@rakun-kit/core 1.4.11 → 1.5.1

package/dist/esm/api/routes/manager/auth/externalLogin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"externalLogin.js","sourceRoot":"","sources":["../../../../../../src/api/routes/manager/auth/externalLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AAEjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAA;AAE9F,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAQjD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AAErC,MAAM,iBAAiB,GAAG,kBAAkB,CAAA;AAC5C,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAS5C,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAgB,EAAE;IACpD,MAAM,OAAO,GAAG,wBAAwB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAC/D,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CACzC,CAAA;IAED,IAAI,CAAC,OAAO;QAAE,aAAa,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAA;IAChF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,GAAoC,EAAE,IAAsB,EAAE,EAAE;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACjF,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAA;IAE/C,IAAI,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACrB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,KAAK,EAAE;YACvC,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG;YACT,MAAM;YACN,MAAM,EAAE,IAAI;SACb,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IAED,GAAG,EAAE,GAAG,EAAE,SAAS,CACjB,YAAY,EACZ,GAAG,iBAAiB,IAAI,kBAAkB,CAAC,KAAK,CAAC,qDAAqD,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAClI,CAAA;AACH,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,GAAyB,EAAoB,EAAE;IACpE,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAA;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC3B,CAAA;QAEvB,IACE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;YACvC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EACpC,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,MAAmB,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE;IAClD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtC,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;AAC7F,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAAE,EAC9C,KAAK,EACL,GAAG,GAIJ,EAAqC,EAAE;IACtC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,EAAE,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAA;IACtE,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC1D,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAEnF,aAAa,CAAC,GAAG,EAAE;QACjB,QAAQ,EAAE,OAAO,CAAC,EAAE;QACpB,KAAK;QACL,YAAY;QACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB;KAC9C,CAAC,CAAA;IAEF,OAAO;QACL,GAAG,EAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;KACpE,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,EACjD,KAAK,EACL,GAAG,GAIJ,EAAwC,EAAE;IACzC,MAAM,YAAY,GAAG,kBAAkB,6BAA6B,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;IAC7F,mBAAmB,CAAC;QAClB,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,CAAC;QACR,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;KACzB,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IAC/B,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACxB,IACE,CAAC,IAAI;QACL,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAC5B,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAChC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EACrC,CAAC;QACD,aAAa,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,QAAQ,CAAA;IACZ,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC5B,aAAa,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAA;IAClC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE;QACtC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;KAC3C,CAAC,CAAA;IACF,IAAI,CAAC,IAAI;QAAE,aAAa,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAExE,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAChC,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5D,MAAM,eAAe,CAAC;QACpB,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,SAAS;QAClB,GAAG;QACH,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACpD,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACvD,IAAI,EAAE,CAAC,gBAAgB,EAAE,OAAO,CAAC,EAAE,CAAC;QACpC,IAAI,EAAE;YACJ,QAAQ,EAAE,OAAO,CAAC,EAAE;YACpB,WAAW,EAAE,WAAW,IAAI,MAAM;SACnC;KACF,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/dist/esm/api/routes/manager/auth/getSession.d.ts

@@ -15,6 +15,7 @@ export declare const getSessionHandler: ({ ctx, }: {
         _trashed?: boolean | undefined;
         _revision?: number | undefined;
         _localeVariantGroupId?: string | undefined;
+        _localeVariantName?: string | undefined;
         _localeVariantRole?: import("zod").infer<typeof import("../../../../index.js").LocaleVariantRole> | undefined;
         trashedAt?: Date | undefined;
         createdAt?: Date | undefined;
@@ -38,6 +39,7 @@ export declare const getSessionHandler: ({ ctx, }: {
     _trashed?: boolean | undefined;
     _revision?: number | undefined;
     _localeVariantGroupId?: string | undefined;
+    _localeVariantName?: string | undefined;
     _localeVariantRole?: import("zod").infer<typeof import("../../../../index.js").LocaleVariantRole> | undefined;
     trashedAt?: Date | undefined;
     createdAt?: Date | undefined;

package/dist/esm/api/routes/manager/auth/getSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getSession.d.ts","sourceRoot":"","sources":["../../../../../../src/api/routes/manager/auth/getSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,eAAO,MAAM,iBAAiB,GAAU,UAErC;IACD,GAAG,EAAE,mBAAmB,CAAC;CAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAAqB,CAAC"}
+{"version":3,"file":"getSession.d.ts","sourceRoot":"","sources":["../../../../../../src/api/routes/manager/auth/getSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,eAAO,MAAM,iBAAiB,GAAU,UAErC;IACD,GAAG,EAAE,mBAAmB,CAAC;CAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAAqB,CAAC"}

package/dist/esm/api/routes/manager/auth/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../../../../src/api/routes/manager/auth/login.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,UAAU,EACV,WAAW,EACZ,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAS5D,eAAO,MAAM,YAAY,GAAU,iBAGhC;IACD,KAAK,EAAE,UAAU,CAAC;IAClB,GAAG,CAAC,EAAE,mBAAmB,CAAC;CAC3B,KAAG,OAAO,CAAC,WAAW,CA0EtB,CAAC"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../../../../src/api/routes/manager/auth/login.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,UAAU,EACV,WAAW,EACZ,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAK5D,eAAO,MAAM,YAAY,GAAU,iBAGhC;IACD,KAAK,EAAE,UAAU,CAAC;IAClB,GAAG,CAAC,EAAE,mBAAmB,CAAC;CAC3B,KAAG,OAAO,CAAC,WAAW,CA+DtB,CAAC"}

package/dist/esm/api/routes/manager/auth/login.js

@@ -1,72 +1,69 @@
-import { randomBytes } from "crypto";
-import { ManagerUser, UserMfa, MfaChallenge, Session, } from "../../../../internal-content-types/index.js";
+import { completePrimaryAuthentication } from "../../../../auth/completePrimaryAuthentication.js";
+import { clearPasswordFailures, getBlockedPasswordIp, recordPasswordFailure, resolvePasswordLoginIp, } from '../../../../auth/passwordFail2ban.js';
+import { getRakunBootstrapOptions } from "../../../../bootstrapState.js";
+import { LoginIpBlock, ManagerUser } from "../../../../internal-content-types/index.js";
 import { throwAppError } from "../../../../lib/errors/index.js";
 import { getMongoService } from "../../../../orm/index.js";
-import { SESSION_MAX_AGE_MS } from "../../../sessionCookie.js";
-import { assertAuthRateLimit, getRequestRateLimitIdentifier, resetAuthRateLimit, } from "../../../utils/authRateLimit.js";
+import { recordAuthEvent } from '../../../utils/authEvents.js';
+import { setApiErrorEventData } from '../../../operations/apiEventLog.js';
 import { hashPassword, verifyStoredPassword } from "../../../utils/passwords.js";
 export const loginHandler = async ({ input, ctx, }) => {
+    if (getRakunBootstrapOptions()?.login?.password === false) {
+        throwAppError("FORBIDDEN", { reason: "LOGIN_METHOD_DISABLED" });
+    }
     const { username, password } = input;
     const db = await getMongoService();
-    const rateLimitKey = `login:${getRequestRateLimitIdentifier(ctx)}:${username.toLowerCase()}`;
-    assertAuthRateLimit({
-        key: rateLimitKey,
-        limit: 8,
-        windowMs: 15 * 60 * 1000,
-    });
-    const user = await db.find(ManagerUser, { email: username });
-    if (!user)
+    const ip = resolvePasswordLoginIp(ctx);
+    const existingBlock = await getBlockedPasswordIp(ip);
+    if (existingBlock) {
+        setApiErrorEventData(ctx, {
+            passwordLogin: {
+                ip: ip ?? null,
+                failedAttempts: existingBlock.failedAttempts,
+                blocked: true,
+            },
+        });
+        throwAppError('FORBIDDEN', { reason: 'IP_BLOCKED' });
+    }
+    const rejectInvalidCredentials = async () => {
+        const failure = await recordPasswordFailure(ip);
+        setApiErrorEventData(ctx, {
+            passwordLogin: {
+                ip: ip ?? null,
+                failedAttempts: failure.failedAttempts ?? 0,
+                blocked: failure.blocked,
+            },
+        });
+        if (failure.newlyBlocked) {
+            await recordAuthEvent({
+                type: 'auth.password.ip-blocked',
+                outcome: 'failure',
+                severity: 'warning',
+                ctx,
+                actor: { type: 'anonymous' },
+                resource: failure.recordId
+                    ? { type: LoginIpBlock.name, id: failure.recordId }
+                    : { type: LoginIpBlock.name },
+                tags: ['password-login', 'ip-block'],
+                data: { failedAttempts: failure.failedAttempts ?? 0 },
+            });
+        }
         throwAppError("FORBIDDEN", {
-            reason: "INVALID_CREDENTIALS",
+            reason: failure.blocked ? 'IP_BLOCKED' : "INVALID_CREDENTIALS",
         });
+    };
+    const user = await db.find(ManagerUser, { email: username });
+    if (!user)
+        return rejectInvalidCredentials();
     const passwordCheck = verifyStoredPassword(password, user.password);
     if (!passwordCheck.valid)
-        throwAppError("FORBIDDEN", {
-            reason: "INVALID_CREDENTIALS",
-        });
+        return rejectInvalidCredentials();
     if (passwordCheck.needsRehash) {
         await db.update(ManagerUser, user._id, {
             password: hashPassword(password),
         });
     }
-    resetAuthRateLimit(rateLimitKey);
-    const mfa = await db.find(UserMfa, { "user._id": user._id });
-    if (mfa?.enabled) {
-        const challenge = randomBytes(32).toString("hex");
-        const expiresAt = new Date(Date.now() + 1000 * 60 * 5); // 5 minutes
-        await db.create(MfaChallenge, {
-            token: challenge,
-            user: {
-                _id: user._id,
-                contentType: ManagerUser.name,
-                type: "existing",
-            },
-            method: mfa.preferredMethod ?? "totp",
-            expiresAt,
-            attempts: 0,
-            _type: "MfaChallenge",
-        });
-        return {
-            challenge,
-            method: mfa.preferredMethod ?? "totp",
-            expiresAt: expiresAt.toISOString(),
-        };
-    }
-    const token = crypto.randomUUID();
-    const expiresAt = new Date(Date.now() + SESSION_MAX_AGE_MS);
-    await db.create(Session, {
-        token,
-        user: {
-            _id: user._id,
-            contentType: ManagerUser.name,
-            type: "existing",
-        },
-        expiresAt,
-        _type: "Session",
-    });
-    return {
-        token,
-        expiresAt: expiresAt.toISOString(),
-    };
+    await clearPasswordFailures(ip);
+    return completePrimaryAuthentication(user._id);
 };
 //# sourceMappingURL=login.js.map

package/dist/esm/api/routes/manager/auth/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../../../../src/api/routes/manager/auth/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,EACL,WAAW,EACX,OAAO,EACP,YAAY,EACZ,OAAO,GACR,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAMlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAE9E,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,EACjC,KAAK,EACL,GAAG,GAIJ,EAAwB,EAAE;IACzB,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IACnC,MAAM,YAAY,GAAG,SAAS,6BAA6B,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;IAE7F,mBAAmB,CAAC;QAClB,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,CAAC;QACR,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;KACzB,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI;QACP,aAAa,CAAC,WAAW,EAAE;YACzB,MAAM,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IAEL,MAAM,aAAa,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpE,IAAI,CAAC,aAAa,CAAC,KAAK;QACtB,aAAa,CAAC,WAAW,EAAE;YACzB,MAAM,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IAEL,IAAI,aAAa,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;YACrC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IACD,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAEjC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAElD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY;QAEpE,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE;YAC5B,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE;gBACJ,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,WAAW,EAAE,WAAW,CAAC,IAAI;gBAC7B,IAAI,EAAE,UAAU;aACjB;YACD,MAAM,EAAE,GAAG,CAAC,eAAe,IAAI,MAAM;YACrC,SAAS;YACT,QAAQ,EAAE,CAAC;YACX,KAAK,EAAE,cAAc;SACtB,CAAC,CAAC;QAEH,OAAO;YACL,SAAS;YACT,MAAM,EAAE,GAAG,CAAC,eAAe,IAAI,MAAM;YACrC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;SACnC,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,CAAC;IAE5D,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;QACvB,KAAK;QACL,IAAI,EAAE;YACJ,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,WAAW,CAAC,IAAI;YAC7B,IAAI,EAAE,UAAU;SACjB;QACD,SAAS;QACT,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;QACL,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;KACnC,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../../../../src/api/routes/manager/auth/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAC/F,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAMlD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AACtE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAE9E,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,EACjC,KAAK,EACL,GAAG,GAIJ,EAAwB,EAAE;IACzB,IAAI,wBAAwB,EAAE,EAAE,KAAK,EAAE,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC1D,aAAa,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IACnC,MAAM,EAAE,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,EAAE,CAAC,CAAA;IACpD,IAAI,aAAa,EAAE,CAAC;QAClB,oBAAoB,CAAC,GAAG,EAAE;YACxB,aAAa,EAAE;gBACb,EAAE,EAAE,EAAE,IAAI,IAAI;gBACd,cAAc,EAAE,aAAa,CAAC,cAAc;gBAC5C,OAAO,EAAE,IAAI;aACd;SACF,CAAC,CAAA;QACF,aAAa,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,wBAAwB,GAAG,KAAK,IAAoB,EAAE;QAC1D,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,EAAE,CAAC,CAAA;QAC/C,oBAAoB,CAAC,GAAG,EAAE;YACxB,aAAa,EAAE;gBACb,EAAE,EAAE,EAAE,IAAI,IAAI;gBACd,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC;gBAC3C,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB;SACF,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,eAAe,CAAC;gBACpB,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EAAE,SAAS;gBAClB,QAAQ,EAAE,SAAS;gBACnB,GAAG;gBACH,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBACxB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE;oBACnD,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE;gBAC/B,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,CAAC;gBACpC,IAAI,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC,EAAE;aACtD,CAAC,CAAA;QACJ,CAAC;QAED,aAAa,CAAC,WAAW,EAAE;YACzB,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB;SAC/D,CAAC,CAAC;IACL,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI;QAAE,OAAO,wBAAwB,EAAE,CAAA;IAE5C,MAAM,aAAa,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpE,IAAI,CAAC,aAAa,CAAC,KAAK;QAAE,OAAO,wBAAwB,EAAE,CAAA;IAE3D,IAAI,aAAa,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;YACrC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,qBAAqB,CAAC,EAAE,CAAC,CAAA;IAE/B,OAAO,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjD,CAAC,CAAC"}

package/dist/esm/api/routes/manager/auth/markTourSeen.d.ts

@@ -18,6 +18,7 @@ export declare const markTourSeenHandler: ({ input, ctx, }: {
         _trashed?: boolean | undefined;
         _revision?: number | undefined;
         _localeVariantGroupId?: string | undefined;
+        _localeVariantName?: string | undefined;
         _localeVariantRole?: import("zod").infer<typeof import("../../../../index.js").LocaleVariantRole> | undefined;
         trashedAt?: Date | undefined;
         trashedBy?: string | undefined;
@@ -25,7 +26,6 @@ export declare const markTourSeenHandler: ({ input, ctx, }: {
         updatedAt?: Date | undefined;
         createdBy?: string | undefined;
         updatedBy?: string | undefined;
-        _iteratorUnlinked?: boolean | undefined;
     };
     twoFactorEnabled: boolean;
     _type: "ManagerUser";
@@ -45,6 +45,7 @@ export declare const markTourSeenHandler: ({ input, ctx, }: {
     _trashed?: boolean | undefined;
     _revision?: number | undefined;
     _localeVariantGroupId?: string | undefined;
+    _localeVariantName?: string | undefined;
     _localeVariantRole?: import("zod").infer<typeof import("../../../../index.js").LocaleVariantRole> | undefined;
     trashedAt?: Date | undefined;
     trashedBy?: string | undefined;
@@ -52,7 +53,6 @@ export declare const markTourSeenHandler: ({ input, ctx, }: {
     updatedAt?: Date | undefined;
     createdBy?: string | undefined;
     updatedBy?: string | undefined;
-    _iteratorUnlinked?: boolean | undefined;
 }>;
 export declare const getUpdatedSeenTours: (seenTours: (string | undefined)[] | undefined, tourId: string) => (string | undefined)[];
 //# sourceMappingURL=markTourSeen.d.ts.map

package/dist/esm/api/routes/manager/auth/mfa/regenerateRecoveryCodes.d.ts

@@ -0,0 +1,10 @@
+import type { RegenerateRecoveryCodesInput } from '../../../../../schemas/manager/auth/mfa/recoveryCode.js';
+import type { RakunRequestContext } from '../../../../context.js';
+export declare const regenerateRecoveryCodesHandler: ({ input, ctx, }: {
+    input: RegenerateRecoveryCodesInput;
+    ctx: RakunRequestContext;
+}) => Promise<{
+    ok: true;
+    recoveryCodes: string[];
+}>;
+//# sourceMappingURL=regenerateRecoveryCodes.d.ts.map

package/dist/esm/api/routes/manager/auth/mfa/regenerateRecoveryCodes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regenerateRecoveryCodes.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/mfa/regenerateRecoveryCodes.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAA;AACxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAK9D,eAAO,MAAM,8BAA8B,GAAU,iBAGlD;IACD,KAAK,EAAE,4BAA4B,CAAA;IACnC,GAAG,EAAE,mBAAmB,CAAA;CACzB;;;EA4CA,CAAA"}

package/dist/esm/api/routes/manager/auth/mfa/regenerateRecoveryCodes.js

@@ -0,0 +1,42 @@
+import { ManagerUser, UserMfa, } from '../../../../../internal-content-types/index.js';
+import { throwAppError } from '../../../../../lib/errors/index.js';
+import { getMongoService } from '../../../../../orm/index.js';
+import { verifyStoredPassword } from '../../../../utils/passwords.js';
+import { generateRecoveryCodes } from '../../../../utils/recoveryCodes.js';
+import { recordAuthEvent } from '../../../../utils/authEvents.js';
+export const regenerateRecoveryCodesHandler = async ({ input, ctx, }) => {
+    const db = await getMongoService();
+    const user = ctx.getUser();
+    const storedUser = await db.get(ManagerUser, user._id, ['password']);
+    if (!verifyStoredPassword(input.currentPassword, storedUser.password).valid) {
+        throwAppError('FORBIDDEN', {
+            reason: 'INVALID_CREDENTIALS',
+        });
+    }
+    const mfa = await db.find(UserMfa, { 'user._id': user._id });
+    if (!mfa?.enabled) {
+        throwAppError('CONFLICT', {
+            key: 'MFA_NOT_ENABLED',
+            message: 'MFA must be enabled before generating recovery codes',
+        });
+    }
+    const recovery = generateRecoveryCodes();
+    await db.update(UserMfa, mfa._id, {
+        recoveryCodeHashes: recovery.hashes,
+        recoveryCodesGeneratedAt: new Date(),
+    }, { reason: 'mfa recovery codes regenerated' });
+    await recordAuthEvent({
+        type: 'auth.mfa.recovery-codes.regenerated',
+        outcome: 'success',
+        ctx,
+        actor: { type: 'manager-user', id: String(user._id) },
+        resource: { type: 'ManagerUser', id: String(user._id) },
+        tags: ['mfa', 'recovery-code'],
+        data: { recoveryCodeCount: recovery.codes.length },
+    });
+    return {
+        ok: true,
+        recoveryCodes: recovery.codes,
+    };
+};
+//# sourceMappingURL=regenerateRecoveryCodes.js.map

package/dist/esm/api/routes/manager/auth/mfa/regenerateRecoveryCodes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regenerateRecoveryCodes.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/mfa/regenerateRecoveryCodes.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,OAAO,GACR,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAGpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAE9D,MAAM,CAAC,MAAM,8BAA8B,GAAG,KAAK,EAAE,EACnD,KAAK,EACL,GAAG,GAIJ,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAA;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAA;IAC1B,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;IAEpE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;QAC5E,aAAa,CAAC,WAAW,EAAE;YACzB,MAAM,EAAE,qBAAqB;SAC9B,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC5D,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;QAClB,aAAa,CAAC,UAAU,EAAE;YACxB,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,sDAAsD;SAChE,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAA;IACxC,MAAM,EAAE,CAAC,MAAM,CACb,OAAO,EACP,GAAG,CAAC,GAAG,EACP;QACE,kBAAkB,EAAE,QAAQ,CAAC,MAAM;QACnC,wBAAwB,EAAE,IAAI,IAAI,EAAE;KACrC,EACD,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAC7C,CAAA;IAED,MAAM,eAAe,CAAC;QACpB,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EAAE,SAAS;QAClB,GAAG;QACH,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrD,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACvD,IAAI,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC;QAC9B,IAAI,EAAE,EAAE,iBAAiB,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE;KACnD,CAAC,CAAA;IAEF,OAAO;QACL,EAAE,EAAE,IAAa;QACjB,aAAa,EAAE,QAAQ,CAAC,KAAK;KAC9B,CAAA;AACH,CAAC,CAAA"}

package/dist/esm/api/routes/manager/auth/mfa/verifyRecoveryCode.d.ts

@@ -0,0 +1,15 @@
+import type { VerifyRecoveryCodeInput } from '../../../../../schemas/manager/auth/mfa/recoveryCode.js';
+import type { RakunRequestContext } from '../../../../context.js';
+export declare const verifyRecoveryCodeHandler: ({ input, ctx, }: {
+    input: VerifyRecoveryCodeInput;
+    ctx?: RakunRequestContext;
+}) => Promise<{
+    error: "INVALID_CODE";
+    token?: undefined;
+    expiresAt?: undefined;
+} | {
+    token: `${string}-${string}-${string}-${string}-${string}`;
+    expiresAt: string;
+    error?: undefined;
+}>;
+//# sourceMappingURL=verifyRecoveryCode.d.ts.map

package/dist/esm/api/routes/manager/auth/mfa/verifyRecoveryCode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyRecoveryCode.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/mfa/verifyRecoveryCode.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sDAAsD,CAAA;AAQnG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAE9D,eAAO,MAAM,yBAAyB,GAAU,iBAG7C;IACD,KAAK,EAAE,uBAAuB,CAAA;IAC9B,GAAG,CAAC,EAAE,mBAAmB,CAAA;CAC1B;;;;;;;;EAwFA,CAAA"}

package/dist/esm/api/routes/manager/auth/mfa/verifyRecoveryCode.js

@@ -0,0 +1,76 @@
+import { ManagerUser, MfaChallenge, Session, UserMfa, } from '../../../../../internal-content-types/index.js';
+import { throwAppError } from '../../../../../lib/errors/index.js';
+import { getMongoService } from '../../../../../orm/index.js';
+import { SESSION_MAX_AGE_MS } from '../../../../sessionCookie.js';
+import { assertAuthRateLimit, resetAuthRateLimit, } from '../../../../utils/authRateLimit.js';
+import { findRecoveryCodeHash } from '../../../../utils/recoveryCodes.js';
+import { recordAuthEvent } from '../../../../utils/authEvents.js';
+export const verifyRecoveryCodeHandler = async ({ input, ctx, }) => {
+    const db = await getMongoService();
+    const rateLimitKey = `mfa:recovery:${input.challenge}`;
+    assertAuthRateLimit({
+        key: rateLimitKey,
+        limit: 8,
+        windowMs: 5 * 60 * 1000,
+    });
+    const challenge = await db.find(MfaChallenge, { token: input.challenge });
+    if (!challenge) {
+        throwAppError('NOT_FOUND', {
+            id: input.challenge,
+            resource: 'MfaChallenge',
+        });
+    }
+    if (challenge.consumedAt ||
+        new Date(challenge.expiresAt).getTime() <= Date.now()) {
+        throwAppError('CONFLICT', {
+            key: 'INVALID_MFA_CHALLENGE',
+            message: 'MFA challenge is invalid or expired',
+        });
+    }
+    const attempts = Number(challenge.attempts ?? 0);
+    if (attempts >= 8) {
+        throwAppError('CONFLICT', {
+            key: 'MFA_ATTEMPTS_EXHAUSTED',
+            message: 'Too many failed attempts',
+        });
+    }
+    await db.update(MfaChallenge, challenge._id, { attempts: attempts + 1 });
+    const userId = challenge.user._id;
+    const mfa = await db.find(UserMfa, { 'user._id': userId });
+    const hashes = (mfa?.recoveryCodeHashes ?? []).filter((hash) => typeof hash === 'string');
+    const usedHash = findRecoveryCodeHash(input.code, hashes);
+    if (!mfa?.enabled || !usedHash) {
+        return { error: 'INVALID_CODE' };
+    }
+    await db.update(UserMfa, mfa._id, {
+        recoveryCodeHashes: hashes.filter((hash) => hash !== usedHash),
+    }, { reason: 'mfa recovery code consumed' });
+    await db.update(MfaChallenge, challenge._id, { consumedAt: new Date() });
+    resetAuthRateLimit(rateLimitKey);
+    const token = crypto.randomUUID();
+    const expiresAt = new Date(Date.now() + SESSION_MAX_AGE_MS);
+    await db.create(Session, {
+        token,
+        user: {
+            _id: userId,
+            contentType: ManagerUser.name,
+            type: 'existing',
+        },
+        expiresAt,
+        _type: 'Session',
+    });
+    await recordAuthEvent({
+        type: 'auth.mfa.recovery-code.used',
+        outcome: 'success',
+        ctx,
+        actor: { type: 'manager-user', id: String(userId) },
+        resource: { type: 'ManagerUser', id: String(userId) },
+        tags: ['mfa', 'recovery-code'],
+        data: { remainingRecoveryCodes: hashes.length - 1 },
+    });
+    return {
+        token,
+        expiresAt: expiresAt.toISOString(),
+    };
+};
+//# sourceMappingURL=verifyRecoveryCode.js.map

package/dist/esm/api/routes/manager/auth/mfa/verifyRecoveryCode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyRecoveryCode.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/mfa/verifyRecoveryCode.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,YAAY,EACZ,OAAO,EACP,OAAO,GACR,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EACL,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAG9D,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAAE,EAC9C,KAAK,EACL,GAAG,GAIJ,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAA;IAClC,MAAM,YAAY,GAAG,gBAAgB,KAAK,CAAC,SAAS,EAAE,CAAA;IAEtD,mBAAmB,CAAC;QAClB,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,CAAC;QACR,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;KACxB,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAA;IACzE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,aAAa,CAAC,WAAW,EAAE;YACzB,EAAE,EAAE,KAAK,CAAC,SAAS;YACnB,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAA;IACJ,CAAC;IAED,IACE,SAAS,CAAC,UAAU;QACpB,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EACrD,CAAC;QACD,aAAa,CAAC,UAAU,EAAE;YACxB,GAAG,EAAE,uBAAuB;YAC5B,OAAO,EAAE,qCAAqC;SAC/C,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAA;IAChD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,aAAa,CAAC,UAAU,EAAE;YACxB,GAAG,EAAE,wBAAwB;YAC7B,OAAO,EAAE,0BAA0B;SACpC,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAA;IAExE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAA;IACjC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC,MAAM,CACnD,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CACnD,CAAA;IACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAEzD,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,cAAuB,EAAE,CAAA;IAC3C,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,CACb,OAAO,EACP,GAAG,CAAC,GAAG,EACP;QACE,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC;KAC/D,EACD,EAAE,MAAM,EAAE,4BAA4B,EAAE,CACzC,CAAA;IACD,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;IACxE,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAEhC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IACjC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,CAAA;IAE3D,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;QACvB,KAAK;QACL,IAAI,EAAE;YACJ,GAAG,EAAE,MAAM;YACX,WAAW,EAAE,WAAW,CAAC,IAAI;YAC7B,IAAI,EAAE,UAAU;SACjB;QACD,SAAS;QACT,KAAK,EAAE,SAAS;KACjB,CAAC,CAAA;IAEF,MAAM,eAAe,CAAC;QACpB,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,SAAS;QAClB,GAAG;QACH,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;QACnD,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;QACrD,IAAI,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC;QAC9B,IAAI,EAAE,EAAE,sBAAsB,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE;KACpD,CAAC,CAAA;IAEF,OAAO;QACL,KAAK;QACL,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;KACnC,CAAA;AACH,CAAC,CAAA"}

package/dist/esm/api/routes/manager/auth/passwordIpBlocks.d.ts

@@ -0,0 +1,10 @@
+import type { ListPasswordIpBlocksOutput, UnblockPasswordIpInput, UnblockPasswordIpOutput } from '../../../../schemas/manager/auth/passwordIpBlocks.js';
+import type { RakunRequestContext } from '../../../context.js';
+export declare const listPasswordIpBlocksHandler: ({ ctx, }: {
+    ctx: RakunRequestContext;
+}) => Promise<ListPasswordIpBlocksOutput>;
+export declare const unblockPasswordIpHandler: ({ input, ctx, }: {
+    input: UnblockPasswordIpInput;
+    ctx: RakunRequestContext;
+}) => Promise<UnblockPasswordIpOutput>;
+//# sourceMappingURL=passwordIpBlocks.d.ts.map

package/dist/esm/api/routes/manager/auth/passwordIpBlocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordIpBlocks.d.ts","sourceRoot":"","sources":["../../../../../../src/api/routes/manager/auth/passwordIpBlocks.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,mDAAmD,CAAA;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAU3D,eAAO,MAAM,2BAA2B,GAAU,UAE/C;IACD,GAAG,EAAE,mBAAmB,CAAA;CACzB,KAAG,OAAO,CAAC,0BAA0B,CAuDrC,CAAA;AAED,eAAO,MAAM,wBAAwB,GAAU,iBAG5C;IACD,KAAK,EAAE,sBAAsB,CAAA;IAC7B,GAAG,EAAE,mBAAmB,CAAA;CACzB,KAAG,OAAO,CAAC,uBAAuB,CAwBlC,CAAA"}

package/dist/esm/api/routes/manager/auth/passwordIpBlocks.js

@@ -0,0 +1,85 @@
+import { getPasswordFail2banConfig } from '../../../../auth/passwordFail2ban.js';
+import { LoginIpBlock } from '../../../../internal-content-types/index.js';
+import { getEventLogService } from '../../../../eventLog/index.js';
+import { throwAppError } from '../../../../lib/errors/index.js';
+import { AUTH_IP_BLOCK_MANAGE_PERMISSION } from '../../../../lib/Permissions.js';
+import { getMongoService } from '../../../../orm/index.js';
+import { recordAuthEvent } from '../../../utils/authEvents.js';
+import { checkPermissions } from '../../../utils/checkPermissions.js';
+const requireManagePermission = (ctx) => {
+    const user = ctx.getUser();
+    checkPermissions(user, [AUTH_IP_BLOCK_MANAGE_PERMISSION]);
+    return user;
+};
+export const listPasswordIpBlocksHandler = async ({ ctx, }) => {
+    requireManagePermission(ctx);
+    const db = await getMongoService();
+    const [result, recentFailures] = await Promise.all([
+        db.list(LoginIpBlock, {
+            filter: { blockedAt: { $exists: true } },
+            options: { limit: 'all', sort: { blockedAt: 'desc' } },
+        }),
+        getEventLogService().query({
+            types: ['api.operation.failed'],
+            operations: ['manager.auth.login'],
+            limit: 25,
+        }),
+    ]);
+    return {
+        maxAttempts: getPasswordFail2banConfig()?.maxAttempts ?? 0,
+        items: result.items.flatMap((record) => record.blockedAt
+            ? [
+                {
+                    id: record._id,
+                    ip: record.ip,
+                    failedAttempts: record.failedAttempts,
+                    lastFailedAt: record.lastFailedAt.toISOString(),
+                    blockedAt: record.blockedAt.toISOString(),
+                },
+            ]
+            : []),
+        recentFailures: recentFailures.items.map((event) => {
+            const context = event.data?.context;
+            const passwordLogin = context && typeof context === 'object' && !Array.isArray(context)
+                ? context.passwordLogin
+                : undefined;
+            const details = passwordLogin &&
+                typeof passwordLogin === 'object' &&
+                !Array.isArray(passwordLogin)
+                ? passwordLogin
+                : undefined;
+            return {
+                id: event.id,
+                occurredAt: event.occurredAt.toISOString(),
+                ip: typeof details?.ip === 'string' ? details.ip : undefined,
+                failedAttempts: typeof details?.failedAttempts === 'number'
+                    ? details.failedAttempts
+                    : 0,
+                blocked: details?.blocked === true,
+            };
+        }),
+    };
+};
+export const unblockPasswordIpHandler = async ({ input, ctx, }) => {
+    const user = requireManagePermission(ctx);
+    const db = await getMongoService();
+    const record = await db.find(LoginIpBlock, { _id: input.id });
+    if (!record?.blockedAt) {
+        throwAppError('NOT_FOUND', {
+            resource: LoginIpBlock.name,
+            id: input.id,
+        });
+    }
+    await db.delete(LoginIpBlock, { _id: record._id }, { actorId: user._id });
+    await recordAuthEvent({
+        type: 'auth.password.ip-unblocked',
+        outcome: 'success',
+        ctx,
+        actor: { type: 'ManagerUser', id: String(user._id) },
+        resource: { type: LoginIpBlock.name, id: record._id },
+        tags: ['password-login', 'ip-block'],
+        data: { failedAttempts: record.failedAttempts },
+    });
+    return { unblocked: true };
+};
+//# sourceMappingURL=passwordIpBlocks.js.map

package/dist/esm/api/routes/manager/auth/passwordIpBlocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordIpBlocks.js","sourceRoot":"","sources":["../../../../../../src/api/routes/manager/auth/passwordIpBlocks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAOjD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAElE,MAAM,uBAAuB,GAAG,CAAC,GAAwB,EAAE,EAAE;IAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAA;IAC1B,gBAAgB,CAAC,IAAI,EAAE,CAAC,+BAA+B,CAAC,CAAC,CAAA;IACzD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,EAAE,EAChD,GAAG,GAGJ,EAAuC,EAAE;IACxC,uBAAuB,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAA;IAClC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE;YACpB,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAW;YACjD,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAW,EAAE;SAChE,CAAC;QACF,kBAAkB,EAAE,CAAC,KAAK,CAAC;YACzB,KAAK,EAAE,CAAC,sBAAsB,CAAC;YAC/B,UAAU,EAAE,CAAC,oBAAoB,CAAC;YAClC,KAAK,EAAE,EAAE;SACV,CAAC;KACH,CAAC,CAAA;IAEF,OAAO;QACL,WAAW,EAAE,yBAAyB,EAAE,EAAE,WAAW,IAAI,CAAC;QAC1D,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACrC,MAAM,CAAC,SAAS;YACd,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,MAAM,CAAC,GAAG;oBACd,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE;oBAC/C,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;iBAC1C;aACF;YACH,CAAC,CAAC,EAAE,CACP;QACD,cAAc,EAAE,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACjD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,OAAO,CAAA;YACnC,MAAM,aAAa,GACjB,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC/D,CAAC,CAAC,OAAO,CAAC,aAAa;gBACvB,CAAC,CAAC,SAAS,CAAA;YACf,MAAM,OAAO,GACX,aAAa;gBACb,OAAO,aAAa,KAAK,QAAQ;gBACjC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;gBAC3B,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,SAAS,CAAA;YAEf,OAAO;gBACL,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE;gBAC1C,EAAE,EAAE,OAAO,OAAO,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;gBAC5D,cAAc,EACZ,OAAO,OAAO,EAAE,cAAc,KAAK,QAAQ;oBACzC,CAAC,CAAC,OAAO,CAAC,cAAc;oBACxB,CAAC,CAAC,CAAC;gBACP,OAAO,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI;aACnC,CAAA;QACH,CAAC,CAAC;KACH,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAAE,EAC7C,KAAK,EACL,GAAG,GAIJ,EAAoC,EAAE;IACrC,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAA;IAClC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IAE7D,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;QACvB,aAAa,CAAC,WAAW,EAAE;YACzB,QAAQ,EAAE,YAAY,CAAC,IAAI;YAC3B,EAAE,EAAE,KAAK,CAAC,EAAE;SACb,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IACzE,MAAM,eAAe,CAAC;QACpB,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,SAAS;QAClB,GAAG;QACH,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACpD,QAAQ,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE;QACrD,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,CAAC;QACpC,IAAI,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE;KAChD,CAAC,CAAA;IAEF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AAC5B,CAAC,CAAA"}

package/dist/esm/api/routes/manager/auth/passwordRecovery.d.ts

@@ -0,0 +1,15 @@
+import type { RequestPasswordResetInput, ResetPasswordInput } from '../../../../schemas/manager/auth/passwordRecovery.js';
+import type { RakunRequestContext } from '../../../context.js';
+export declare const requestPasswordResetHandler: ({ input, ctx, }: {
+    input: RequestPasswordResetInput;
+    ctx?: RakunRequestContext;
+}) => Promise<{
+    ok: true;
+}>;
+export declare const resetPasswordHandler: ({ input, ctx, }: {
+    input: ResetPasswordInput;
+    ctx?: RakunRequestContext;
+}) => Promise<{
+    ok: true;
+}>;
+//# sourceMappingURL=passwordRecovery.d.ts.map

package/dist/esm/api/routes/manager/auth/passwordRecovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordRecovery.d.ts","sourceRoot":"","sources":["../../../../../../src/api/routes/manager/auth/passwordRecovery.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,mDAAmD,CAAA;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AA0B3D,eAAO,MAAM,2BAA2B,GAAU,iBAG/C;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,GAAG,CAAC,EAAE,mBAAmB,CAAA;CAC1B;;EAwFA,CAAA;AAED,eAAO,MAAM,oBAAoB,GAAU,iBAGxC;IACD,KAAK,EAAE,kBAAkB,CAAA;IACzB,GAAG,CAAC,EAAE,mBAAmB,CAAA;CAC1B;;EA4EA,CAAA"}