@schemavaults/auth-common 0.12.10 → 0.13.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (19) hide show
  1. package/dist/authenticate_result.d.ts +66 -0
  2. package/dist/authenticate_result.js +10 -0
  3. package/dist/authenticate_result.js.map +1 -1
  4. package/dist/index.d.ts +1 -1
  5. package/dist/index.js +1 -1
  6. package/dist/index.js.map +1 -1
  7. package/dist/mfa/index.d.ts +2 -1
  8. package/dist/mfa/index.js +2 -1
  9. package/dist/mfa/index.js.map +1 -1
  10. package/dist/mfa/mfa-factor-type.d.ts +2 -2
  11. package/dist/mfa/mfa-factor-type.js +1 -1
  12. package/dist/mfa/mfa-factor-type.js.map +1 -1
  13. package/dist/mfa/mfa-verify-body.d.ts +268 -7
  14. package/dist/mfa/mfa-verify-body.js +88 -10
  15. package/dist/mfa/mfa-verify-body.js.map +1 -1
  16. package/dist/mfa/webauthn.d.ts +182 -0
  17. package/dist/mfa/webauthn.js +81 -0
  18. package/dist/mfa/webauthn.js.map +1 -0
  19. package/package.json +1 -1
package/dist/authenticate_result.d.ts CHANGED
@@ -1,4 +1,18 @@
1
1
  import { z } from "zod";
2
+ export declare const availableMfaFactorSchema: z.ZodObject<{
3
+ factor_id: z.ZodString;
4
+ factor_type: z.ZodEnum<["totp", "webauthn"]>;
5
+ last_used_at: z.ZodNullable<z.ZodNumber>;
6
+ }, "strict", z.ZodTypeAny, {
7
+ factor_id: string;
8
+ factor_type: "totp" | "webauthn";
9
+ last_used_at: number | null;
10
+ }, {
11
+ factor_id: string;
12
+ factor_type: "totp" | "webauthn";
13
+ last_used_at: number | null;
14
+ }>;
15
+ export type AvailableMfaFactor = z.infer<typeof availableMfaFactorSchema>;
2
16
  export declare const authenticatedAuthenticateResultSchema: z.ZodObject<{
3
17
  kind: z.ZodLiteral<"authenticated">;
4
18
  success: z.ZodBoolean;
@@ -22,18 +36,44 @@ export declare const mfaRequiredAuthenticateResultSchema: z.ZodObject<{
22
36
  message: z.ZodString;
23
37
  challenge_id: z.ZodString;
24
38
  expires_at: z.ZodNumber;
39
+ available_factors: z.ZodArray<z.ZodObject<{
40
+ factor_id: z.ZodString;
41
+ factor_type: z.ZodEnum<["totp", "webauthn"]>;
42
+ last_used_at: z.ZodNullable<z.ZodNumber>;
43
+ }, "strict", z.ZodTypeAny, {
44
+ factor_id: string;
45
+ factor_type: "totp" | "webauthn";
46
+ last_used_at: number | null;
47
+ }, {
48
+ factor_id: string;
49
+ factor_type: "totp" | "webauthn";
50
+ last_used_at: number | null;
51
+ }>, "many">;
52
+ recovery_codes_available: z.ZodBoolean;
25
53
  }, "strict", z.ZodTypeAny, {
26
54
  message: string;
27
55
  expires_at: number;
28
56
  kind: "mfa_required";
29
57
  success: boolean;
30
58
  challenge_id: string;
59
+ available_factors: {
60
+ factor_id: string;
61
+ factor_type: "totp" | "webauthn";
62
+ last_used_at: number | null;
63
+ }[];
64
+ recovery_codes_available: boolean;
31
65
  }, {
32
66
  message: string;
33
67
  expires_at: number;
34
68
  kind: "mfa_required";
35
69
  success: boolean;
36
70
  challenge_id: string;
71
+ available_factors: {
72
+ factor_id: string;
73
+ factor_type: "totp" | "webauthn";
74
+ last_used_at: number | null;
75
+ }[];
76
+ recovery_codes_available: boolean;
37
77
  }>;
38
78
  export type MfaRequiredAuthenticateResult = z.infer<typeof mfaRequiredAuthenticateResultSchema>;
39
79
  export declare const authenticateFailureResultSchema: z.ZodObject<{
@@ -85,18 +125,44 @@ export declare const authenticateResultSchema: z.ZodDiscriminatedUnion<"kind", [
85
125
  message: z.ZodString;
86
126
  challenge_id: z.ZodString;
87
127
  expires_at: z.ZodNumber;
128
+ available_factors: z.ZodArray<z.ZodObject<{
129
+ factor_id: z.ZodString;
130
+ factor_type: z.ZodEnum<["totp", "webauthn"]>;
131
+ last_used_at: z.ZodNullable<z.ZodNumber>;
132
+ }, "strict", z.ZodTypeAny, {
133
+ factor_id: string;
134
+ factor_type: "totp" | "webauthn";
135
+ last_used_at: number | null;
136
+ }, {
137
+ factor_id: string;
138
+ factor_type: "totp" | "webauthn";
139
+ last_used_at: number | null;
140
+ }>, "many">;
141
+ recovery_codes_available: z.ZodBoolean;
88
142
  }, "strict", z.ZodTypeAny, {
89
143
  message: string;
90
144
  expires_at: number;
91
145
  kind: "mfa_required";
92
146
  success: boolean;
93
147
  challenge_id: string;
148
+ available_factors: {
149
+ factor_id: string;
150
+ factor_type: "totp" | "webauthn";
151
+ last_used_at: number | null;
152
+ }[];
153
+ recovery_codes_available: boolean;
94
154
  }, {
95
155
  message: string;
96
156
  expires_at: number;
97
157
  kind: "mfa_required";
98
158
  success: boolean;
99
159
  challenge_id: string;
160
+ available_factors: {
161
+ factor_id: string;
162
+ factor_type: "totp" | "webauthn";
163
+ last_used_at: number | null;
164
+ }[];
165
+ recovery_codes_available: boolean;
100
166
  }>, z.ZodObject<{
101
167
  kind: z.ZodLiteral<"failure">;
102
168
  success: z.ZodBoolean;
package/dist/authenticate_result.js CHANGED
@@ -1,4 +1,12 @@
1
1
  import { z } from "zod";
2
+ import { mfaFactorTypeSchema } from "./mfa/mfa-factor-type";
3
+ export const availableMfaFactorSchema = z
4
+ .object({
5
+ factor_id: z.string().uuid(),
6
+ factor_type: mfaFactorTypeSchema,
7
+ last_used_at: z.number().int().positive().nullable(),
8
+ })
9
+ .strict();
2
10
  export const authenticatedAuthenticateResultSchema = z
3
11
  .object({
4
12
  kind: z.literal("authenticated"),
@@ -16,6 +24,8 @@ export const mfaRequiredAuthenticateResultSchema = z
16
24
  message: z.string(),
17
25
  challenge_id: z.string().uuid(),
18
26
  expires_at: z.number().int().positive(),
27
+ available_factors: z.array(availableMfaFactorSchema),
28
+ recovery_codes_available: z.boolean(),
19
29
  })
20
30
  .strict();
21
31
  export const authenticateFailureResultSchema = z
package/dist/authenticate_result.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"authenticate_result.js","sourceRoot":"","sources":["../src/authenticate_result.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,kBAAkB,EAAE,CAAC;SAClB,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,EAAE,wDAAwD,CAAC;CACrE,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC7C,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,uEAAuE;AACvE,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC;KACtD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACnE,qCAAqC;IACrC,mCAAmC;IACnC,+BAA+B;IAC/B,wCAAwC;CACzC,CAAC,CAAC"}
1
+ {"version":3,"file":"authenticate_result.js","sourceRoot":"","sources":["../src/authenticate_result.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,mBAAmB;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,kBAAkB,EAAE,CAAC;SAClB,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,EAAE,wDAAwD,CAAC;CACrE,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACpD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;CACtC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC7C,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,uEAAuE;AACvE,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC;KACtD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACnE,qCAAqC;IACrC,mCAAmC;IACnC,+BAA+B;IAC/B,wCAAwC;CACzC,CAAC,CAAC"}
package/dist/index.d.ts CHANGED
@@ -10,7 +10,7 @@ export * from "./middleware";
10
10
  export type * from "./middleware";
11
11
  export * from "./pkce";
12
12
  export type * from "./pkce";
13
- export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, type AuthenticateResult, type AuthenticatedAuthenticateResult, type MfaRequiredAuthenticateResult, type AuthenticateFailureResult, type ChallengeExpiredAuthenticateResult, } from "./authenticate_result";
13
+ export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, availableMfaFactorSchema, type AuthenticateResult, type AuthenticatedAuthenticateResult, type MfaRequiredAuthenticateResult, type AuthenticateFailureResult, type ChallengeExpiredAuthenticateResult, type AvailableMfaFactor, } from "./authenticate_result";
14
14
  export * from "./mfa";
15
15
  export { requestTokensResultSchema, type RequestTokensResult, successfullyGeneratedTokensRecordSchema, type SuccessfullyGeneratedTokensRecord, } from "./request_tokens_result";
16
16
  export * from "./auth_acquire_tokens_grant_types";
package/dist/index.js CHANGED
@@ -5,7 +5,7 @@ export * from "./credentials";
5
5
  export * from "./token-data";
6
6
  export * from "./middleware";
7
7
  export * from "./pkce";
8
- export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, } from "./authenticate_result";
8
+ export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, availableMfaFactorSchema, } from "./authenticate_result";
9
9
  export * from "./mfa";
10
10
  export { requestTokensResultSchema, successfullyGeneratedTokensRecordSchema, } from "./request_tokens_result";
11
11
  export * from "./auth_acquire_tokens_grant_types";
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,GAMzC,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,yBAAyB,EAEzB,uCAAuC,GAExC,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,aAAa,EACb,4BAA4B,EAC5B,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,EACxC,wBAAwB,GAOzB,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,yBAAyB,EAEzB,uCAAuC,GAExC,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,aAAa,EACb,4BAA4B,EAC5B,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}
package/dist/mfa/index.d.ts CHANGED
@@ -1,3 +1,4 @@
1
1
  export { mfaFactorTypes, mfaFactorTypeSchema, isValidMfaFactorType, type MfaFactorType, } from "./mfa-factor-type";
2
2
  export { mfaChallengeSchema, type MfaChallengeDescriptor, } from "./mfa-challenge";
3
- export { totpCodeSchema, recoveryCodeSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaCodeOnlyBodySchema, type MfaVerifyBody, type MfaEnrollResponse, type MfaVerifyEnrollmentBody, type MfaVerifyEnrollmentResponse, type MfaStatusResponse, type MfaCodeOnlyBody, } from "./mfa-verify-body";
3
+ export { totpCodeSchema, recoveryCodeSchema, mfaProofSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaFactorStatusResponseSchema, mfaEnrolledFactorSchema, mfaCodeOnlyBodySchema, mfaTotpProofBodySchema, mfaChallengeFactorsPayloadSchema, type MfaProof, type MfaVerifyBody, type MfaEnrollResponse, type MfaVerifyEnrollmentBody, type MfaVerifyEnrollmentResponse, type MfaStatusResponse, type MfaFactorStatusResponse, type MfaEnrolledFactor, type MfaCodeOnlyBody, type MfaTotpProofBody, type MfaChallengeFactorsPayload, } from "./mfa-verify-body";
4
+ export { webauthnRegistrationResponseSchema, webauthnAuthenticationResponseSchema, webauthnLabelSchema, webauthnEnrollOptionsResponseSchema, webauthnVerifyEnrollmentBodySchema, webauthnAuthenticationOptionsResponseSchema, webauthnCredentialSummarySchema, webauthnCredentialListResponseSchema, type WebauthnRegistrationResponse, type WebauthnAuthenticationResponse, type WebauthnEnrollOptionsResponse, type WebauthnVerifyEnrollmentBody, type WebauthnAuthenticationOptionsResponse, type WebauthnCredentialSummary, type WebauthnCredentialListResponse, } from "./webauthn";
package/dist/mfa/index.js CHANGED
@@ -1,4 +1,5 @@
1
1
  export { mfaFactorTypes, mfaFactorTypeSchema, isValidMfaFactorType, } from "./mfa-factor-type";
2
2
  export { mfaChallengeSchema, } from "./mfa-challenge";
3
- export { totpCodeSchema, recoveryCodeSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaCodeOnlyBodySchema, } from "./mfa-verify-body";
3
+ export { totpCodeSchema, recoveryCodeSchema, mfaProofSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaFactorStatusResponseSchema, mfaEnrolledFactorSchema, mfaCodeOnlyBodySchema, mfaTotpProofBodySchema, mfaChallengeFactorsPayloadSchema, } from "./mfa-verify-body";
4
+ export { webauthnRegistrationResponseSchema, webauthnAuthenticationResponseSchema, webauthnLabelSchema, webauthnEnrollOptionsResponseSchema, webauthnVerifyEnrollmentBodySchema, webauthnAuthenticationOptionsResponseSchema, webauthnCredentialSummarySchema, webauthnCredentialListResponseSchema, } from "./webauthn";
4
5
  //# sourceMappingURL=index.js.map
package/dist/mfa/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mfa/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,GAEnB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,uBAAuB,EACvB,qBAAqB,GAOtB,MAAM,mBAAmB,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mfa/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,GAEnB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,uBAAuB,EACvB,6BAA6B,EAC7B,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,GAYjC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kCAAkC,EAClC,oCAAoC,EACpC,mBAAmB,EACnB,mCAAmC,EACnC,kCAAkC,EAClC,2CAA2C,EAC3C,+BAA+B,EAC/B,oCAAoC,GAQrC,MAAM,YAAY,CAAC"}
package/dist/mfa/mfa-factor-type.d.ts CHANGED
@@ -1,5 +1,5 @@
1
1
  import { z } from "zod";
2
- export declare const mfaFactorTypes: readonly ["totp"];
3
- export declare const mfaFactorTypeSchema: z.ZodEnum<["totp"]>;
2
+ export declare const mfaFactorTypes: readonly ["totp", "webauthn"];
3
+ export declare const mfaFactorTypeSchema: z.ZodEnum<["totp", "webauthn"]>;
4
4
  export type MfaFactorType = z.infer<typeof mfaFactorTypeSchema>;
5
5
  export declare function isValidMfaFactorType(value: unknown): value is MfaFactorType;
package/dist/mfa/mfa-factor-type.js CHANGED
@@ -1,5 +1,5 @@
1
1
  import { z } from "zod";
2
- export const mfaFactorTypes = ["totp"];
2
+ export const mfaFactorTypes = ["totp", "webauthn"];
3
3
  export const mfaFactorTypeSchema = z.enum(mfaFactorTypes);
4
4
  export function isValidMfaFactorType(value) {
5
5
  return mfaFactorTypeSchema.safeParse(value).success;
package/dist/mfa/mfa-factor-type.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"mfa-factor-type.js","sourceRoot":"","sources":["../../src/mfa/mfa-factor-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAM,CAAU,CAAC;AAEhD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAI1D,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtD,CAAC"}
1
+ {"version":3,"file":"mfa-factor-type.js","sourceRoot":"","sources":["../../src/mfa/mfa-factor-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,UAAU,CAAU,CAAC;AAE5D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAI1D,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtD,CAAC"}
package/dist/mfa/mfa-verify-body.d.ts CHANGED
@@ -1,18 +1,154 @@
1
1
  import { z } from "zod";
2
2
  export declare const totpCodeSchema: z.ZodString;
3
3
  export declare const recoveryCodeSchema: z.ZodString;
4
+ export declare const mfaProofSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
5
+ type: z.ZodLiteral<"totp">;
6
+ factor_id: z.ZodString;
7
+ code: z.ZodString;
8
+ }, "strict", z.ZodTypeAny, {
9
+ code: string;
10
+ type: "totp";
11
+ factor_id: string;
12
+ }, {
13
+ code: string;
14
+ type: "totp";
15
+ factor_id: string;
16
+ }>, z.ZodObject<{
17
+ type: z.ZodLiteral<"webauthn">;
18
+ factor_id: z.ZodString;
19
+ assertion: z.ZodObject<{
20
+ id: z.ZodString;
21
+ rawId: z.ZodString;
22
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
23
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
24
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
25
+ type: z.ZodString;
26
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
27
+ id: z.ZodString;
28
+ rawId: z.ZodString;
29
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
30
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
31
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
32
+ type: z.ZodString;
33
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
34
+ id: z.ZodString;
35
+ rawId: z.ZodString;
36
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
37
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
38
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
39
+ type: z.ZodString;
40
+ }, z.ZodTypeAny, "passthrough">>;
41
+ }, "strict", z.ZodTypeAny, {
42
+ type: "webauthn";
43
+ factor_id: string;
44
+ assertion: {
45
+ type: string;
46
+ id: string;
47
+ rawId: string;
48
+ response: {} & {
49
+ [k: string]: unknown;
50
+ };
51
+ authenticatorAttachment?: string | undefined;
52
+ clientExtensionResults?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
53
+ } & {
54
+ [k: string]: unknown;
55
+ };
56
+ }, {
57
+ type: "webauthn";
58
+ factor_id: string;
59
+ assertion: {
60
+ type: string;
61
+ id: string;
62
+ rawId: string;
63
+ response: {} & {
64
+ [k: string]: unknown;
65
+ };
66
+ authenticatorAttachment?: string | undefined;
67
+ clientExtensionResults?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
68
+ } & {
69
+ [k: string]: unknown;
70
+ };
71
+ }>, z.ZodObject<{
72
+ type: z.ZodLiteral<"recovery_code">;
73
+ recovery_code: z.ZodString;
74
+ }, "strict", z.ZodTypeAny, {
75
+ type: "recovery_code";
76
+ recovery_code: string;
77
+ }, {
78
+ type: "recovery_code";
79
+ recovery_code: string;
80
+ }>]>;
81
+ export type MfaProof = z.infer<typeof mfaProofSchema>;
4
82
  export declare const mfaVerifyBodySchema: z.ZodObject<{
5
83
  challenge_id: z.ZodString;
6
84
  client_app_id: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
7
85
  proof: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
8
86
  type: z.ZodLiteral<"totp">;
87
+ factor_id: z.ZodString;
9
88
  code: z.ZodString;
10
89
  }, "strict", z.ZodTypeAny, {
11
90
  code: string;
12
91
  type: "totp";
92
+ factor_id: string;
13
93
  }, {
14
94
  code: string;
15
95
  type: "totp";
96
+ factor_id: string;
97
+ }>, z.ZodObject<{
98
+ type: z.ZodLiteral<"webauthn">;
99
+ factor_id: z.ZodString;
100
+ assertion: z.ZodObject<{
101
+ id: z.ZodString;
102
+ rawId: z.ZodString;
103
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
104
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
105
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
106
+ type: z.ZodString;
107
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
108
+ id: z.ZodString;
109
+ rawId: z.ZodString;
110
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
111
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
112
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
113
+ type: z.ZodString;
114
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
115
+ id: z.ZodString;
116
+ rawId: z.ZodString;
117
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
118
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
119
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
120
+ type: z.ZodString;
121
+ }, z.ZodTypeAny, "passthrough">>;
122
+ }, "strict", z.ZodTypeAny, {
123
+ type: "webauthn";
124
+ factor_id: string;
125
+ assertion: {
126
+ type: string;
127
+ id: string;
128
+ rawId: string;
129
+ response: {} & {
130
+ [k: string]: unknown;
131
+ };
132
+ authenticatorAttachment?: string | undefined;
133
+ clientExtensionResults?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
134
+ } & {
135
+ [k: string]: unknown;
136
+ };
137
+ }, {
138
+ type: "webauthn";
139
+ factor_id: string;
140
+ assertion: {
141
+ type: string;
142
+ id: string;
143
+ rawId: string;
144
+ response: {} & {
145
+ [k: string]: unknown;
146
+ };
147
+ authenticatorAttachment?: string | undefined;
148
+ clientExtensionResults?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
149
+ } & {
150
+ [k: string]: unknown;
151
+ };
16
152
  }>, z.ZodObject<{
17
153
  type: z.ZodLiteral<"recovery_code">;
18
154
  recovery_code: z.ZodString;
@@ -29,6 +165,22 @@ export declare const mfaVerifyBodySchema: z.ZodObject<{
29
165
  proof: {
30
166
  code: string;
31
167
  type: "totp";
168
+ factor_id: string;
169
+ } | {
170
+ type: "webauthn";
171
+ factor_id: string;
172
+ assertion: {
173
+ type: string;
174
+ id: string;
175
+ rawId: string;
176
+ response: {} & {
177
+ [k: string]: unknown;
178
+ };
179
+ authenticatorAttachment?: string | undefined;
180
+ clientExtensionResults?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
181
+ } & {
182
+ [k: string]: unknown;
183
+ };
32
184
  } | {
33
185
  type: "recovery_code";
34
186
  recovery_code: string;
@@ -39,6 +191,22 @@ export declare const mfaVerifyBodySchema: z.ZodObject<{
39
191
  proof: {
40
192
  code: string;
41
193
  type: "totp";
194
+ factor_id: string;
195
+ } | {
196
+ type: "webauthn";
197
+ factor_id: string;
198
+ assertion: {
199
+ type: string;
200
+ id: string;
201
+ rawId: string;
202
+ response: {} & {
203
+ [k: string]: unknown;
204
+ };
205
+ authenticatorAttachment?: string | undefined;
206
+ clientExtensionResults?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
207
+ } & {
208
+ [k: string]: unknown;
209
+ };
42
210
  } | {
43
211
  type: "recovery_code";
44
212
  recovery_code: string;
@@ -79,32 +247,83 @@ export type MfaVerifyEnrollmentBody = z.infer<typeof mfaVerifyEnrollmentBodySche
79
247
  export declare const mfaVerifyEnrollmentResponseSchema: z.ZodObject<{
80
248
  success: z.ZodLiteral<true>;
81
249
  recovery_codes: z.ZodArray<z.ZodString, "many">;
250
+ recovery_codes_issued: z.ZodBoolean;
82
251
  }, "strict", z.ZodTypeAny, {
83
252
  success: true;
84
253
  recovery_codes: string[];
254
+ recovery_codes_issued: boolean;
85
255
  }, {
86
256
  success: true;
87
257
  recovery_codes: string[];
258
+ recovery_codes_issued: boolean;
88
259
  }>;
89
260
  export type MfaVerifyEnrollmentResponse = z.infer<typeof mfaVerifyEnrollmentResponseSchema>;
90
- export declare const mfaStatusResponseSchema: z.ZodObject<{
261
+ export declare const mfaFactorStatusResponseSchema: z.ZodObject<{
91
262
  enabled: z.ZodBoolean;
263
+ pending: z.ZodBoolean;
92
264
  factor_id: z.ZodOptional<z.ZodString>;
93
- factor_type: z.ZodOptional<z.ZodLiteral<"totp">>;
265
+ factor_type: z.ZodOptional<z.ZodEnum<["totp", "webauthn"]>>;
94
266
  verified_at: z.ZodOptional<z.ZodNumber>;
95
- recovery_codes_remaining: z.ZodOptional<z.ZodNumber>;
96
267
  }, "strict", z.ZodTypeAny, {
97
268
  enabled: boolean;
269
+ pending: boolean;
98
270
  factor_id?: string | undefined;
99
- factor_type?: "totp" | undefined;
271
+ factor_type?: "totp" | "webauthn" | undefined;
100
272
  verified_at?: number | undefined;
101
- recovery_codes_remaining?: number | undefined;
102
273
  }, {
103
274
  enabled: boolean;
275
+ pending: boolean;
104
276
  factor_id?: string | undefined;
105
- factor_type?: "totp" | undefined;
277
+ factor_type?: "totp" | "webauthn" | undefined;
106
278
  verified_at?: number | undefined;
107
- recovery_codes_remaining?: number | undefined;
279
+ }>;
280
+ export type MfaFactorStatusResponse = z.infer<typeof mfaFactorStatusResponseSchema>;
281
+ export declare const mfaEnrolledFactorSchema: z.ZodObject<{
282
+ factor_id: z.ZodString;
283
+ factor_type: z.ZodEnum<["totp", "webauthn"]>;
284
+ verified_at: z.ZodOptional<z.ZodNumber>;
285
+ }, "strict", z.ZodTypeAny, {
286
+ factor_id: string;
287
+ factor_type: "totp" | "webauthn";
288
+ verified_at?: number | undefined;
289
+ }, {
290
+ factor_id: string;
291
+ factor_type: "totp" | "webauthn";
292
+ verified_at?: number | undefined;
293
+ }>;
294
+ export type MfaEnrolledFactor = z.infer<typeof mfaEnrolledFactorSchema>;
295
+ export declare const mfaStatusResponseSchema: z.ZodObject<{
296
+ enabled: z.ZodBoolean;
297
+ factors: z.ZodArray<z.ZodObject<{
298
+ factor_id: z.ZodString;
299
+ factor_type: z.ZodEnum<["totp", "webauthn"]>;
300
+ verified_at: z.ZodOptional<z.ZodNumber>;
301
+ }, "strict", z.ZodTypeAny, {
302
+ factor_id: string;
303
+ factor_type: "totp" | "webauthn";
304
+ verified_at?: number | undefined;
305
+ }, {
306
+ factor_id: string;
307
+ factor_type: "totp" | "webauthn";
308
+ verified_at?: number | undefined;
309
+ }>, "many">;
310
+ recovery_codes_remaining: z.ZodNumber;
311
+ }, "strict", z.ZodTypeAny, {
312
+ enabled: boolean;
313
+ factors: {
314
+ factor_id: string;
315
+ factor_type: "totp" | "webauthn";
316
+ verified_at?: number | undefined;
317
+ }[];
318
+ recovery_codes_remaining: number;
319
+ }, {
320
+ enabled: boolean;
321
+ factors: {
322
+ factor_id: string;
323
+ factor_type: "totp" | "webauthn";
324
+ verified_at?: number | undefined;
325
+ }[];
326
+ recovery_codes_remaining: number;
108
327
  }>;
109
328
  export type MfaStatusResponse = z.infer<typeof mfaStatusResponseSchema>;
110
329
  export declare const mfaCodeOnlyBodySchema: z.ZodObject<{
@@ -115,3 +334,45 @@ export declare const mfaCodeOnlyBodySchema: z.ZodObject<{
115
334
  code: string;
116
335
  }>;
117
336
  export type MfaCodeOnlyBody = z.infer<typeof mfaCodeOnlyBodySchema>;
337
+ export declare const mfaTotpProofBodySchema: z.ZodObject<{
338
+ factor_id: z.ZodString;
339
+ code: z.ZodString;
340
+ }, "strict", z.ZodTypeAny, {
341
+ code: string;
342
+ factor_id: string;
343
+ }, {
344
+ code: string;
345
+ factor_id: string;
346
+ }>;
347
+ export type MfaTotpProofBody = z.infer<typeof mfaTotpProofBodySchema>;
348
+ export declare const mfaChallengeFactorsPayloadSchema: z.ZodObject<{
349
+ available_factors: z.ZodArray<z.ZodObject<{
350
+ factor_id: z.ZodString;
351
+ factor_type: z.ZodEnum<["totp", "webauthn"]>;
352
+ last_used_at: z.ZodNullable<z.ZodNumber>;
353
+ }, "strict", z.ZodTypeAny, {
354
+ factor_id: string;
355
+ factor_type: "totp" | "webauthn";
356
+ last_used_at: number | null;
357
+ }, {
358
+ factor_id: string;
359
+ factor_type: "totp" | "webauthn";
360
+ last_used_at: number | null;
361
+ }>, "many">;
362
+ recovery_codes_available: z.ZodBoolean;
363
+ }, "strict", z.ZodTypeAny, {
364
+ available_factors: {
365
+ factor_id: string;
366
+ factor_type: "totp" | "webauthn";
367
+ last_used_at: number | null;
368
+ }[];
369
+ recovery_codes_available: boolean;
370
+ }, {
371
+ available_factors: {
372
+ factor_id: string;
373
+ factor_type: "totp" | "webauthn";
374
+ last_used_at: number | null;
375
+ }[];
376
+ recovery_codes_available: boolean;
377
+ }>;
378
+ export type MfaChallengeFactorsPayload = z.infer<typeof mfaChallengeFactorsPayloadSchema>;
package/dist/mfa/mfa-verify-body.js CHANGED
@@ -1,5 +1,8 @@
1
1
  import { z } from "zod";
2
2
  import { appIdSchema } from "@schemavaults/app-definitions";
3
+ import { availableMfaFactorSchema } from "../authenticate_result";
4
+ import { mfaFactorTypeSchema } from "./mfa-factor-type";
5
+ import { webauthnAuthenticationResponseSchema } from "./webauthn";
3
6
  export const totpCodeSchema = z
4
7
  .string()
5
8
  .regex(/^\d{6}$/u, "TOTP code must be exactly 6 digits");
@@ -7,16 +10,35 @@ export const recoveryCodeSchema = z
7
10
  .string()
8
11
  .min(8)
9
12
  .max(64);
13
+ // The proof a user presents to satisfy an MFA gate. Shared between the
14
+ // login second-factor exchange (POST /api/auth/mfa/verify) and step-up
15
+ // authorization for destructive account actions (e.g. removing a passkey).
16
+ // `totp`/`recovery_code` mirror the original v1 factors; `webauthn` carries
17
+ // a passkey assertion bound to a server-issued challenge.
18
+ export const mfaProofSchema = z.discriminatedUnion("type", [
19
+ z
20
+ .object({
21
+ type: z.literal("totp"),
22
+ factor_id: z.string().uuid(),
23
+ code: totpCodeSchema,
24
+ })
25
+ .strict(),
26
+ z
27
+ .object({
28
+ type: z.literal("webauthn"),
29
+ factor_id: z.string().uuid(),
30
+ assertion: webauthnAuthenticationResponseSchema,
31
+ })
32
+ .strict(),
33
+ z
34
+ .object({ type: z.literal("recovery_code"), recovery_code: recoveryCodeSchema })
35
+ .strict(),
36
+ ]);
10
37
  export const mfaVerifyBodySchema = z
11
38
  .object({
12
39
  challenge_id: z.string().uuid(),
13
40
  client_app_id: appIdSchema,
14
- proof: z.discriminatedUnion("type", [
15
- z.object({ type: z.literal("totp"), code: totpCodeSchema }).strict(),
16
- z
17
- .object({ type: z.literal("recovery_code"), recovery_code: recoveryCodeSchema })
18
- .strict(),
19
- ]),
41
+ proof: mfaProofSchema,
20
42
  })
21
43
  .strict();
22
44
  export const mfaEnrollResponseSchema = z
@@ -34,19 +56,54 @@ export const mfaVerifyEnrollmentBodySchema = z
34
56
  code: totpCodeSchema,
35
57
  })
36
58
  .strict();
59
+ // Returned by both the TOTP and WebAuthn verify-enrollment endpoints after
60
+ // a factor is confirmed. Recovery codes are an account-wide fallback issued
61
+ // only when the user gains their *first* verified factor — enrolling a
62
+ // second factor (e.g. a passkey on top of existing TOTP) must NOT rotate
63
+ // the codes the user already saved. `recovery_codes_issued` tells the
64
+ // client whether `recovery_codes` carries freshly minted codes to display
65
+ // (true) or whether the existing codes still apply and the array is empty
66
+ // (false).
37
67
  export const mfaVerifyEnrollmentResponseSchema = z
38
68
  .object({
39
69
  success: z.literal(true),
40
- recovery_codes: z.array(recoveryCodeSchema).min(1),
70
+ recovery_codes: z.array(recoveryCodeSchema),
71
+ recovery_codes_issued: z.boolean(),
41
72
  })
42
73
  .strict();
43
- export const mfaStatusResponseSchema = z
74
+ // Status of a single MFA factor type — returned by
75
+ // GET /api/user/mfa/status/[factor_type]. `enabled` means a verified,
76
+ // active factor of that type exists; `pending` means an enrollment is in
77
+ // progress (an unverified factor exists but hasn't been confirmed yet).
78
+ // The two are mutually exclusive. When neither is set the user has no
79
+ // factor of that type. `factor_id`/`factor_type` are present whenever a
80
+ // factor row exists (verified or pending); `verified_at` only when enabled.
81
+ export const mfaFactorStatusResponseSchema = z
44
82
  .object({
45
83
  enabled: z.boolean(),
84
+ pending: z.boolean(),
46
85
  factor_id: z.string().uuid().optional(),
47
- factor_type: z.literal("totp").optional(),
86
+ factor_type: mfaFactorTypeSchema.optional(),
87
+ verified_at: z.number().int().positive().optional(),
88
+ })
89
+ .strict();
90
+ // A single verified factor in the account-wide MFA status list.
91
+ export const mfaEnrolledFactorSchema = z
92
+ .object({
93
+ factor_id: z.string().uuid(),
94
+ factor_type: mfaFactorTypeSchema,
48
95
  verified_at: z.number().int().positive().optional(),
49
- recovery_codes_remaining: z.number().int().nonnegative().optional(),
96
+ })
97
+ .strict();
98
+ // Account-wide MFA status — returned by GET /api/user/mfa/status. Lists
99
+ // every verified factor rather than collapsing to a single one, plus the
100
+ // account-wide recovery-code count. `enabled` is a convenience mirror of
101
+ // `factors.length > 0`.
102
+ export const mfaStatusResponseSchema = z
103
+ .object({
104
+ enabled: z.boolean(),
105
+ factors: z.array(mfaEnrolledFactorSchema),
106
+ recovery_codes_remaining: z.number().int().nonnegative(),
50
107
  })
51
108
  .strict();
52
109
  export const mfaCodeOnlyBodySchema = z
@@ -54,4 +111,25 @@ export const mfaCodeOnlyBodySchema = z
54
111
  code: totpCodeSchema,
55
112
  })
56
113
  .strict();
114
+ // Authorize an action with a TOTP code from a specific factor. The caller
115
+ // names which factor the code belongs to so the server verifies against
116
+ // exactly that factor (one targeted lookup) instead of trying every
117
+ // enrolled factor's secret in turn.
118
+ export const mfaTotpProofBodySchema = z
119
+ .object({
120
+ factor_id: z.string().uuid(),
121
+ code: totpCodeSchema,
122
+ })
123
+ .strict();
124
+ // Shape of the MFA challenge factor list that the login form stashes in
125
+ // sessionStorage (keyed by challenge_id) so the downstream MFA challenge
126
+ // page can render the factor picker without a second server round-trip.
127
+ // Mirrors the `available_factors` + `recovery_codes_available` fields the
128
+ // server already includes in the `mfa_required` login response.
129
+ export const mfaChallengeFactorsPayloadSchema = z
130
+ .object({
131
+ available_factors: z.array(availableMfaFactorSchema),
132
+ recovery_codes_available: z.boolean(),
133
+ })
134
+ .strict();
57
135
  //# sourceMappingURL=mfa-verify-body.js.map
package/dist/mfa/mfa-verify-body.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"mfa-verify-body.js","sourceRoot":"","sources":["../../src/mfa/mfa-verify-body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,KAAK,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,aAAa,EAAE,WAAW;IAC1B,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAClC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;QACpE,CAAC;aACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC;aAC/E,MAAM,EAAE;KACZ,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACnD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IACzC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACpE,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC"}
1
+ {"version":3,"file":"mfa-verify-body.js","sourceRoot":"","sources":["../../src/mfa/mfa-verify-body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,KAAK,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC,CAAC;AAEX,uEAAuE;AACvE,uEAAuE;AACvE,2EAA2E;AAC3E,4EAA4E;AAC5E,0DAA0D;AAC1D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACzD,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QAC5B,IAAI,EAAE,cAAc;KACrB,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QAC5B,SAAS,EAAE,oCAAoC;KAChD,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC;SAC/E,MAAM,EAAE;CACZ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,aAAa,EAAE,WAAW;IAC1B,KAAK,EAAE,cAAc;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,2EAA2E;AAC3E,4EAA4E;AAC5E,uEAAuE;AACvE,yEAAyE;AACzE,sEAAsE;AACtE,0EAA0E;AAC1E,0EAA0E;AAC1E,WAAW;AACX,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAC3C,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,mDAAmD;AACnD,sEAAsE;AACtE,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,4EAA4E;AAC5E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,gEAAgE;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,mBAAmB;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,wBAAwB;AACxB,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACzC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACzD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,0EAA0E;AAC1E,wEAAwE;AACxE,oEAAoE;AACpE,oCAAoC;AACpC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,gEAAgE;AAChE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC9C,MAAM,CAAC;IACN,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACpD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;CACtC,CAAC;KACD,MAAM,EAAE,CAAC"}
package/dist/mfa/webauthn.d.ts ADDED
@@ -0,0 +1,182 @@
1
+ import { z } from "zod";
2
+ export declare const webauthnRegistrationResponseSchema: z.ZodObject<{
3
+ id: z.ZodString;
4
+ rawId: z.ZodString;
5
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
6
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
7
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
8
+ type: z.ZodString;
9
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10
+ id: z.ZodString;
11
+ rawId: z.ZodString;
12
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
13
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
14
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
15
+ type: z.ZodString;
16
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
17
+ id: z.ZodString;
18
+ rawId: z.ZodString;
19
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
20
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
21
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
22
+ type: z.ZodString;
23
+ }, z.ZodTypeAny, "passthrough">>;
24
+ export type WebauthnRegistrationResponse = z.infer<typeof webauthnRegistrationResponseSchema>;
25
+ export declare const webauthnAuthenticationResponseSchema: z.ZodObject<{
26
+ id: z.ZodString;
27
+ rawId: z.ZodString;
28
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
29
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
30
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
31
+ type: z.ZodString;
32
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
33
+ id: z.ZodString;
34
+ rawId: z.ZodString;
35
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
36
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
37
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
38
+ type: z.ZodString;
39
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
40
+ id: z.ZodString;
41
+ rawId: z.ZodString;
42
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
43
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
44
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
45
+ type: z.ZodString;
46
+ }, z.ZodTypeAny, "passthrough">>;
47
+ export type WebauthnAuthenticationResponse = z.infer<typeof webauthnAuthenticationResponseSchema>;
48
+ export declare const webauthnLabelSchema: z.ZodString;
49
+ export declare const webauthnEnrollOptionsResponseSchema: z.ZodObject<{
50
+ factor_id: z.ZodString;
51
+ options: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
52
+ }, "strict", z.ZodTypeAny, {
53
+ options: {} & {
54
+ [k: string]: unknown;
55
+ };
56
+ factor_id: string;
57
+ }, {
58
+ options: {} & {
59
+ [k: string]: unknown;
60
+ };
61
+ factor_id: string;
62
+ }>;
63
+ export type WebauthnEnrollOptionsResponse = z.infer<typeof webauthnEnrollOptionsResponseSchema>;
64
+ export declare const webauthnVerifyEnrollmentBodySchema: z.ZodObject<{
65
+ factor_id: z.ZodString;
66
+ label: z.ZodOptional<z.ZodString>;
67
+ attestation: z.ZodObject<{
68
+ id: z.ZodString;
69
+ rawId: z.ZodString;
70
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
71
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
72
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
73
+ type: z.ZodString;
74
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
75
+ id: z.ZodString;
76
+ rawId: z.ZodString;
77
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
78
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
79
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
80
+ type: z.ZodString;
81
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
82
+ id: z.ZodString;
83
+ rawId: z.ZodString;
84
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
85
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
86
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
87
+ type: z.ZodString;
88
+ }, z.ZodTypeAny, "passthrough">>;
89
+ }, "strict", z.ZodTypeAny, {
90
+ factor_id: string;
91
+ attestation: {
92
+ type: string;
93
+ id: string;
94
+ rawId: string;
95
+ response: {} & {
96
+ [k: string]: unknown;
97
+ };
98
+ authenticatorAttachment?: string | undefined;
99
+ clientExtensionResults?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
100
+ } & {
101
+ [k: string]: unknown;
102
+ };
103
+ label?: string | undefined;
104
+ }, {
105
+ factor_id: string;
106
+ attestation: {
107
+ type: string;
108
+ id: string;
109
+ rawId: string;
110
+ response: {} & {
111
+ [k: string]: unknown;
112
+ };
113
+ authenticatorAttachment?: string | undefined;
114
+ clientExtensionResults?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
115
+ } & {
116
+ [k: string]: unknown;
117
+ };
118
+ label?: string | undefined;
119
+ }>;
120
+ export type WebauthnVerifyEnrollmentBody = z.infer<typeof webauthnVerifyEnrollmentBodySchema>;
121
+ export declare const webauthnAuthenticationOptionsResponseSchema: z.ZodObject<{
122
+ options: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
123
+ }, "strict", z.ZodTypeAny, {
124
+ options: {} & {
125
+ [k: string]: unknown;
126
+ };
127
+ }, {
128
+ options: {} & {
129
+ [k: string]: unknown;
130
+ };
131
+ }>;
132
+ export type WebauthnAuthenticationOptionsResponse = z.infer<typeof webauthnAuthenticationOptionsResponseSchema>;
133
+ export declare const webauthnCredentialSummarySchema: z.ZodObject<{
134
+ factor_id: z.ZodString;
135
+ label: z.ZodNullable<z.ZodString>;
136
+ created_at: z.ZodNumber;
137
+ last_used_at: z.ZodNullable<z.ZodNumber>;
138
+ }, "strict", z.ZodTypeAny, {
139
+ factor_id: string;
140
+ last_used_at: number | null;
141
+ created_at: number;
142
+ label: string | null;
143
+ }, {
144
+ factor_id: string;
145
+ last_used_at: number | null;
146
+ created_at: number;
147
+ label: string | null;
148
+ }>;
149
+ export type WebauthnCredentialSummary = z.infer<typeof webauthnCredentialSummarySchema>;
150
+ export declare const webauthnCredentialListResponseSchema: z.ZodObject<{
151
+ credentials: z.ZodArray<z.ZodObject<{
152
+ factor_id: z.ZodString;
153
+ label: z.ZodNullable<z.ZodString>;
154
+ created_at: z.ZodNumber;
155
+ last_used_at: z.ZodNullable<z.ZodNumber>;
156
+ }, "strict", z.ZodTypeAny, {
157
+ factor_id: string;
158
+ last_used_at: number | null;
159
+ created_at: number;
160
+ label: string | null;
161
+ }, {
162
+ factor_id: string;
163
+ last_used_at: number | null;
164
+ created_at: number;
165
+ label: string | null;
166
+ }>, "many">;
167
+ }, "strict", z.ZodTypeAny, {
168
+ credentials: {
169
+ factor_id: string;
170
+ last_used_at: number | null;
171
+ created_at: number;
172
+ label: string | null;
173
+ }[];
174
+ }, {
175
+ credentials: {
176
+ factor_id: string;
177
+ last_used_at: number | null;
178
+ created_at: number;
179
+ label: string | null;
180
+ }[];
181
+ }>;
182
+ export type WebauthnCredentialListResponse = z.infer<typeof webauthnCredentialListResponseSchema>;
package/dist/mfa/webauthn.js ADDED
@@ -0,0 +1,81 @@
1
+ import { z } from "zod";
2
+ // WebAuthn ceremony payloads exchanged between the browser and the auth
3
+ // server. The browser uses @simplewebauthn/browser to produce these and
4
+ // the server uses @simplewebauthn/server to verify them; the heavy lifting
5
+ // (signature checks, challenge binding, RP-ID/origin validation) lives in
6
+ // those libraries. These schemas therefore only assert that the payloads
7
+ // are structurally well-formed JSON of the expected shape — verification is
8
+ // delegated, not duplicated here. `.passthrough()` keeps forward-compat with
9
+ // fields newer @simplewebauthn versions may add.
10
+ // Mirrors @simplewebauthn/browser's RegistrationResponseJSON.
11
+ export const webauthnRegistrationResponseSchema = z
12
+ .object({
13
+ id: z.string().min(1),
14
+ rawId: z.string().min(1),
15
+ response: z.object({}).passthrough(),
16
+ authenticatorAttachment: z.string().optional(),
17
+ clientExtensionResults: z.object({}).passthrough().optional(),
18
+ type: z.string().min(1),
19
+ })
20
+ .passthrough();
21
+ // Mirrors @simplewebauthn/browser's AuthenticationResponseJSON.
22
+ export const webauthnAuthenticationResponseSchema = z
23
+ .object({
24
+ id: z.string().min(1),
25
+ rawId: z.string().min(1),
26
+ response: z.object({}).passthrough(),
27
+ authenticatorAttachment: z.string().optional(),
28
+ clientExtensionResults: z.object({}).passthrough().optional(),
29
+ type: z.string().min(1),
30
+ })
31
+ .passthrough();
32
+ // Optional human-friendly label a user may give a passkey ("MacBook
33
+ // Touch ID", "YubiKey 5C"). Kept short and trimmed.
34
+ export const webauthnLabelSchema = z
35
+ .string()
36
+ .trim()
37
+ .min(1)
38
+ .max(64);
39
+ // Response from POST /api/user/mfa/webauthn/options — the server-issued
40
+ // PublicKeyCredentialCreationOptionsJSON plus the pending factor_id the
41
+ // enrollment will be confirmed against.
42
+ export const webauthnEnrollOptionsResponseSchema = z
43
+ .object({
44
+ factor_id: z.string().uuid(),
45
+ // PublicKeyCredentialCreationOptionsJSON — opaque to us, handed to the
46
+ // browser verbatim.
47
+ options: z.object({}).passthrough(),
48
+ })
49
+ .strict();
50
+ // Body for POST /api/user/mfa/webauthn/verify-enrollment.
51
+ export const webauthnVerifyEnrollmentBodySchema = z
52
+ .object({
53
+ factor_id: z.string().uuid(),
54
+ label: webauthnLabelSchema.optional(),
55
+ attestation: webauthnRegistrationResponseSchema,
56
+ })
57
+ .strict();
58
+ // Response from POST /api/auth/mfa/webauthn/options — the server-issued
59
+ // PublicKeyCredentialRequestOptionsJSON for an in-flight login challenge.
60
+ export const webauthnAuthenticationOptionsResponseSchema = z
61
+ .object({
62
+ // PublicKeyCredentialRequestOptionsJSON — opaque to us.
63
+ options: z.object({}).passthrough(),
64
+ })
65
+ .strict();
66
+ // A single enrolled passkey as surfaced to the account settings UI.
67
+ export const webauthnCredentialSummarySchema = z
68
+ .object({
69
+ factor_id: z.string().uuid(),
70
+ label: z.string().nullable(),
71
+ created_at: z.number().int().positive(),
72
+ last_used_at: z.number().int().positive().nullable(),
73
+ })
74
+ .strict();
75
+ // Response from GET /api/user/mfa/webauthn — the user's enrolled passkeys.
76
+ export const webauthnCredentialListResponseSchema = z
77
+ .object({
78
+ credentials: z.array(webauthnCredentialSummarySchema),
79
+ })
80
+ .strict();
81
+ //# sourceMappingURL=webauthn.js.map
package/dist/mfa/webauthn.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../src/mfa/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,wEAAwE;AACxE,wEAAwE;AACxE,2EAA2E;AAC3E,0EAA0E;AAC1E,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,iDAAiD;AAEjD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC;KAChD,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;IACpC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9C,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC7D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC;KACD,WAAW,EAAE,CAAC;AAMjB,gEAAgE;AAChE,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC;KAClD,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;IACpC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9C,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC7D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC;KACD,WAAW,EAAE,CAAC;AAMjB,oEAAoE;AACpE,oDAAoD;AACpD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC,CAAC;AAEX,wEAAwE;AACxE,wEAAwE;AACxE,wCAAwC;AACxC,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,uEAAuE;IACvE,oBAAoB;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,0DAA0D;AAC1D,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC;KAChD,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,KAAK,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,kCAAkC;CAChD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,wEAAwE;AACxE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC;KACzD,MAAM,CAAC;IACN,wDAAwD;IACxD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,oEAAoE;AACpE,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC7C,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC;KAClD,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC;CACtD,CAAC;KACD,MAAM,EAAE,CAAC"}
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@schemavaults/auth-common",
3
3
  "description": "Types and utility functions for authentication and authorization",
4
- "version": "0.12.10",
4
+ "version": "0.13.0",
5
5
  "license": "UNLICENSED",
6
6
  "private": false,
7
7
  "repository": {