@schemavaults/auth-common 0.10.11 → 0.12.0

package/dist/authenticate_result.d.ts

@@ -1,15 +1,125 @@
 import { z } from "zod";
-export declare const authenticateResultSchema: z.ZodObject<{
+export declare const authenticatedAuthenticateResultSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"authenticated">;
+    success: z.ZodBoolean;
+    message: z.ZodString;
+    authorization_code: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    message: string;
+    authorization_code: string;
+    kind: "authenticated";
+    success: boolean;
+}, {
+    message: string;
+    authorization_code: string;
+    kind: "authenticated";
+    success: boolean;
+}>;
+export type AuthenticatedAuthenticateResult = z.infer<typeof authenticatedAuthenticateResultSchema>;
+export declare const mfaRequiredAuthenticateResultSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"mfa_required">;
+    success: z.ZodBoolean;
+    message: z.ZodString;
+    challenge_id: z.ZodString;
+    expires_at: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    message: string;
+    expires_at: number;
+    kind: "mfa_required";
+    success: boolean;
+    challenge_id: string;
+}, {
+    message: string;
+    expires_at: number;
+    kind: "mfa_required";
+    success: boolean;
+    challenge_id: string;
+}>;
+export type MfaRequiredAuthenticateResult = z.infer<typeof mfaRequiredAuthenticateResultSchema>;
+export declare const authenticateFailureResultSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"failure">;
+    success: z.ZodBoolean;
     message: z.ZodString;
-    authorization_code: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    message: string;
+    kind: "failure";
+    success: boolean;
+}, {
+    message: string;
+    kind: "failure";
+    success: boolean;
+}>;
+export type AuthenticateFailureResult = z.infer<typeof authenticateFailureResultSchema>;
+export declare const challengeExpiredAuthenticateResultSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"challenge_expired">;
     success: z.ZodBoolean;
+    message: z.ZodString;
 }, "strict", z.ZodTypeAny, {
     message: string;
+    kind: "challenge_expired";
     success: boolean;
-    authorization_code?: string | undefined;
 }, {
     message: string;
+    kind: "challenge_expired";
     success: boolean;
-    authorization_code?: string | undefined;
 }>;
+export type ChallengeExpiredAuthenticateResult = z.infer<typeof challengeExpiredAuthenticateResultSchema>;
+export declare const authenticateResultSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+    kind: z.ZodLiteral<"authenticated">;
+    success: z.ZodBoolean;
+    message: z.ZodString;
+    authorization_code: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    message: string;
+    authorization_code: string;
+    kind: "authenticated";
+    success: boolean;
+}, {
+    message: string;
+    authorization_code: string;
+    kind: "authenticated";
+    success: boolean;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"mfa_required">;
+    success: z.ZodBoolean;
+    message: z.ZodString;
+    challenge_id: z.ZodString;
+    expires_at: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    message: string;
+    expires_at: number;
+    kind: "mfa_required";
+    success: boolean;
+    challenge_id: string;
+}, {
+    message: string;
+    expires_at: number;
+    kind: "mfa_required";
+    success: boolean;
+    challenge_id: string;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"failure">;
+    success: z.ZodBoolean;
+    message: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    message: string;
+    kind: "failure";
+    success: boolean;
+}, {
+    message: string;
+    kind: "failure";
+    success: boolean;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"challenge_expired">;
+    success: z.ZodBoolean;
+    message: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    message: string;
+    kind: "challenge_expired";
+    success: boolean;
+}, {
+    message: string;
+    kind: "challenge_expired";
+    success: boolean;
+}>]>;
 export type AuthenticateResult = z.infer<typeof authenticateResultSchema>;

package/dist/authenticate_result.js

@@ -1,12 +1,46 @@
 import { z } from "zod";
-export const authenticateResultSchema = z.object({
+export const authenticatedAuthenticateResultSchema = z
+    .object({
+    kind: z.literal("authenticated"),
     success: z.boolean(),
     message: z.string(),
-    authorization_code: z.string()
-        .min(43, 'Authorization code must be at least 43 characters long')
-        .optional()
-}).required({
-    success: true,
-    message: true
-}).strict();
+    authorization_code: z
+        .string()
+        .min(43, "Authorization code must be at least 43 characters long"),
+})
+    .strict();
+export const mfaRequiredAuthenticateResultSchema = z
+    .object({
+    kind: z.literal("mfa_required"),
+    success: z.boolean(),
+    message: z.string(),
+    challenge_id: z.string().uuid(),
+    expires_at: z.number().int().positive(),
+})
+    .strict();
+export const authenticateFailureResultSchema = z
+    .object({
+    kind: z.literal("failure"),
+    success: z.boolean(),
+    message: z.string(),
+})
+    .strict();
+// Returned by /api/auth/mfa/verify with HTTP 410 when an in-flight MFA
+// challenge has been invalidated — either by exhausting the per-challenge
+// attempt cap or by expiring (TTL elapsed). Distinct from `failure` so
+// clients can navigate the user back to the login page rather than letting
+// them retry against a key that no longer exists in Redis.
+export const challengeExpiredAuthenticateResultSchema = z
+    .object({
+    kind: z.literal("challenge_expired"),
+    success: z.boolean(),
+    message: z.string(),
+})
+    .strict();
+export const authenticateResultSchema = z.discriminatedUnion("kind", [
+    authenticatedAuthenticateResultSchema,
+    mfaRequiredAuthenticateResultSchema,
+    authenticateFailureResultSchema,
+    challengeExpiredAuthenticateResultSchema,
+]);
 //# sourceMappingURL=authenticate_result.js.map

package/dist/authenticate_result.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate_result.js","sourceRoot":"","sources":["../src/authenticate_result.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;SAC3B,GAAG,CAAC,EAAE,EAAE,wDAAwD,CAAC;SACjE,QAAQ,EAAE;CACd,CAAC,CAAC,QAAQ,CAAC;IACV,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,IAAI;CACd,CAAC,CAAC,MAAM,EAAE,CAAC"}
+{"version":3,"file":"authenticate_result.js","sourceRoot":"","sources":["../src/authenticate_result.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,kBAAkB,EAAE,CAAC;SAClB,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,EAAE,wDAAwD,CAAC;CACrE,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC7C,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,uEAAuE;AACvE,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC;KACtD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACnE,qCAAqC;IACrC,mCAAmC;IACnC,+BAA+B;IAC/B,wCAAwC;CACzC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -10,7 +10,8 @@ export * from "./middleware";
 export type * from "./middleware";
 export * from "./pkce";
 export type * from "./pkce";
-export { authenticateResultSchema, type AuthenticateResult, } from "./authenticate_result";
+export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, type AuthenticateResult, type AuthenticatedAuthenticateResult, type MfaRequiredAuthenticateResult, type AuthenticateFailureResult, type ChallengeExpiredAuthenticateResult, } from "./authenticate_result";
+export * from "./mfa";
 export { requestTokensResultSchema, type RequestTokensResult, successfullyGeneratedTokensRecordSchema, type SuccessfullyGeneratedTokensRecord, } from "./request_tokens_result";
 export * from "./auth_acquire_tokens_grant_types";
 export type * from "./auth_acquire_tokens_grant_types";
@@ -28,3 +29,6 @@ export { determineRefreshTokenCookieSameSiteValue } from "./determineRefreshToke
 export { authorizeClientApplicationFormType } from "./authorize-client-application-form-type";
 export { paginationOptionsSchema, DEFAULT_PAGINATION_PAGE_INDEX, DEFAULT_PAGINATION_PAGE_SIZE, isValidPaginationOptions, } from "./pagination";
 export type { PaginationOptions } from "./pagination";
+export { timingSafeStringEqual } from "./timing-safe-string-equal";
+export { oauth2StateSchema, OAUTH2_STATE_VSCHAR_REGEX, parseOAuth2State, OAuth2StateValidationError, } from "./oauth2-state-schema";
+export type { OAuth2State } from "./oauth2-state-schema";

package/dist/index.js

@@ -5,7 +5,8 @@ export * from "./credentials";
 export * from "./token-data";
 export * from "./middleware";
 export * from "./pkce";
-export { authenticateResultSchema, } from "./authenticate_result";
+export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, } from "./authenticate_result";
+export * from "./mfa";
 export { requestTokensResultSchema, successfullyGeneratedTokensRecordSchema, } from "./request_tokens_result";
 export * from "./auth_acquire_tokens_grant_types";
 export { PRODUCTION_AUTH_SERVER_URL } from "@schemavaults/app-definitions";
@@ -19,4 +20,6 @@ export { AccessTokenCookieName, AccessTokenExpiryCookieName, } from "./AccessTok
 export { determineRefreshTokenCookieSameSiteValue } from "./determineRefreshTokenCookieSameSiteValue";
 export { authorizeClientApplicationFormType } from "./authorize-client-application-form-type";
 export { paginationOptionsSchema, DEFAULT_PAGINATION_PAGE_INDEX, DEFAULT_PAGINATION_PAGE_SIZE, isValidPaginationOptions, } from "./pagination";
+export { timingSafeStringEqual } from "./timing-safe-string-equal";
+export { oauth2StateSchema, OAUTH2_STATE_VSCHAR_REGEX, parseOAuth2State, OAuth2StateValidationError, } from "./oauth2-state-schema";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,OAAO,EACL,wBAAwB,GAEzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,EAEzB,uCAAuC,GAExC,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,aAAa,EACb,4BAA4B,EAC5B,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,iBAAiB,CAAC;AAczB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,GAMzC,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,yBAAyB,EAEzB,uCAAuC,GAExC,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,aAAa,EACb,4BAA4B,EAC5B,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,iBAAiB,CAAC;AAczB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}

package/dist/mfa/index.d.ts

@@ -0,0 +1,3 @@
+export { mfaFactorTypes, mfaFactorTypeSchema, isValidMfaFactorType, type MfaFactorType, } from "./mfa-factor-type";
+export { mfaChallengeSchema, type MfaChallengeDescriptor, } from "./mfa-challenge";
+export { totpCodeSchema, recoveryCodeSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaCodeOnlyBodySchema, type MfaVerifyBody, type MfaEnrollResponse, type MfaVerifyEnrollmentBody, type MfaVerifyEnrollmentResponse, type MfaStatusResponse, type MfaCodeOnlyBody, } from "./mfa-verify-body";

package/dist/mfa/index.js

@@ -0,0 +1,4 @@
+export { mfaFactorTypes, mfaFactorTypeSchema, isValidMfaFactorType, } from "./mfa-factor-type";
+export { mfaChallengeSchema, } from "./mfa-challenge";
+export { totpCodeSchema, recoveryCodeSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaCodeOnlyBodySchema, } from "./mfa-verify-body";
+//# sourceMappingURL=index.js.map

package/dist/mfa/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mfa/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,GAEnB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,uBAAuB,EACvB,qBAAqB,GAOtB,MAAM,mBAAmB,CAAC"}

package/dist/mfa/mfa-challenge.d.ts

@@ -0,0 +1,12 @@
+import { z } from "zod";
+export declare const mfaChallengeSchema: z.ZodObject<{
+    challenge_id: z.ZodString;
+    expires_at: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    expires_at: number;
+    challenge_id: string;
+}, {
+    expires_at: number;
+    challenge_id: string;
+}>;
+export type MfaChallengeDescriptor = z.infer<typeof mfaChallengeSchema>;

package/dist/mfa/mfa-challenge.js

@@ -0,0 +1,8 @@
+import { z } from "zod";
+export const mfaChallengeSchema = z
+    .object({
+    challenge_id: z.string().uuid(),
+    expires_at: z.number().int().positive(),
+})
+    .strict();
+//# sourceMappingURL=mfa-challenge.js.map

package/dist/mfa/mfa-challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-challenge.js","sourceRoot":"","sources":["../../src/mfa/mfa-challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/mfa/mfa-factor-type.d.ts

@@ -0,0 +1,5 @@
+import { z } from "zod";
+export declare const mfaFactorTypes: readonly ["totp"];
+export declare const mfaFactorTypeSchema: z.ZodEnum<["totp"]>;
+export type MfaFactorType = z.infer<typeof mfaFactorTypeSchema>;
+export declare function isValidMfaFactorType(value: unknown): value is MfaFactorType;

package/dist/mfa/mfa-factor-type.js

@@ -0,0 +1,7 @@
+import { z } from "zod";
+export const mfaFactorTypes = ["totp"];
+export const mfaFactorTypeSchema = z.enum(mfaFactorTypes);
+export function isValidMfaFactorType(value) {
+    return mfaFactorTypeSchema.safeParse(value).success;
+}
+//# sourceMappingURL=mfa-factor-type.js.map

package/dist/mfa/mfa-factor-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-factor-type.js","sourceRoot":"","sources":["../../src/mfa/mfa-factor-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAM,CAAU,CAAC;AAEhD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAI1D,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtD,CAAC"}

package/dist/mfa/mfa-verify-body.d.ts

@@ -0,0 +1,117 @@
+import { z } from "zod";
+export declare const totpCodeSchema: z.ZodString;
+export declare const recoveryCodeSchema: z.ZodString;
+export declare const mfaVerifyBodySchema: z.ZodObject<{
+    challenge_id: z.ZodString;
+    client_app_id: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
+    proof: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+        type: z.ZodLiteral<"totp">;
+        code: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        code: string;
+        type: "totp";
+    }, {
+        code: string;
+        type: "totp";
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"recovery_code">;
+        recovery_code: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        type: "recovery_code";
+        recovery_code: string;
+    }, {
+        type: "recovery_code";
+        recovery_code: string;
+    }>]>;
+}, "strict", z.ZodTypeAny, {
+    client_app_id: string;
+    challenge_id: string;
+    proof: {
+        code: string;
+        type: "totp";
+    } | {
+        type: "recovery_code";
+        recovery_code: string;
+    };
+}, {
+    client_app_id: string;
+    challenge_id: string;
+    proof: {
+        code: string;
+        type: "totp";
+    } | {
+        type: "recovery_code";
+        recovery_code: string;
+    };
+}>;
+export type MfaVerifyBody = z.infer<typeof mfaVerifyBodySchema>;
+export declare const mfaEnrollResponseSchema: z.ZodObject<{
+    factor_id: z.ZodString;
+    factor_type: z.ZodLiteral<"totp">;
+    otpauth_url: z.ZodString;
+    qr_code_data_url: z.ZodString;
+    secret: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    factor_id: string;
+    factor_type: "totp";
+    otpauth_url: string;
+    qr_code_data_url: string;
+    secret: string;
+}, {
+    factor_id: string;
+    factor_type: "totp";
+    otpauth_url: string;
+    qr_code_data_url: string;
+    secret: string;
+}>;
+export type MfaEnrollResponse = z.infer<typeof mfaEnrollResponseSchema>;
+export declare const mfaVerifyEnrollmentBodySchema: z.ZodObject<{
+    factor_id: z.ZodString;
+    code: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    code: string;
+    factor_id: string;
+}, {
+    code: string;
+    factor_id: string;
+}>;
+export type MfaVerifyEnrollmentBody = z.infer<typeof mfaVerifyEnrollmentBodySchema>;
+export declare const mfaVerifyEnrollmentResponseSchema: z.ZodObject<{
+    success: z.ZodLiteral<true>;
+    recovery_codes: z.ZodArray<z.ZodString, "many">;
+}, "strict", z.ZodTypeAny, {
+    success: true;
+    recovery_codes: string[];
+}, {
+    success: true;
+    recovery_codes: string[];
+}>;
+export type MfaVerifyEnrollmentResponse = z.infer<typeof mfaVerifyEnrollmentResponseSchema>;
+export declare const mfaStatusResponseSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    factor_id: z.ZodOptional<z.ZodString>;
+    factor_type: z.ZodOptional<z.ZodLiteral<"totp">>;
+    verified_at: z.ZodOptional<z.ZodNumber>;
+    recovery_codes_remaining: z.ZodOptional<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    enabled: boolean;
+    factor_id?: string | undefined;
+    factor_type?: "totp" | undefined;
+    verified_at?: number | undefined;
+    recovery_codes_remaining?: number | undefined;
+}, {
+    enabled: boolean;
+    factor_id?: string | undefined;
+    factor_type?: "totp" | undefined;
+    verified_at?: number | undefined;
+    recovery_codes_remaining?: number | undefined;
+}>;
+export type MfaStatusResponse = z.infer<typeof mfaStatusResponseSchema>;
+export declare const mfaCodeOnlyBodySchema: z.ZodObject<{
+    code: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    code: string;
+}, {
+    code: string;
+}>;
+export type MfaCodeOnlyBody = z.infer<typeof mfaCodeOnlyBodySchema>;

package/dist/mfa/mfa-verify-body.js

@@ -0,0 +1,57 @@
+import { z } from "zod";
+import { appIdSchema } from "@schemavaults/app-definitions";
+export const totpCodeSchema = z
+    .string()
+    .regex(/^\d{6}$/u, "TOTP code must be exactly 6 digits");
+export const recoveryCodeSchema = z
+    .string()
+    .min(8)
+    .max(64);
+export const mfaVerifyBodySchema = z
+    .object({
+    challenge_id: z.string().uuid(),
+    client_app_id: appIdSchema,
+    proof: z.discriminatedUnion("type", [
+        z.object({ type: z.literal("totp"), code: totpCodeSchema }).strict(),
+        z
+            .object({ type: z.literal("recovery_code"), recovery_code: recoveryCodeSchema })
+            .strict(),
+    ]),
+})
+    .strict();
+export const mfaEnrollResponseSchema = z
+    .object({
+    factor_id: z.string().uuid(),
+    factor_type: z.literal("totp"),
+    otpauth_url: z.string().url(),
+    qr_code_data_url: z.string().min(1),
+    secret: z.string().min(16),
+})
+    .strict();
+export const mfaVerifyEnrollmentBodySchema = z
+    .object({
+    factor_id: z.string().uuid(),
+    code: totpCodeSchema,
+})
+    .strict();
+export const mfaVerifyEnrollmentResponseSchema = z
+    .object({
+    success: z.literal(true),
+    recovery_codes: z.array(recoveryCodeSchema).min(1),
+})
+    .strict();
+export const mfaStatusResponseSchema = z
+    .object({
+    enabled: z.boolean(),
+    factor_id: z.string().uuid().optional(),
+    factor_type: z.literal("totp").optional(),
+    verified_at: z.number().int().positive().optional(),
+    recovery_codes_remaining: z.number().int().nonnegative().optional(),
+})
+    .strict();
+export const mfaCodeOnlyBodySchema = z
+    .object({
+    code: totpCodeSchema,
+})
+    .strict();
+//# sourceMappingURL=mfa-verify-body.js.map

package/dist/mfa/mfa-verify-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-verify-body.js","sourceRoot":"","sources":["../../src/mfa/mfa-verify-body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,KAAK,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,aAAa,EAAE,WAAW;IAC1B,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAClC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;QACpE,CAAC;aACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC;aAC/E,MAAM,EAAE;KACZ,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACnD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IACzC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACpE,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/oauth2-state-schema.d.ts

@@ -0,0 +1,29 @@
+import { z } from "zod";
+export declare const OAUTH2_STATE_VSCHAR_REGEX: RegExp;
+export declare const oauth2StateSchema: z.ZodString;
+export type OAuth2State = z.infer<typeof oauth2StateSchema>;
+/**
+ * Thrown by `parseOAuth2State` when the caller supplied a `state`
+ * value that is present but fails schema validation. Callers at
+ * server-side entry points should turn this into a 400 response
+ * (e.g. `redirectWithError(400, "bad_request")` for page routes,
+ * `NextResponse.json(..., { status: 400 })` for API routes).
+ */
+export declare class OAuth2StateValidationError extends Error {
+    readonly reasons: readonly string[];
+    constructor(reasons: readonly string[]);
+}
+/**
+ * Validates an OAuth2 `state` at a server boundary.
+ *
+ *   - Absent / null / undefined → returns `null` (RFC-legal; `state`
+ *     is optional).
+ *   - Present + well-formed → returns the validated string.
+ *   - Present + malformed (wrong type, empty, too long, non-VSCHAR)
+ *     → throws `OAuth2StateValidationError` so the caller can 400.
+ *
+ * Empty strings are treated as malformed (not absent) so a client
+ * that accidentally serializes `?state=` gets a loud signal instead
+ * of a silent downgrade.
+ */
+export declare function parseOAuth2State(raw: unknown): string | null;

package/dist/oauth2-state-schema.js

@@ -0,0 +1,71 @@
+import { z } from "zod";
+// RFC 6749 §10.12 introduces the OAuth2 `state` parameter as a
+// client-side CSRF nonce. RFC 6749 §A.5 defines its on-the-wire form
+// as `*VSCHAR` — zero or more printable ASCII characters %x20-%x7E.
+// The auth server never interprets `state`; it only echoes the value
+// untouched on the callback. The validator below therefore captures
+// only the properties worth enforcing at the protocol boundary:
+//
+//   1. Non-empty (a zero-length state has no CSRF value).
+//   2. Bounded length — 512 chars is comfortably above common shapes
+//      (UUID, base64url 32-byte nonce, short signed JWTs) while
+//      protecting log pipelines and callback-URL buffers from
+//      unbounded echo.
+//   3. Printable ASCII only — prevents log-pollution / terminal-escape
+//      smuggling via control chars, NULs, and CR/LF.
+//
+// This schema is deliberately not base64url-specific: that would be
+// SDK-opinionated and would break RFC-legal third-party clients that
+// use UUIDs, signed JWTs, or other formats for their state value.
+const MAX_OAUTH2_STATE_LENGTH = 512;
+export const OAUTH2_STATE_VSCHAR_REGEX = /^[\x20-\x7E]+$/;
+export const oauth2StateSchema = z
+    .string()
+    .min(1)
+    .max(MAX_OAUTH2_STATE_LENGTH)
+    .regex(OAUTH2_STATE_VSCHAR_REGEX, {
+    message: "OAuth2 'state' must contain only printable ASCII (RFC 6749 §A.5 VSCHAR)",
+});
+/**
+ * Thrown by `parseOAuth2State` when the caller supplied a `state`
+ * value that is present but fails schema validation. Callers at
+ * server-side entry points should turn this into a 400 response
+ * (e.g. `redirectWithError(400, "bad_request")` for page routes,
+ * `NextResponse.json(..., { status: 400 })` for API routes).
+ */
+export class OAuth2StateValidationError extends Error {
+    reasons;
+    constructor(reasons) {
+        super(`Invalid OAuth2 'state' parameter: ${reasons.join("; ")}`);
+        this.name = "OAuth2StateValidationError";
+        this.reasons = reasons;
+    }
+}
+/**
+ * Validates an OAuth2 `state` at a server boundary.
+ *
+ *   - Absent / null / undefined → returns `null` (RFC-legal; `state`
+ *     is optional).
+ *   - Present + well-formed → returns the validated string.
+ *   - Present + malformed (wrong type, empty, too long, non-VSCHAR)
+ *     → throws `OAuth2StateValidationError` so the caller can 400.
+ *
+ * Empty strings are treated as malformed (not absent) so a client
+ * that accidentally serializes `?state=` gets a loud signal instead
+ * of a silent downgrade.
+ */
+export function parseOAuth2State(raw) {
+    if (raw === undefined || raw === null)
+        return null;
+    if (typeof raw !== "string") {
+        throw new OAuth2StateValidationError([
+            `Expected string, got ${Array.isArray(raw) ? "array" : typeof raw}`,
+        ]);
+    }
+    const parsed = oauth2StateSchema.safeParse(raw);
+    if (!parsed.success) {
+        throw new OAuth2StateValidationError(parsed.error.issues.map((i) => i.message));
+    }
+    return parsed.data;
+}
+//# sourceMappingURL=oauth2-state-schema.js.map

package/dist/oauth2-state-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-state-schema.js","sourceRoot":"","sources":["../src/oauth2-state-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+DAA+D;AAC/D,qEAAqE;AACrE,oEAAoE;AACpE,qEAAqE;AACrE,oEAAoE;AACpE,gEAAgE;AAChE,EAAE;AACF,0DAA0D;AAC1D,qEAAqE;AACrE,gEAAgE;AAChE,8DAA8D;AAC9D,uBAAuB;AACvB,uEAAuE;AACvE,qDAAqD;AACrD,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,kEAAkE;AAElE,MAAM,uBAAuB,GAAG,GAAY,CAAC;AAE7C,MAAM,CAAC,MAAM,yBAAyB,GAAW,gBAAgB,CAAC;AAElE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,uBAAuB,CAAC;KAC5B,KAAK,CAAC,yBAAyB,EAAE;IAChC,OAAO,EACL,yEAAyE;CAC5E,CAAC,CAAC;AAIL;;;;;;GAMG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnC,OAAO,CAAoB;IAC3C,YAAmB,OAA0B;QAC3C,KAAK,CAAC,qCAAqC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,0BAA0B,CAAC;YACnC,wBAAwB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;SACpE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,0BAA0B,CAClC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAC1C,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/timing-safe-string-equal.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Timing-safe string comparison usable from browser bundles.
+ *
+ * `node:crypto.timingSafeEqual` is Node-only; this pure-JS variant
+ * operates on strings and runs in both browser and server contexts.
+ * Not strictly constant-time under every JIT, but avoids early-exit on
+ * the first byte of divergence — strictly better than `===` for
+ * CSRF-nonce / token comparison.
+ *
+ * Returns false on any non-string input or length mismatch.
+ */
+export declare function timingSafeStringEqual(a: string, b: string): boolean;
+export default timingSafeStringEqual;

package/dist/timing-safe-string-equal.js

@@ -0,0 +1,24 @@
+/**
+ * Timing-safe string comparison usable from browser bundles.
+ *
+ * `node:crypto.timingSafeEqual` is Node-only; this pure-JS variant
+ * operates on strings and runs in both browser and server contexts.
+ * Not strictly constant-time under every JIT, but avoids early-exit on
+ * the first byte of divergence — strictly better than `===` for
+ * CSRF-nonce / token comparison.
+ *
+ * Returns false on any non-string input or length mismatch.
+ */
+export function timingSafeStringEqual(a, b) {
+    if (typeof a !== "string" || typeof b !== "string")
+        return false;
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return diff === 0;
+}
+export default timingSafeStringEqual;
+//# sourceMappingURL=timing-safe-string-equal.js.map

package/dist/timing-safe-string-equal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timing-safe-string-equal.js","sourceRoot":"","sources":["../src/timing-safe-string-equal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAS,EAAE,CAAS;IACxD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,eAAe,qBAAqB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@schemavaults/auth-common",
   "description": "Types and utility functions for authentication and authorization",
-  "version": "0.10.11",
+  "version": "0.12.0",
   "license": "UNLICENSED",
   "private": false,
   "repository": {