA,qBAAe,GAAE,CAAA;IAClC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,qCAAY,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IAE7D,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;QACvB,IAAA,sBAAa,EAAC,WAAW,EAAE;YACzB,QAAQ,EAAE,qCAAY,CAAC,IAAI;YAC3B,EAAE,EAAE,KAAK,CAAC,EAAE;SACb,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,CAAC,qCAAY,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IACzE,MAAM,IAAA,4BAAe,EAAC;QACpB,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,SAAS;QAClB,GAAG;QACH,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACpD,QAAQ,EAAE,EAAE,IAAI,EAAE,qCAAY,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE;QACrD,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,CAAC;QACpC,IAAI,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE;KAChD,CAAC,CAAA;IAEF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AAC5B,CAAC,CAAA;AA9BY,QAAA,wBAAwB,4BA8BpC"}