@schemavaults/auth-common 0.12.15 → 0.13.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (19) hide show
  1. package/dist/authenticate_result.d.ts +14 -13
  2. package/dist/authenticate_result.js +29 -0
  3. package/dist/authenticate_result.js.map +1 -1
  4. package/dist/index.d.ts +1 -1
  5. package/dist/index.js +1 -1
  6. package/dist/index.js.map +1 -1
  7. package/dist/mfa/index.d.ts +2 -1
  8. package/dist/mfa/index.js +2 -1
  9. package/dist/mfa/index.js.map +1 -1
  10. package/dist/mfa/mfa-factor-type.d.ts +2 -2
  11. package/dist/mfa/mfa-factor-type.js +1 -1
  12. package/dist/mfa/mfa-factor-type.js.map +1 -1
  13. package/dist/mfa/mfa-verify-body.d.ts +182 -16
  14. package/dist/mfa/mfa-verify-body.js +36 -13
  15. package/dist/mfa/mfa-verify-body.js.map +1 -1
  16. package/dist/mfa/webauthn.d.ts +182 -0
  17. package/dist/mfa/webauthn.js +81 -0
  18. package/dist/mfa/webauthn.js.map +1 -0
  19. package/package.json +1 -1
package/dist/authenticate_result.d.ts CHANGED
@@ -1,18 +1,19 @@
1
1
  import { z } from "zod";
2
2
  export declare const availableMfaFactorSchema: z.ZodObject<{
3
3
  factor_id: z.ZodString;
4
- factor_type: z.ZodEnum<["totp"]>;
4
+ factor_type: z.ZodEnum<["totp", "webauthn"]>;
5
5
  last_used_at: z.ZodNullable<z.ZodNumber>;
6
6
  }, "strict", z.ZodTypeAny, {
7
7
  factor_id: string;
8
- factor_type: "totp";
8
+ factor_type: "totp" | "webauthn";
9
9
  last_used_at: number | null;
10
10
  }, {
11
11
  factor_id: string;
12
- factor_type: "totp";
12
+ factor_type: "totp" | "webauthn";
13
13
  last_used_at: number | null;
14
14
  }>;
15
15
  export type AvailableMfaFactor = z.infer<typeof availableMfaFactorSchema>;
16
+ export declare function collapseWebauthnFactors(factors: AvailableMfaFactor[]): AvailableMfaFactor[];
16
17
  export declare const authenticatedAuthenticateResultSchema: z.ZodObject<{
17
18
  kind: z.ZodLiteral<"authenticated">;
18
19
  success: z.ZodBoolean;
@@ -38,15 +39,15 @@ export declare const mfaRequiredAuthenticateResultSchema: z.ZodObject<{
38
39
  expires_at: z.ZodNumber;
39
40
  available_factors: z.ZodArray<z.ZodObject<{
40
41
  factor_id: z.ZodString;
41
- factor_type: z.ZodEnum<["totp"]>;
42
+ factor_type: z.ZodEnum<["totp", "webauthn"]>;
42
43
  last_used_at: z.ZodNullable<z.ZodNumber>;
43
44
  }, "strict", z.ZodTypeAny, {
44
45
  factor_id: string;
45
- factor_type: "totp";
46
+ factor_type: "totp" | "webauthn";
46
47
  last_used_at: number | null;
47
48
  }, {
48
49
  factor_id: string;
49
- factor_type: "totp";
50
+ factor_type: "totp" | "webauthn";
50
51
  last_used_at: number | null;
51
52
  }>, "many">;
52
53
  recovery_codes_available: z.ZodBoolean;
@@ -58,7 +59,7 @@ export declare const mfaRequiredAuthenticateResultSchema: z.ZodObject<{
58
59
  challenge_id: string;
59
60
  available_factors: {
60
61
  factor_id: string;
61
- factor_type: "totp";
62
+ factor_type: "totp" | "webauthn";
62
63
  last_used_at: number | null;
63
64
  }[];
64
65
  recovery_codes_available: boolean;
@@ -70,7 +71,7 @@ export declare const mfaRequiredAuthenticateResultSchema: z.ZodObject<{
70
71
  challenge_id: string;
71
72
  available_factors: {
72
73
  factor_id: string;
73
- factor_type: "totp";
74
+ factor_type: "totp" | "webauthn";
74
75
  last_used_at: number | null;
75
76
  }[];
76
77
  recovery_codes_available: boolean;
@@ -127,15 +128,15 @@ export declare const authenticateResultSchema: z.ZodDiscriminatedUnion<"kind", [
127
128
  expires_at: z.ZodNumber;
128
129
  available_factors: z.ZodArray<z.ZodObject<{
129
130
  factor_id: z.ZodString;
130
- factor_type: z.ZodEnum<["totp"]>;
131
+ factor_type: z.ZodEnum<["totp", "webauthn"]>;
131
132
  last_used_at: z.ZodNullable<z.ZodNumber>;
132
133
  }, "strict", z.ZodTypeAny, {
133
134
  factor_id: string;
134
- factor_type: "totp";
135
+ factor_type: "totp" | "webauthn";
135
136
  last_used_at: number | null;
136
137
  }, {
137
138
  factor_id: string;
138
- factor_type: "totp";
139
+ factor_type: "totp" | "webauthn";
139
140
  last_used_at: number | null;
140
141
  }>, "many">;
141
142
  recovery_codes_available: z.ZodBoolean;
@@ -147,7 +148,7 @@ export declare const authenticateResultSchema: z.ZodDiscriminatedUnion<"kind", [
147
148
  challenge_id: string;
148
149
  available_factors: {
149
150
  factor_id: string;
150
- factor_type: "totp";
151
+ factor_type: "totp" | "webauthn";
151
152
  last_used_at: number | null;
152
153
  }[];
153
154
  recovery_codes_available: boolean;
@@ -159,7 +160,7 @@ export declare const authenticateResultSchema: z.ZodDiscriminatedUnion<"kind", [
159
160
  challenge_id: string;
160
161
  available_factors: {
161
162
  factor_id: string;
162
- factor_type: "totp";
163
+ factor_type: "totp" | "webauthn";
163
164
  last_used_at: number | null;
164
165
  }[];
165
166
  recovery_codes_available: boolean;
package/dist/authenticate_result.js CHANGED
@@ -7,6 +7,35 @@ export const availableMfaFactorSchema = z
7
7
  last_used_at: z.number().int().positive().nullable(),
8
8
  })
9
9
  .strict();
10
+ // Collapse a user's verified factors for the login factor picker: every
11
+ // passkey folds into a single representative `webauthn` entry while all other
12
+ // factor types pass through unchanged.
13
+ //
14
+ // Why: at login the WebAuthn assertion lists *all* of a user's enrolled
15
+ // passkeys in `allowCredentials`, and the platform/browser sheet is what lets
16
+ // them pick between those passkeys — so rendering one picker row per passkey
17
+ // is redundant and undifferentiated (the same "Passkey / Security key" label
18
+ // repeated). For a webauthn proof the selected factor_id is advisory:
19
+ // evaluateMfaProof resolves the credential the authenticator actually signed
20
+ // with, so any enrolled passkey still verifies against the single row.
21
+ //
22
+ // Order is preserved and the *first* passkey encountered is kept as the
23
+ // representative. Callers pass a list already sorted last_used_at DESC NULLS
24
+ // LAST, so the survivor is the most-recently-used passkey — keeping the
25
+ // picker's "default to most-recently-used factor" behaviour intact.
26
+ export function collapseWebauthnFactors(factors) {
27
+ const collapsed = [];
28
+ let keptWebauthn = false;
29
+ for (const factor of factors) {
30
+ if (factor.factor_type === "webauthn") {
31
+ if (keptWebauthn)
32
+ continue;
33
+ keptWebauthn = true;
34
+ }
35
+ collapsed.push(factor);
36
+ }
37
+ return collapsed;
38
+ }
10
39
  export const authenticatedAuthenticateResultSchema = z
11
40
  .object({
12
41
  kind: z.literal("authenticated"),
package/dist/authenticate_result.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"authenticate_result.js","sourceRoot":"","sources":["../src/authenticate_result.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,mBAAmB;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,kBAAkB,EAAE,CAAC;SAClB,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,EAAE,wDAAwD,CAAC;CACrE,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACpD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;CACtC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC7C,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,uEAAuE;AACvE,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC;KACtD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACnE,qCAAqC;IACrC,mCAAmC;IACnC,+BAA+B;IAC/B,wCAAwC;CACzC,CAAC,CAAC"}
1
+ {"version":3,"file":"authenticate_result.js","sourceRoot":"","sources":["../src/authenticate_result.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,mBAAmB;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,wEAAwE;AACxE,8EAA8E;AAC9E,uCAAuC;AACvC,EAAE;AACF,wEAAwE;AACxE,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,sEAAsE;AACtE,6EAA6E;AAC7E,uEAAuE;AACvE,EAAE;AACF,wEAAwE;AACxE,6EAA6E;AAC7E,wEAAwE;AACxE,oEAAoE;AACpE,MAAM,UAAU,uBAAuB,CACrC,OAA6B;IAE7B,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACtC,IAAI,YAAY;gBAAE,SAAS;YAC3B,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,kBAAkB,EAAE,CAAC;SAClB,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,EAAE,wDAAwD,CAAC;CACrE,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACpD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;CACtC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC7C,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,uEAAuE;AACvE,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC;KACtD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACnE,qCAAqC;IACrC,mCAAmC;IACnC,+BAA+B;IAC/B,wCAAwC;CACzC,CAAC,CAAC"}
package/dist/index.d.ts CHANGED
@@ -10,7 +10,7 @@ export * from "./middleware";
10
10
  export type * from "./middleware";
11
11
  export * from "./pkce";
12
12
  export type * from "./pkce";
13
- export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, availableMfaFactorSchema, type AuthenticateResult, type AuthenticatedAuthenticateResult, type MfaRequiredAuthenticateResult, type AuthenticateFailureResult, type ChallengeExpiredAuthenticateResult, type AvailableMfaFactor, } from "./authenticate_result";
13
+ export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, availableMfaFactorSchema, collapseWebauthnFactors, type AuthenticateResult, type AuthenticatedAuthenticateResult, type MfaRequiredAuthenticateResult, type AuthenticateFailureResult, type ChallengeExpiredAuthenticateResult, type AvailableMfaFactor, } from "./authenticate_result";
14
14
  export * from "./mfa";
15
15
  export { requestTokensResultSchema, type RequestTokensResult, successfullyGeneratedTokensRecordSchema, type SuccessfullyGeneratedTokensRecord, } from "./request_tokens_result";
16
16
  export * from "./auth_acquire_tokens_grant_types";
package/dist/index.js CHANGED
@@ -5,7 +5,7 @@ export * from "./credentials";
5
5
  export * from "./token-data";
6
6
  export * from "./middleware";
7
7
  export * from "./pkce";
8
- export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, availableMfaFactorSchema, } from "./authenticate_result";
8
+ export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, availableMfaFactorSchema, collapseWebauthnFactors, } from "./authenticate_result";
9
9
  export * from "./mfa";
10
10
  export { requestTokensResultSchema, successfullyGeneratedTokensRecordSchema, } from "./request_tokens_result";
11
11
  export * from "./auth_acquire_tokens_grant_types";
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,EACxC,wBAAwB,GAOzB,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,yBAAyB,EAEzB,uCAAuC,GAExC,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,aAAa,EACb,4BAA4B,EAC5B,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,EACxC,wBAAwB,EACxB,uBAAuB,GAOxB,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,yBAAyB,EAEzB,uCAAuC,GAExC,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,aAAa,EACb,4BAA4B,EAC5B,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}
package/dist/mfa/index.d.ts CHANGED
@@ -1,3 +1,4 @@
1
1
  export { mfaFactorTypes, mfaFactorTypeSchema, isValidMfaFactorType, type MfaFactorType, } from "./mfa-factor-type";
2
2
  export { mfaChallengeSchema, type MfaChallengeDescriptor, } from "./mfa-challenge";
3
- export { totpCodeSchema, recoveryCodeSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaFactorStatusResponseSchema, mfaEnrolledFactorSchema, mfaCodeOnlyBodySchema, mfaTotpProofBodySchema, mfaChallengeFactorsPayloadSchema, type MfaVerifyBody, type MfaEnrollResponse, type MfaVerifyEnrollmentBody, type MfaVerifyEnrollmentResponse, type MfaStatusResponse, type MfaFactorStatusResponse, type MfaEnrolledFactor, type MfaCodeOnlyBody, type MfaTotpProofBody, type MfaChallengeFactorsPayload, } from "./mfa-verify-body";
3
+ export { totpCodeSchema, recoveryCodeSchema, mfaProofSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaFactorStatusResponseSchema, mfaEnrolledFactorSchema, mfaCodeOnlyBodySchema, mfaTotpProofBodySchema, mfaChallengeFactorsPayloadSchema, type MfaProof, type MfaVerifyBody, type MfaEnrollResponse, type MfaVerifyEnrollmentBody, type MfaVerifyEnrollmentResponse, type MfaStatusResponse, type MfaFactorStatusResponse, type MfaEnrolledFactor, type MfaCodeOnlyBody, type MfaTotpProofBody, type MfaChallengeFactorsPayload, } from "./mfa-verify-body";
4
+ export { webauthnRegistrationResponseSchema, webauthnAuthenticationResponseSchema, webauthnLabelSchema, webauthnEnrollOptionsResponseSchema, webauthnVerifyEnrollmentBodySchema, webauthnAuthenticationOptionsResponseSchema, webauthnCredentialSummarySchema, webauthnCredentialListResponseSchema, type WebauthnRegistrationResponse, type WebauthnAuthenticationResponse, type WebauthnEnrollOptionsResponse, type WebauthnVerifyEnrollmentBody, type WebauthnAuthenticationOptionsResponse, type WebauthnCredentialSummary, type WebauthnCredentialListResponse, } from "./webauthn";
package/dist/mfa/index.js CHANGED
@@ -1,4 +1,5 @@
1
1
  export { mfaFactorTypes, mfaFactorTypeSchema, isValidMfaFactorType, } from "./mfa-factor-type";
2
2
  export { mfaChallengeSchema, } from "./mfa-challenge";
3
- export { totpCodeSchema, recoveryCodeSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaFactorStatusResponseSchema, mfaEnrolledFactorSchema, mfaCodeOnlyBodySchema, mfaTotpProofBodySchema, mfaChallengeFactorsPayloadSchema, } from "./mfa-verify-body";
3
+ export { totpCodeSchema, recoveryCodeSchema, mfaProofSchema, mfaVerifyBodySchema, mfaEnrollResponseSchema, mfaVerifyEnrollmentBodySchema, mfaVerifyEnrollmentResponseSchema, mfaStatusResponseSchema, mfaFactorStatusResponseSchema, mfaEnrolledFactorSchema, mfaCodeOnlyBodySchema, mfaTotpProofBodySchema, mfaChallengeFactorsPayloadSchema, } from "./mfa-verify-body";
4
+ export { webauthnRegistrationResponseSchema, webauthnAuthenticationResponseSchema, webauthnLabelSchema, webauthnEnrollOptionsResponseSchema, webauthnVerifyEnrollmentBodySchema, webauthnAuthenticationOptionsResponseSchema, webauthnCredentialSummarySchema, webauthnCredentialListResponseSchema, } from "./webauthn";
4
5
  //# sourceMappingURL=index.js.map
package/dist/mfa/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mfa/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,GAEnB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,uBAAuB,EACvB,6BAA6B,EAC7B,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,GAWjC,MAAM,mBAAmB,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mfa/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,GAEnB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,uBAAuB,EACvB,6BAA6B,EAC7B,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,GAYjC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kCAAkC,EAClC,oCAAoC,EACpC,mBAAmB,EACnB,mCAAmC,EACnC,kCAAkC,EAClC,2CAA2C,EAC3C,+BAA+B,EAC/B,oCAAoC,GAQrC,MAAM,YAAY,CAAC"}
package/dist/mfa/mfa-factor-type.d.ts CHANGED
@@ -1,5 +1,5 @@
1
1
  import { z } from "zod";
2
- export declare const mfaFactorTypes: readonly ["totp"];
3
- export declare const mfaFactorTypeSchema: z.ZodEnum<["totp"]>;
2
+ export declare const mfaFactorTypes: readonly ["totp", "webauthn"];
3
+ export declare const mfaFactorTypeSchema: z.ZodEnum<["totp", "webauthn"]>;
4
4
  export type MfaFactorType = z.infer<typeof mfaFactorTypeSchema>;
5
5
  export declare function isValidMfaFactorType(value: unknown): value is MfaFactorType;
package/dist/mfa/mfa-factor-type.js CHANGED
@@ -1,5 +1,5 @@
1
1
  import { z } from "zod";
2
- export const mfaFactorTypes = ["totp"];
2
+ export const mfaFactorTypes = ["totp", "webauthn"];
3
3
  export const mfaFactorTypeSchema = z.enum(mfaFactorTypes);
4
4
  export function isValidMfaFactorType(value) {
5
5
  return mfaFactorTypeSchema.safeParse(value).success;
package/dist/mfa/mfa-factor-type.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"mfa-factor-type.js","sourceRoot":"","sources":["../../src/mfa/mfa-factor-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAM,CAAU,CAAC;AAEhD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAI1D,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtD,CAAC"}
1
+ {"version":3,"file":"mfa-factor-type.js","sourceRoot":"","sources":["../../src/mfa/mfa-factor-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,UAAU,CAAU,CAAC;AAE5D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAI1D,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtD,CAAC"}
package/dist/mfa/mfa-verify-body.d.ts CHANGED
@@ -1,6 +1,84 @@
1
1
  import { z } from "zod";
2
2
  export declare const totpCodeSchema: z.ZodString;
3
3
  export declare const recoveryCodeSchema: z.ZodString;
4
+ export declare const mfaProofSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
5
+ type: z.ZodLiteral<"totp">;
6
+ factor_id: z.ZodString;
7
+ code: z.ZodString;
8
+ }, "strict", z.ZodTypeAny, {
9
+ code: string;
10
+ type: "totp";
11
+ factor_id: string;
12
+ }, {
13
+ code: string;
14
+ type: "totp";
15
+ factor_id: string;
16
+ }>, z.ZodObject<{
17
+ type: z.ZodLiteral<"webauthn">;
18
+ factor_id: z.ZodString;
19
+ assertion: z.ZodObject<{
20
+ id: z.ZodString;
21
+ rawId: z.ZodString;
22
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
23
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
24
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
25
+ type: z.ZodString;
26
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
27
+ id: z.ZodString;
28
+ rawId: z.ZodString;
29
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
30
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
31
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
32
+ type: z.ZodString;
33
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
34
+ id: z.ZodString;
35
+ rawId: z.ZodString;
36
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
37
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
38
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
39
+ type: z.ZodString;
40
+ }, z.ZodTypeAny, "passthrough">>;
41
+ }, "strict", z.ZodTypeAny, {
42
+ type: "webauthn";
43
+ factor_id: string;
44
+ assertion: {
45
+ type: string;
46
+ id: string;
47
+ rawId: string;
48
+ response: {} & {
49
+ [k: string]: unknown;
50
+ };
51
+ authenticatorAttachment?: string | undefined;
52
+ clientExtensionResults?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
53
+ } & {
54
+ [k: string]: unknown;
55
+ };
56
+ }, {
57
+ type: "webauthn";
58
+ factor_id: string;
59
+ assertion: {
60
+ type: string;
61
+ id: string;
62
+ rawId: string;
63
+ response: {} & {
64
+ [k: string]: unknown;
65
+ };
66
+ authenticatorAttachment?: string | undefined;
67
+ clientExtensionResults?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
68
+ } & {
69
+ [k: string]: unknown;
70
+ };
71
+ }>, z.ZodObject<{
72
+ type: z.ZodLiteral<"recovery_code">;
73
+ recovery_code: z.ZodString;
74
+ }, "strict", z.ZodTypeAny, {
75
+ type: "recovery_code";
76
+ recovery_code: string;
77
+ }, {
78
+ type: "recovery_code";
79
+ recovery_code: string;
80
+ }>]>;
81
+ export type MfaProof = z.infer<typeof mfaProofSchema>;
4
82
  export declare const mfaVerifyBodySchema: z.ZodObject<{
5
83
  challenge_id: z.ZodString;
6
84
  client_app_id: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
@@ -16,6 +94,61 @@ export declare const mfaVerifyBodySchema: z.ZodObject<{
16
94
  code: string;
17
95
  type: "totp";
18
96
  factor_id: string;
97
+ }>, z.ZodObject<{
98
+ type: z.ZodLiteral<"webauthn">;
99
+ factor_id: z.ZodString;
100
+ assertion: z.ZodObject<{
101
+ id: z.ZodString;
102
+ rawId: z.ZodString;
103
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
104
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
105
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
106
+ type: z.ZodString;
107
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
108
+ id: z.ZodString;
109
+ rawId: z.ZodString;
110
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
111
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
112
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
113
+ type: z.ZodString;
114
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
115
+ id: z.ZodString;
116
+ rawId: z.ZodString;
117
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
118
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
119
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
120
+ type: z.ZodString;
121
+ }, z.ZodTypeAny, "passthrough">>;
122
+ }, "strict", z.ZodTypeAny, {
123
+ type: "webauthn";
124
+ factor_id: string;
125
+ assertion: {
126
+ type: string;
127
+ id: string;
128
+ rawId: string;
129
+ response: {} & {
130
+ [k: string]: unknown;
131
+ };
132
+ authenticatorAttachment?: string | undefined;
133
+ clientExtensionResults?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
134
+ } & {
135
+ [k: string]: unknown;
136
+ };
137
+ }, {
138
+ type: "webauthn";
139
+ factor_id: string;
140
+ assertion: {
141
+ type: string;
142
+ id: string;
143
+ rawId: string;
144
+ response: {} & {
145
+ [k: string]: unknown;
146
+ };
147
+ authenticatorAttachment?: string | undefined;
148
+ clientExtensionResults?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
149
+ } & {
150
+ [k: string]: unknown;
151
+ };
19
152
  }>, z.ZodObject<{
20
153
  type: z.ZodLiteral<"recovery_code">;
21
154
  recovery_code: z.ZodString;
@@ -33,6 +166,21 @@ export declare const mfaVerifyBodySchema: z.ZodObject<{
33
166
  code: string;
34
167
  type: "totp";
35
168
  factor_id: string;
169
+ } | {
170
+ type: "webauthn";
171
+ factor_id: string;
172
+ assertion: {
173
+ type: string;
174
+ id: string;
175
+ rawId: string;
176
+ response: {} & {
177
+ [k: string]: unknown;
178
+ };
179
+ authenticatorAttachment?: string | undefined;
180
+ clientExtensionResults?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
181
+ } & {
182
+ [k: string]: unknown;
183
+ };
36
184
  } | {
37
185
  type: "recovery_code";
38
186
  recovery_code: string;
@@ -44,6 +192,21 @@ export declare const mfaVerifyBodySchema: z.ZodObject<{
44
192
  code: string;
45
193
  type: "totp";
46
194
  factor_id: string;
195
+ } | {
196
+ type: "webauthn";
197
+ factor_id: string;
198
+ assertion: {
199
+ type: string;
200
+ id: string;
201
+ rawId: string;
202
+ response: {} & {
203
+ [k: string]: unknown;
204
+ };
205
+ authenticatorAttachment?: string | undefined;
206
+ clientExtensionResults?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
207
+ } & {
208
+ [k: string]: unknown;
209
+ };
47
210
  } | {
48
211
  type: "recovery_code";
49
212
  recovery_code: string;
@@ -84,45 +247,48 @@ export type MfaVerifyEnrollmentBody = z.infer<typeof mfaVerifyEnrollmentBodySche
84
247
  export declare const mfaVerifyEnrollmentResponseSchema: z.ZodObject<{
85
248
  success: z.ZodLiteral<true>;
86
249
  recovery_codes: z.ZodArray<z.ZodString, "many">;
250
+ recovery_codes_issued: z.ZodBoolean;
87
251
  }, "strict", z.ZodTypeAny, {
88
252
  success: true;
89
253
  recovery_codes: string[];
254
+ recovery_codes_issued: boolean;
90
255
  }, {
91
256
  success: true;
92
257
  recovery_codes: string[];
258
+ recovery_codes_issued: boolean;
93
259
  }>;
94
260
  export type MfaVerifyEnrollmentResponse = z.infer<typeof mfaVerifyEnrollmentResponseSchema>;
95
261
  export declare const mfaFactorStatusResponseSchema: z.ZodObject<{
96
262
  enabled: z.ZodBoolean;
97
263
  pending: z.ZodBoolean;
98
264
  factor_id: z.ZodOptional<z.ZodString>;
99
- factor_type: z.ZodOptional<z.ZodEnum<["totp"]>>;
265
+ factor_type: z.ZodOptional<z.ZodEnum<["totp", "webauthn"]>>;
100
266
  verified_at: z.ZodOptional<z.ZodNumber>;
101
267
  }, "strict", z.ZodTypeAny, {
102
268
  enabled: boolean;
103
269
  pending: boolean;
104
270
  factor_id?: string | undefined;
105
- factor_type?: "totp" | undefined;
271
+ factor_type?: "totp" | "webauthn" | undefined;
106
272
  verified_at?: number | undefined;
107
273
  }, {
108
274
  enabled: boolean;
109
275
  pending: boolean;
110
276
  factor_id?: string | undefined;
111
- factor_type?: "totp" | undefined;
277
+ factor_type?: "totp" | "webauthn" | undefined;
112
278
  verified_at?: number | undefined;
113
279
  }>;
114
280
  export type MfaFactorStatusResponse = z.infer<typeof mfaFactorStatusResponseSchema>;
115
281
  export declare const mfaEnrolledFactorSchema: z.ZodObject<{
116
282
  factor_id: z.ZodString;
117
- factor_type: z.ZodEnum<["totp"]>;
283
+ factor_type: z.ZodEnum<["totp", "webauthn"]>;
118
284
  verified_at: z.ZodOptional<z.ZodNumber>;
119
285
  }, "strict", z.ZodTypeAny, {
120
286
  factor_id: string;
121
- factor_type: "totp";
287
+ factor_type: "totp" | "webauthn";
122
288
  verified_at?: number | undefined;
123
289
  }, {
124
290
  factor_id: string;
125
- factor_type: "totp";
291
+ factor_type: "totp" | "webauthn";
126
292
  verified_at?: number | undefined;
127
293
  }>;
128
294
  export type MfaEnrolledFactor = z.infer<typeof mfaEnrolledFactorSchema>;
@@ -130,15 +296,15 @@ export declare const mfaStatusResponseSchema: z.ZodObject<{
130
296
  enabled: z.ZodBoolean;
131
297
  factors: z.ZodArray<z.ZodObject<{
132
298
  factor_id: z.ZodString;
133
- factor_type: z.ZodEnum<["totp"]>;
299
+ factor_type: z.ZodEnum<["totp", "webauthn"]>;
134
300
  verified_at: z.ZodOptional<z.ZodNumber>;
135
301
  }, "strict", z.ZodTypeAny, {
136
302
  factor_id: string;
137
- factor_type: "totp";
303
+ factor_type: "totp" | "webauthn";
138
304
  verified_at?: number | undefined;
139
305
  }, {
140
306
  factor_id: string;
141
- factor_type: "totp";
307
+ factor_type: "totp" | "webauthn";
142
308
  verified_at?: number | undefined;
143
309
  }>, "many">;
144
310
  recovery_codes_remaining: z.ZodNumber;
@@ -146,7 +312,7 @@ export declare const mfaStatusResponseSchema: z.ZodObject<{
146
312
  enabled: boolean;
147
313
  factors: {
148
314
  factor_id: string;
149
- factor_type: "totp";
315
+ factor_type: "totp" | "webauthn";
150
316
  verified_at?: number | undefined;
151
317
  }[];
152
318
  recovery_codes_remaining: number;
@@ -154,7 +320,7 @@ export declare const mfaStatusResponseSchema: z.ZodObject<{
154
320
  enabled: boolean;
155
321
  factors: {
156
322
  factor_id: string;
157
- factor_type: "totp";
323
+ factor_type: "totp" | "webauthn";
158
324
  verified_at?: number | undefined;
159
325
  }[];
160
326
  recovery_codes_remaining: number;
@@ -182,29 +348,29 @@ export type MfaTotpProofBody = z.infer<typeof mfaTotpProofBodySchema>;
182
348
  export declare const mfaChallengeFactorsPayloadSchema: z.ZodObject<{
183
349
  available_factors: z.ZodArray<z.ZodObject<{
184
350
  factor_id: z.ZodString;
185
- factor_type: z.ZodEnum<["totp"]>;
351
+ factor_type: z.ZodEnum<["totp", "webauthn"]>;
186
352
  last_used_at: z.ZodNullable<z.ZodNumber>;
187
353
  }, "strict", z.ZodTypeAny, {
188
354
  factor_id: string;
189
- factor_type: "totp";
355
+ factor_type: "totp" | "webauthn";
190
356
  last_used_at: number | null;
191
357
  }, {
192
358
  factor_id: string;
193
- factor_type: "totp";
359
+ factor_type: "totp" | "webauthn";
194
360
  last_used_at: number | null;
195
361
  }>, "many">;
196
362
  recovery_codes_available: z.ZodBoolean;
197
363
  }, "strict", z.ZodTypeAny, {
198
364
  available_factors: {
199
365
  factor_id: string;
200
- factor_type: "totp";
366
+ factor_type: "totp" | "webauthn";
201
367
  last_used_at: number | null;
202
368
  }[];
203
369
  recovery_codes_available: boolean;
204
370
  }, {
205
371
  available_factors: {
206
372
  factor_id: string;
207
- factor_type: "totp";
373
+ factor_type: "totp" | "webauthn";
208
374
  last_used_at: number | null;
209
375
  }[];
210
376
  recovery_codes_available: boolean;
package/dist/mfa/mfa-verify-body.js CHANGED
@@ -2,6 +2,7 @@ import { z } from "zod";
2
2
  import { appIdSchema } from "@schemavaults/app-definitions";
3
3
  import { availableMfaFactorSchema } from "../authenticate_result";
4
4
  import { mfaFactorTypeSchema } from "./mfa-factor-type";
5
+ import { webauthnAuthenticationResponseSchema } from "./webauthn";
5
6
  export const totpCodeSchema = z
6
7
  .string()
7
8
  .regex(/^\d{6}$/u, "TOTP code must be exactly 6 digits");
@@ -9,22 +10,35 @@ export const recoveryCodeSchema = z
9
10
  .string()
10
11
  .min(8)
11
12
  .max(64);
13
+ // The proof a user presents to satisfy an MFA gate. Shared between the
14
+ // login second-factor exchange (POST /api/auth/mfa/verify) and step-up
15
+ // authorization for destructive account actions (e.g. removing a passkey).
16
+ // `totp`/`recovery_code` mirror the original v1 factors; `webauthn` carries
17
+ // a passkey assertion bound to a server-issued challenge.
18
+ export const mfaProofSchema = z.discriminatedUnion("type", [
19
+ z
20
+ .object({
21
+ type: z.literal("totp"),
22
+ factor_id: z.string().uuid(),
23
+ code: totpCodeSchema,
24
+ })
25
+ .strict(),
26
+ z
27
+ .object({
28
+ type: z.literal("webauthn"),
29
+ factor_id: z.string().uuid(),
30
+ assertion: webauthnAuthenticationResponseSchema,
31
+ })
32
+ .strict(),
33
+ z
34
+ .object({ type: z.literal("recovery_code"), recovery_code: recoveryCodeSchema })
35
+ .strict(),
36
+ ]);
12
37
  export const mfaVerifyBodySchema = z
13
38
  .object({
14
39
  challenge_id: z.string().uuid(),
15
40
  client_app_id: appIdSchema,
16
- proof: z.discriminatedUnion("type", [
17
- z
18
- .object({
19
- type: z.literal("totp"),
20
- factor_id: z.string().uuid(),
21
- code: totpCodeSchema,
22
- })
23
- .strict(),
24
- z
25
- .object({ type: z.literal("recovery_code"), recovery_code: recoveryCodeSchema })
26
- .strict(),
27
- ]),
41
+ proof: mfaProofSchema,
28
42
  })
29
43
  .strict();
30
44
  export const mfaEnrollResponseSchema = z
@@ -42,10 +56,19 @@ export const mfaVerifyEnrollmentBodySchema = z
42
56
  code: totpCodeSchema,
43
57
  })
44
58
  .strict();
59
+ // Returned by both the TOTP and WebAuthn verify-enrollment endpoints after
60
+ // a factor is confirmed. Recovery codes are an account-wide fallback issued
61
+ // only when the user gains their *first* verified factor — enrolling a
62
+ // second factor (e.g. a passkey on top of existing TOTP) must NOT rotate
63
+ // the codes the user already saved. `recovery_codes_issued` tells the
64
+ // client whether `recovery_codes` carries freshly minted codes to display
65
+ // (true) or whether the existing codes still apply and the array is empty
66
+ // (false).
45
67
  export const mfaVerifyEnrollmentResponseSchema = z
46
68
  .object({
47
69
  success: z.literal(true),
48
- recovery_codes: z.array(recoveryCodeSchema).min(1),
70
+ recovery_codes: z.array(recoveryCodeSchema),
71
+ recovery_codes_issued: z.boolean(),
49
72
  })
50
73
  .strict();
51
74
  // Status of a single MFA factor type — returned by
package/dist/mfa/mfa-verify-body.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"mfa-verify-body.js","sourceRoot":"","sources":["../../src/mfa/mfa-verify-body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,KAAK,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,aAAa,EAAE,WAAW;IAC1B,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAClC,CAAC;aACE,MAAM,CAAC;YACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;YAC5B,IAAI,EAAE,cAAc;SACrB,CAAC;aACD,MAAM,EAAE;QACX,CAAC;aACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC;aAC/E,MAAM,EAAE;KACZ,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACnD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,mDAAmD;AACnD,sEAAsE;AACtE,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,4EAA4E;AAC5E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,gEAAgE;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,mBAAmB;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,wBAAwB;AACxB,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACzC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACzD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,0EAA0E;AAC1E,wEAAwE;AACxE,oEAAoE;AACpE,oCAAoC;AACpC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,gEAAgE;AAChE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC9C,MAAM,CAAC;IACN,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACpD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;CACtC,CAAC;KACD,MAAM,EAAE,CAAC"}
1
+ {"version":3,"file":"mfa-verify-body.js","sourceRoot":"","sources":["../../src/mfa/mfa-verify-body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,KAAK,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC,CAAC;AAEX,uEAAuE;AACvE,uEAAuE;AACvE,2EAA2E;AAC3E,4EAA4E;AAC5E,0DAA0D;AAC1D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACzD,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QAC5B,IAAI,EAAE,cAAc;KACrB,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QAC5B,SAAS,EAAE,oCAAoC;KAChD,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC;SAC/E,MAAM,EAAE;CACZ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,aAAa,EAAE,WAAW;IAC1B,KAAK,EAAE,cAAc;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC7B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,2EAA2E;AAC3E,4EAA4E;AAC5E,uEAAuE;AACvE,yEAAyE;AACzE,sEAAsE;AACtE,0EAA0E;AAC1E,0EAA0E;AAC1E,WAAW;AACX,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAC3C,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,mDAAmD;AACnD,sEAAsE;AACtE,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,4EAA4E;AAC5E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,gEAAgE;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,mBAAmB;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,wBAAwB;AACxB,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACzC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACzD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,0EAA0E;AAC1E,wEAAwE;AACxE,oEAAoE;AACpE,oCAAoC;AACpC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,IAAI,EAAE,cAAc;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,gEAAgE;AAChE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC9C,MAAM,CAAC;IACN,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACpD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;CACtC,CAAC;KACD,MAAM,EAAE,CAAC"}
package/dist/mfa/webauthn.d.ts ADDED
@@ -0,0 +1,182 @@
1
+ import { z } from "zod";
2
+ export declare const webauthnRegistrationResponseSchema: z.ZodObject<{
3
+ id: z.ZodString;
4
+ rawId: z.ZodString;
5
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
6
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
7
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
8
+ type: z.ZodString;
9
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10
+ id: z.ZodString;
11
+ rawId: z.ZodString;
12
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
13
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
14
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
15
+ type: z.ZodString;
16
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
17
+ id: z.ZodString;
18
+ rawId: z.ZodString;
19
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
20
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
21
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
22
+ type: z.ZodString;
23
+ }, z.ZodTypeAny, "passthrough">>;
24
+ export type WebauthnRegistrationResponse = z.infer<typeof webauthnRegistrationResponseSchema>;
25
+ export declare const webauthnAuthenticationResponseSchema: z.ZodObject<{
26
+ id: z.ZodString;
27
+ rawId: z.ZodString;
28
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
29
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
30
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
31
+ type: z.ZodString;
32
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
33
+ id: z.ZodString;
34
+ rawId: z.ZodString;
35
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
36
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
37
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
38
+ type: z.ZodString;
39
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
40
+ id: z.ZodString;
41
+ rawId: z.ZodString;
42
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
43
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
44
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
45
+ type: z.ZodString;
46
+ }, z.ZodTypeAny, "passthrough">>;
47
+ export type WebauthnAuthenticationResponse = z.infer<typeof webauthnAuthenticationResponseSchema>;
48
+ export declare const webauthnLabelSchema: z.ZodString;
49
+ export declare const webauthnEnrollOptionsResponseSchema: z.ZodObject<{
50
+ factor_id: z.ZodString;
51
+ options: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
52
+ }, "strict", z.ZodTypeAny, {
53
+ options: {} & {
54
+ [k: string]: unknown;
55
+ };
56
+ factor_id: string;
57
+ }, {
58
+ options: {} & {
59
+ [k: string]: unknown;
60
+ };
61
+ factor_id: string;
62
+ }>;
63
+ export type WebauthnEnrollOptionsResponse = z.infer<typeof webauthnEnrollOptionsResponseSchema>;
64
+ export declare const webauthnVerifyEnrollmentBodySchema: z.ZodObject<{
65
+ factor_id: z.ZodString;
66
+ label: z.ZodOptional<z.ZodString>;
67
+ attestation: z.ZodObject<{
68
+ id: z.ZodString;
69
+ rawId: z.ZodString;
70
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
71
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
72
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
73
+ type: z.ZodString;
74
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
75
+ id: z.ZodString;
76
+ rawId: z.ZodString;
77
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
78
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
79
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
80
+ type: z.ZodString;
81
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
82
+ id: z.ZodString;
83
+ rawId: z.ZodString;
84
+ response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
85
+ authenticatorAttachment: z.ZodOptional<z.ZodString>;
86
+ clientExtensionResults: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
87
+ type: z.ZodString;
88
+ }, z.ZodTypeAny, "passthrough">>;
89
+ }, "strict", z.ZodTypeAny, {
90
+ factor_id: string;
91
+ attestation: {
92
+ type: string;
93
+ id: string;
94
+ rawId: string;
95
+ response: {} & {
96
+ [k: string]: unknown;
97
+ };
98
+ authenticatorAttachment?: string | undefined;
99
+ clientExtensionResults?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
100
+ } & {
101
+ [k: string]: unknown;
102
+ };
103
+ label?: string | undefined;
104
+ }, {
105
+ factor_id: string;
106
+ attestation: {
107
+ type: string;
108
+ id: string;
109
+ rawId: string;
110
+ response: {} & {
111
+ [k: string]: unknown;
112
+ };
113
+ authenticatorAttachment?: string | undefined;
114
+ clientExtensionResults?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
115
+ } & {
116
+ [k: string]: unknown;
117
+ };
118
+ label?: string | undefined;
119
+ }>;
120
+ export type WebauthnVerifyEnrollmentBody = z.infer<typeof webauthnVerifyEnrollmentBodySchema>;
121
+ export declare const webauthnAuthenticationOptionsResponseSchema: z.ZodObject<{
122
+ options: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
123
+ }, "strict", z.ZodTypeAny, {
124
+ options: {} & {
125
+ [k: string]: unknown;
126
+ };
127
+ }, {
128
+ options: {} & {
129
+ [k: string]: unknown;
130
+ };
131
+ }>;
132
+ export type WebauthnAuthenticationOptionsResponse = z.infer<typeof webauthnAuthenticationOptionsResponseSchema>;
133
+ export declare const webauthnCredentialSummarySchema: z.ZodObject<{
134
+ factor_id: z.ZodString;
135
+ label: z.ZodNullable<z.ZodString>;
136
+ created_at: z.ZodNumber;
137
+ last_used_at: z.ZodNullable<z.ZodNumber>;
138
+ }, "strict", z.ZodTypeAny, {
139
+ factor_id: string;
140
+ last_used_at: number | null;
141
+ created_at: number;
142
+ label: string | null;
143
+ }, {
144
+ factor_id: string;
145
+ last_used_at: number | null;
146
+ created_at: number;
147
+ label: string | null;
148
+ }>;
149
+ export type WebauthnCredentialSummary = z.infer<typeof webauthnCredentialSummarySchema>;
150
+ export declare const webauthnCredentialListResponseSchema: z.ZodObject<{
151
+ credentials: z.ZodArray<z.ZodObject<{
152
+ factor_id: z.ZodString;
153
+ label: z.ZodNullable<z.ZodString>;
154
+ created_at: z.ZodNumber;
155
+ last_used_at: z.ZodNullable<z.ZodNumber>;
156
+ }, "strict", z.ZodTypeAny, {
157
+ factor_id: string;
158
+ last_used_at: number | null;
159
+ created_at: number;
160
+ label: string | null;
161
+ }, {
162
+ factor_id: string;
163
+ last_used_at: number | null;
164
+ created_at: number;
165
+ label: string | null;
166
+ }>, "many">;
167
+ }, "strict", z.ZodTypeAny, {
168
+ credentials: {
169
+ factor_id: string;
170
+ last_used_at: number | null;
171
+ created_at: number;
172
+ label: string | null;
173
+ }[];
174
+ }, {
175
+ credentials: {
176
+ factor_id: string;
177
+ last_used_at: number | null;
178
+ created_at: number;
179
+ label: string | null;
180
+ }[];
181
+ }>;
182
+ export type WebauthnCredentialListResponse = z.infer<typeof webauthnCredentialListResponseSchema>;
package/dist/mfa/webauthn.js ADDED
@@ -0,0 +1,81 @@
1
+ import { z } from "zod";
2
+ // WebAuthn ceremony payloads exchanged between the browser and the auth
3
+ // server. The browser uses @simplewebauthn/browser to produce these and
4
+ // the server uses @simplewebauthn/server to verify them; the heavy lifting
5
+ // (signature checks, challenge binding, RP-ID/origin validation) lives in
6
+ // those libraries. These schemas therefore only assert that the payloads
7
+ // are structurally well-formed JSON of the expected shape — verification is
8
+ // delegated, not duplicated here. `.passthrough()` keeps forward-compat with
9
+ // fields newer @simplewebauthn versions may add.
10
+ // Mirrors @simplewebauthn/browser's RegistrationResponseJSON.
11
+ export const webauthnRegistrationResponseSchema = z
12
+ .object({
13
+ id: z.string().min(1),
14
+ rawId: z.string().min(1),
15
+ response: z.object({}).passthrough(),
16
+ authenticatorAttachment: z.string().optional(),
17
+ clientExtensionResults: z.object({}).passthrough().optional(),
18
+ type: z.string().min(1),
19
+ })
20
+ .passthrough();
21
+ // Mirrors @simplewebauthn/browser's AuthenticationResponseJSON.
22
+ export const webauthnAuthenticationResponseSchema = z
23
+ .object({
24
+ id: z.string().min(1),
25
+ rawId: z.string().min(1),
26
+ response: z.object({}).passthrough(),
27
+ authenticatorAttachment: z.string().optional(),
28
+ clientExtensionResults: z.object({}).passthrough().optional(),
29
+ type: z.string().min(1),
30
+ })
31
+ .passthrough();
32
+ // Optional human-friendly label a user may give a passkey ("MacBook
33
+ // Touch ID", "YubiKey 5C"). Kept short and trimmed.
34
+ export const webauthnLabelSchema = z
35
+ .string()
36
+ .trim()
37
+ .min(1)
38
+ .max(64);
39
+ // Response from POST /api/user/mfa/webauthn/options — the server-issued
40
+ // PublicKeyCredentialCreationOptionsJSON plus the pending factor_id the
41
+ // enrollment will be confirmed against.
42
+ export const webauthnEnrollOptionsResponseSchema = z
43
+ .object({
44
+ factor_id: z.string().uuid(),
45
+ // PublicKeyCredentialCreationOptionsJSON — opaque to us, handed to the
46
+ // browser verbatim.
47
+ options: z.object({}).passthrough(),
48
+ })
49
+ .strict();
50
+ // Body for POST /api/user/mfa/webauthn/verify-enrollment.
51
+ export const webauthnVerifyEnrollmentBodySchema = z
52
+ .object({
53
+ factor_id: z.string().uuid(),
54
+ label: webauthnLabelSchema.optional(),
55
+ attestation: webauthnRegistrationResponseSchema,
56
+ })
57
+ .strict();
58
+ // Response from POST /api/auth/mfa/webauthn/options — the server-issued
59
+ // PublicKeyCredentialRequestOptionsJSON for an in-flight login challenge.
60
+ export const webauthnAuthenticationOptionsResponseSchema = z
61
+ .object({
62
+ // PublicKeyCredentialRequestOptionsJSON — opaque to us.
63
+ options: z.object({}).passthrough(),
64
+ })
65
+ .strict();
66
+ // A single enrolled passkey as surfaced to the account settings UI.
67
+ export const webauthnCredentialSummarySchema = z
68
+ .object({
69
+ factor_id: z.string().uuid(),
70
+ label: z.string().nullable(),
71
+ created_at: z.number().int().positive(),
72
+ last_used_at: z.number().int().positive().nullable(),
73
+ })
74
+ .strict();
75
+ // Response from GET /api/user/mfa/webauthn — the user's enrolled passkeys.
76
+ export const webauthnCredentialListResponseSchema = z
77
+ .object({
78
+ credentials: z.array(webauthnCredentialSummarySchema),
79
+ })
80
+ .strict();
81
+ //# sourceMappingURL=webauthn.js.map
package/dist/mfa/webauthn.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../src/mfa/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,wEAAwE;AACxE,wEAAwE;AACxE,2EAA2E;AAC3E,0EAA0E;AAC1E,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,iDAAiD;AAEjD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC;KAChD,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;IACpC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9C,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC7D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC;KACD,WAAW,EAAE,CAAC;AAMjB,gEAAgE;AAChE,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC;KAClD,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;IACpC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9C,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC7D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC;KACD,WAAW,EAAE,CAAC;AAMjB,oEAAoE;AACpE,oDAAoD;AACpD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC,CAAC;AAEX,wEAAwE;AACxE,wEAAwE;AACxE,wCAAwC;AACxC,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,uEAAuE;IACvE,oBAAoB;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,0DAA0D;AAC1D,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC;KAChD,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,KAAK,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,kCAAkC;CAChD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,wEAAwE;AACxE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC;KACzD,MAAM,CAAC;IACN,wDAAwD;IACxD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,oEAAoE;AACpE,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC7C,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC;KAClD,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC;CACtD,CAAC;KACD,MAAM,EAAE,CAAC"}
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@schemavaults/auth-common",
3
3
  "description": "Types and utility functions for authentication and authorization",
4
- "version": "0.12.15",
4
+ "version": "0.13.1",
5
5
  "license": "UNLICENSED",
6
6
  "private": false,
7
7
  "repository": {