@rapidrest/auth 1.0.0-beta.1

package/dist/lib/auth/OIDCStrategy.js

@@ -0,0 +1,397 @@
+////////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+////////////////////////////////////////////////////////////////////////////////
+import axios from "axios";
+import * as crypto from "crypto";
+import * as jwt from "jsonwebtoken";
+export const Protocol = {
+    OAUTH2: "oauth2",
+    OPENID: "openid",
+};
+/**
+ * Describes the configuration options that can be used to initialize OIDCStrategy.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class OIDCStrategyOptions {
+    /**
+     * Retrieves the user data for the given unique identifier after authentication has completed successfully.
+     * NOTE: You must override this function when using this strategy.
+     * @param token The user's authenticated access token to the third-party provider.
+     * @param profile The user's profile data associated with the third-party provider.
+     */
+    getUser(token, profile) {
+        throw new Error("Did you forget to override OIDCStrategyOptions.getUser?");
+    }
+    constructor(name, provider) {
+        /** The unique name of the auth strategy instance. */
+        this.name = "oauth";
+        this.name = name;
+        this.provider = provider;
+    }
+}
+export const DEFAULT_PROFILE_MAP = {
+    id: "profile.id",
+    name: "profile.username",
+    email: "profile.email",
+    email_verified: "profile.verified && profile.email",
+    givenName: "profile.givenName",
+    familyName: "profile.familyName",
+    birthdate: "profile.birthdate",
+    locale: "profile.locale",
+    phone: "profile.phone",
+    phone_verified: "profile.verified && profile.phone",
+    avatar: "profile.avatar",
+};
+/** Matches a valid RFC 7636 code_verifier: 43-128 chars from the unreserved character set. */
+const PKCE_VERIFIER_PATTERN = /^[A-Za-z0-9\-._~]{43,128}$/;
+/**
+ * Implements an authentication strategy for performing OIDC 2.0 or OpenID Connect (OIDC) authorization with a
+ * third-party provider. This strategy does not require that require an account already be registered. When using
+ * this strategy, ensure to allow for account creation to occur after a successful login.
+ *
+ * The authorization flow has the following steps:
+ *
+ * 1. Client initiates a request for an Authorization Request URI. Builds the Authorization Request URI and returns it
+ * to the client.
+ * 2. The client should automatically redirect the user to the Authorization Request URI obtained in step 1.
+ * 3. Once the user has approved the authorization request with the third-party provider the client will be
+ * redirected to the application's registered callback URL with a single query parameter containing an
+ * Authorization Code. The client initiates a request to a route handler, containing the code, and then
+ * calls `authenticate()`.
+ *
+ * NOTE: Requires session support!
+ *
+ * @author Jean-Philippe Steinmetz <rapidrests@gmail.com>
+ */
+export class OIDCStrategy {
+    constructor(options) {
+        this.name = "oauth";
+        /** Cached `jwks-rsa` clients, keyed by JWKS URI, so keys are cached across requests. */
+        this.jwksClients = new Map();
+        this.name = options.name ?? this.name;
+        this.options = options;
+    }
+    /**
+     * Resolves the effective PKCE code challenge method to use, given what the provider requires
+     * (if anything specific) and what the client requested. Throws if the client requests an
+     * invalid value, or a value that conflicts with a provider-mandated method.
+     *
+     * @param clientMethod The `code_challenge_method` requested by the client, if any.
+     */
+    resolvePkceMethod(clientMethod) {
+        const pkce = this.options.provider.pkce;
+        const required = pkce === "S256" || pkce === "plain" ? pkce : undefined;
+        if (clientMethod) {
+            if (clientMethod !== "S256" && clientMethod !== "plain") {
+                throw new Error(`Invalid code_challenge_method '${clientMethod}'. Must be "S256" or "plain".`);
+            }
+            if (required && clientMethod !== required) {
+                throw new Error(`This provider requires PKCE method '${required}', but '${clientMethod}' was requested.`);
+            }
+            return clientMethod;
+        }
+        return required ?? "S256";
+    }
+    /**
+     * Creates and returns the Authorization Request URI for the configured OIDC provider.
+     *
+     * @param req The source HTTP request.
+     * @param redirectURI The source URI to redirect the user to once authentication is complete.
+     */
+    buildAuthorizationURI(req, redirectURI) {
+        if (!req.session) {
+            throw new Error("OIDCStrategy requires session support. Configure the `session` config block so the " +
+                "session middleware is registered.");
+        }
+        const provider = this.options.provider;
+        // Only a redirect_uri that exactly matches one of the provider's configured/allowed values
+        // is honored — this lets a downstream frontend dynamically choose its own callback target
+        // (different environments, subdomains, multi-tenant deployments) without opening the door
+        // to an attacker supplying an arbitrary redirect_uri.
+        const allowedRedirectURIs = Array.isArray(provider.redirectURI)
+            ? provider.redirectURI
+            : [provider.redirectURI];
+        const requestedRedirectURI = redirectURI ?? req.query?.redirect_uri;
+        if (requestedRedirectURI && !allowedRedirectURIs.includes(requestedRedirectURI)) {
+            throw new Error(`redirect_uri '${requestedRedirectURI}' is not in the list of allowed redirect URIs configured ` +
+                "for this provider.");
+        }
+        const finalRedirectURI = requestedRedirectURI ?? allowedRedirectURIs[0];
+        req.session.redirect_uri = finalRedirectURI;
+        let url = provider.authorizationURL + `?client_id=${encodeURIComponent(provider.clientID)}`;
+        // Combined state: a server-generated CSRF token, plus optional client-supplied
+        // app-correlation data. The session cookie is httpOnly (invisible to browser JS), so this
+        // is the only channel a frontend has to round-trip its own data through the provider
+        // redirect. Only the CSRF-token half is ever validated server-side; the app-data half is
+        // handed back to the caller untouched via AuthResult.state.
+        const csrfToken = crypto.randomBytes(24).toString("base64url");
+        const clientAppData = req.query?.state ?? "";
+        req.session.state = csrfToken;
+        url += `&state=${encodeURIComponent(`${csrfToken}.${clientAppData}`)}`;
+        if (provider.pkce) {
+            const method = this.resolvePkceMethod(req.query.code_challenge_method);
+            const clientVerifier = req.query.code_verifier;
+            if (clientVerifier && !PKCE_VERIFIER_PATTERN.test(clientVerifier)) {
+                throw new Error("code_verifier does not meet RFC 7636 requirements (43-128 chars, unreserved charset).");
+            }
+            const verifier = clientVerifier ?? crypto.randomBytes(32).toString("base64url");
+            const codeChallenge = req.query.code_challenge ||
+                (method === "plain"
+                    ? verifier
+                    : crypto
+                        .createHash("sha256")
+                        .update(Buffer.from(verifier, "ascii"))
+                        .digest("base64")
+                        .replace(/=/g, "")
+                        .replace(/\+/g, "-")
+                        .replace(/\//g, "_"));
+            url += `&code_challenge=${encodeURIComponent(codeChallenge)}&code_challenge_method=${encodeURIComponent(method)}`;
+            // Store all pkce info in the session for reference later.
+            req.session.code_challenge = codeChallenge;
+            req.session.code_challenge_method = method;
+            req.session.code_verifier = verifier;
+        }
+        if (provider.protocol === Protocol.OPENID) {
+            const nonce = crypto.randomBytes(24).toString("base64url");
+            req.session.nonce = nonce;
+            url += `&nonce=${encodeURIComponent(nonce)}`;
+        }
+        url += `&redirect_uri=${encodeURIComponent(finalRedirectURI)}`;
+        url += `&response_type=code`;
+        url += `&scope=${encodeURIComponent(req.query.scope || (provider.scope ?? []).join(" "))}`;
+        return url;
+    }
+    async authenticate(req, res, required) {
+        const error = req.query?.error ?? req.body?.error;
+        if (error) {
+            const description = req.query?.error_description ?? req.body?.error_description;
+            throw new Error(`OIDC provider returned an error: ${error}${description ? ` - ${description}` : ""}`);
+        }
+        // Is this an authorization request or token exchange?
+        if (req.body?.code || req.query?.code) {
+            if (!req.session) {
+                throw new Error("OIDCStrategy requires session support. Configure the `session` config block so the " +
+                    "session middleware is registered.");
+            }
+            const incomingState = (req.body?.state ?? req.query?.state ?? "");
+            const separatorIdx = incomingState.indexOf(".");
+            const csrfPortion = separatorIdx >= 0 ? incomingState.slice(0, separatorIdx) : incomingState;
+            const appData = separatorIdx >= 0 ? incomingState.slice(separatorIdx + 1) : undefined;
+            if (!csrfPortion || csrfPortion !== req.session.state) {
+                throw new Error("Invalid or missing state parameter. Possible CSRF attempt.");
+            }
+            delete req.session.state;
+            // 1. First exchange the auth code for the access token with the provider
+            const accessToken = await this.exchangeOIDCCode(req);
+            // 2. Retrieve the user profile.
+            const profile = await this.retrieveUserProfile(accessToken, req);
+            // Consumed — clear so a stolen/replayed session cookie can't be used against a second flow.
+            delete req.session.code_verifier;
+            delete req.session.code_challenge;
+            delete req.session.code_challenge_method;
+            delete req.session.nonce;
+            delete req.session.redirect_uri;
+            // 3. Notify the verify callback to create a user object for this profile.
+            const user = await this.options.getUser(accessToken, profile);
+            return {
+                data: accessToken,
+                method: this.name,
+                payload: accessToken,
+                state: appData,
+                user,
+            };
+        }
+        else {
+            const url = this.buildAuthorizationURI(req);
+            res.status(302);
+            res.setHeader("Location", url);
+            res.setHeader("Content-Length", 0);
+            res.end();
+            return undefined;
+        }
+    }
+    authenticateSync(req, res, required) {
+        throw new Error("Not supported. This auth strategy must be used asynchronously.");
+    }
+    /**
+     * Performs a request against the OIDC provider to exchange the given authorization code for an access token.
+     *
+     * @param req The request data to use in the exchange exchange.
+     * @param provider The OIDC provider to perform the exchange with.
+     */
+    async exchangeOIDCCode(req) {
+        const provider = this.options.provider;
+        // The code may come from either request query for body
+        const code = req.body?.code || req.query?.code;
+        if (!code) {
+            throw new Error("Authorization code is missing!");
+        }
+        const allowedRedirectURIs = Array.isArray(provider.redirectURI)
+            ? provider.redirectURI
+            : [provider.redirectURI];
+        // Create a url-encoded payload for the token exchange per RFC-6749 Section 4.1.3
+        let data = {
+            code,
+            grant_type: "authorization_code",
+            // Must exactly match what was sent during the authorize step — reuse the value that was
+            // validated and stored in the session then, rather than re-trusting client input here.
+            redirect_uri: req.session?.redirect_uri ?? allowedRedirectURIs[0],
+        };
+        // If PKCE is required for this provider make sure to include the challenge. The request body may have already
+        // included the challenge details. If not, we'll use what we have from the stored session.
+        if (provider.pkce) {
+            data.code_verifier = req.body?.code_verifier ?? req.query?.code_verifier ?? req.session?.code_verifier;
+        }
+        const headers = { "Content-Type": "application/x-www-form-urlencoded" };
+        if (provider.clientSecret) {
+            headers.Authorization = `Basic ${Buffer.from(provider.clientID + ":" + provider.clientSecret).toString("base64")}`;
+        }
+        else {
+            // Public/PKCE-only clients have no secret to authenticate with via Basic auth — per
+            // RFC 6749 §2.3.1 they must instead identify themselves via a body parameter.
+            data.client_id = provider.clientID;
+        }
+        try {
+            const result = await axios.post(provider.tokenURL, data, { headers });
+            if (result && (result.status !== 200 || !result.data)) {
+                throw new Error("Failed to retrieve access token.");
+            }
+            const json = typeof result.data === "string" ? JSON.parse(result.data) : result.data;
+            return json;
+        }
+        catch (err) {
+            const error = err.response?.data || new Error(`Failed to exchange auth token. ${err.message || ""}`);
+            error.status = err.status;
+            throw error;
+        }
+    }
+    /**
+     * Converts the given user profile obtained from the specified OAuth provider into an OIDCProfile object.
+     *
+     * @param profile The profile to convert.
+     * @param provider The OAuth provider that the profile was obtained from.
+     */
+    convertProfile(profile) {
+        const result = {
+            provider: this.options.provider.name,
+            _json: profile,
+        };
+        const transform = (profile, map, result) => {
+            for (const key in map) {
+                try {
+                    if (typeof map[key] === "object") {
+                        result[key] = transform(profile, map[key], Array.isArray(map[key]) ? [] : {});
+                    }
+                    else {
+                        // eslint-disable-next-line no-eval
+                        result[key] = eval(map[key]);
+                    }
+                }
+                catch (err) {
+                    throw new Error(`Failed on transforming ${key} using mapped value ${map[key]}`);
+                }
+            }
+            return result;
+        };
+        const map = Object.assign({}, DEFAULT_PROFILE_MAP, this.options.provider.profileMap);
+        return transform(profile, map, result);
+    }
+    /**
+     * Retrieves the user profile from the specified OIDC provider using the given access token.
+     * @param token The access token to use to retrieve the user profile.
+     * @param req The source HTTP request, used to validate the id_token's nonce claim.
+     */
+    async retrieveUserProfile(token, req) {
+        // Was an id_token provided? If so, we can verify and decode it to retrieve the profile
+        // without having to contact the OIDC provider again — some OpenID providers only expose
+        // profile data this way and have no separate profile endpoint at all.
+        if (token.id_token && this.options.provider.protocol === Protocol.OPENID) {
+            const payload = await this.verifyIdToken(token.id_token, req);
+            return this.convertProfile(payload);
+        }
+        // If no profileURL has been set just immediately return.
+        if (!this.options.provider.profileURL) {
+            return undefined;
+        }
+        try {
+            const request = await axios.get(this.options.provider.profileURL, {
+                headers: {
+                    Accept: "application/json",
+                    Authorization: `${token.token_type} ${token.access_token}`,
+                },
+            });
+            if (request && (request.status !== 200 || !request.data)) {
+                throw new Error("Failed to retrieve user profile.");
+            }
+            const json = typeof request.data === "string" ? JSON.parse(request.data) : request.data;
+            return this.convertProfile(json);
+        }
+        catch (err) {
+            const error = err.response?.data || new Error(`Failed to retrieve user profile. ${err.message || ""}`);
+            error.status = err.status;
+            throw error;
+        }
+    }
+    /**
+     * Dynamically imports the given optional peer dependency, throwing a helpful error if it is not installed.
+     *
+     * @param pkg The name of the package to import.
+     */
+    async importOptionalDependency(pkg) {
+        try {
+            return await import(pkg);
+        }
+        catch (err) {
+            throw new Error(`OIDC provider '${this.options.provider.name}' uses OpenID with an id_token, which requires ` +
+                `the optional peer dependency '${pkg}' for signature verification. Install it with: yarn add ${pkg}`);
+        }
+    }
+    /**
+     * Returns a (cached) `jwks-rsa` client for the given JWKS URI.
+     * @param jwksURI The JWKS endpoint to fetch signing keys from.
+     */
+    async getJwksClient(jwksURI) {
+        let client = this.jwksClients.get(jwksURI);
+        if (!client) {
+            const mod = await this.importOptionalDependency("jwks-rsa");
+            /* v8 ignore next -- `jwks-rsa`'s CJS export always gets a synthetic `.default` under
+               Node's ESM dynamic-import interop; this only guards atypical bundler/interop setups
+               where it doesn't. */
+            const buildClient = mod.default ?? mod;
+            client = buildClient({ jwksUri: jwksURI });
+            this.jwksClients.set(jwksURI, client);
+        }
+        return client;
+    }
+    /**
+     * Verifies the signature, issuer, audience, and nonce of the given ID token.
+     *
+     * @param idToken The compact JWT id_token to verify.
+     * @param req The source HTTP request, used to validate the nonce against the stored session value.
+     */
+    async verifyIdToken(idToken, req) {
+        const provider = this.options.provider;
+        if (!provider.jwksURI || !provider.issuer) {
+            throw new Error(`OIDC provider '${provider.name}' has protocol 'openid' but is missing required ` +
+                "'jwksURI'/'issuer' configuration for ID token verification.");
+        }
+        const decoded = jwt.decode(idToken, { complete: true });
+        if (!decoded || typeof decoded === "string") {
+            throw new Error("Invalid id_token: unable to decode JWT header.");
+        }
+        const client = await this.getJwksClient(provider.jwksURI);
+        const signingKey = await client.getSigningKey(decoded.header.kid);
+        const publicKey = signingKey.getPublicKey();
+        const payload = jwt.verify(idToken, publicKey, {
+            algorithms: ["RS256"],
+            issuer: provider.issuer,
+            audience: provider.clientID,
+        });
+        if (!req.session?.nonce || payload.nonce !== req.session.nonce) {
+            throw new Error("Invalid or missing nonce in id_token. Possible replay attack.");
+        }
+        return payload;
+    }
+}
+//# sourceMappingURL=OIDCStrategy.js.map

package/dist/lib/auth/OIDCStrategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OIDCStrategy.js","sourceRoot":"","sources":["../../../src/auth/OIDCStrategy.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,6CAA6C;AAC7C,gFAAgF;AAChF,OAAO,KAAwB,MAAM,OAAO,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,GAAG,MAAM,cAAc,CAAC;AAIpC,MAAM,CAAC,MAAM,QAAQ,GAAG;IACpB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACV,CAAC;AAoFX;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IAS5B;;;;;OAKG;IACI,OAAO,CAAC,KAAa,EAAE,OAAoB;QAC9C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC/E,CAAC;IAED,YAAY,IAAY,EAAE,QAAsB;QAlBhD,qDAAqD;QAC9C,SAAI,GAAW,OAAO,CAAC;QAkB1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC7B,CAAC;CACJ;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAQ;IACpC,EAAE,EAAE,YAAY;IAChB,IAAI,EAAE,kBAAkB;IACxB,KAAK,EAAE,eAAe;IACtB,cAAc,EAAE,mCAAmC;IACnD,SAAS,EAAE,mBAAmB;IAC9B,UAAU,EAAE,oBAAoB;IAChC,SAAS,EAAE,mBAAmB;IAC9B,MAAM,EAAE,gBAAgB;IACxB,KAAK,EAAE,eAAe;IACtB,cAAc,EAAE,mCAAmC;IACnD,MAAM,EAAE,gBAAgB;CAC3B,CAAC;AAEF,8FAA8F;AAC9F,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAE3D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,YAAY;IAMrB,YAAY,OAA4B;QALxB,SAAI,GAAW,OAAO,CAAC;QAEvC,wFAAwF;QAChF,gBAAW,GAAqB,IAAI,GAAG,EAAE,CAAC;QAG9C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC;QACtC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACO,iBAAiB,CAAC,YAAqB;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxC,MAAM,QAAQ,GAA2B,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhG,IAAI,YAAY,EAAE,CAAC;YACf,IAAI,YAAY,KAAK,MAAM,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,kCAAkC,YAAY,+BAA+B,CAAC,CAAC;YACnG,CAAC;YACD,IAAI,QAAQ,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACX,uCAAuC,QAAQ,WAAW,YAAY,kBAAkB,CAC3F,CAAC;YACN,CAAC;YACD,OAAO,YAAY,CAAC;QACxB,CAAC;QAED,OAAO,QAAQ,IAAI,MAAM,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACO,qBAAqB,CAAC,GAAgB,EAAE,WAAoB;QAClE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACX,qFAAqF;gBACjF,mCAAmC,CAC1C,CAAC;QACN,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAEvC,2FAA2F;QAC3F,0FAA0F;QAC1F,0FAA0F;QAC1F,sDAAsD;QACtD,MAAM,mBAAmB,GAAa,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YACrE,CAAC,CAAC,QAAQ,CAAC,WAAW;YACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC7B,MAAM,oBAAoB,GAAG,WAAW,IAAK,GAAG,CAAC,KAAK,EAAE,YAAmC,CAAC;QAC5F,IAAI,oBAAoB,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CACX,iBAAiB,oBAAoB,2DAA2D;gBAC5F,oBAAoB,CAC3B,CAAC;QACN,CAAC;QACD,MAAM,gBAAgB,GAAG,oBAAoB,IAAI,mBAAmB,CAAC,CAAC,CAAC,CAAC;QACxE,GAAG,CAAC,OAAO,CAAC,YAAY,GAAG,gBAAgB,CAAC;QAE5C,IAAI,GAAG,GAAW,QAAQ,CAAC,gBAAgB,GAAG,cAAc,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAEpG,+EAA+E;QAC/E,0FAA0F;QAC1F,qFAAqF;QACrF,yFAAyF;QACzF,4DAA4D;QAC5D,MAAM,SAAS,GAAW,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACvE,MAAM,aAAa,GAAY,GAAG,CAAC,KAAK,EAAE,KAA4B,IAAI,EAAE,CAAC;QAC7E,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;QAC9B,GAAG,IAAI,UAAU,kBAAkB,CAAC,GAAG,SAAS,IAAI,aAAa,EAAE,CAAC,EAAE,CAAC;QAEvE,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,qBAA2C,CAAC,CAAC;YAC7F,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,aAAmC,CAAC;YACrE,IAAI,cAAc,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,KAAK,CACX,uFAAuF,CAC1F,CAAC;YACN,CAAC;YACD,MAAM,QAAQ,GAAW,cAAc,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACxF,MAAM,aAAa,GACd,GAAG,CAAC,KAAK,CAAC,cAAyB;gBACpC,CAAC,MAAM,KAAK,OAAO;oBACf,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,MAAM;yBACD,UAAU,CAAC,QAAQ,CAAC;yBACpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;yBACtC,MAAM,CAAC,QAAQ,CAAC;yBAChB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;yBACjB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;yBACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YAEpC,GAAG,IAAI,mBAAmB,kBAAkB,CAAC,aAAa,CAAC,0BAA0B,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;YAElH,0DAA0D;YAC1D,GAAG,CAAC,OAAO,CAAC,cAAc,GAAG,aAAa,CAAC;YAC3C,GAAG,CAAC,OAAO,CAAC,qBAAqB,GAAG,MAAM,CAAC;YAC3C,GAAG,CAAC,OAAO,CAAC,aAAa,GAAG,QAAQ,CAAC;QACzC,CAAC;QAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,KAAK,GAAW,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACnE,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;YAC1B,GAAG,IAAI,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,CAAC;QAED,GAAG,IAAI,iBAAiB,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/D,GAAG,IAAI,qBAAqB,CAAC;QAC7B,GAAG,IAAI,UAAU,kBAAkB,CAAE,GAAG,CAAC,KAAK,CAAC,KAAgB,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAEvG,OAAO,GAAG,CAAC;IACf,CAAC;IAEM,KAAK,CAAC,YAAY,CACrB,GAAgB,EAChB,GAAiB,EACjB,QAAkB;QAElB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;QAClD,IAAI,KAAK,EAAE,CAAC;YACR,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,EAAE,iBAAiB,IAAI,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC;YAChF,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;QAED,sDAAsD;QACtD,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACX,qFAAqF;oBACjF,mCAAmC,CAC1C,CAAC;YACN,CAAC;YAED,MAAM,aAAa,GAAW,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,GAAG,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAW,CAAC;YACpF,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAC7F,MAAM,OAAO,GAAG,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAEtF,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAClF,CAAC;YACD,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;YAEzB,yEAAyE;YACzE,MAAM,WAAW,GAAQ,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAE1D,gCAAgC;YAChC,MAAM,OAAO,GAAQ,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAEtE,4FAA4F;YAC5F,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YACjC,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;YAClC,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC;YACzC,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;YACzB,OAAO,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC;YAEhC,0EAA0E;YAC1E,MAAM,IAAI,GAAwB,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAEnF,OAAO;gBACH,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,OAAO,EAAE,WAAW;gBACpB,KAAK,EAAE,OAAO;gBACd,IAAI;aACP,CAAC;QACN,CAAC;aAAM,CAAC;YACJ,MAAM,GAAG,GAAW,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;YACpD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChB,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC/B,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;YACnC,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAEM,gBAAgB,CAAC,GAAgB,EAAE,GAAiB,EAAE,QAAkB;QAC3E,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACtF,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,gBAAgB,CAAC,GAAgB;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAEvC,uDAAuD;QACvD,MAAM,IAAI,GAAW,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC;QACvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,mBAAmB,GAAa,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YACrE,CAAC,CAAC,QAAQ,CAAC,WAAW;YACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE7B,iFAAiF;QACjF,IAAI,IAAI,GAAQ;YACZ,IAAI;YACJ,UAAU,EAAE,oBAAoB;YAChC,wFAAwF;YACxF,uFAAuF;YACvF,YAAY,EAAE,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,mBAAmB,CAAC,CAAC,CAAC;SACpE,CAAC;QAEF,8GAA8G;QAC9G,0FAA0F;QAC1F,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChB,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC,IAAI,EAAE,aAAa,IAAI,GAAG,CAAC,KAAK,EAAE,aAAa,IAAI,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC;QAC3G,CAAC;QAED,MAAM,OAAO,GAAQ,EAAE,cAAc,EAAE,mCAAmC,EAAE,CAAC;QAC7E,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO,CAAC,aAAa,GAAG,SAAS,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvH,CAAC;aAAM,CAAC;YACJ,oFAAoF;YACpF,8EAA8E;YAC9E,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACvC,CAAC;QAED,IAAI,CAAC;YACD,MAAM,MAAM,GAAkB,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACrF,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACxD,CAAC;YAED,MAAM,IAAI,GAAQ,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;YAC1F,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,MAAM,KAAK,GAAQ,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1G,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAC1B,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACO,cAAc,CAAC,OAAY;QACjC,MAAM,MAAM,GAAQ;YAChB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI;YACpC,KAAK,EAAE,OAAO;SACjB,CAAC;QAEF,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;YACvC,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACD,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;wBAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBAClF,CAAC;yBAAM,CAAC;wBACJ,mCAAmC;wBACnC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;oBACjC,CAAC;gBACL,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,uBAAuB,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACpF,CAAC;YACL,CAAC;YAED,OAAO,MAAM,CAAC;QAClB,CAAC,CAAC;QAEF,MAAM,GAAG,GAAQ,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC1F,OAAO,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,mBAAmB,CAAC,KAAU,EAAE,GAAgB;QAC5D,uFAAuF;QACvF,wFAAwF;QACxF,sEAAsE;QACtE,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,yDAAyD;QACzD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,IAAI,CAAC;YACD,MAAM,OAAO,GAAkB,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE;gBAC7E,OAAO,EAAE;oBACL,MAAM,EAAE,kBAAkB;oBAC1B,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,EAAE;iBAC7D;aACJ,CAAC,CAAC;YACH,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACxD,CAAC;YAED,MAAM,IAAI,GAAQ,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;YAC7F,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,MAAM,KAAK,GAAQ,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5G,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAC1B,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,wBAAwB,CAAC,GAAW;QAC9C,IAAI,CAAC;YACD,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACX,kBAAkB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,iDAAiD;gBACzF,iCAAiC,GAAG,2DAA2D,GAAG,EAAE,CAC3G,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa,CAAC,OAAe;QACvC,IAAI,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,GAAG,GAAQ,MAAM,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC;YACjE;;mCAEuB;YACvB,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;YACvC,MAAM,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,GAAgB;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACX,kBAAkB,QAAQ,CAAC,IAAI,kDAAkD;gBAC7E,6DAA6D,CACpE,CAAC;QACN,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClE,MAAM,SAAS,GAAW,UAAU,CAAC,YAAY,EAAE,CAAC;QAEpD,MAAM,OAAO,GAAQ,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE;YAChD,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC9B,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACrF,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;CACJ"}

package/dist/lib/auth/OTPStrategy.js

@@ -0,0 +1,143 @@
+import { generateOTP, getRequestData, obfuscateContact, verifyOTP } from "./shared.js";
+/**
+ * Describes the configuration options that can be used to initialize OTPStrategy.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class OTPStrategyOptions {
+    constructor() {
+        /** The name of the header to look for when performing header based authentication. Default value is `Authorization`. */
+        this.headerKey = "authorization";
+        /** The authorization scheme type when using header based authentication. Default value is `otp`. */
+        this.headerScheme = "otp";
+    }
+    /**
+     * Retrieves the user's contact information for a given id.
+     * NOTE: You must override this function when using this strategy.
+     * @param id The unique id of the contact to retrieve.
+     */
+    getContact(id) {
+        throw new Error("Did you forget to override OTPStrategyOptions.getContact?");
+    }
+    /**
+     * Retrieves the list of available contacts for the user with the given id.
+     * NOTE: You must override this function when using this strategy.
+     * @param id The unique id of the user.
+     */
+    getContacts(id) {
+        throw new Error("Did you forget to override OTPStrategyOptions.getContacts?");
+    }
+    /**
+     * Retrieves the user data for the given unique identifier after authentication has completed successfully.
+     * NOTE: You must override this function when using this strategy.
+     * @param id The unique identifier of the user that has been successfully authenticated.
+     */
+    getUser(uid) {
+        throw new Error("Did you forget to override OTPStrategyOptions.getUsers?");
+    }
+    /**
+     * Sends a notification to the specified contact with the provided OTP token.
+     * NOTE: You must override this function when using this strategy.
+     * @param contact The contact to send the OTP token to.
+     * @param token The OTP token to send to the user.
+     */
+    notifyContact(contact, token) {
+        throw new Error("Did you forget to override OTPStrategyOptions.notify?");
+    }
+}
+/**
+ * Implements an strategy for authenticating a user with a One Time Password (OTP) that is sent to one of the user's
+ * verified contact methods. This allows for implementation of a password-less login flow. This strategy requires that
+ * an existing user account has already been registered with at least one verified contact method.
+ *
+ * This strategy should not to be confused with Time-Based One Time Password (TOTP) authentication which uses a
+ * pre-shared security key, often stored on the user's device (e.g. authenticator app) or digital vault (e.g. 1Password,
+ * Bitwarden, etc.). For TOTP authentication, see `TOTPStrategy`.
+ *
+ * The login flow has three phases:
+ *
+ * 1. Discovery - The client requests a list of contacts for a given user id. The `getContacts()` callback is used to
+ * return the list of contacts.
+ * 2. Challenge - The client requests a OTP token to be sent to the contact with a specified id. The
+ * OTP token is generated and sent to the contact using the `notify()` callback and stored in the session.
+ * 3. Verify - The client submits the OTP token and contact id. The OTP token is verified against the one stored in the
+ * session, and the associated user is resolved using the `getUser()` callback.
+ *
+ * The client sends request data either in the `Authorization` header or the request body in standard form-data format
+ * (e.g. `id=<id>&token=<otp>`). For example, the initial challenge request (step 2) can be sent as
+ * `Authorization: otp id=<contact_id>`. The final verification request (step 3) is then sent as
+ * `Authorization: otp id=<contact_id>&token=<otp>`.
+ *
+ * WARNING: Allowing discovery (setting `OTPStrategyOptions.allowDiscovery` to `true`) is a potential side-channel
+ * attack allowing anyone to discover or gather partial contact information about a given user. For improved security,
+ * the returned list of contacts is partially obfuscated. However, enough information is still provided that an
+ * attacker may be able to harvest information anyway. For example, a phone number will be obfuscated from
+ * `818-867-5309` to `****5309`. An email address will be obfuscated from `john.smith@gmail.com` to
+ * `j****th@gmail.com`.
+ *
+ * @author Jean-Philippe Steinmetz <rapidrests@gmail.com>
+ */
+export class OTPStrategy {
+    constructor(options) {
+        this.name = "otp";
+        this.options = options;
+        this.regexHeaderScheme = new RegExp("^" + this.options.headerScheme + "$", "i");
+    }
+    async authenticate(req, res, required) {
+        const { data, payload } = getRequestData(req, this.options.headerKey, this.options.headerScheme);
+        if (payload.id && payload.token) {
+            const user = await this.verify(payload, req, res);
+            if (user) {
+                return {
+                    data,
+                    method: this.name,
+                    payload,
+                    user,
+                };
+            }
+        }
+        else if (payload.id) {
+            return await this.challenge(payload, req, res);
+        }
+        else if (this.options.allowDiscovery) {
+            return await this.discovery(req, res);
+        }
+        if (required) {
+            throw new Error("Invalid authentication request.");
+        }
+        return undefined;
+    }
+    authenticateSync(req, res, required) {
+        throw new Error("Not supported. This auth strategy must be used asynchronously.");
+    }
+    async discovery(req, res) {
+        const id = req.query?.id ?? undefined;
+        let contacts = (await this.options.getContacts(id)) ?? [];
+        contacts = contacts.map((c) => ({ contact: obfuscateContact(c.contact, c.type), type: c.type }));
+        res.status(200);
+        res.json(contacts);
+        return undefined;
+    }
+    async challenge(payload, req, res) {
+        if (!req.session) {
+            throw new Error("OTPStrategy requires session support. Configure the `session` config " +
+                "block so the session middleware is registered.");
+        }
+        const contact = await this.options.getContact(payload.id);
+        if (!contact) {
+            return undefined;
+        }
+        const token = await generateOTP(req, payload);
+        await this.options.notifyContact(contact, token);
+        res.status(200);
+        res.json({});
+        return undefined;
+    }
+    async verify(payload, req, res) {
+        if (!(await verifyOTP(req, payload))) {
+            return undefined;
+        }
+        return this.options.getUser(payload.id);
+    }
+}
+//# sourceMappingURL=OTPStrategy.js.map

package/dist/lib/auth/OTPStrategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OTPStrategy.js","sourceRoot":"","sources":["../../../src/auth/OTPStrategy.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGvF;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IAA/B;QAOI,wHAAwH;QACjH,cAAS,GAAW,eAAe,CAAC;QAC3C,oGAAoG;QAC7F,iBAAY,GAAW,KAAK,CAAC;IAkCxC,CAAC;IAjCG;;;;OAIG;IACI,UAAU,CAAC,EAAU;QACxB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACjF,CAAC;IACD;;;;OAIG;IACI,WAAW,CAAC,EAAU;QACzB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAClF,CAAC;IACD;;;;OAIG;IACI,OAAO,CAAC,GAAW;QACtB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC/E,CAAC;IACD;;;;;OAKG;IACI,aAAa,CAAC,OAAmB,EAAE,KAAa;QACnD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC7E,CAAC;CACJ;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,OAAO,WAAW;IAKpB,YAAY,OAA2B;QAJvB,SAAI,GAAW,KAAK,CAAC;QAKjC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,iBAAiB,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;IACpF,CAAC;IAEM,KAAK,CAAC,YAAY,CACrB,GAAgB,EAChB,GAAiB,EACjB,QAAkB;QAElB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAEjG,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAwB,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACvE,IAAI,IAAI,EAAE,CAAC;gBACP,OAAO;oBACH,IAAI;oBACJ,MAAM,EAAE,IAAI,CAAC,IAAI;oBACjB,OAAO;oBACP,IAAI;iBACP,CAAC;YACN,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YACrC,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAEM,gBAAgB,CAAC,GAAgB,EAAE,GAAiB,EAAE,QAAkB;QAC3E,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACtF,CAAC;IAES,KAAK,CAAC,SAAS,CAAC,GAAgB,EAAE,GAAiB;QACzD,MAAM,EAAE,GAAwB,GAAG,CAAC,KAAK,EAAE,EAAa,IAAI,SAAS,CAAC;QACtE,IAAI,QAAQ,GAAiB,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxE,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACjG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnB,OAAO,SAAS,CAAC;IACrB,CAAC;IAES,KAAK,CAAC,SAAS,CAAC,OAAY,EAAE,GAAgB,EAAE,GAAiB;QACvE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACX,uEAAuE;gBACnE,gDAAgD,CACvD,CAAC;QACN,CAAC;QAED,MAAM,OAAO,GAA2B,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,KAAK,GAAW,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAEjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,OAAO,SAAS,CAAC;IACrB,CAAC;IAES,KAAK,CAAC,MAAM,CAAC,OAAY,EAAE,GAAgB,EAAE,GAAiB;QACpE,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YACnC,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;CACJ"}